KR102207554B1 - Apparatus and Method for Protecting Files - Google Patents

Abstract

The present invention relates to a method for protecting a file from malicious code that maliciously encrypts a corresponding file after detecting user's file information such as a document or image file created by a user. The present invention provides a file search unit that searches for files with a predetermined extension, an extension generator that generates change extensions, and changes the extensions of files searched by the file search unit to changed extensions generated by the extension generation unit. An extension changing unit, an extension updating unit that updates changed extensions to other changed extensions generated by the extension generating unit over time, and information storing a piece of extension change and update information of files retrieved by the file search unit A storage unit, a transmission unit that transmits a piece of extension change and update information stored in the information storage unit to a server or a mobile terminal, and an information deletion that deletes the extension change and update information piece transmitted through the transmission unit from the information storage unit A unit, a receiving unit for receiving extension change and update information of a file requested to be executed from the mobile terminal, and an extension restoration unit for restoring an extension of a file requested to be executed using the extension change and update information received from the receiving unit Provides a file security device containing.

Description

Apparatus and Method for Protecting Files}

The present invention relates to a method for protecting a file from malicious code that maliciously encrypts the file after detecting a user's file, such as a document or image file created by the user.

Due to the increased use of the Internet, malicious codes such as viruses, worms, and ransomware that destroy data and programs of user terminals are also on the rise. The malicious code is hidden in a storage device such as a hard disk or SSD (Solid State Drive) and is executed when certain conditions (e.g., booting of the user terminal, a specific date, execution of a specific program, etc.) are executed and the data inside the user terminal. It destroys the system by deleting or changing the and programs.

The virus infects other programs, deletes or changes a part of the program, and then stores its own code therein. Through such a process, the virus is infected while continuously replicating to a plurality of files, thereby reducing system performance, taking up storage space, or even causing damage to hardware.

Among these malicious codes, ransomware is a compound word of ransom and ware, infiltrating into the user's user terminal, maliciously encrypting various user files such as internal documents, spreadsheets, and picture files, and then decrypting them. It is a malicious code that asks for money in exchange for sending the key program.

Such ransomware is mainly infected by executing files delivered through e-mail, social network service (SNS), messenger, etc., and ransomware detects the extension or file signature of the malicious encryption target file and is the target to be encrypted. There is a feature to select files.

When important files written by users are infected with malicious codes such as ransomware, the files are encrypted so that the files cannot be read anymore, and the files are restored even if money is paid in response to the request of the person who distributed the ransomware because they are essential files. There are even cases where they don't. Therefore, protection is required for important documents written by users.

Registered Patent 10-1772439 Registered Patent 10-1710928 Registered Patent 10-1834808 Registered Patent 10-1156227

An object of the present invention is to solve the above-described problem, and an object of the present invention is to prevent the user's files from being maliciously encrypted by malicious codes such as ramsomware by changing the extensions of files created by the user.

In order to achieve the above object, the present invention provides a file search unit for searching files with a predetermined extension, an extension generator for generating changed extensions, and extensions of files searched by the file search unit in the extension generation unit. An extension changer that changes to the generated changed extensions, an extension updater that updates the changed extensions to other changed extensions generated by the extension generator over time, and changes the extensions of files searched by the file searcher And an information storage unit for storing an update information piece, a transmission unit for transmitting the extension change and update information pieces stored in the information storage unit to a server or a mobile terminal, and an extension change and update information piece transmitted through the transmission unit. An information deletion unit deleted from the information storage unit, a receiving unit receiving extension change and update information of a file requested to be executed from the mobile terminal, and a file requested to be executed using extension change and update information received from the receiving unit It provides a file security device including an extension restoration unit to restore the extension of.

In addition, in the present invention, the file search unit searches for files with a predetermined extension, the extension generation unit generates changed extensions, and the extension change unit generates the extensions of the files searched by the file search unit in the extension generation unit. Changing the changed extensions to the changed extensions, updating the changed extensions to other changed extensions generated by the extension generating unit over time by an extension update unit, and the extension of the files searched by the file search unit by an information storage unit Storing a piece of change and update information, a transmitting unit transmitting a piece of extension change and update information stored in the information storage unit to a server or a mobile terminal, and an information deletion unit changing and updating the extension that has been transmitted through the transmitting unit Deleting a piece of information from the information storage unit, a receiving unit receiving extension change and update information of a file requested to be executed from the mobile terminal, and an extension restoring unit receiving extension change and update information received from the receiving unit. It provides a file security method including the step of restoring an extension of a file requested to be executed by using.

Files protected by the file security device and method according to the present invention are not selected as target files to be encrypted by malicious codes such as ransomware, so the files can be secured. In addition, since the extension change and update information of the protected files is not stored in the user terminal where the files are stored, the files can be more safely protected.

1 is a conceptual diagram showing an embodiment of a system including a file security device according to the present invention.
2 is a block diagram of the user terminal shown in FIG. 1.
3 is a flowchart of a file security method according to an embodiment of the present invention.
4 is a block diagram of the mobile terminal shown in FIG. 1.
5 is a flowchart of a file execution process in a file security method according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, embodiments of the present invention may be modified into various other forms, and the scope of the present invention should not be construed as being limited to the embodiments described below. Embodiments of the present invention are provided to more completely describe the present invention to those of ordinary skill in the art.

1 is a conceptual diagram showing an embodiment of a system including a file security device according to the present invention. As shown in FIG. 1, an embodiment of a system including a file security device according to the present invention includes a portable terminal 10, a user terminal 20, and a server 15. An embodiment of the file security device according to the present invention may be included in the user terminal 20.

The user terminal 20 is an input/output means such as a keyboard, a mouse, a display, a CPU, a memory, a storage device such as a hard disk or SSD, a wireless communication means capable of accessing the server 15 through the network 1, and a portable terminal. (10) It may be a variety of devices including a Bluetooth device capable of direct wireless communication with. For example, it may be a desktop computer, a laptop computer, a PDA, a smart phone, a smart pad, and the like. In addition, an OS program, programs capable of generating various documents and images, and a file security program are installed in the memory or storage device of the user terminal 20.

The portable terminal 10 may be various devices including a touch screen, a processor, a storage device such as a memory, and a wireless communication means. For example, it may be a PDA, a smart phone, or a smart pad. In addition, an OS program and an application for file security are installed in the storage device of the portable terminal 10.

The application for file security of the portable terminal 10 is an application interlocked with the program for file security of the user terminal 20. When a security program and a security application are installed in the user terminal 20 and the mobile terminal 10, respectively, the protocol between the security program and the security application is matched by authentication of the mobile terminal 10 for synchronization.

The portable terminal 10 is connected to the server 15 through the network 1, and the server 15 is connected to the user terminal 20 through the network 1. In addition, the portable terminal 10 is connected to the user terminal 20 without going through a server through communication means such as Bluetooth, Wi-Fi, and Zigbee.

In this embodiment, the file security device uses various programs installed in the user terminal 20 to change the extensions of documents or image files created by the user, thereby preventing malicious data such as ransomware that penetrated into the user terminal 20 from outside. The code detects files of the user terminal 20 and serves to prevent malicious encryption.

Hereinafter, a method of protecting files of a user terminal by a file security device according to an embodiment of the present invention will be described in detail with reference to the drawings.

2 is a block diagram of the user terminal shown in FIG. 1. As shown in FIG. 2, the user terminal 20 comprises a file search unit 21, a file hiding unit 22, an extension generating unit 23, an extension changing unit 24, and an extension updating unit constituting a file security device. (25), an information storage unit 26, a transmission unit 27, an information deletion unit 28, a reception unit 29, and an extension restoration unit 30.

These may be composed of hardware such as memory, CPU, storage device, and communication means of the user terminal 20 and a file security program stored in the storage device of the user terminal 20. The operation of each element of the user terminal 20 will be described in detail with reference to FIG. 3.

3 is a flowchart of a file security method according to an embodiment of the present invention. As shown in FIG. 3, the file security method according to an embodiment of the present invention according to the present invention begins with a step (S11) in which the file search unit 21 searches for files stored in the user terminal.

This step may be started by, for example, a method of selecting files of a type determined to require security from items such as options of the file security program after the user executes the file security program installed in the user terminal 20. Options include, for example, document file extensions such as "hwp, doc, ppt", image file extensions such as "jpg, jpeg, tif", and CAD file extensions such as "step, stp, igs". Can be.

When the user selects the extensions determined to need protection from among these extensions and then clicks the search button to execute, among files stored in a storage device such as the hard disk or SSD of the user terminal 20, files having the corresponding extensions All files are searched.

Next, the file hiding unit 22 creates a security folder using a security solution, and moves the files searched by the file search unit 21 to the security folder (S12). The security folder is a separate space in the user terminal 20 and can protect files from malicious codes.

In addition, the extension generation unit 23 generates changed extensions (S13). The modified extension means extensions to replace the original extensions of files. There are no special restrictions on the configuration of the change extension. The modified extension can be randomly generated by combining various characters, special characters, and numbers within a predetermined number. For example, if it is created within 10 characters, various extensions such as "erwqr!, wqerw@qte6, 1234fwt34" can be created. In addition, extensions may be created by combining date, weather, and time information at the time of generating the changed extension. For example, an extension such as '20181227/SUNSHINE/13HOUR' may be created.

Next, the extension changing unit 24 changes the extensions of the files searched by the file searching unit 21 to the changed extensions generated by the extension generating unit 23 (S14). When there are files of the same type, for example, a plurality of files with an extension of'hwp', each of the files has a different extension extension.

If the extension is changed, the file cannot be opened because it is recognized as an unknown file when executed by a method such as double-clicking the file. Also, ransomware cannot detect files.

In addition, the extension updater 25 updates the changed extensions with other changed extensions generated by the extension generator 23 as time passes (S15). The extension updater 25 may update the extensions at a predetermined time every day or at a randomly set time once a day.

The information storage unit 26 stores extension change and update information pieces of files searched by the file search unit 21 (S16). That is, information on the initial extension of the searched files and the changed and updated extensions is stored. For example, extensions of files may be stored in the form of a lookup table. The extension change and update information fragment is used in the process of restoring files with the original extension when executing files whose extension has changed later.

The transmission unit 27 transmits the extension change and update information pieces stored in the information storage unit 26 to the server 15 or the mobile terminal 10 (S17). That is, when the mobile terminal 10 is in a state in which direct communication with the user terminal 10 is possible, a piece of extension change and update information is immediately transmitted to the mobile terminal 10, and otherwise, it is transmitted to the server 15. For example, when the user terminal 20 and the mobile terminal 10 are connected via Bluetooth or are on the same Wi-Fi network, the extension change and update information pieces are transmitted to the mobile terminal 10, otherwise, the server Send to (15).

The information deletion unit 28 deletes, from the information storage unit 26 of the user terminal 20, the extension change and update information pieces that have been transmitted to the server 15 or the mobile terminal 10 (S18). In the case of transmission to the server 15, when the transmission from the server 15 to the mobile terminal 10 is completed, the extension change and update information pieces are deleted from the server 15. Therefore, in the information storage unit 26, not all extension change and update information, but fragmentary extension change and update information pieces are only temporarily stored.

Since the pieces of extension change and update information are deleted from the user terminal 20, even if a malicious code invades the user terminal 20, information on the original extensions of the user's files changed or updated extensions cannot be secured. .

In addition, some of the fragmentary extension change and update information pieces stored in the information storage unit 26 are transmitted to the mobile terminal 10 through the server 15, and some are directly transmitted to the mobile terminal 10, so the server ( 15), even if a third party can obtain all fragmentary extension change and update information fragments that are stored in the server 15 and disappear after hacking 15), some extension change and update information fragments directly transmitted to the mobile terminal 10 are secured. Therefore, it is difficult to restore the original extension of the file only by hacking the server 15. Therefore, it is preferable to transmit at least some of the extension change and update information pieces transmitted from the transmission unit 27 to the mobile terminal 10 and the rest to the server 15.

4 is a block diagram of the mobile terminal shown in FIG. 1. The portable terminal 10 includes a portable terminal receiving unit 11, a portable terminal storage unit 12 and a portable terminal transmitting unit 13. These may be composed of hardware of the portable terminal 10 and an application for file security stored in the memory of the portable terminal 10.

The portable terminal receiving unit 11 receives pieces of extension change and update information from the user terminal 20 or the server 15. In addition, the portable terminal storage unit 12 collects these and generates and stores extension change and update information. If the extension change and update information stored in the portable terminal storage unit 12 is used, the original extension can be found from the current extension of the files. The extension change and update information means information for knowing the relationship between the original extension of files and the current change extension.

Extension change and update information may be obtained by arranging extension change and update information pieces in order. For example, the first extension change and update information piece received from the server 15 includes "Company.hwp:Company.k35289!@:Company.ukjhgkjh", and directly from the user terminal 20. If the second extension change and update information piece you receive contains "Company.ukjhgkjh:Company.89235fjk", the extension change and update information contains "Company.hwp:Company.k35289!@:Company.ukjhgkjh" :Company Introduction.89235fjk" is included. Therefore, if you use the extension change and update information, you can restore the'Company Profile.89235fjk' file to'Company Profile.hwp'.

The portable terminal transmitter 13 serves to transmit extension change and update information to the user terminal 20 when there is a request from the user terminal 20.

5 is a flowchart of a file execution process in a file security method according to an embodiment of the present invention. The files of the user terminal 20 are not detected by ransomware by the method shown in FIG. 3, but the user cannot execute the files of the user terminal 20 either. The user terminal 20 may receive the latest extension change and update information from the portable terminal 10 and execute files by restoring files whose extension has been changed and/or updated.

First, when a user executes a security program installed in the user terminal 20, the user terminal 20 requests extension change and update information from the portable terminal 10 (S21).

The reception unit 29 of the user terminal receives the extension change and update information transmitted from the portable terminal transmission unit 13 (S22).

The extension restoration unit 30 displays the initial extensions of the files on the display of the user terminal 20 by using the extension change and update information received from the receiving unit 29. And when the user selects a file to be executed, the extension of the file is restored (S23). The extensions of the remaining files are not restored.

In addition, the file security program executes the file using a document or image creation program used to execute a file having a corresponding extension (S24).

When the document or image creation program is terminated, the extension of the corresponding file is changed to a new changed extension generated by the extension generator 23 again by the extension changer 24 (S25).

In addition, the information deletion unit 28 also deletes extension change and update information used in the extension restoration unit 30.

The embodiments described above are only to describe the preferred embodiments of the present invention, the scope of the present invention is not limited to the described embodiments, within the technical spirit and claims of the present invention. Various changes, modifications, or substitutions may be made by those skilled in the art, and such embodiments are to be understood as being within the scope of the present invention.

10: mobile terminal
15: server
20: user terminal
21: file search unit
22: file hider
23: extension generation unit
24: extension change part
25: extension update unit
26: information storage unit
27: transmitter
28: information deletion unit
29: receiver
30: extension restoration unit

Claims (6)

A file search unit that searches files with a predetermined extension,
An extension generation unit that generates changed extensions,
An extension changing unit for changing extensions of files searched by the file search unit to changed extensions generated by the extension generating unit,
An extension update unit that updates changed extensions to other changed extensions generated by the extension generation unit over time;
An information storage unit for storing extension change and update information pieces of files searched by the file search unit,
A transmission unit for transmitting a piece of extension change and update information stored in the information storage unit to a server or a mobile terminal;
An information deletion unit that deletes a piece of extension change and update information that has been transmitted through the transmission unit from the information storage unit,
A receiver for receiving extension change and update information of a file requested to be executed from the mobile terminal,
A file security device comprising an extension restoration unit for restoring an extension of a file requested to be executed using the extension change and update information received by the receiver. The method of claim 1,
File security device further comprising a file hiding unit for creating a secure folder, and moving the files searched by the file search unit to the secure folder. The method of claim 1,
A file security device that transmits at least some of the extension change and update information pieces transmitted from the transmitter to the mobile terminal and the rest to the server. The method of claim 1,
The extension change and update information is generated by combining the extension change and update information pieces transmitted from the server or the transmitting unit to the mobile terminal in the mobile terminal. The method of claim 1,
The file security device in which the extension change and update information pieces transmitted to the server are transmitted to the mobile terminal and then deleted from the server. A step of a file search unit searching for files with a predetermined extension;
Generating the changed extensions by the extension generation unit,
Changing, by an extension changing unit, extensions of files searched by the file search unit to changed extensions generated by the extension generating unit;
Updating, by an extension update unit, changed extensions with other changed extensions generated by the extension generation unit as time passes; and
Storing, by an information storage unit, pieces of extension and update information of files searched by the file search unit;
Transmitting, by a transmitting unit, a piece of extension change and update information stored in the information storage unit to a server or a mobile terminal;
An information deletion unit deleting, from the information storage unit, a piece of extension change and update information that has been transmitted through the transmission unit,
Receiving, by a receiving unit, extension change and update information of a file requested to be executed from the mobile terminal,
And restoring an extension of a file requested to be executed by using the extension change and update information received by the receiver.

Images