KR102345501B1 - Electronic terminal device which verifies if the program is fabricated or falsified interworking plural node units constituting blockchain network and operating method thereof - Google Patents

Abstract

Disclosed are an electronic terminal device for performing forgery/falsification verification of a program in conjunction with a plurality of node devices constituting a block chain network, and an operating method thereof. Provided are the electronic terminal device capable of performing forgery/falsification verification of a program using block chain data and the operation method thereof. The block chain data comprises a transaction consisting of a unique identifier of a program which is pre-designated to be included in a white list stored in a plurality of node devices, and a hash value for an executable file of the program.

Description

An electronic terminal device that performs forgery/falsification verification of a program in conjunction with a plurality of node devices constituting a block chain network and an operation method thereof NETWORK AND OPERATING METHOD THEREOF}

The present invention relates to an electronic terminal device for performing forgery/falsification verification of a program in conjunction with a plurality of node devices constituting a block chain network, and an operating method thereof.

Recently, in order to prevent a forged/falsified program from being executed in an electronic terminal device, various services for verifying whether a corresponding program is forged/altered when the program is executed in the electronic terminal device have been developed.

Since the service that verifies whether an existing program is forged/falsified based on the data stored in the specific server, verifies whether the corresponding program is forged/falsified, so if a problem occurs in the server, the basis for verifying forgery/falsification of the program The data that becomes the data can be easily transformed, and as a result, the results of the forgery/falsification verification of the program performed based on the data become unreliable.

In this regard, recently, blockchain technology that can ensure reliability and stability of data by composing data into blocks connected by chains and storing them in a plurality of node devices rather than on a specific server has been widely used.

In blockchain technology, when data called a transaction is created, any one node device among a plurality of node devices constituting the blockchain network is By creating a new block containing the transaction, chaining the block to the block chain data, and distributing the block to other node devices through the block chain network, predetermined data is transmitted to a plurality of node devices. It refers to a technology that enables distributed storage in

If such block chain technology is introduced to the forgery/falsification verification service of the program, even if a problem occurs in any node device among a plurality of node devices and the data stored in the node device is corrupted or modified, the data is transmitted to the remaining node devices. is distributed and stored, so it can support more stable and reliable program forgery/falsification verification.

Therefore, in order to ensure the stability and reliability of the program's forgery/falsification verification results, a study on the technology to perform the forgery/falsification verification of the program in conjunction with a plurality of node devices constituting the block chain network is needed

The present invention provides an electronic terminal device for performing forgery/falsification verification of a program in conjunction with a plurality of node devices constituting a block chain network and an operation method thereof, thereby improving stability and reliability of program forgery/falsification verification We want to help you ensure that.

A plurality of node devices forming a block chain network according to an embodiment of the present invention - The plurality of node devices are a unique identifier of a program pre-designated to be included in a white list and a hash value for the executable file of the program The electronic terminal device that performs forgery/falsification verification of the program in conjunction with storing block chain data in which blocks including configured transactions are chained is the plurality of node devices for verification of forgery/falsification of the program A function storage unit in which a hash function shared in advance with others is stored, and a unique identifier corresponding to a plurality of programs installed in the electronic terminal device, wherein the plurality of programs are programs included in the white list. When an execution event for executing a first program among the plurality of programs occurs in a table storage unit in which a recorded identifier table is stored, and in the electronic terminal device, a unique corresponding to the first program with reference to the identifier table occurs After confirming a first unique identifier that is an identifier, and extracting a first executable file that is an executable file of the first program from the first program, a first hash value that is a hash value for the first executable file using the hash function an identification information generator to generate, a node selector for selecting K (K is a natural number greater than or equal to 2) first node devices among the plurality of node devices as node devices to perform forgery/falsification verification of the first program; When the K first node devices are selected, the verification request unit transmits the first unique identifier and the first hash value to the K first node devices and simultaneously requests forgery/falsification verification of the first program. , based on the first unique identifier from the block chain data stored in each of the K first node devices, each of the K first node devices in response to the forgery/falsification verification request of the first program a second for the executable file of the first program recorded on the block chain data as After extracting a hash value, by comparing whether the second hash value and the first hash value match each other, a verification result for whether the first program is forged/altered is generated, each of the K first node devices When the verification result as to whether the first program is forged/altered is received from a ratio checking unit to check, and an execution unit to check whether the ratio exceeds a preset reference ratio, and to execute the first program when it is determined that the ratio exceeds the reference ratio.

In addition, a plurality of node devices forming a block chain network according to an embodiment of the present invention - The plurality of node devices are a hash of the program's executable file and a unique identifier of the program pre-designated to be included in the white list The operation method of the electronic terminal device that performs forgery/falsification verification of a program in conjunction with blocks containing transactions composed of values stores block chain data connected by a chain is maintaining a function storage unit in which a hash function previously shared with the plurality of node devices is stored; a plurality of programs installed in the electronic terminal device - the plurality of programs being included in the white list maintaining a table storage unit in which an identifier table in which a unique identifier corresponding to a unique identifier is recorded is stored, when an execution event for executing a first program among the plurality of programs occurs in the electronic terminal device, the identifier table a first unique identifier that is a unique identifier corresponding to the first program is identified with reference to , a first executable file that is an executable file of the first program is extracted from the first program, Generating a first hash value that is a hash value for an executable file, K (K being a natural number greater than or equal to 2) among the plurality of node devices, a node device to perform forgery/falsification verification of the first program selecting , when the K first node devices are selected, transmitting the first unique identifier and the first hash value to the K first node devices and simultaneously verifying forgery/falsification of the first program requesting, each of the K first node devices in response to the forgery/falsification verification request of the first program, from the block chain data stored in each of the K first node devices, the first of the first program recorded on the block chain data based on the unique identifier After extracting the second hash value for the executable file, and comparing whether the second hash value and the first hash value match each other, as a verification result for whether the first program is forged/altered is generated, the K When a verification result as to whether the first program is forged/altered is received from each of the first node devices, the verification result determined that the first program is not forged/altered from among the K first node devices is transmitted checking the ratio of one node device and checking whether the ratio exceeds a preset reference ratio, and when it is determined that the ratio exceeds the reference ratio, executing the first program.

The present invention provides an electronic terminal device for performing forgery/falsification verification of a program in conjunction with a plurality of node devices constituting a block chain network and an operation method thereof, thereby improving stability and reliability of program forgery/falsification verification We can assist you to ensure that

1 is a diagram illustrating the structure of an electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention.
2 is a flowchart illustrating a method of operating an electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention;

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings. These descriptions are not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. While describing each drawing, like reference numerals are used for similar components, and unless otherwise defined, all terms used in this specification, including technical or scientific terms, refer to those of ordinary skill in the art to which the present invention belongs. It has the same meaning as is commonly understood by those who have it.

In this document, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated. In addition, in various embodiments of the present invention, each of the components, functional blocks or means may be composed of one or more sub-components, and the electrical, electronic, and mechanical functions performed by each component are electronic. A circuit, an integrated circuit, an ASIC (Application Specific Integrated Circuit), etc. may be implemented as various well-known devices or mechanical elements, and may be implemented separately or two or more may be integrated into one.

On the other hand, the blocks in the accompanying block diagram or steps in the flowchart are computer program instructions that are loaded in a processor or memory of equipment capable of data processing, such as a general-purpose computer, a special-purpose computer, a portable notebook computer, and a network computer, and perform specified functions. can be interpreted as meaning Since these computer program instructions may be stored in a memory provided in a computer device or in a computer-readable memory, the functions described in the blocks of the block diagram or the steps of the flowchart are produced as articles of manufacture containing instruction means for performing the same. it might be In addition, each block or each step may represent a module, segment, or portion of code comprising one or more executable instructions for executing the specified logical function(s). It should also be noted that, in some alternative embodiments, it is also possible for the functions recited in blocks or steps to be executed out of the prescribed order. For example, two blocks or steps shown one after another may be performed substantially simultaneously or in the reverse order, and in some cases, some blocks or steps may be omitted.

1 is a diagram illustrating the structure of an electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention.

The electronic terminal device 110 for performing forgery/falsification verification of the program according to the present invention interworks with a plurality of node devices 101, 102, 103 forming the block chain network 100 to perform forgery/falsification of the program An electronic terminal device for performing verification, including a function storage unit 111 , a table storage unit 112 , an identification information generation unit 113 , a node selection unit 114 , a verification request unit 115 , and a ratio check unit 116 . ) and an execution unit 117 .

First, a plurality of node devices (101, 102, 103) is a block containing a transaction consisting of a hash value for the execution file of the program and the unique identifier of the program pre-designated to be included in the white list is connected in a chain Storing blockchain data. Here, the plurality of node devices 101, 102, 103 is a microprocessor-based computing device having a network function, and the block chain data is stored in the memory of each of the plurality of node devices 101, 102, 103. have.

For example, assuming that there is a 'program 1' that is pre-designated to be included in the white list, the plurality of node devices 101, 102, 103 may have a unique identifier of the 'program 1' and the 'program' as shown in Table 1 below. A block containing a transaction composed of a hash value for the 1' executable file may be chained and stored in the blockchain data.

program unique identifier hash value Program 1 unique identifier 1 hash value 1

The function storage unit 111 stores a hash function shared in advance with the plurality of node devices 101 , 102 , 103 for forgery/falsification verification of the program.

The table storage unit 112 stores an identifier table in which unique identifiers corresponding to a plurality of programs installed in the electronic terminal device 110 are recorded. Here, the plurality of programs are programs included in the white list.

In addition, the unique identifier means unique identification information for distinguishing each of the plurality of programs from each other, and the identifier table includes information on unique identifiers corresponding to the plurality of programs as shown in Table 2 below. may be recorded.

multiple programs unique identifier Program 1 unique identifier 1 Program 2 unique identifier 2 Program 3 unique identifier 3 ... ...

At this time, as an execution command for executing the first program, which is one of the plurality of programs, is applied from the user 130 on the electronic terminal apparatus 110 , the electronic terminal apparatus 110 executes the first program When an execution event occurs, the identification information generating unit 113 refers to the identifier table stored in the table storage unit 112 and identifies a first unique identifier that is a unique identifier corresponding to the first program, and After extracting a first executable file that is an executable file of the first program from a first program, a first hash value that is a hash value of the first executable file is generated by using the hash function.

For example, assuming that the first program is 'Program 1' and a command for executing 'Program 1' from the user 130 is applied to the electronic terminal device 110 , the identification information generating unit 113 may As shown in Table 2, 'unique identifier 1' corresponding to 'program 1' is identified as the first unique identifier by referring to the identifier table in which information is recorded, and after extracting the executable file from 'program 1', the executable file By applying as an input to the hash function, the first hash value may be generated.

The node selector 114 selects K (K is a natural number greater than or equal to 2) first node devices among the plurality of node devices 101, 102, 103 as node devices to perform forgery/falsification verification of the first program. do.

At this time, according to an embodiment of the present invention, the node selector 114 performs forgery/falsification verification of the first program on the K first node devices among the plurality of node devices 101 , 102 , 103 . As a configuration for selecting a node device to be performed, the information confirmation unit 118 , the numerical calculation unit 119 , the state measurement unit 120 , the vector generation unit 121 , the node matrix generation unit 122 , and the selection unit 123 . ) may be included.

First, each of the plurality of node devices 101 , 102 , 103 is configured to perform a virus scan at a preset first cycle interval and at the same time store virus detection history information according to the virus scan, It may be configured to measure a traffic level generated in each of the plurality of node devices 101 , 102 , 103 at a set second cycle interval and store information on the measured traffic level.

For example, when the first cycle is '24 hours' and the second cycle is '30 hours', each of the plurality of node devices 101, 102, 103 performs a virus check at '24 hours' intervals, Virus detection history information according to virus inspection can be stored, and the information about this can be stored by measuring the number of traffic generated by each node device at an interval of '30 hours'.

At this time, the information check unit 118 connects to the plurality of node devices 101, 102, 103 and provides information on virus detection history information and traffic values stored in each of the plurality of node devices 101, 102, 103. Based on the information, a total number of virus detections for each of the plurality of node devices (101, 102, 103) for a period from a predetermined past time point to the present time point is checked, and the plurality of node devices (101, 102, 103) ) calculates the average value of the traffic figure for each said period.

For example, when the predetermined past time point is '2 months ago from the current time point', the information check unit 118 performs a plurality of node devices 101, 102, 103) For each, the total number of virus detections occurring in each node device can be checked, and for each of the plurality of node devices 101, 102, 103, each node from '2 months ago from the current time to the present time It is possible to calculate the average value of the number of traffic generated by the device.

After that, the numerical calculation unit 119 divides the total number of virus detections by a preset reference number of virus detections for each of the plurality of node devices 101, 102, and 103 as a hyperbolic tangent function. A plurality of nodes by applying a first numerical value as an input to calculate a first numerical value, and calculating a second numerical value by applying a value obtained by dividing the average value of the traffic numerical value by a preset reference traffic numerical value as an input to the hyperbolic tangent function The first numerical value and the second numerical value corresponding to each of the devices 101 , 102 , and 103 are calculated.

In this regard, the numerical calculation unit 119 may calculate the first numerical value and the second numerical value corresponding to each of the plurality of node devices 101 , 102 , 103 according to the operation of Equation 1 below. have.

In Equation 1, Y ₁ is the first numerical value, V _A is the total number of virus detections, and V is the preset reference number of virus detections. In addition, Y ₂ is the second numerical value, T _A is an average value of the traffic numerical value, and T is the preset reference traffic numerical value.

For example, let the reference number of virus detections be '10', the reference traffic numerical value be '30 GB', and as a result of confirmation by the information confirmation unit 118 , the total number of virus detections of the node device 1 101 is If it is '5 times' and it is confirmed that the average value of the traffic figure is '100GB', the numerical calculation unit 119 may calculate '0.462' as the first numerical value for the node device 1 101, , '0.997' may be calculated as the second numerical value. In this way, the numerical calculator 119 may calculate the first numerical value and the second numerical value corresponding to each of the plurality of node devices 101 , 102 , 103 .

The state measuring unit 120 measures a current CPU usage rate and a memory usage rate of each of the plurality of node devices 101 , 102 , 103 .

The vector generator 121 constructs a two-dimensional column vector having the first numerical value and the second numerical value as components for each of the plurality of node apparatuses 101 , 102 , 103 , thereby forming a plurality of node apparatuses. A two-dimensional column vector corresponding to each of the elements 101, 102, and 103 is generated, and the current CPU usage rate and the memory usage rate are used for each of the plurality of node devices (101, 102, 103). By configuring the row vector, a two-dimensional row vector corresponding to each of the plurality of node devices 101 , 102 , 103 is generated.

'이라고 하는 2차원의 열벡터를 생성할 수 있다. 또한, 노드 장치(101)에 대해서 상기 현재 CPU 사용률이 '40%'이고 메모리 사용률이 '50%'로 측정되었다고 하는 경우, 벡터 생성부(121)는 노드 장치 1(101)에 대해서 '

'이라고 하는 2차원의 행벡터를 생성할 수 있다. 이러한 방식으로, 벡터 생성부(121)는 복수의 노드 장치들(101, 102, 103) 각각에 대응되는 2차원의 열벡터 및 2차원의 행벡터를 생성할 수 있다. For example, when '0.462' is calculated as the first numerical value and '0.997' is calculated as the second numerical value with respect to the node device 1 101 , the vector generating unit 121 is the node device 1 101 . about '

You can create a two-dimensional column vector called '. In addition, when it is assumed that the current CPU usage rate is '40%' and the memory usage rate is measured to be '50%' for the node device 101, the vector generator 121 '

You can create a two-dimensional row vector called '. In this way, the vector generator 121 may generate a two-dimensional column vector and a two-dimensional row vector corresponding to each of the plurality of node devices 101 , 102 , 103 .

In this way, when the two-dimensional column vector and the two-dimensional row vector corresponding to each of the plurality of node apparatuses 101, 102, 103 are generated, the node matrix generator 122 may generate the plurality of node apparatuses 101, For each of 102 and 103, a node matrix having a size of 2 x 2 corresponding to each of the plurality of node devices 101, 102, and 103 by multiplying the column vector and the row vector corresponding to each node device. create

'이라고 하는 2차원의 열벡터가 생성 되었고 '

'이라고 하는 2차원의 행벡터가 생성된 경우, 노드 행렬 생성부(122)는 상기 열벡터 및 상기 행벡터를 서로 곱함으로써 '

'라고 하는 노드 행렬을 생성할 수 있다. 이러한 방식으로 노드 행렬 생성부(122)는 복수의 노드 장치들(101,102,103) 각각에 대응되는 2 x 2의 크기를 갖는 노드 행렬을 생성할 수 있다.In this regard, as in the previous example, for node device 1 101, '

A two-dimensional column vector called ' was created and '

When a two-dimensional row vector ' is generated, the node matrix generator 122 multiplies the column vector and the row vector by

You can create a node matrix called '. In this way, the node matrix generator 122 may generate a node matrix having a size of 2 x 2 corresponding to each of the plurality of node devices 101 , 102 , and 103 .

In this way, when the node matrix corresponding to each of the plurality of node devices 101 , 102 , 103 is generated, the selector 123 is the node matrix corresponding to each of the plurality of node devices 101 , 102 , 103 . K to calculate the Euclidean norm of and perform forgery/modulation verification of the first program in the order in which the Euclidean norm of the node matrix is calculated to be smaller among the plurality of node devices 101, 102, 103 Select the first node devices.

Here, the Euclidean norm is an L2 norm indicating the size of a vector or matrix in the Euclidean space, and can be expressed as in Equation 2 below.

가 유클리드 노름, x_k는 벡터 또는 행렬의 k번째 성분을 의미한다. here,

is the Euclidean norm, x _k denotes the kth component of a vector or matrix.

In this regard, let K be 2, and for the plurality of node devices 101 , 102 , 103 , in the order of node device 1 101 , node device 2 102 , and node device 3 103 , the When it is assumed that the Euclidean norm is calculated to be small, the selection unit 123 may select the node device 1 101 and the node device 2 102 as two node devices for performing forgery/tamper verification of the first program.

Here, the fact that the Euclidean norm of the node matrix is calculated to be small means that the total number of virus detections in the node device is small, the average value of the traffic value is small, and the current CPU usage rate and memory usage rate are low. This small calculated node device is relatively stable, and it can be seen that it is currently in a state close to the idle state. Accordingly, the selection unit 123 selects the node device for which the Euclidean norm is calculated to be small as the node device for performing the forgery/falsification verification of the first program, thereby enabling more stable and efficient forgery/falsification verification of the first program. can support

In this way, when the K first node devices are selected by the node selector 114 as node devices to perform forgery/falsification verification of the first program, the verification requesting unit 115 selects the K first node devices. to transmit the first unique identifier and the first hash value and simultaneously request forgery/falsification verification of the first program.

For example, as in the previous example, when it is assumed that node device 1 101 and node device 2 102 are selected as node devices to perform forgery/falsification verification of the first program, the verification request unit 115 is the node device While transmitting the first unique identifier and the first hash value to each of the node 1 101 and the node device 2 102 , it is possible to request forgery/falsification verification of the first program.

At this time, according to an embodiment of the present invention, each of the K first node devices receives the first unique identifier and the first hash value from the electronic terminal device 110 and at the same time the When a modulation verification request is received, the first block in which the first unique identifier is recorded is retrieved from the block chain data stored in each of the K first node devices, and the first block is retrieved from the first block. When it is confirmed that the second hash value and the first hash value match each other by extracting the second hash value recorded in the , if it is determined that the first program has not been forged/altered, and it is determined that the second hash value and the first hash value do not match each other, after determining that the first program has been forged/altered 1 The verification result according to the determination of whether the program is forged/falsified may be transmitted to the electronic terminal device 110 .

For example, the first program is called 'program 1', the first unique identifier is called 'unique identifier 1', and any one node device among the K first node devices is called node device 1 (101). In this case, when the first hash value for the executable file of 'unique identifier 1' and 'program 1' is received from the electronic terminal device 110, the node device 1 101 is a node based on the 'unique identifier 1' From the block chain data stored in the device 1 101, 'hash value 1' may be extracted as the second hash value from a block including a transaction as shown in Table 1 above. Then, the node device 1 101 checks whether the first hash value received from the electronic terminal device 110 matches the 'hash value 1', which is the second hash value extracted from the block chain data, When it is confirmed that both hash values match each other, it is determined that the 'Program 1' has not been forged/altered, and the verification result may be transmitted to the electronic terminal device 110 . On the other hand, when both hash values do not match, the executable file of 'Program 1' can be viewed as being modified in the electronic terminal device 110, so that the node device 1 101 has both hash values coincide with each other. When it is confirmed that not, it is determined that the 'Program 1' has been forged/altered, and the verification result may be transmitted to the electronic terminal device 110 .

In this way, each of the K first node devices obtains the first unique identifier from the blockchain data stored in each of the K first node devices in response to the forgery/falsification verification request of the first program. By extracting the second hash value for the executable file of the first program recorded on the block chain data based on the basis, and comparing whether the second hash value and the first hash value match each other, the first program As the verification result for forgery/falsification of The unit 116 checks the ratio of the node devices that transmit the verification result determined that the first program has not been forged/altered among the K first node devices.

Then, the execution unit 117 checks whether the ratio exceeds a preset reference ratio, and when it is confirmed that the ratio exceeds the reference ratio, the first program is executed.

For example, it is assumed that the K first node devices are node device 1 101 and node device 2 102 , the reference ratio is '60%', and node device 1 101 and node device 2 102 . When it is said that the verification result determined that the first program has not been forged/falsified has been received by the electronic terminal device 110 from all of them, the ratio check unit 116 determines that the first program has not been forged/falsified. It can be confirmed that the ratio of the node device that has transmitted the verification result is 100%, and since it exceeds the reference ratio of 60%, the execution unit 117 finally confirms that the first program is a safe program that is not forged / tampered with Thus, the first program may be executed in the electronic terminal device 110 .

According to an embodiment of the present invention, the electronic terminal device 110 may further include a log transmission unit 124 .

When the execution unit 117 completes the execution of the first program, the log transmission unit 124 provides device identification information of the electronic terminal device 110, information on the time at which the first program is executed, and the first unique information. A log management server having a program execution history database confirms information on the identifier, and displays device identification information of the electronic terminal device 110 , information on the execution time of the first program, and information on the first unique identifier (131).

At this time, the log management server 131 receives from the electronic terminal device 110 device identification information of the electronic terminal device 110 , information on the time when the first program is executed, and information on the first unique identifier. , storing the device identification information of the electronic terminal device 110 , information on the execution time of the first program, and information on the first unique identifier in the program execution history database provided in the log management server 131 . do.

That is, in the present invention, whenever a predetermined program is executed in the electronic terminal device 110, log information is stored in the program execution history database of the log management server 131, so that the electronic terminal device ( 110), it can be supported so that the administrator can easily check the program execution history.

So far, when the user 130 executes the first program, which is one of a plurality of programs designated to be included in the white list, in the electronic terminal device 110, forgery/falsification verification of the first program is performed. After that, the configuration for executing the first program has been described.

However, since the user 130 may newly install a new program other than one of a plurality of programs designated to be included in the white list in the electronic terminal device 110, one embodiment of the present invention The electronic terminal device 110 according to an example is configured to newly register information on the second program to the white list when an installation event for installing a second program not included in the plurality of programs occurs. may further include.

In this regard, according to an embodiment of the present invention, the electronic terminal device 110 may further include a message display unit 125 , a registration information generation unit 126 , a registration request unit 127 , and an identifier recording unit 128 . can

When a command for installing a second program, which is a new program not included in the plurality of programs, is applied from the user 130 to the electronic terminal device 110 , the message display unit 125 displays the message in the electronic terminal device 110 . When an installation event for installing the second program occurs, a query message asking whether to register the second program on the white list is displayed on the screen.

The registration information generating unit 126 receives a registration request command to include the second program in the white list from the user 130 of the electronic terminal device 110 in response to the inquiry message, and the second program Generates a second unique identifier that is a unique identifier corresponding to , extracts a second executable file that is an executable file of the second program from the second program, and uses the hash function 3 Generate a hash value.

In this way, when the second unique identifier and the second hash value are generated, the registration requesting unit 127 transmits the second unique identifier and the third hash value to the registration management server 132 and simultaneously transmits the second Sends a registration request for the program to be included in the white list.

When the registration request is transmitted to the registration management server 132, the identifier recorder 128 performs an installation process for installing the second program in the electronic terminal device 110, and sets the second unique identifier to the identifier table. record in

At this time, when the registration request is received at the same time that the second unique identifier and the third hash value are received from the electronic terminal device 110 , the registration management server 132 uses the second unique identifier and the third hash value as the second unique identifier and the third hash value. A configured first transaction is generated, and a registration request of the first transaction and the first transaction to the blockchain network is transmitted to a second node device that is any one of the plurality of node devices.

At this time, the second node device receives the first transaction and the registration request to the blockchain network of the first transaction from the registration management server 132, the block chain data stored in the second node device A second block including the first transaction is generated based on a chain, the second block is chained to the block chain data, and the second block is connected to a plurality of node devices 101 through the block chain network. 102 and 103), propagating to the remaining node devices except for the second node device.

Through this, the second unique identifier and the third hash value for the second program are distributed and stored in the plurality of node devices 101, 102, 103, so that the second program can be registered on the white list. If the second program is later executed in the electronic terminal device 110 , the above-described forgery/falsification verification process of the program may be performed.

According to an embodiment of the present invention, the electronic terminal device 110 transmits the white list synchronization request to any one node device among the plurality of node devices 101, 102, 103 at a predetermined synchronization cycle interval. can At this time, when the request for synchronization of the white list is received from the electronic terminal device 110, the one node device extracts unique identifiers and hash values of all programs registered in the white list stored in the block chain data, It can be transmitted to the electronic terminal device 110, and when the unique identifiers and hash values of all programs are received from the one node device, the electronic terminal device 110 transmits the unique identifiers and hash values of all the received programs to the electronic terminal. It may be stored as a white list in the storage inside the device 110 .

Through this, even in an offline situation in which the electronic terminal device 110 cannot connect to the plurality of node devices 101, 102, 103 due to a network error, etc., based on the white list stored in the internal storage, the electronic terminal device Forgery/falsification verification for the program executed in 110 may be performed.

2 is a diagram of a plurality of node devices forming a block chain network according to an embodiment of the present invention (the plurality of node devices are a unique identifier of a program pre-designated to be included in a white list and an executable file of the program It is a flowchart illustrating an operation method of an electronic terminal device that performs forgery/falsification verification of a program in conjunction with blocks including transactions composed of hash values (which store block chain data connected by a chain).

In step S210, a function storage unit in which a hash function previously shared with the plurality of node devices is stored for forgery/falsification verification of the program is maintained.

In step S220, a table storage unit in which an identifier table in which unique identifiers corresponding to a plurality of programs installed in the electronic terminal device (the plurality of programs are programs included in the white list) is recorded is stored. keep

In step S230, when an execution event for executing a first program among the plurality of programs occurs in the electronic terminal device, a first unique identifier that is a unique identifier corresponding to the first program is obtained by referring to the identifier table. After checking and extracting a first executable file that is an executable file of the first program from the first program, a first hash value that is a hash value of the first executable file is generated using the hash function.

In step S240, K (K is a natural number greater than or equal to 2) number of first node devices among the plurality of node devices is selected as node devices for performing forgery/tampering verification of the first program.

In step S250, when the K first node devices are selected, the first unique identifier and the first hash value are transmitted to the K first node devices, and at the same time, forgery/falsification verification of the first program to request

In step S260, each of the K first node devices responds to the forgery/falsification verification request of the first program, and receives the first data from the block chain data stored in each of the K first node devices. By extracting a second hash value for the executable file of the first program recorded on the block chain data based on a unique identifier and comparing whether the second hash value and the first hash value match each other, the second hash value is As the verification result of whether one program is forged/altered is generated, when verification results are received from each of the K first node devices, the K first node devices Among them, the ratio of the node devices that transmitted the verification result determined that the first program has not been forged/altered is checked.

In step S270, it is checked whether the ratio exceeds a preset reference ratio, and when it is confirmed that the ratio exceeds the reference ratio, the first program is executed.

At this time, according to an embodiment of the present invention, each of the K first node devices receives the first unique identifier and the first hash value from the electronic terminal device and simultaneously verifies forgery/falsification of the first program When a request is received, the first block in which the first unique identifier is recorded is retrieved from the block chain data stored in each of the K first node devices, and the first block is written from the first block into the first block After extracting the second hash value, it is checked whether the second hash value and the first hash value match each other, and when it is confirmed that the second hash value and the first hash value match each other, If it is determined that the first program has not been forged/tampered, and it is determined that the second hash value and the first hash value do not match each other, after determining that the first program has been forged/tampered, the first A verification result according to the determination of whether the program is forged/falsified is transmitted to the electronic terminal device.

In addition, according to an embodiment of the present invention, each of the plurality of node devices is set to perform a virus scan at a preset first cycle interval and is configured to simultaneously store virus detection history information according to the virus scan, In addition, it may be configured to measure a traffic level generated in each of the plurality of node devices at a preset second cycle interval to store information on the measured traffic level.

In this case, in step S240, each of the plurality of node devices is connected to the plurality of node devices and each of the plurality of node devices is pre-designated based on the information on the virus detection history and traffic values stored in each of the plurality of node devices. Checking the total number of virus detections for the period from the past time point to the present time point, calculating an average value of the traffic figure for the period of each of the plurality of node devices, for each of the plurality of node devices , the first numerical value is calculated by applying a value obtained by dividing the total number of virus detections by the preset reference number of virus detections as an input to the hyperbolic tangent function, and dividing the average value of the traffic numerical value by the preset reference traffic numerical value calculating the first numerical value and the second numerical value corresponding to each of the plurality of node devices by applying a second numerical value to the hyperbolic tangent function as an input, each of the plurality of node devices measuring the current CPU usage rate and memory usage rate of , generating a two-dimensional row vector corresponding to each of the plurality of node devices by constructing a two-dimensional row vector having the current CPU usage rate and memory usage rate as components, for each of the plurality of node devices , generating a node matrix having a size of 2 x 2 corresponding to each of the plurality of node devices by multiplying the column vector and the row vector corresponding to each node device, and in each of the plurality of node devices When the node matrix having a corresponding size of 2 x 2 is generated, the Euclidean norm of the node matrix corresponding to each of the plurality of node devices is calculated, and the Euclidean norm of the node matrix among the plurality of node devices is The K first nodes to perform forgery/falsification verification of the first program in the order of calculation in the smallest number may include selecting devices.

In addition, according to an embodiment of the present invention, in the method of operating the electronic terminal device, when the execution of the first program is completed, device identification information of the electronic terminal device, information on the time when the first program is executed, and Check information on the first unique identifier, and log device identification information of the electronic terminal device, information on the execution time of the first program, and information on the first unique identifier in a program execution history database It may further include the step of transmitting to the management server.

In this case, when the log management server receives the device identification information of the electronic terminal device, the information on the execution time of the first program, and the information on the first unique identifier from the electronic terminal device, the Device identification information, information on a time when the first program is executed, and information on the first unique identifier may be stored in the program execution history database provided in the log management server.

In addition, according to another embodiment of the present invention, the method of operating the electronic terminal device includes a method for installing a second program (the second program is a program not included in the plurality of programs) in the electronic terminal device. When an installation event occurs, displaying a query message for inquiring whether to register the second program on the white list on a screen; When a registration request command to be included in the white list is applied, a second unique identifier that is a unique identifier corresponding to the second program is generated, and a second executable file that is an executable file of the second program in the second program generating a third hash value that is a hash value for the second executable file using the hash function after extracting the transmitting a registration request for a program to be included in the white list, and when the registration request is transmitted to the registration management server, performing an installation process for installing the second program in the electronic terminal device; The method may further include recording a unique identifier in the identifier table.

In this case, when the registration request is received at the same time as the second unique identifier and the third hash value are received from the electronic terminal device, the registration management server performs a first transaction composed of the second unique identifier and the third hash value. and transmit the first transaction and a registration request to the blockchain network of the first transaction to a second node device that is any one of the plurality of node devices.

And, when the registration request to the blockchain network of the first transaction and the first transaction is received from the registration management server, the second node device is based on the blockchain data stored in the second node device. generating a second block including the first transaction, chaining the second block to the block chain data, and then connecting the second block to the second block among the plurality of node devices through the block chain network It can propagate to other node devices except for the node device.

In the above, an operation method of an electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention has been described with reference to FIG. 2 . Here, the operating method of the electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention is based on the operation of the electronic terminal device 110 for performing forgery/falsification verification of the program described with reference to FIG. 1 . Since it may correspond to the configuration for , a more detailed description thereof will be omitted.

The method of operating an electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention may be implemented as a computer program stored in a storage medium for execution through combination with a computer.

In addition, the method of operating an electronic terminal device for performing forgery/falsification verification of a program according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. . The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, in the present invention, specific matters such as specific components, etc., and limited embodiments and drawings have been described, but these are only provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , various modifications and variations are possible from these descriptions by those of ordinary skill in the art to which the present invention pertains.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and not only the claims to be described later, but also all those with equivalent or equivalent modifications to the claims will be said to belong to the scope of the spirit of the present invention. .

110: Electronic terminal device for performing forgery / falsification verification of the program
111: function storage unit 112: table storage unit
113: identification information generation unit 114: node selection unit
115: verification request unit 116: ratio verification unit
117: execution unit 118: information confirmation unit
119: numerical calculation unit 120: state measurement unit
121: vector generator 122: node matrix generator
123: selection unit 124: log transmission unit
125: message display unit 126: registration information generation unit
127: registration request unit 128: identifier record unit
100: Blockchain Network
101, 102, 103: a plurality of node devices
130: user
131: log management server
132: registration management server

Claims (12)

A plurality of node devices forming a blockchain network - The plurality of node devices is a block chain containing a transaction consisting of a unique identifier of a program pre-designated to be included in a white list and a hash value of the program's executable file. In an electronic terminal device that performs forgery/falsification verification of a program in conjunction with -
a function storage unit in which a hash function pre-shared with the plurality of node devices is stored for forgery/falsification verification of the program;
a table storage unit storing an identifier table in which unique identifiers corresponding to a plurality of programs installed in the electronic terminal device are programs included in the white list;
When an execution event for executing a first program among the plurality of programs occurs in the electronic terminal device, a first unique identifier that is a unique identifier corresponding to the first program is identified by referring to the identifier table, and the first unique identifier is identified by referring to the identifier table. an identification information generating unit that extracts a first executable file that is an executable file of the first program from one program and generates a first hash value that is a hash value of the first executable file by using the hash function;
a node selection unit that selects K (K is a natural number greater than or equal to 2) first node devices from among the plurality of node devices as node devices for performing forgery/tamper verification of the first program;
When the K first node devices are selected, a verification request for transmitting the first unique identifier and the first hash value to the K first node devices and simultaneously requesting forgery/falsification verification of the first program wealth;
Based on the first unique identifier from the block chain data stored in each of the K first node devices, each of the K first node devices corresponds to the forgery/falsification verification request of the first program. After extracting the second hash value for the executable file of the first program recorded on the block chain data, by comparing whether the second hash value and the first hash value match each other, As a result of verification of whether or not modulation is generated, a verification result of whether or not the first program is forged/modulated is received from each of the K first node devices, and the first of the K first node devices a rate checking unit that checks the ratio of the node devices that have transmitted the verification result determined that the program is not forged/falsified;
an execution unit that checks whether the ratio exceeds a preset reference ratio, and executes the first program when it is determined that the ratio exceeds the reference ratio;
When an installation event for installing a second program - the second program is a program not included in the plurality of programs - occurs in the electronic terminal device, whether to register the second program in the white list a message display unit for displaying a query message to be inquired on the screen;
In response to the inquiry message, when a registration request command for including the second program to be included in the white list is applied from the user of the electronic terminal device, a second unique identifier that is a unique identifier corresponding to the second program is generated; , a registration information generator for extracting a second executable file that is an executable file of the second program from the second program and then generates a third hash value that is a hash value for the second executable file by using the hash function;
a registration request unit that transmits the second unique identifier and the third hash value to a registration management server and simultaneously transmits a registration request for the second program to be included in the white list; and
When the registration request is transmitted to the registration management server, an identifier recording unit that performs an installation process for installing the second program in the electronic terminal device, and records the second unique identifier in the identifier table
including,
The registration management server
When the registration request is received at the same time that the second unique identifier and the third hash value are received from the electronic terminal device, a first transaction composed of the second unique identifier and the third hash value is generated, and the plurality of sending the first transaction and the registration request to the blockchain network of the first transaction to a second node device that is a node device of any one of the node devices;
The second node device
When a registration request to the blockchain network of the first transaction and the first transaction is received from the registration management server, a first transaction including the first transaction based on the blockchain data stored in the second node device After generating 2 blocks, and linking the second block to the block chain data in a chain, the second block is connected to the other node devices except for the second node device among the plurality of node devices through the block chain network. An electronic terminal device for performing forgery / falsification verification of a program, characterized in that it propagates to According to claim 1,
Each of the K first node devices is
When the first unique identifier and the first hash value are received from the electronic terminal device and at the same time the forgery/falsification verification request of the first program is received, the block chain stored in each of the K first node devices After searching for a first block in which the first unique identifier is recorded from data, and extracting the second hash value recorded in the first block from the first block, the second hash value and the first hash When it is confirmed that the second hash value and the first hash value match each other by checking whether the values match each other, it is determined that the first program has not been forged/altered, and the second hash value and the When it is determined that the first hash values do not match each other, it is determined that the first program has been forged/falsified, and then a verification result according to the determination of whether the first program is forged/falsified is transmitted to the electronic terminal device Electronic terminal device for performing forgery / falsification verification of the program, characterized in that. According to claim 1,
Each of the plurality of node devices is
It is set to perform a virus scan at a preset first cycle interval and is configured to store virus detection history information according to the virus scan, and occurs in each of the plurality of node devices at a preset second cycle interval is configured to measure the traffic figure and store information about the measured traffic figure,
The node selector
From a predetermined past time point to the present time point of each of the plurality of node devices based on the information on the traffic values and virus detection history information stored in each of the plurality of node devices in connection with the plurality of node devices an information confirmation unit that checks the total number of virus detections for a period of , and calculates an average value of traffic values for the period of each of the plurality of node devices;
For each of the plurality of node devices, a value obtained by dividing the total number of virus detections by a preset reference number of virus detections is applied as an input to hyperbolic tangent functions to calculate a first numerical value, and the traffic value The first numerical value and the second value corresponding to each of the plurality of node devices by applying a value obtained by dividing an average value of ? by a preset reference traffic numerical value as an input to the hyperbolic tangent function to calculate a second numerical value a numerical calculation unit for calculating a numerical value;
a state measuring unit measuring a current CPU usage rate and a memory usage rate of each of the plurality of node devices;
For each of the plurality of node devices, a two-dimensional column vector corresponding to each of the plurality of node devices is obtained by constructing a two-dimensional column vector having the first numerical value and the second numerical value as components. A vector for generating a two-dimensional row vector corresponding to each of the plurality of node devices by generating a two-dimensional row vector having the current CPU usage rate and memory usage rate as components for each of the plurality of node devices generator;
A node generating, for each of the plurality of node devices, a node matrix having a size of 2×2 corresponding to each of the plurality of node devices by multiplying the column vector and the row vector corresponding to each node device matrix generator; and
When the node matrix having a size of 2 x 2 corresponding to each of the plurality of node devices is generated, a Euclidean norm of the node matrix corresponding to each of the plurality of node devices is calculated, and the plurality of A selection unit that selects the K first node devices for performing forgery/modulation verification of the first program in the order in which the Euclidean norm of the node matrix is calculated to be small among the node devices of
An electronic terminal device for performing forgery / falsification verification of a program comprising a. According to claim 1,
When the execution of the first program is completed, device identification information of the electronic terminal device, information on a time when the first program is executed, and information on the first unique identifier are checked, and device identification of the electronic terminal device A log transmission unit for transmitting information, information on the time when the first program was executed, and information on the first unique identifier to a log management server having a program execution history database
further comprising,
The log management server
When the device identification information of the electronic terminal device, the information on the execution time of the first program, and the information on the first unique identifier are received from the electronic terminal device, the device identification information of the electronic terminal device, the first Electronic terminal device for performing forgery/falsification verification of a program, characterized in that the information on the execution time of the program and the information on the first unique identifier are stored in the program execution history database provided in the log management server . delete A plurality of node devices forming a blockchain network - The plurality of node devices is a block chain containing a transaction consisting of a unique identifier of a program pre-designated to be included in a white list and a hash value of the program's executable file. In the method of operating an electronic terminal device for performing forgery/falsification verification of a program in conjunction with -
maintaining a function storage unit in which a hash function previously shared with the plurality of node devices is stored for forgery/falsification verification of the program;
maintaining a table storage unit storing an identifier table in which unique identifiers corresponding to a plurality of programs installed in the electronic terminal device are programs included in the white list;
When an execution event for executing a first program among the plurality of programs occurs in the electronic terminal device, a first unique identifier that is a unique identifier corresponding to the first program is identified by referring to the identifier table, and the first unique identifier is identified by referring to the identifier table. generating a first hash value that is a hash value for the first executable file by using the hash function after extracting a first executable file that is an executable file of the first program from one program;
selecting K (K is a natural number greater than or equal to 2) first node devices among the plurality of node devices as node devices for performing forgery/tampering verification of the first program;
when the K first node devices are selected, transmitting the first unique identifier and the first hash value to the K first node devices and simultaneously requesting forgery/falsification verification of the first program;
Based on the first unique identifier from the block chain data stored in each of the K first node devices, each of the K first node devices corresponds to the forgery/falsification verification request of the first program. After extracting the second hash value for the executable file of the first program recorded on the block chain data, by comparing whether the second hash value and the first hash value match each other, As a result of verification of whether or not modulation is generated, a verification result of whether or not the first program is forged/modulated is received from each of the K first node devices, and the first of the K first node devices checking the proportion of node devices that have transmitted the verification result determined that the program is not forged/altered;
checking whether the ratio exceeds a preset reference ratio, and when it is determined that the ratio exceeds the reference ratio, executing the first program;
When an installation event for installing a second program - the second program is a program not included in the plurality of programs - occurs in the electronic terminal device, whether to register the second program in the white list displaying a query message to inquire on a screen;
In response to the inquiry message, when a registration request command for including the second program to be included in the white list is applied from the user of the electronic terminal device, a second unique identifier that is a unique identifier corresponding to the second program is generated; , extracting a second executable file that is an executable file of the second program from the second program and then generating a third hash value that is a hash value for the second executable file by using the hash function;
transmitting the second unique identifier and the third hash value to a registration management server and simultaneously transmitting a registration request for including the second program in the white list; and
When the registration request is transmitted to the registration management server, performing an installation process for installing the second program in the electronic terminal device, and recording the second unique identifier in the identifier table;
including,
The registration management server
When the registration request is received at the same time as the second unique identifier and the third hash value are received from the electronic terminal device, a first transaction composed of the second unique identifier and the third hash value is generated, and the plurality of sending the first transaction and the registration request to the blockchain network of the first transaction to a second node device that is a node device of any one of the node devices;
The second node device
When a registration request to the blockchain network of the first transaction and the first transaction is received from the registration management server, the first transaction including the first transaction based on the blockchain data stored in the second node device After generating 2 blocks, and linking the second block to the block chain data in a chain, the second block is connected to the other node devices except for the second node device among the plurality of node devices through the block chain network. A method of operating an electronic terminal device for performing forgery/falsification verification of a program, characterized in that it propagates to 7. The method of claim 6,
Each of the K first node devices is
When the first unique identifier and the first hash value are received from the electronic terminal device and at the same time the forgery/falsification verification request of the first program is received, the block chain stored in each of the K first node devices After searching for a first block in which the first unique identifier is recorded from data, and extracting the second hash value recorded in the first block from the first block, the second hash value and the first hash When it is confirmed that the second hash value and the first hash value match each other by checking whether the values match each other, it is determined that the first program has not been forged/altered, and the second hash value and the When it is determined that the first hash values do not match each other, it is determined that the first program has been forged/falsified, and then a verification result according to the determination of whether the first program is forged/falsified is transmitted to the electronic terminal device An operating method of an electronic terminal device for performing forgery/falsification verification of a program, characterized in that. 7. The method of claim 6,
Each of the plurality of node devices is
It is set to perform a virus scan at a preset first cycle interval and is configured to store virus detection history information according to the virus scan, and occurs in each of the plurality of node devices at a preset second cycle interval is configured to measure the traffic figure and store information about the measured traffic figure,
The selecting step
From a predetermined past time point to the present time point of each of the plurality of node devices based on the information on the traffic values and virus detection history information stored in each of the plurality of node devices in connection with the plurality of node devices checking a total number of virus detections for a period of , and calculating an average value of traffic values for each of the plurality of node devices during the period;
For each of the plurality of node devices, a value obtained by dividing the total number of virus detections by a preset reference number of virus detections is applied as an input to hyperbolic tangent functions to calculate a first numerical value, and the traffic value The first numerical value and the second value corresponding to each of the plurality of node devices by applying a value obtained by dividing an average value of ? by a preset reference traffic numerical value as an input to the hyperbolic tangent function to calculate a second numerical value calculating a numerical value;
measuring a current CPU usage rate and a memory usage rate of each of the plurality of node devices;
For each of the plurality of node devices, a two-dimensional column vector corresponding to each of the plurality of node devices is obtained by constructing a two-dimensional column vector having the first numerical value and the second numerical value as components. generating, for each of the plurality of node devices, constructing a two-dimensional row vector having the current CPU usage rate and memory usage rate as components, thereby generating a two-dimensional row vector corresponding to each of the plurality of node devices; ;
generating, for each of the plurality of node devices, a node matrix having a size of 2×2 corresponding to each of the plurality of node devices by multiplying the column vector and the row vector corresponding to each node device ; and
When the node matrix having a size of 2 x 2 corresponding to each of the plurality of node devices is generated, a Euclidean norm of the node matrix corresponding to each of the plurality of node devices is calculated, and the plurality of selecting the K first node devices for performing forgery/modulation verification of the first program in the order in which the Euclidean norm of the node matrix is calculated to be smaller among the node devices of ;
An operating method of an electronic terminal device for performing forgery/falsification verification of a program comprising a. 7. The method of claim 6,
When the execution of the first program is completed, device identification information of the electronic terminal device, information on a time when the first program is executed, and information on the first unique identifier are checked, and device identification of the electronic terminal device Transmitting information, information on the execution time of the first program, and information on the first unique identifier to a log management server having a program execution history database
further comprising,
The log management server
When the device identification information of the electronic terminal device, the information on the execution time of the first program, and the information on the first unique identifier are received from the electronic terminal device, the device identification information of the electronic terminal device, the first Electronic terminal device for performing forgery/falsification verification of a program, characterized in that the information on the execution time of the program and the information on the first unique identifier are stored in the program execution history database provided in the log management server how it works. delete A computer-readable recording medium recording a computer program for executing the method of any one of claims 6, 7, 8, or 9 through combination with a computer. A computer program stored in a storage medium for executing the method of any one of claims 6, 7, 8 or 9 in combination with a computer.

Images