KR102323732B1 - Apparatus and method for protecting files through hash management - Google Patents

Abstract

The present invention detects a request for modification or deletion of a file included in a preset group while monitoring the guest operating system in the virtualization driver, and the virtualization driver to the host operating system for modification or deletion of a file included in the preset group Inquiring for permission, the host operating system determines whether modification or deletion of the file included in the preset group is permitted by using whether the file included in the preset group is included in a preset file list, The host operating system permits modification or deletion of a file included in the preset group or permits modification or deletion of a file included in the preset group or files included in the preset group according to a determination result of whether to permit modification or deletion of the file included in the preset group It relates to a device and method for protecting files from being modified or deleted.

Description

APPARATUS AND METHOD FOR PROTECTING FILES THROUGH HASH MANAGEMENT

The following embodiments relate to an apparatus and method for securing the integrity of a guest operating system in operating a guest operating system in a virtualization system and protecting the modification or deletion of files included in a preset group through the guest operating system.

The dictionary meaning of "virtualization" is defined as "treating something that does not actually exist or is vague as a fact or entity that actually exists".

In the present invention, the virtualization technology is "a technology capable of installing and using a computer operating system without being affected by the system structure or hardware".

The virtualization technology was first proposed by IBM in the 1970s and was proposed to solve the problem of space saving and cost of the main frame at that time. However, in recent years, virtualization technology is attracting attention because it provides compatibility, flexibility, and security as well as cost reduction effect. Mainly applied fields are diverse, such as server virtualization for cloud computing, desktop virtualization, and mobile virtualization.

The reason why this virtualization technology is used for security is based on the advantage of virtualization called high isolation. A virtual environment generally consists of a virtual machine running a guest operating system and a virtual machine monitor (VMM) or hypervisor running a host operating system that manages it, and each virtual machine exists as an isolated space. do. In particular, even when a threat occurs to a virtual machine, it does not affect other virtual machines and virtual machine monitors except for the virtual machine.

However, in the virtualization system, the existing security solutions used in physical machines have limitations, and the frequency of occurrence of security threats is increasing significantly.

A typical reason why security solutions have limitations in virtualization systems is that multiple operating systems can be installed in one virtualization system.

When hackers modify or delete files by attacking at the operating system level using one of the operating systems installed in the virtualization system, it is difficult to prevent this.

Accordingly, there is a need for a technology capable of efficiently monitoring and blocking file modification or deletion.

The present invention was derived to solve the problems of the prior art as described above, and an object of the present invention is to provide an apparatus and method for protecting a file through hash management.

A method of protecting a file according to an embodiment of the present invention includes: detecting a request to modify or delete a file included in a preset group while monitoring a guest operating system in a virtualization driver; inquiring from the virtual driver to a host operating system for permission to modify or delete a file included in the preset group; determining, in the host operating system, whether to allow modification or deletion of the file included in the preset group by using whether the file included in the preset group is included in the preset file list; and the host operating system permits modification or deletion of files included in the preset group or permits modification or deletion of files included in the preset group according to the determination result of whether to permit the modification or deletion of the files included in the preset group. Blocking modification or deletion of the file.

In this case, the step of determining whether to allow the modification or deletion of the file included in the preset group may include, if the file included in the preset group is not included in the preset file list, included in the preset group It can be determined that modification or deletion of a file is permitted, and when a file included in the preset group is included in the preset file list, it is determined that modification or deletion of a file included in the preset group is not permitted. .

In this case, the file included in the preset group may be an executable file.

In this case, the step of inquiring from the virtualization driver to the host operating system for permission to modify or delete the file included in the preset group includes using a preset hash function for the file included in the preset group in the virtualization driver. to generate a hash value calculated by hashing, and transmit the calculated hash value to the host operating system to inquire permission to modify or delete a file included in the predetermined group, The step of determining whether to allow modification or deletion of the file included in the preset group using whether the file included in the group is included in the preset file list may include modifying or deleting the file in the file management unit of the host operating system. Checks whether the calculated hash value is included in the preset file list in which the hash value of the file to be blocked is stored, and if the calculated hash value is not included in the preset file list, included in the preset group If modification or deletion of a file is permitted, and the calculated hash value is included in the predetermined file list, it may be determined that modification or deletion of the file included in the predetermined group is not permitted.

In this case, the preset file list may store a hash value corresponding to a file to be blocked from modification or deletion, and may further include at least one of identifier information for identifying the file or a path of the file.

At this time, before detecting a request for modification or deletion of a file included in the preset group, when a request to register a file in the preset file list is received, checking whether the request is a registration request through a pre-approved local network ; and if the registration request is a registration request through a pre-approved local network, a hash value of the file to be modified is calculated using a preset hash function, and the hash value corresponding to the file to be registered is stored in the preset file list. It may further include the step of

In this case, the method of protecting a file may include: receiving a modification request for a file included in the preset file list through a local network permitted by the host operating system; calculating a hash value of the modified file using a preset hash function when a file included in the preset group is modified; and modifying the hash value of the file before modification stored in the preset file list to the hash value of the modified file.

In this case, the method of protecting a file may include: receiving a deletion request for a file included in the preset file list through a local network permitted by the host operating system; and deleting a hash value corresponding to the file requested to be deleted from the preset file list.

In this case, the method of protecting a file may include parsing the file system of the guest operating system before starting the guest operating system and verifying the integrity of the virtualization driver executing the guest operating system; As a result of the verification, if the virtualization driver is intact, the memory area to which the virtualization driver is allocated, the memory area corresponding to the master boot record (MBR) of the guest operating system, and the memory area corresponding to the volume boot record (VBR) of the guest operating system are blocking tampering; and executing the guest operating system and the virtualization driver.

The device for protecting a file according to an embodiment of the present invention permits modification or deletion of a file included in the preset group by using whether the file included in the preset group is included in the preset file list. a file management unit to determine whether or not; And upon receiving an inquiry from the virtualization driver for permission to modify or delete a file included in the preset group, check whether permission is granted through the file management unit, and modify or modify the file included in the preset group according to the determination result Includes a host operating system file protector that permits or blocks deletion.

In this case, the file management unit, if the file included in the preset group is not included in the preset file list, permits modification or deletion of the file included in the preset group, and is included in the preset group. If the file is included in the preset file list, it may be determined that modification or deletion of the file included in the preset group is not permitted.

In this case, the file included in the preset group may be an executable file.

In this case, the file management unit, upon receiving the calculated hash value for the file included in the preset group from the virtualization driver, checks whether the calculated hash value is included in the preset file list, and the calculated hash value If the value is not included in the preset file list, modification or deletion of the file included in the preset group is permitted, and if the calculated hash value is included in the preset file list, it is included in the preset group It may be determined that modification or deletion of the deleted file is not permitted.

In this case, the preset file list may store a hash value corresponding to a file to be blocked from modification or deletion, and may further include at least one of identifier information for identifying the file or a path of the file.

At this time, when the file management unit receives a request to register a file in the preset file list before detecting a request for modification or deletion of a file included in the preset group, whether it is a registration request through a pre-approved local network After checking, if the registration request is a registration request through a pre-approved local network, a hash value of the file to be modified is calculated using a preset hash function, and the preset file list is set as a hash value corresponding to the file to be registered. can be stored in

At this time, when the file management unit receives a request to modify a file included in the preset file list through a local network permitted by the host operating system, it calculates a hash value of the modified file using a preset hash function, , the hash value of the file before modification stored in the preset file list may be modified as the hash value of the modified file.

In this case, when the file manager receives a request to delete a file included in the preset file list through a local network permitted by the host operating system, a hash value corresponding to the file requested to be deleted from the preset file list is can be deleted.

In this case, the apparatus for protecting a file includes: an analysis unit that parses the file system of the guest operating system before starting the guest operating system and verifies the integrity of the virtualization driver executing the guest operating system; and if a request for modification or deletion of a file included in the preset group is detected while monitoring the guest operating system, it inquires to the host operating system file protection unit for permission to modify or delete a file included in the preset group and the host operating system file protection unit, if the verification result is that the virtualization driver is intact, a memory area to which the virtualization driver is allocated, a memory area corresponding to a master boot record (MBR) of the guest operating system, and Blocks modulation of a memory area corresponding to the volume boot record (VBR) of the guest operating system, and receives an inquiry from the virtualization driver whether to allow modification or deletion of files included in the preset group, the preset group A result of determining whether to allow the modification or deletion of the file included in the file may be transmitted to the virtualization driver.

In this case, the virtualization driver blocks access to the file included in the preset group if the host operating system file protection unit does not permit modification or deletion of the file included in the preset group, and the preset group If modification or deletion of a file included in . is permitted, modification or deletion of a file included in the preset group may be performed.

At this time, when the host operating system file protection unit receives from the virtualization driver the start time of the virtualization driver and the address of the memory area to block modulation, the memory area to which the virtualization driver is allocated, the master boot record (MBR) of the guest operating system Modulation may be blocked by setting the access right of the memory area corresponding to , and the memory area corresponding to the volume boot record (VBR) of the guest operating system to read only.

The present invention detects a request for modification or deletion of a file included in a preset group while monitoring the guest operating system in the virtualization driver, and the virtualization driver to the host operating system for modification or deletion of a file included in the preset group Inquiring for permission, the host operating system determines whether modification or deletion of the file included in the preset group is permitted by using whether the file included in the preset group is included in a preset file list, The host operating system permits modification or deletion of a file included in the preset group or permits modification or deletion of a file included in the preset group or files included in the preset group according to a determination result of whether to permit modification or deletion of the file included in the preset group It relates to an apparatus and method for protecting a file that blocks modification or deletion of a file, and it is possible to protect a file from modification and deletion of a file included in a preset file list among files included in a preset group.

1 is a diagram illustrating a configuration of an apparatus for protecting files of a guest operating system and a file system in a virtualization system according to an embodiment.
FIG. 2 is a diagram illustrating a page table entry modified in order to block modulation of a memory area of a virtualization driver according to an embodiment.
3 is a flowchart illustrating a process of obtaining permission before modifying or deleting a file included in a preset group in an apparatus according to an exemplary embodiment.
4 is a flowchart illustrating a process of registering a file in a file list in an apparatus according to an exemplary embodiment.
5 is a flowchart illustrating a process of modifying a file included in a file list in an apparatus according to an exemplary embodiment.
6 is a flowchart illustrating a process of deleting a file included in a file list in an apparatus according to an exemplary embodiment.
7 is a diagram illustrating a message flow for protecting a file included in a preset group in a virtualization system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, since various changes may be made to the embodiments, the scope of the patent application is not limited or limited by these embodiments. It should be understood that all modifications, equivalents and substitutes for the embodiments are included in the scope of the rights.

The terms used in the examples are used for description purposes only, and should not be construed as limiting. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present specification, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiment belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

In addition, in the description with reference to the accompanying drawings, the same components are given the same reference numerals regardless of the reference numerals, and the overlapping description thereof will be omitted. In the description of the embodiment, if it is determined that a detailed description of a related known technology may unnecessarily obscure the gist of the embodiment, the detailed description thereof will be omitted.

In addition, in describing the components of the embodiment, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are only for distinguishing the components from other components, and the essence, order, or order of the components are not limited by the terms. When it is described that a component is “connected”, “coupled” or “connected” to another component, the component may be directly connected or connected to the other component, but another component is between each component. It will be understood that may also be "connected", "coupled" or "connected".

Components included in one embodiment and components having a common function will be described using the same names in other embodiments. Unless otherwise stated, a description described in one embodiment may be applied to another embodiment, and a detailed description in the overlapping range will be omitted.

Hereinafter, an apparatus and method for protecting a file through hash management according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 8 .

1 is a diagram illustrating a configuration of an apparatus for protecting files of a guest operating system and a file system in a virtualization system according to an embodiment.

Referring to FIG. 1 , the security device may largely include a guest operating system (OS) 110 , a host operating system (OS) 120 , and a local terminal 130 .

The guest OS 110 has an IP address and is connected to the network, and even if the host OS 120 does not have an IP address or has an IP address, the control of the host OS 120 is performed by the local terminal 130 through the local network. ) can be controlled only through

Data transmitted to the guest OS 110 through the network is transmitted to the guest OS 110 through the host OS 120 , but the host OS 120 does not have an IP address or is allowed even if it has an IP address. Since control is possible only through the local terminal 130 , it is possible to prevent direct access to the host OS 120 from the outside.

That is, the host OS 120 can access only through an authorized terminal regardless of whether the host OS 120 has an IP address. Therefore, it would be more preferable not to have an IP address so that direct access to the host OS 120 from the outside can be fundamentally blocked.

More specifically, the guest OS 110 includes a para-virtualized agent 112 and a file system 114 , and the host OS 120 includes a host operating system (OS) file protection unit 122 and an analysis unit. (Parser) 124 , it may be configured to include a file management unit 126 .

Before starting in the guest operating system, the virtualization driver 112 provides the start time and memory area information of the virtualization driver to the analysis unit 124 through the host operating system file protection unit 122 to check integrity. In this case, a memory address corresponding to the agent's memory area information may be obtained through a structure of the kernel and an application programming interface (API).

The virtualization driver 112 may be implemented regardless of the operating system, but the implementation method may vary depending on the operating system. For example, in the case of Windows, the virtualization driver 112 may be implemented through a file system minifilter driver, and in the case of Linux, the virtualization driver through a kernel module. (112) may be implemented.

The analyzer 124 parses the file system of the guest operating system and verifies the integrity of the virtualization driver before starting the guest OS 110 , and provides the verification result to the host operating system file protection unit 122 .

The host operating system file protection unit 122 blocks the modification of the memory area to which the virtualization driver 112 is allocated when the virtualization driver is intact as a result of the verification by the analysis unit 124 .

In addition, the host operating system file protection unit 122 blocks tampering of a memory area corresponding to a master boot record (MBR) of the guest operating system and a memory area corresponding to a volume boot record (VBR) of the guest operating system.

More specifically, the host operating system file protection unit 122 uses the received start time of the virtualization driver 112 and the address of the memory area to which the virtualization driver 112 is allocated. You can block tampering by setting the access right to read only.

And, by using the address of the memory area corresponding to the master boot record (MBR) of the guest operating system and the address of the memory area corresponding to the volume boot record (VBR) of the guest operating system, the access right of the corresponding memory area is read only (read only) ) to block tampering.

FIG. 2 is a diagram illustrating a page table entry modified in order to block modulation of a memory area of a virtualization driver according to an embodiment.

Referring to FIG. 2 , the host operating system file protection unit 122 blocks tampering by modifying the access rights (RWX bits) shaded in the page table entry to read corresponding to write-protection. can

Meanwhile, in the case of Intel, memory virtualization technology, Extended Page Table (EPT), can be used to block tampering in the memory area, and in the case of AMD, Nested Page Tables (NPT) can be utilized.

Returning to the description of FIG. 1 again, when the virtualization driver 112 detects a request to modify or delete a file included in a preset group while monitoring the guest operating system, the virtualization driver 112 is responsible for modifying or deleting a file included in the preset group. Whether permission is granted may be inquired to the host operating system file protection unit 122 .

At this time, the virtualization driver 112 hashes a file included in a preset group using a preset hash function to generate a calculated hash value, and returns the calculated hash value for the file included in the preset group to the host operating system file. It may transmit to the protection unit 122 to inquire permission for modification or deletion of a file included in a preset group.

When the host operating system file protection unit 122 receives an inquiry from the virtualization driver 112 for permission to modify or delete a file included in a preset group, the host operating system file protection unit 122 checks whether permission is granted through the file management unit 126 and according to the determination result Modification or deletion of files included in the preset group is permitted or blocked, and the determination result is transmitted to the virtualization driver 112 .

Files included in a preset group may be classified by a file header or extension, and executable files may be classified into a preset group. In this case, in the executable file, the file header may have a PE (executable file header) structure, or files with extensions such as EXE, DLL, SYS, etc. may correspond to the executable file.

The file management unit 126 may determine whether to allow modification or deletion of the file included in the preset group by using whether the file included in the preset group is included in the preset file list.

If the file included in the preset group is not included in the preset file list, the file management unit 126 permits modification or deletion of the file included in the preset group, and the file included in the preset group is the preset file. If it is included in the list, it may be determined that modification or deletion of the file included in the preset group is not permitted.

More specifically, when the file management unit 126 receives the calculated hash value for the file included in the preset group from the virtualization driver 112, check whether the calculated hash value is included in the preset file list, and If the hash value is not included in the preset file list, modification or deletion of the file included in the preset group is permitted, and if the calculated hash value is included in the preset file list, the file included in the preset group It may be determined that modification or deletion is not permitted.

In this case, the preset file list may store a hash value corresponding to a file to be blocked from modification or deletion, and may further include at least one of identifier information for identifying the file or a file path.

On the other hand, when the file management unit 126 receives a request to register a file in a preset file list before detecting a request to modify or delete a file included in a preset group, through a pre-authorized local network (for example, , through the permitted local terminal 130), it is checked whether the registration request A hash value corresponding to the file to be stored may be stored in a preset file list.

When the file manager 126 receives a request to modify a file included in the preset file list through the local network permitted by the host operating system 120 (eg, through the permitted local terminal 130), the The hash value of the modified file can be calculated using the set hash function, and the hash value of the file before modification stored in the preset file list can be modified as the hash value of the modified file.

When the file management unit 126 receives a request to delete a file included in the preset file list through the local network permitted by the host operating system 120 (eg, through the permitted local terminal 130), the A hash value corresponding to a file requested to be deleted can be deleted from the set file list.

The virtualization driver 112 blocks access to the file included in the preset group if the host operating system file protection unit 122 does not permit modification or deletion of the file included in the preset group, and includes it in the preset group If modification or deletion of a file is permitted, modification or deletion of a file included in a preset group can be performed.

Meanwhile, the virtualization driver 112 and the host operating system file protection unit 122 may communicate using a hypercall interface.

Hereinafter, a method according to the present invention configured as described above will be described with reference to the drawings below.

3 is a flowchart illustrating a process of obtaining permission before modifying or deleting a file included in a preset group in an apparatus according to an exemplary embodiment.

Referring to FIG. 3 , when the virtualization driver 112 monitors the guest operating system 110 and detects a request to modify or delete a file included in a preset group 310 , the virtualization driver 112 monitors the host operating system 120 . ) of the host operating system file protection unit 122 inquires for permission to modify or delete a file included in a preset group ( 320 ).

In this case, files included in the preset group may be classified by a file header and an extension, and executable files may be classified into a preset group. In an executable file, the file header may have a PE (executable file header) structure, or files with extensions such as EXE, DLL, SYS, etc. may correspond to executable files.

More specifically, in step 320, the virtualization driver 112 hashes a file included in a preset group using a preset hash function to generate a calculated hash value, and the calculated hash value for the file included in the preset group. may be transmitted to the host operating system file protection unit 122 to inquire permission for modification or deletion of a file included in a preset group.

The host operating system file protection unit 122 checks whether a file included in a predetermined group exists in a predetermined file list through the file management unit 126 ( 330 ).

As a result of the check in step 330 , if the file management unit 126 determines that a file included in the preset group is included in the preset file list in the host operating system file protection unit 122 , the file included in the preset group is modified or It is determined that the deletion is not permitted and blocked, and the determination result is provided to the virtualization driver 112 to block modification or deletion of files included in the preset group ( 340 ).

If it is determined in step 330 that the file management unit 126 determines that the file included in the preset group is not included in the preset file list in the host operating system file protection unit 122, the file included in the preset group is corrected. Alternatively, it is determined that deletion is permitted, and the determination result is provided to the virtualization driver 112 to permit modification or deletion of files included in a preset group (350).

In step 330, the file management unit 126 of the host operating system 120 checks whether the calculated hash value transmitted from the virtual driver 112 is included in the preset file list. You can check whether it exists in the file list. In this case, the preset file list may store a hash value corresponding to a file to be blocked from modification or deletion, and may further include at least one of identifier information for identifying the file or a file path.

Meanwhile, although not shown in FIG. 3 , before starting the guest operating system in the analysis unit 124 of the host operating system 120 , the file system of the guest operating system is parsed and the integrity of the virtualization driver executing the guest operating system is verified, If the integrity verification result of the analysis unit 124 in the host operating system file protection unit 122 indicates that the virtualization driver is intact, the memory area to which the virtualization driver is allocated, the memory area corresponding to the master boot record (MBR) of the guest operating system, and the guest operating system are After blocking the modulation of the memory area corresponding to the volume boot record (VBR), the guest operating system 110 and the virtualization driver 112 may be executed.

4 is a flowchart illustrating a process of registering a file in a file list in an apparatus according to an exemplary embodiment.

Referring to FIG. 4 , when the file management unit 126 receives a request to register a file in a preset file list ( 410 ), it checks whether it is a registration request through a pre-approved local network ( 420 ).

As a result of checking in step 420, if the registration request is a registration request through a previously permitted local network, the file management unit 126 calculates a hash value of the file to be modified using a preset hash function, and returns a hash value corresponding to the file to be registered. It is stored in a preset file list (430).

If it is determined in step 420 that the registration request is not a registration request through a pre-approved local network, the file management unit 126 blocks the file registration request ( 440 ).

5 is a flowchart illustrating a process of modifying a file included in a file list in an apparatus according to an exemplary embodiment.

Referring to FIG. 5 , when receiving a request to modify a file included in a preset file list ( 510 ), the file management unit 126 checks whether the request is a modification through a pre-authorized local network ( 520 ).

As a result of checking in step 520, if the modification request is a modification request through a pre-authorized local network, the file management unit 126 calculates a hash value of the modified file using a predetermined hash function, and before modification stored in the predetermined file list The hash value of the file is corrected to the hash value of the modified file (530).

If it is determined in step 520 that the registration request is not a modification request through a previously authorized local network, the file management unit 126 blocks the modification request of the file ( 540 ).

6 is a flowchart illustrating a process of deleting a file included in a file list in an apparatus according to an exemplary embodiment.

Referring to FIG. 6 , when the file management unit 126 receives a request to delete a file included in a preset file list ( 610 ), it checks whether the request is a deletion request through a pre-approved local network ( 620 ).

As a result of checking in step 620, if the modification request is a deletion request through a pre-approved local network, the file management unit 126 deletes a hash value corresponding to the file requested to be deleted from the preset file list (630).

If it is determined in step 620 that the registration request is not a request for deletion through a pre-approved local network, the file management unit 126 blocks the request to delete the file ( 640 ).

7 is a diagram illustrating a message flow for protecting a file included in a preset group in a virtualization system according to an embodiment.

Referring to FIG. 7 , before starting in the guest operating system, the virtualization driver 112 transmits a start time and memory area information of the virtualization driver to the host operating system file protection unit 122 ( 710 ).

The host OS file protection unit 122 provides the start time and memory area information of the virtualization driver to the analysis unit 124 ( 712 ).

The analyzer 124 parses the file system of the guest operating system before starting the guest OS 110 and verifies the integrity of the virtualization driver (S714).

Then, the analysis unit 124 provides the result of determining the integrity to the host OS file protection unit 122 (S716).

The host OS file protection unit 122 determines that the virtualization driver is intact as a result of the verification of the analysis unit 124 , the memory area to which the virtualization driver 112 is allocated, the memory area corresponding to the master boot record (MBR) of the guest operating system, and the guest Modulation is blocked by setting it to read only so that writing is prohibited in the memory area corresponding to the volume boot record (VBR) of the operating system (718).

Thereafter, when the virtualization driver 112 detects a request to modify or delete a file included in a preset group while monitoring the guest operating system 110 ( 720 ), the host operating system file protection unit 122 of the host operating system 120 . Inquires for permission to modify or delete a file included in a group preset as ' (722).

The host operating system file protection unit 122 inquires the file management unit 126 for permission to modify or delete a file included in a preset group (S724).

The file management unit 126 determines whether to allow modification or deletion of the file included in the preset group by using whether the file included in the preset group is included in the preset file list (S726).

The file management unit 126 responds to the host operating system file protection unit 122 with a result of determining whether to allow modification or deletion of the files included in the preset group to the host operating system file protection unit 122 (S728).

The host operating system file protection unit 122 responds to the virtualization driver 112 with a result of determining whether to allow modification or deletion of files included in a preset group ( 730 ).

The virtualization driver 112 permits modification or deletion of a file included in a preset group or allows modification or deletion of a file included in a preset group according to a determination result of whether to permit modification or deletion of a file included in a preset group. Modification or deletion of the block is blocked (732).

As described above, although the embodiments have been described with reference to the limited drawings, those skilled in the art may apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

110; guest operating system
112; virtualization driver
114; file system
120; host operating system
122; Host operating system file protection
124; analysis department
126; file management department
130; local terminal

Claims (20)

Detecting a request to modify or delete a file included in a preset group while monitoring the guest operating system in the virtualization driver;
inquiring from the virtual driver to a host operating system for permission to modify or delete a file included in the preset group;
determining, in the host operating system, whether to allow modification or deletion of the file included in the preset group by using whether the file included in the preset group is included in the preset file list; and
The host operating system permits modification or deletion of a file included in the preset group or permits modification or deletion of a file included in the preset group or files included in the preset group according to a determination result of whether to permit modification or deletion of the file included in the preset group Steps to block modifications or deletions to
including,
The step of determining whether to allow modification or deletion of files included in the preset group includes:
If the file included in the preset group is not included in the preset file list, modify or delete the file included in the preset group is permitted,
If the file included in the preset group is included in the preset file list, it is determined that modification or deletion of the file included in the preset group is not permitted.
How to protect your files.
delete According to claim 1,
The files included in the preset group are,
characterized in that it is an executable file
How to protect your files.
According to claim 1,
Inquiring from the virtualization driver to the host operating system for permission to modify or delete a file included in the preset group comprises:
The virtualization driver hashes the file included in the preset group using a preset hash function to generate a calculated hash value, and transmits the calculated hash value to the host operating system to transmit the file included in the preset group. Inquire for permission to modify or delete
The step of determining, in the host operating system, whether to allow modification or deletion of the file included in the preset group by using whether the file included in the preset group is included in the preset file list,
The file management unit of the host operating system checks whether the calculated hash value is included in a preset file list in which a hash value of a file to be blocked from modification or deletion is stored, and the calculated hash value is included in the preset file list If not, modification or deletion of files included in the preset group is permitted, and if the calculated hash value is included in the preset file list, modification or deletion of files included in the preset group is permitted. deciding not to
How to protect your files.
5. The method of claim 4,
The preset file list is,
Stores the hash value corresponding to the file that should be blocked from modification or deletion,
Further comprising at least one of identifier information for identifying the file or a path of the file
How to protect your files.
According to claim 1,
Prior to the step of detecting a request to modify or delete a file included in the preset group,
checking whether the request for registration of a file in the preset file list is received through a pre-approved local network; and
If the registration request is a registration request through a pre-approved local network, the hash value of the file to be modified is calculated using a preset hash function, and the hash value corresponding to the file to be registered is stored in the preset file list. step
How to protect files containing more.
According to claim 1,
receiving a modification request for a file included in the preset file list through a local network permitted by the host operating system;
calculating a hash value of the modified file using a preset hash function when a file included in the preset group is modified; and
Correcting the hash value of the file before modification stored in the preset file list to the hash value of the modified file
How to protect files containing more.
According to claim 1,
receiving a deletion request for a file included in the preset file list through a local network permitted by the host operating system; and
Deleting a hash value corresponding to a file requested to be deleted from the preset file list
How to protect files containing more.
According to claim 1,
parsing the file system of the guest operating system before starting the guest operating system and verifying the integrity of the virtualization driver executing the guest operating system;
As a result of the verification, if the virtualization driver is intact, the memory area to which the virtualization driver is allocated, the memory area corresponding to the master boot record (MBR) of the guest operating system, and the memory area corresponding to the volume boot record (VBR) of the guest operating system are blocking tampering; and
executing the guest operating system and the virtualization driver
How to protect files containing more.
a file management unit for determining whether to permit modification or deletion of files included in the preset group by using whether the files included in the preset group are included in the preset file list; and
Upon receiving an inquiry from the virtualization driver for permission to modify or delete a file included in the preset group, check whether permission is granted through the file management unit, and modify or delete the file included in the preset group according to the determination result Host operating system file protection unit that allows or blocks
including,
The file management unit,
If the file included in the preset group is not included in the preset file list, modify or delete the file included in the preset group is permitted,
If the file included in the preset group is included in the preset file list, it is determined that modification or deletion of the file included in the preset group is not permitted.
A device that protects your files.
delete 11. The method of claim 10,
The files included in the preset group are,
characterized in that it is an executable file
A device that protects your files.
11. The method of claim 10,
The file management unit,
Upon receiving the calculated hash value for the file included in the preset group from the virtualization driver, it is checked whether the calculated hash value is included in the preset file list, and the calculated hash value is the preset file list If it is not included in , modification or deletion of a file included in the preset group is permitted, and if the calculated hash value is included in the preset file list, modification or deletion of a file included in the preset group judged not to permit
A device that protects your files.
14. The method of claim 13,
The preset file list is,
Stores the hash value corresponding to the file that should be blocked from modification or deletion,
Further comprising at least one of identifier information for identifying the file or a path of the file
A device that protects your files.
11. The method of claim 10,
The file management unit,
When a request to register a file in the preset file list is received before detecting a request for modification or deletion of a file included in the preset group, it is checked whether it is a registration request through a pre-approved local network, and the confirmation result is a registration request If it is a registration request through the local network allowed in advance, the hash value of the file to be modified is calculated using a preset hash function and stored in the preset file list as a hash value corresponding to the file to be registered.
A device that protects your files.
11. The method of claim 10,
The file management unit,
Upon receiving a request for modification of a file included in the preset file list through a local network permitted by the host operating system, a hash value of the modified file is calculated using a preset hash function and added to the preset file list. Modifying the hash value of the stored file before modification to the hash value of the modified file
A device that protects your files.
11. The method of claim 10,
The file management unit,
When a deletion request for a file included in the preset file list is received through the local network permitted by the host operating system, a hash value corresponding to the file requested to be deleted from the preset file list is deleted.
A device that protects your files.
11. The method of claim 10,
an analysis unit that parses the file system of the guest operating system before starting the guest operating system and verifies the integrity of the virtualization driver executing the guest operating system; and
When a request for modification or deletion of a file included in the preset group is detected while monitoring the guest operating system, it inquires to the host operating system file protection unit for permission to modify or delete a file included in the preset group Further comprising the virtualization driver,
The host operating system file protection unit,
As a result of the verification, if the virtualization driver is intact, the memory area to which the virtualization driver is allocated, the memory area corresponding to the master boot record (MBR) of the guest operating system, and the memory area corresponding to the volume boot record (VBR) of the guest operating system are When tampering is blocked, and when a request is made from the virtualization driver whether to allow modification or deletion of files included in the preset group, the result of determining whether to permit modification or deletion of files included in the preset group to the virtualization driver
A device that protects your files.
19. The method of claim 18,
The virtualization driver is
If the host operating system file protection unit does not permit modification or deletion of the file included in the preset group, access to the file included in the preset group is blocked, and the file included in the preset group is modified Or, if deletion is permitted, modification or deletion of files included in the preset group is performed.
A device that protects your files.
19. The method of claim 18,
The host operating system file protection unit,
When the start time of the virtualization driver and the address of the memory area to block modulation are received from the virtualization driver, the memory area to which the virtualization driver is allocated, the memory area corresponding to the master boot record (MBR) of the guest operating system, and the guest operating system It blocks tampering by setting the access right of the memory area corresponding to the volume boot record (VBR) to read only.
A device that protects your files.

Images