KR102277376B1 - Method for detecting forgery of web content and client terminal - Google Patents

Abstract

A method for detecting forgery and falsification of web content in a client terminal according to an embodiment comprises the steps of: transmitting a request signal according to a communication protocol between a client and a server to a network for using web content; and receiving a response signal to the request signal through the network and determining whether the web content is forged or falsified based on the result of checking the integrity of the response signal according to the communication protocol.

Description

Web content forgery detection method and client terminal

The present invention relates to a method for detecting forgery and falsification of web content and to a client terminal performing such a detection method.

Among security threats that forge or falsify web content such as web pages, web scripts, web images, etc. provided to clients by a server, there is a threat related to a proxy. For example, in an environment where security support is not provided, a proxy may be installed between a client and a server, and a security threat that the proxy provides to the client by forging or falsifying a web page of the server may occur.

As a prior art for detecting forgery and falsification of web content by such a proxy, a method of receiving and verifying metadata for web content from a server has been proposed.

However, this prior art has a problem in that it is necessary to separately receive metadata in addition to web content from the server.

Korean Patent Publication No. 10-1264280 (Registered on May 8, 2013)

An object to be solved according to an embodiment is to provide a method for detecting forgery and falsification of web content using only a signal according to a communication protocol between a client and a server, and a client terminal for performing such a detection method.

However, the problems to be solved of the present invention are not limited to those mentioned above, and other problems to be solved that are not mentioned can be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description. will be.

A method for detecting forgery and falsification of web content by a client terminal according to a first aspect comprises the steps of: transmitting a request signal according to a communication protocol between a client and a server to a network for using web content; a response signal to the request signal through the network and determining whether the web content is forged or falsified based on a result of checking the integrity of the communication protocol of the response signal.

According to the second aspect, when the computer program of the computer-readable recording medium storing the computer program is executed by a processor, transmitting a request signal according to a communication protocol between a client and a server to a network for using web content and receiving a response signal to the request signal through the network, and determining whether the web content has been forged or falsified based on a result of checking the communication protocol integrity of the response signal. and instructions for causing the processor to perform a detection method.

According to a third aspect, a computer program stored in a computer-readable recording medium includes instructions for, when the computer program is executed by a processor, causes the processor to perform the web content forgery detection method.

A client terminal according to a fourth aspect includes a communication unit for communicating with a server, and a control unit for controlling the communication unit, wherein the control unit provides a request signal according to a communication protocol between a client and a server to a network for using web content. controls the communication unit to transmit, and when a response signal to the request signal is received through the communication unit through the network, whether the web content is forged or forged based on the communication protocol integrity check result of the response signal judge

According to an embodiment, forgery of web content may be detected using only a signal according to a communication protocol between a client and a server. For example, it is possible to accurately detect forgery and falsification of web content without separately receiving metadata, etc. from the server. The present invention can detect both a proxy installed inside a client and a proxy installed outside the client, as well as forgery and falsification of web content by a proxy installed in a virtual machine host (VM Host).

1 is a block diagram of a web content operating system including a client terminal capable of performing a web content forgery detection method according to an embodiment of the present invention.
2 to 4 are block diagrams showing various examples of a client-server system to which a method for detecting forgery and forgery of web content according to an embodiment of the present invention can be applied.
5 is a signal flow diagram illustrating a web content forgery detection method according to an embodiment of the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

In describing the embodiments of the present invention, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, the terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification.

In this specification, the singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as 'comprise' or 'comprise' are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification is present, and one or more other It should be understood that this does not preclude the possibility of addition or presence of features or numbers, steps, operations, components, parts, or combinations thereof.

In addition, in an embodiment of the present invention, when it is said that a part is connected to another part, this includes not only a direct connection but also an indirect connection through another medium. In addition, the meaning that a certain component includes a certain component does not exclude other components unless otherwise stated, but may further include other components.

1 is a block diagram of a web content operating system including a client terminal capable of performing a web content forgery detection method according to an embodiment of the present invention.

Referring to FIG. 1 , a web content operating system 100 according to an embodiment includes a client terminal 110 and a server 120 connected to each other through a network. The client terminal 110 includes a communication unit 111 and a control unit 112 , and may further include an output unit 113 and/or a storage unit 114 .

The client terminal 110 may transmit a request signal according to the communication protocol between the client and the server to the server 120 through a network for using web content, and may receive a response signal to the request signal through the network, , it is possible to perform the web content forgery detection method according to an embodiment capable of determining whether the web content is forged or falsified based on the result of checking the integrity of the received response signal according to the communication protocol.

In order to perform the web content forgery detection method according to an embodiment, the communication unit 111 of the client terminal 110 communicates with the server 120 through a network under the control of the control unit 112 . For example, the communication unit 111 may include a wired network card, a wireless network card, a mobile communication module, a short-range communication module, and the like.

The control unit 112 of the client terminal 110 controls the communication unit 111 to transmit a request signal according to the communication protocol between the client and the server to the network for using the web content, and a response signal to the request signal is transmitted through the network. When received through the communication unit 111, it is determined whether the web content is forged or forged based on the result of checking the integrity of the received response signal according to the communication protocol. For example, the control unit 112 may include a computing means such as a microprocessor (microprocessor).

The output unit 113 of the client terminal 110 may output an operation result and a processing result by the control unit 112 . For example, the output unit 113 may include a serial interface, and may provide an operation result and a processing result by the control unit 112 to a peripheral electronic device connected through the serial interface. Alternatively, the output unit 113 may include an image output means such as an organic light-emitting diode (OLED) panel, a liquid crystal display (LCD) panel, etc. The processing result can be displayed.

The storage unit 114 of the client terminal 110 may store the calculation and processing results by the control unit 112 . For example, the storage unit 114 may be built into the control unit 112 , a flash memory type, a hard disk type, a multimedia card micro type, and a RAM. It may include at least one type of storage medium among (RAM) and ROM (ROM). The storage unit 114 may store a computer program including various commands for enabling the control unit 112 to perform the web content forgery detection method according to an embodiment. For example, a browser program for communication and web service through a network, a security program for generating a diagnostic tool for security support, and the like may be stored.

2 to 4 are block diagrams showing various examples of a client-server system to which a method for detecting forgery and falsification of web content according to an embodiment of the present invention can be applied.

FIG. 2 shows an example in which the proxy 203 is installed in the client terminal 110 . The browser 201 and the diagnostic tool 202 may be loaded in advance before the release and distribution of the client terminal 110 , and the controller 112 stores the storage unit 114 after the release and distribution of the client terminal 110 . It can also be created by running the saved browser program and security program. In this client-server system of FIG. 2, the control unit 112 of the client terminal 110 executes the browser 201 to access the server 120 on the network, and a web page provided by the server 120; Web contents such as web scripts and web images may be used through the browser 201 and the communication unit 111 . In this embodiment, the control unit 112 of the client terminal 110 may detect forgery of web content (eg, web page, web script, web image, etc.) by performing the web content forgery detection method according to an embodiment. , the diagnostic tool 202 may also detect forgery of web content (eg, web page, web script, web image, etc.) by the proxy 203 .

3 shows an example in which the proxy 203 is separately installed outside the client terminal 110 . The browser 201 and the diagnostic tool 202 may be loaded in advance before the release and distribution of the client terminal 110 , and the controller 112 stores the storage unit 114 after the release and distribution of the client terminal 110 . It can also be created by running the saved browser program and security program. In the client-server system of FIG. 3, the control unit 112 of the client terminal 110 executes the browser 201 to access the server 120 on the network, and a web page provided by the server 120; Web contents such as web scripts and web images may be used through the browser 201 and the communication unit 111 . In this embodiment, the diagnostic tool 202 cannot detect forgery and falsification of web content (eg, web page, web script, web image, etc.) by the proxy 203, but the control unit 112 of the client terminal 110 is Forgery of web content (eg, web page, web script, web image, etc.) may be detected by performing the web content forgery detection method according to an embodiment.

4 shows an example in which the clients 311 and 312 and the proxy 203 are installed in the form of a virtual machine in a virtual machine (VM) host 310 . The browser 201 and the diagnostic tool 202 may be created in the clients 311 and 312 in the form of virtual machines. In this client-server system of FIG. 4, the control unit 112 of the client terminal 110 executes the browser 201 to access the server 120 on the network, and a web page provided by the server 120; Web contents such as web scripts and web images may be used through the browser 201 and the communication unit 111 . In this embodiment, the control unit 112 of the client terminal 110 may detect forgery of web content (eg, web page, web script, web image, etc.) by performing the web content forgery detection method according to an embodiment. . Here, the number of clients 311 and 312 is only an example.

5 is a signal flow diagram illustrating a web content forgery detection method according to an embodiment of the present invention.

Referring to FIG. 5 , the method for detecting forgery and falsification of web content according to an embodiment includes a step ( S505 ) of a client terminal transmitting a request signal according to a communication protocol between a client and a server to a network for using web content. For example, the client terminal may transmit a conditional request according to the HTTP (HyperText Transfer Protocol) communication protocol. Here, the reference date and time included in the conditional request may use time information stored in the client terminal. Alternatively, the client terminal may query the server for the reference date and time (S501) and include the server time information included in the response data (S503) in the condition request. For example, in step S505 , the client terminal may transmit a request signal in which a predetermined response type is predicted among response types included in the communication protocol between the client and the server. For example, a request signal in which a 304 response code is predicted as a predetermined response form according to the HTTP communication protocol may be transmitted.

The web content forgery detection method according to an embodiment further includes the step (S507) of the client terminal receiving a response signal to the request signal through a network. Here, the response signal to the request signal includes an HTTP response code and response data according to the communication protocol between the client and the server. For example, the server may transmit a response signal including a 304 response code as a predetermined response form according to the HTTP communication protocol. In this case, the proxy may forge and/or modulate the HTTP response code and response data for forgery and forgery of web content and provide it to the client terminal. For example, the proxy may provide a response signal including a 200 response code to the client terminal.

Web content forgery detection method according to an embodiment further comprises the step (S513) of the client terminal determining whether the web content is forgery or falsification based on the inspection result (S509) of the integrity on the communication protocol between the client and the server of the received response signal include For example, when the response signal has a valid format of a 304 response code in the integrity check of step S509, the client terminal may determine that the integrity is normal. Alternatively, when the response signal includes a 200 response code in the integrity check of step S509, the client terminal may determine that web content such as a web page, web script, or web image is in a forged state. However, the client terminal may re-perform steps S505 to S509 after changing the reference date and time ( S511 ) in consideration that normal data update between the client and server may be performed during steps 501 to 509 . For example, the number of times of re-performing steps S511 and S505 to S509 may be performed a preset number of times.

Hereinafter, a process in which a method for detecting forgery of web content is performed in a client-server system according to an embodiment of the present invention will be described in more detail with reference to FIGS. 1 to 5 .

First, the control unit 112 drives the browser 201 to access the server 120 through the communication unit 111 and then inquires (S501) the reference date and time, so that the time information of the server 120 through the communication unit 111 is Receives the HTTP response code and response data containing the (S503).

Then, the control unit 112 controls the communication unit 111 to transmit a request signal according to the communication protocol between the client and the server to the server 120 . Here, the control unit 112 may transmit a conditional request according to the HTTP communication protocol. For example, the controller 112 may transmit an HTTP conditional request header in the HTTP request header field of the request signal. For example, the control unit 112 may include the time information received through step S503 as the reference date and time while including If-Modified-Since as the HTTP conditional request header. Here, steps S501 and S503 may be omitted because they are selectively performed, and in this case, the control unit 112 includes If-Modified-Since as an HTTP conditional request header and the reference date and time stored in the control unit 112 in advance. Time information may also be included (S505).

Then, the server 120 that has received the request signal according to the communication protocol between the client and the server from the client terminal 110 generates a response signal according to the communication agreement between the client and the server, and sends the generated response signal to the request signal in step S505 It is sent as a reply corresponding to For example, the server 120 may generate and transmit a response signal including a 304 response code according to the HTTP communication protocol. The HTTP conditional request header of step S505 is for checking whether anything has been altered after the reference date and time, and the server 120 must transmit the 304 response code and valid response data in accordance with the HTTP communication protocol. For example, as an HTTP conditional request header, If-Modified-Since MUST send a copy of the resource if the last-modified version is no longer up-to-date at the time it was last contained in the Last-Modified response header.

Here, when the proxy 203 does not pose a security threat, a response signal by the server 120 is transmitted to the client terminal 110 . However, when the proxy 203 forges and/or modifies web content such as a web page, web script, or web image by the server 120, a response signal including a specific response code is provided to the client terminal 110 do. For example, the proxy 203 may provide a response signal including a 200 response code according to the HTTP communication protocol to the client terminal 110 . This is because the client terminal 110 uses only the response data of the response signal including the 200 response code.

Therefore, the response signal received by the communication unit 111 of the client terminal 110 through the network may be generated by the server 120 or modulated by the proxy 203 . For example, in the case of the HTTP communication protocol, a response signal including a 304 response code generated by the server 120 is received by the client terminal 110 or includes a 200 response code according to the modulation of the proxy 203 . A response signal is received by the client terminal 110 (S507).

Then, the control unit 112 checks and verifies the integrity of the communication protocol between the client and the server of the response signal received in step S507 (S509). Here, when the integrity is confirmed, the control unit 112 determines that the web content provided by the server 120, such as a web page, a web script, a web image, is not forged or forged as a normal situation. For example, when the response signal of step S507 has a valid format of the 304 response code, the control unit 112 may determine that it is a normal situation with integrity (S513).

However, when the response signal received in step S507 does not pass the integrity check of step S509, the control unit 112 may determine that web content such as a web page, web script, or web image is in a forged state. For example, when the response signal of step S507 includes a 200 response code, the control unit 112 determines whether web content such as a web page, web script, or web image provided by the server 120 is forged and/or altered. It can be judged as a security threat situation. However, the controller 112 may re-perform steps S505 to S509 after changing the reference date and time ( S511 ) in consideration that normal data update between the client and server may be performed during steps 501 to 509 . For example, the number of times of re-performing steps S511 and S505 to S509 may be performed a preset number of times. For example, if it is confirmed that the response signal of step S507 includes a 200 response code even as a result of re-execution for a preset number of times, web content such as web pages, web scripts, and web images is forged and/or altered in a security threat situation can be finally determined.

As described so far, according to an embodiment of the present invention, it is possible to detect forgery of web content using only a signal according to a communication protocol between a client and a server. For example, it is possible to accurately detect forgery and falsification of web content without separately receiving metadata, etc. from the server. The present invention can detect both the proxy installed inside the client and the proxy installed outside the client, as well as forgery and falsification of web content by the proxy installed in the virtual machine host. According to the web content forgery detection method according to this embodiment, when a web site by a server requests an installation check using an interlocking script or login input data for a diagnostic tool, it detects falsification of the script and responds with an installation check failure or Data leakage can be prevented by blocking login. Alternatively, when a client terminal attempts to access a server through a link, link movement may be blocked through forgery detection using a conditional request.

On the other hand, a computer program including instructions for causing the processor to perform the web content forgery detection method including each step according to the above-described embodiment may be stored in a computer-readable recording medium.

In addition, a computer-readable recording medium storing a computer program including instructions for causing a processor to perform the web content forgery detection method including each step according to the above-described embodiment may be provided.

Combinations of respective steps in each flowchart attached to the present invention may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, such that the instructions performed by the processor of the computer or other programmable data processing equipment provide the functions described in each step of the flowchart. It creates a means to do these things. These computer program instructions may also be stored in a computer-usable or computer-readable medium that may direct a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer-usable or computer-readable medium. The instructions stored in the recording medium are also possible to produce an article of manufacture containing instruction means for performing the functions described in each step of the flowchart. The computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other programmable data processing equipment. It is also possible that instructions for performing the processing equipment provide steps for performing the functions described in each step of the flowchart.

Further, each step may represent a module, segment, or portion of code comprising one or more executable instructions for executing the specified logical function(s). It should also be noted that in some alternative embodiments it is also possible for the functions recited in the steps to occur out of order. For example, it is possible that two steps shown one after another may in fact be performed substantially simultaneously, or that the steps may sometimes be performed in the reverse order depending on the corresponding function.

The above description is merely illustrative of the technical spirit of the present invention, and various modifications and variations will be possible without departing from the essential characteristics of the present invention by those skilled in the art to which the present invention pertains. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: client terminal
110: communication department
120: control unit
130: output unit

Claims (16)

A method for detecting forgery and falsification of web content in a client terminal,
Transmitting a request signal for which a predetermined response type is predicted among response types included in a communication protocol between a client and a server to a network for using web content, including an HTTP conditional request header in an HTTP request header field;
receiving a response signal to the request signal through the network;
determining whether the web content is forged or falsified based on a result of checking the integrity of the communication protocol based on a comparison result of the response signal and the preset response,
The communication protocol is an HTTP (HyperText Transfer Protocol) communication protocol, the preset response form includes a 304 response code, and the integrity check is to confirm whether the 304 response code is included in the response signal,
The HTTP conditional request header is If-Modified-Since, and the reference date and time included in the request signal is time information queried from the server or time information of the client,
In the step of determining whether the forgery or not, if the response signal includes a 200 response code, after changing the reference date and time to transmit the request signal and receiving the response signal again, the When a 200 response code is included in the received response signal according to re-execution, it is determined that the web content is forged or forged.
Web content forgery detection method. delete delete The method of claim 1,
The integrity check further confirms whether the response signal has a valid format of the 304 response code.
Web content forgery detection method. delete delete delete As a computer-readable recording medium storing a computer program,
The computer program, when executed by a processor,
Transmitting a request signal for which a predetermined response type is predicted among response types included in a communication protocol between a client and a server to a network for using web content, including an HTTP conditional request header in an HTTP request header field;
receiving a response signal to the request signal through the network;
determining whether the web content is forged or falsified based on a result of checking the integrity of the communication protocol based on a comparison result of the predetermined response with the response signal;
The communication protocol is an HTTP (HyperText Transfer Protocol) communication protocol, the preset response form includes a 304 response code, and the integrity check is to confirm whether the 304 response code is included in the response signal,
The HTTP conditional request header is If-Modified-Since, and the reference date and time included in the request signal is time information queried from the server or time information of the client,
In the step of determining whether the forgery or not, if the response signal includes a 200 response code, after changing the reference date and time to transmit the request signal and receiving the response signal again, the Including instructions for causing the processor to perform a web content forgery detection method comprising determining that the web content has been forged when a 200 response code is included in the received response signal according to re-execution
computer readable recording medium. delete delete 9. The method of claim 8,
The integrity check further confirms whether the response signal has a valid format of the 304 response code.
computer readable recording medium. delete delete delete As a computer program stored in a computer-readable recording medium,
The computer program, when executed by a processor,
A method comprising instructions for causing the processor to perform the method according to any one of claims 1 to 4
computer program. a communication unit for communicating with the server;
A control unit for controlling the communication unit,
The control unit transmits, to a network for using web content, a request signal for which a predetermined response type is predicted among response types included in a communication protocol between a client and a server, including an HTTP conditional request header in an HTTP request header field control the communication unit to do so, and when a response signal to the request signal is received through the communication unit through the network, based on the communication protocol integrity check result based on the comparison result of the response signal and the preset response It is determined whether the web content is forged or not, wherein the communication protocol is a HyperText Transfer Protocol (HTTP) communication protocol, the preset response form includes a 304 response code, and the integrity check is the 304 response to the response signal. It is to check whether a code is included, the HTTP conditional request header is If-Modified-Since, the reference date and time included in the request signal is time information queried from the server or time information of the client, and the forgery In the step of determining whether or not the response signal includes a 200 response code, after changing the reference date and time to transmit the request signal and receiving the response signal again, the re-perform In the case where the 200 response code is included in the received response signal according to
client terminal.

Images