KR102433435B1 - Method and apparatus for restoring disk in pear to pear for restoring damage from ransomware - Google Patents

Abstract

Disclosed are a peer-to-peer (P2P) disk restoration method and apparatus for restoring a damaged device by cloning the contents of a disk of the same type of device that is not infected with ransomware in an Internet of Things or industrial control system environment. A P2P disk restoration method for restoration of an infected disk executed by a restoration management server connected to a network, the method comprising: activating a first restoration device connected to a first IoT device infected with ransomware or malware in a network; 1 Receiving a search request for a second IoT device of the same type as the first IoT device from the restoration device, searching for a second IoT device in the network based on device information on the first IoT device included in the discovery request, and and transmitting the restoration request of the first IoT device to a second restoration device connected to the previously discovered second IoT device.

Description

P2P disk restoration method and device for restoring ransomware damage

The present invention relates to a method of restoring ransomware damage using a peer-to-peer (P2P) disk restoration, and more particularly, to an Internet of things (IoT) or an industry control system, It relates to a P2P disk restoration method and apparatus for restoring a damaged device by duplicating the contents of the disk of the same type of device that is not infected with ransomware in the ICS) environment.

'Ransomware', a type of malware that forcibly locks computer systems or encrypts files and requires payment to unlock or decrypt files, damages not only individual users but also businesses, industrial facilities, or infrastructure. is giving Accordingly, various studies on how to detect ransomware and how to restore ransomware damage are emerging.

However, since most existing studies require the use of a specific disk such as a solid state drive (SSD) or restore damage through backup, it is applied in an industrial control system environment such as an Internet of Things environment or a smart factory. The downside is that it is difficult to do.

Laid-open Patent Publication No. 10-2017-0121911 (2017.11.03) Laid-open Patent Publication No. 10-2019-0140314 (2019.12.19)

The present invention was derived to solve the problems of the prior art, and an object of the present invention is when one or more Internet of Things (IoT) devices are infected with ransomware in an industrial control system environment such as the Internet of Things or a smart factory. An object of the present invention is to provide a P2P (pear to pear) disk restoration method and apparatus for restoring ransomware damage, which can restore the disk of an infected device using other homogeneous devices that are not infected with .

Another object of the present invention is to provide a P2P disk restoration method and apparatus for restoring ransomware damage, which can restore system software or essential applications required to maintain the operation of a device in the Internet of Things or a smart factory.

A P2P (pear to pear) disk restoration method for restoring ransomware damage according to an aspect of the present invention for solving the above technical problem is executed by a restoration management server connected to a network, infected by ransomware or malware A P2P (pear to pear) disk restoration method for disk restoration, comprising: activating a first restoration device connected to a first Internet of Thing (IoT) device infected with ransomware or malware in a network; receiving a search request for a second IoT device of the same type as the first IoT device from the first restoration device; discovering the second IoT device in the network based on device information on the first IoT device included in the discovery request; and transmitting the restoration request of the first IoT device to a second restoration device connected to the discovered second IoT device.

In an embodiment, by controlling the operation of the second restoration device, the second IoT device copies the chunk or firmware stored in its primary storage device and overwrites it in real time on the primary storage device of the first IoT device.

In one embodiment, the P2P disk restoration method includes terminating the operations of the first restoration device and the second restoration device when a normal state of the first IoT device is detected by restoration of the primary storage device in the network. further includes

The P2P disk restoration method for restoring ransomware damage according to another aspect of the present invention for solving the above technical problem is a P2P disk restoration method for restoration of a disk infected by ransomware or malware, which is executed by a restoration device connected to a network. (pear to pear) disk restoration method, which is connected to a first internet of thing (IoT) device infected with ransomware or malware in a network and receives a first control signal for activation from a restoration management server connected to the network to do; transmitting a search request for a second IoT device of the same type as the first IoT device to the restoration management server in response to the first control signal; functioning as system software of the first IoT device in response to the first control signal; Overwriting of the main storage device of the first IoT device from the second IoT device discovered by the restoration management server connected to the network based on device information on the first IoT device included in the discovery request allowing; and rebooting the first IoT device when the overwriting is completed.

In one embodiment, the P2P disk restoration method includes performing the original function of the first IoT device until the reboot of the first IoT device is completed by a self-stored function maintenance program in response to the first control signal. include more

In an embodiment, when the second restoration device connected to the second IoT device is activated in response to a second control signal from the restoration management server, and for the overwrite operation, the main storage device of the second IoT device When the contents of is modified, the operation of the specific function of the second IoT device may be temporarily stopped during the overwrite operation time.

In one embodiment, when the data part content of the first IoT device is modified in the normal operating state of the first IoT device by the self-stored data log program, the restoration device records the contents of the corresponding modification operation as a log separately. It is stored in its own storage space, and after the overwriting is completed, the data of the first IoT device may be recovered based on the log stored in the storage space.

A P2P disk restoration apparatus for restoring ransomware damage according to another aspect of the present invention for solving the above technical problem includes a restoration management server connected to a network and a restoration device, the first infected by ransomware or malware It is a P2P (pear to pear) disk restoration device for restoration of a main storage device of an IoT (internet of thing) device. Here, the restoration device receives a first control signal from the restoration management server, and transmits a search request for a second IoT device of the same type as the first IoT device to the restoration management server in response to the first control signal and a second IoT that functions as system software of the first IoT device in response to the first control signal, and is discovered by the restoration management server based on device information on the first IoT device included in the discovery request. a restoration program that allows overwriting of the main storage device of the first IoT device from a device and reboots the first IoT device when the overwriting is completed; and a remote power supply for activating the restoration device by supplying power to the restoration device based on the first control signal or a separate trigger signal or activation signal.

In one embodiment, the P2P disk restoration device further includes a function maintenance program for performing the original function of the first IoT device until the restoration or the rebooting of the first IoT device is completed in response to the first control signal do.

In an embodiment, the P2P disk restoration apparatus stores the contents of the corresponding modification operation as a log when the contents of the data part of the first IoT device are modified in the normal operating state of the first IoT device, and a data log program for recovering data of the first IoT device based on the log stored in advance after completion; and a storage space for storing a log designated by the data log program.

A P2P disk restoration apparatus for restoring ransomware damage according to another aspect of the present invention for solving the above technical problem is a disk infected by ransomware or malware, including a restoration management server and a restoration device connected to a network. It is a P2P (pear to pear) disk restoration device for restoration. Here, the restoration management server may include: a control signal generator configured to generate a first control signal to be transmitted to the first restoration device connected to the first IoT device according to the detection of ransomware or malware damage of the first IoT device in the network; a message processing unit receiving a search request for a second IoT device of the same type as the first IoT device from the first restoration device, and extracting device information of the first IoT device included in the discovery request; and a search unit configured to search for the second IoT device in the network based on device information of the first IoT device.

In an embodiment, the P2P disk restoration apparatus further includes a sensing unit for detecting ransomware or malware damage of the first IoT device in the network. The output signal generated by the sensing unit is transmitted to the control signal generating unit.

In an embodiment, when the normal state of the first IoT device on the network is sensed by the sensing unit according to the restoration of the main storage device of the first IoT device, the control signal generating unit is the first according to the signal of the sensing unit. A control signal or an operation end signal for terminating the operation of the restoration device and the second restoration device may be generated.

In the case of using the P2P (pear to pear) disk restoration method and device for restoring the ransomware damage described above, the Internet of thing (IoT) device or industrial control due to ransomware or malware When the system's disk contents are damaged, the disk of the infected device can be effectively restored by copying the disk contents of other devices of the same type that are actually working.

In addition, according to the present invention, when the operation of the device serving as the source of restoration modifies the disk contents of the ransomware victim device, the operation of the device serving as the source of the restoration is temporarily stopped, thereby preventing overwriting Ransomware damage using the restoration device of the device as the source of the restoration by preventing the contents of the source of the restoration from being changed while it is being performed (that is, preventing the restoration operation of the device as the source from modifying its own disk contents) You can restore your device's disks reliably and quickly.

In addition, according to the present invention, when the operation of the device serving as the restoration source is stopped, the essential program existing in the restoration device is executed to continuously perform the function to be performed by the restoration target device even in the disk restoration process of the restoration target device. has the effect of making it possible.

Also, according to the present invention, it is possible to effectively restore a specific data portion of the restoration target device through the data log of the restoration device connected to the restoration target device infected with ramsomware or malware.

In addition, according to the present invention, when the restoration target device is infected with ransomware or malware, the software system in the infected disk of the restoration target device is restored using the restoration device coupled to the restoration target device, and the corresponding device in the Internet of Things and Smart Factory. It has the effect of maintaining essential functions required as IoT devices or industrial control system devices.

1 is a block diagram for explaining the macroscopic IoT environment configuration of a system (hereinafter briefly referred to as 'disk restoration device) for implementing a P2P (pear to pear) disk restoration method for ransomware damage restoration according to an embodiment of the present invention. .
FIG. 2 is a block diagram illustrating an environment configuration of an IoT device that can be employed in the disk restoration apparatus of FIG. 1 .
3 is a diagram illustrating an IoT device and a restoration device of FIG. 2 .
4 is a schematic block diagram of the configuration of the IoT device and the restoration device of FIG. 3 .
5 and 6 are configuration diagrams for explaining the operating principle of the disk restoration apparatus according to another embodiment of the present invention.
7A and 7B are flowcharts for explaining the operating principle of the disk restoration apparatus of FIG. 5 .
8 is a block diagram showing another first configuration that can be employed in the restoration apparatus of the disk restoration apparatus of FIG. 5 .
9 is a block diagram showing another second configuration that can be employed in the restoration apparatus of the disk restoration apparatus of FIG. 5 .
FIG. 10 is a block diagram showing another third configuration that can be employed in the restoration apparatus of the disk restoration apparatus of FIG. 5 .
11 is a block diagram showing a configuration employable in the restoration management server of the disk restoration apparatus of FIG. 5 .

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being “connected” or “connected” to another component, it may be directly connected or connected to the other component, but it is understood that other components may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It is to be understood that this does not preclude the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate the overall understanding, the same reference numerals are used for the same components in the drawings, and duplicate descriptions of the same components are omitted.

Prior to the detailed description of this embodiment, if an Internet of thing (IoT) or an industrial control system (ICS) environment is defined, the Internet of Things or an industrial control system environment is an environment in which several identical devices are used. , refers to an environment that can make the device operate normally only by restoring system software or essential applications.

In addition, the term 'IoT device' refers to a physical device that receives and transmits signals or data on a wired or wireless network without manual operation. It may include a device, a motion controller of a robotic arm, and the like. In addition, the term 'disk' may be used interchangeably with the main storage device.

1 is a block diagram for explaining the macroscopic IoT environment configuration of a system (hereinafter briefly referred to as 'disk restoration device) for implementing a P2P (pear to pear) disk restoration method for ransomware damage restoration according to an embodiment of the present invention. . FIG. 2 is a block diagram illustrating an environment configuration of an IoT device that can be employed in the disk restoration apparatus of FIG. 1 .

Referring to FIG. 1 , the disk restoration apparatus according to the present embodiment includes a plurality of IoT devices 10 to 13 and 20 to 23 and a restoration management server 100 . The disk restoration device is an IoT device that has been damaged by ramsomware or malware through the restoration management server 100 connected to the IoT devices 10 to 13 and 20 to 23 in an environment in which a plurality of IoT devices including the same type of device exist. Performs disk restoration management.

The IoT device 10 according to the present embodiment includes a primary storage device 11 as shown in FIG. 2 . The main storage device 11 stores system software 12 and data 13 . In this embodiment, one IoT device 10 is connected to one restoration device 15 or is configured to include one restoration device 15 . The restoration device 15 is equipped with a restoration program 16 . The restoration program 16 includes a function of emergency system software to restore the disk of the IoT device 10 infected with ransomware or malware.

The IoT device 10 and the restoration device 15 may send and receive signals to and from the restoration management server 100 through a network including wired communication or wireless communication. In the present embodiment, the restoration device 15 and the restoration management server 100 operate to restore the disk of the IoT device 10 infected with ransomware or malware or to maintain its functions during restoration.

In more detail, the restoration management server 100 serves as an intermediary for P2P (pear to pear) restoration between IoT devices. The restoration management server 100 may end the use of the IoT device in the P2P restoration process, control the operation of the restoration device 15 , and manage the operation of booting the IoT device 10 through the restoration program 16 . have. That is, the restoration management server 100 may manage the termination and rebooting of the IoT device 10 and the operation of the restoration device 15 .

According to the present embodiment, the restoration management server 100 controls the IoT devices necessary for the P2P restoration process, but the actual P2P restoration is performed between the corresponding IoT devices. Compared to the basic method of having and distributing a server directly, it has the advantage of reducing the load on the restoration management server.

3 is a diagram illustrating an IoT device and a restoration device of FIG. 2 . 4 is a schematic block diagram of the configuration of the IoT device and the restoration device of FIG. 3 .

Referring to FIG. 3 , the disk restoration apparatus according to the present embodiment includes an IoT device 10 , a restoration device 15 , and their connection means 14 . The IoT device 10 may be implemented as a MinnowBoard Turbot, and in a modified example thereof, may be implemented as a device including means or components performing the same or similar functions as the MinnowBoard Turbot.

In addition, the restoration device 15 may be implemented using a Raspberry pi zero, and may also be implemented as a device including a means or a component for performing the same or similar function as the Raspberry pi zero.

The IoT device 10 and the restoration device 15 may be connected by a universal serial bus (USB), but the connection means 14 is not limited to USB, and among other connection methods of various wired networks, Any one or more may be selected and used as a means or a component that implements any one or more of the existing wireless network connection methods.

The IoT device 10 may use a secure digital card (SD) as a primary storage device, and an Ubuntu server may be used as the system software. Here, the IoT device 10 includes an industrial control system device for a smart factory or the like.

It is assumed that a plurality of pairs of the above-described IoT device 10 and the restoration device 15 exist in an IoT environment or an industrial control system environment, and each of the IoT device 10 and the restoration device 15 is another such as USB. It may be connected to the restoration management server through a connection means.

In the aforementioned disk restoration environment, when the IoT device 10 is infected with a virus such as ransomware or malware, the contents stored in the main storage device of the IoT device 10 are encrypted. In particular, when the system software is encrypted, the IoT device 10 becomes unbootable and the use of the IoT device becomes impossible. Therefore, restoration of the IoT device 10 is required.

Restoring the IoT device 10 means enabling the IoT device 10 to perform its function. That is, as shown in FIG. 4 , in order to perform the function of the IoT device 10 , it is essential to restore essential applications in the system software 12 and data 13 .

When the IoT device 10 is infected by ransomware or malware, the restoration management server 100 activates the restoration device 15 and it is impossible to boot through the main storage device 11 of the IoT device 10 . Restoration and booting of the IoT device 10 are performed through the restoration device 15 . The restoration program 16 of the restoration device 15 functions as an emergency restoration program for restoration of the primary storage device 11 .

At this time, the restoration device 15 is provided with a remote power source 17 , and based on this, the restoration management server 100 may operate the restoration device 15 only when restoration of the IoT device 10 is required. That is, the restoration device 15 may be selectively activated through the remote power supply 17 only when it is desired to restore the ransomware damage of the IoT device 10 .

As described above, the system environment that can be employed in the disk restoration apparatus according to the present embodiment is as follows. Homogeneous IoT devices having the same system software, etc. exist in the network to which the restoration management server is connected, and these IoT devices perform a core function of the system, and the function interacts with the restoration management server that exists separately.

And if an IoT device is infected with ransomware, the IoT device becomes unbootable and unusable. In order to restore the IoT device to perform its original function, it is essential to restore the system software of the corresponding IoT device. In order to restore an IoT device infected with ransomware in such an environment, the restoration device of the disk restoration device according to the present embodiment is connected to one corresponding target IoT device, and includes a restoration program for restoring the target IoT device.

The restoration program performs an emergency recovery function for restoration of the primary storage device of the target IoT device. Restoration devices can only be operated when restoration is required via remote power. The restoration device may include a program for maintaining the function of the target IoT device, a log program for data restoration, and an independent storage device.

The restoration management server communicates with the IoT device and the restoration device, respectively, and supports the restoration function. Since IoT devices infected with ransomware cannot be operated, the restoration management server is connected to the IoT devices infected with ransomware and activates the restoration devices equipped with restoration software to operate the infected IoT devices. The restoration device may be physically connected to the IoT device before the ransomware infection. Since the restoration device is installed to access the damaged disk of the infected IoT device, it can operate to copy the disk contents of other uninfected IoT devices and save them to the disk of the infected IoT device. In this way, according to the present embodiment, damage to the infected disk can be restored and correct operation can be resumed.

If the system that modifies the disk contents of the IoT device when the IoT device that is the source of replication is operating, the IoT device that is the source of replication can be shut down and the damage to the infected disk can be restored.

In this case, the restoration device can be used to perform the original functions of IoT devices that should not be disconnected in the Internet of Things and Smart Factory. To this end, the disk restoration apparatus may be implemented to restore data generated by such a program as well as system software or essential applications when restoring ransomware damage using a log and restoration of data.

5 and 6 are configuration diagrams for explaining the operating principle of the disk restoration apparatus according to another embodiment of the present invention. 7A and 7B are flowcharts for explaining the operating principle of the disk restoration apparatus of FIG. 5 .

5 to 7A and 7B , in the disk restoration method according to the present embodiment, the restoration management server 100 detects ransomware damage of the first IoT device 10 by an IoT sensor or a manager input, etc. It can be done (S71). When ransomware damage to the first IoT device 10 occurs, the restoration management server 100 transmits a first trigger signal or a first control signal to the first restoration device connected to the first IoT device 10 . (15a) is operated (S72). The first restoration device 15a may operate the restoration program in response to the first control signal (S72a).

Next, the first restoration device 15a restores and manages the search for the same type of IoT device in full operation without damage from ransomware in the IoT environment or the industrial control system environment through the restoration program 16 in response to the first control signal. A request is made to the server 100 (S73). And the first restoration device 15a performs the function of the system software of the first IoT device 10 through the control module stored in advance in response to the first control signal (see S76c).

Next, the restoration management server 100 discovers whether a specific type of IoT device included in the first request message for discovery of the same type of IoT device exists in the IoT environment or the industrial control system environment, which is the currently connected network (S74). The discovery may be performed by transmitting a preset operation check signal, such as a predetermined ping signal, to IoT devices connected through a network and receiving feedback thereon.

Next, when the second IoT device 20 is discovered as the same type of IoT device in normal operation, the restoration management server 100 controls the second IoT device 20 discovered through the second trigger signal or the second control signal. The restoration device 15b is operated (S75).

At this time, when the operation of the second restoration device 15b is set to change the system software 12 stored in the primary storage device 11 of the second IoT device 20, the second trigger signal or the second control The signal may include a message or a command to first terminate the second IoT device 20 . Of course, in a modified example, the restoration management server 100 first terminates the system software 12 of the second IoT device 20 by transmitting a separate signal or command to stop the operation of the discovered second IoT device 20 . can do it Then, the second IoT device 20 may boot again in the activated state of the second restoration device 15b and operate normally.

Next, the second restoration device 15b transmits a preset third control signal or a command corresponding thereto to the second IoT device 20 in response to the second control signal (S76a) so that the second IoT device 20 is the main It functions to transmit (S76b) the contents stored in the storage device 11 to the first IoT device 10 through a preset network path 30 . At this time, the restoration program of the first restoration device 15a receives the contents of the main storage device 11 of the second IoT device 20 as a control module of the first IoT device 10 , and transmits the received contents to the first It functions to overwrite the main storage device 11 of the IoT device 10 (S76c).

Next, when all the contents of the main storage device 11 of the second IoT device 20 are overwritten on the main storage device 11 of the first IoT device 10 (S77a), the first restoration device 15a is The first IoT device 10 is rebooted (S77b). At this time, the reboot of the first IoT device 10 is booted using the restored main storage device 11 of the first IoT device 10 .

According to the present embodiment, the disk of the first IoT device 10 infected with ransomware can be restored and booted by itself through P2P disk restoration between the second IoT device 20 and the first IoT device 12 .

In addition, the first restoration device 15a may be set to delete a preset partial data part among the restored disk contents of the first IoT device 10 . In addition, the first restoration device 15a initializes a part of the contents of the restored disk of the first IoT device 10 using some data received from the first IoT device 10 and stored before being infected with the ransomware. can be implemented. In this case, the first restoration device 15a may include a data log program for separately logging data contents of the first IoT device 10 and a separate independent storage space for storing some data contents.

Next, when the reboot and data initialization of the first IoT device 10 are completed (S78a), the restoration management server 100 transmits an operation termination signal, etc. (S78b) to the first restoration device 15a and the second restoration device The operation of (15b) can be ended (S79a, S79b). The reboot of the first IoT device 10 and completion of data initialization are implemented by the restoration management server 100 detecting a normal operation of the first IoT device based on a signal or data transmitted from the first IoT device 10 . can be

8 is a block diagram showing another first configuration that can be employed in the restoration apparatus of the disk restoration apparatus of FIG. 5 . And FIG. 9 is a block diagram showing another second configuration that can be employed in the restoration apparatus of the disk restoration apparatus of FIG. 5 .

Referring to FIG. 8 , the restoration device 15 of the disk restoration apparatus according to the present embodiment is equipped with a restoration program 16 , a remote power source 17 , and a function maintenance program 18 .

The restoration program 16 is a basic component of the restoration device to restore the disk of the corresponding IoT device when the corresponding IoT device is infected with ransomware.

The remote power source 17 is used by the restoration program 16 to selectively boot the restoration device 15 in a ransomware infection situation of the corresponding IoT device. That is, the remote power source 17 only needs the restoration device 15 so that the restoration device 15 is not exposed to the damage of the ransomware when the corresponding IoT device is infected with ransomware when the restoration program 16 needs to be formatted as a file system. ) or the restoration program 16 is selectively activated and used.

The function maintenance program 18 is mounted inside the restoration program 16 of the restoration device 15 . The function maintenance program 18 may perform essential functions of the corresponding IoT device while the corresponding IoT device is booted when continuous operation of the IoT device is required, such as an IoT device such as a smart factory. Essential functions may include, for example, sensor measurement, network communication, operation of a robotic arm, and the like.

On the other hand, the function maintenance program 18 is not mounted inside the restoration program 16 of the restoration device 15 as shown in FIG. 9 , but may be loaded together with the restoration program 16 in a separate software 16a. .

The function maintenance program 18 may be used for both an IoT device infected with ransomware or a normally operating IoT device that copies and delivers the disk contents to the infected IoT device.

For example, when the disk of the IoT device is actually operated and the disk of the IoT device is used as a copy source, there may be a case where the operation of the IoT device overwrites the system software area or a case where a simple copy is made.

In the case of overwriting the system software area, in the present embodiment, the corresponding IoT device is terminated to prevent overwriting from occurring, and the disk copy is performed through the restoration device.

And, the reason that the IoT device needs to be terminated in the disk copy process is that the contents of the source disk remain the same during the disk copy, that is, at the start point of the copy and the end point of the copy, that is, the contents of the source disk, especially the system software. This is to ensure that there are no changes. The time required for copying disk contents varies depending on the performance of the IoT device and the performance of communication. The device may not provide normal functions. Therefore, in order to prevent such a problem, it is possible to select the termination of the IoT device when copying the disk including the system software.

FIG. 10 is a block diagram showing another third configuration that can be employed in the restoration apparatus of the disk restoration apparatus of FIG. 5 .

Referring to FIG. 10 , the restoration device 15 of the disk restoration apparatus according to the present embodiment includes a restoration program 16 , a remote power supply 17 , a function maintenance program 18 , a data log program 19a and a storage space ( 19b) is provided. The restoration program 16, the function maintenance program 18, and the data log program 19a may be loaded together in a separate software 16b.

When the content of the data part of the IoT device is modified, the data log program 19a may leave the contents of the corresponding modification operation as a log. These logs are stored in a separate storage space 19b inside the restoration device 15 . That is, in the present embodiment, the log is stored at the hardware level. And since the stored log is stored in the independent storage space 19b of the restoration device 15, it cannot be viewed in the IoT device.

As described above, in the present embodiment, by supporting the data log program 19a, even data of an IoT device to be restored can be restored.

In addition, after restoring the system software of the IoT device, the restoration device 15 may restore the data of the IoT device by calling the data modification log from the independent storage space 19b and re-executing it.

In addition, when the restoration device 15 provides various functions such as the restoration program 16, the function maintenance program 18, and the data log program 19a, the restoration management server of the present embodiment or disk restoration including the restoration device In the device, it is possible to prevent a functional program such as a restoration program from being infected by ramsomware by selectively determining whether to execute the functional program mounted on the restoration device or selectively starting it when necessary. For example, when the data part of the IoT device is left as a log, if only the data log program is executed, the restoration program is not visible in the IoT device, so when the IoT device is infected with ransomware, the program of the restoration device is also infected. it can be prevented

11 is a block diagram showing a configuration that can be employed in the restoration management server of the disk restoration apparatus of FIG. 5 .

Referring to FIG. 11 , the restoration management server 100 according to the present embodiment includes a sensing unit 110 , a control signal generating unit 120 , a message processing unit 130 , and a search unit 140 .

The restoration management server 100 detects that the first IoT device in the network is infected by ransomware or malware by the detection unit 110 , and uses the control signal generation unit 120 connected to the detection unit 110 to first A first control signal to be transmitted to the first restoration device connected to the IoT device is generated.

In addition, the restoration management server 100 receives a discovery request for a second IoT device of the same type as the first IoT device from the first restoration device through the message processing unit 130 , and the device of the first IoT device included in the discovery request. extract information

Then, the restoration management server 100 searches for a second IoT device existing in the network through the search unit 140 based on device information of the first IoT device.

When the second IoT device is discovered, the restoration management server 100 generates a second control signal through the control signal generator 120 and sends the second control signal to the second restoration device connected to the second IoT device. transmit At this time, the second restoration device controls the operation of the second IoT device in response to the second control signal so that the second IoT device can overwrite the primary storage device of the first IoT device by copying the contents of the primary storage device. do.

When the restoration of the first IoT device is completed by overwriting and rebooting the main storage device of the first IoT device, the restoration management server detects the normal state of the first IoT device on the network, and accordingly the control signal generator 120 ) through which a control signal or an operation end signal for terminating the operation of the first restoration device and the second restoration device may be generated.

According to the above embodiment, when the disk contents of the IoT device in the Internet of Things or industrial control system environment are damaged due to ransomware, malware, etc. It can be restored effectively so that the IoT device can be quickly restored and operated normally.

On the other hand, the P2P disk restoration method for ransomware damage restoration described through the above-described embodiments may be implemented in the form of a module or program command that can be executed through various computer means and recorded in a computer readable medium. A module may refer to a unit including hardware, software, firmware, or a combination thereof. The unit may be referred to, for example, as a logic, a logical block, a component, or a circuit, and an ASIC (application) that performs a series of operations for the method according to the present embodiment. It may include at least one of a specific integrated circuit (FPGA) chip, field-programmable gate arrays (FPGA), and a programmable-logic device.

The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer readable medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the art of computer software.

Examples of computer-readable media also include hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The above-described hardware device may be configured to operate as at least one software module to perform a series of operations of the P2P disk restoration method for restoring ransomware damage according to the present embodiment, and vice versa.

Although it has been described with reference to the above embodiments, those skilled in the art will understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the following claims. will be.

Claims (13)

A P2P (pear to pear) disk restoration method for restoring a disk infected by ransomware or malware, which is executed by a network-connected restoration management server, comprising:
activating a first restoration device connected to a first internet of thing (IoT) device infected with ransomware or malware in a network;
receiving a search request for a second IoT device of the same type as the first IoT device from the first restoration device;
discovering the second IoT device in the network based on device information on the first IoT device included in the discovery request; and
and transmitting the restoration request of the first IoT device to a second restoration device connected to the discovered second IoT device. The method according to claim 1,
The P2P disk restoration method, wherein the second IoT device copies the chunk or firmware stored in its primary storage device and overwrites it in real time in the primary storage device of the first IoT device by controlling the operation of the second restoration device. The method according to claim 1,
The P2P disk restoration method further comprising terminating the operation of the first restoration device and the second restoration device when a normal state of the first IoT device is detected by restoration of the primary storage device in the network. A P2P (pear to pear) disk restoration method for restoration of a disk infected by ransomware or malware, which is executed by a network-connected restoration device, comprising:
Receiving a first control signal for activation from a restoration management server connected to a first Internet of thing (IoT) device infected with ransomware or malware in a network and connected to the network;
transmitting a search request for a second IoT device of the same type as the first IoT device to the restoration management server in response to the first control signal;
functioning as system software of the first IoT device in response to the first control signal;
Overwriting of the main storage device of the first IoT device from the second IoT device discovered by the restoration management server connected to the network based on the device information on the first IoT device included in the discovery request allowing; and
and rebooting the first IoT device when the overwriting is completed. 5. The method according to claim 4,
and performing the original function of the first IoT device until the reboot of the first IoT device is completed by a self-stored function maintenance program in response to the first control signal. 5. The method according to claim 4,
When the second restoration device connected to the second IoT device is activated in response to a second control signal from the restoration management server, when the contents of the main storage device of the second IoT device are modified for the overwrite operation , P2P disk restoration method for temporarily stopping the operation of a specific function of the second IoT device during the operation time of the overwrite. 5. The method according to claim 4,
When the data part content of the first IoT device is modified in the normal operating state of the first IoT device by the self-stored data log program, the restoration device stores the contents of the corresponding modification operation as a log in a separate self-storage space and recovering the data of the first IoT device based on the log stored in the storage space after the overwriting is completed. As a P2P (pear to pear) disk restoration device for restoration of a primary storage device of a first IoT (internet of thing) device infected by ransomware or malware, including a restoration management server connected to a network and a restoration device, the above restoration device,
Receives a first control signal from the restoration management server, and transmits a search request for a second IoT device of the same type as the first IoT device to the restoration management server in response to the first control signal, and the first control signal The first IoT from a second IoT device that functions as the system software of the first IoT device in response and is discovered by the restoration management server based on device information about the first IoT device included in the discovery request a restoration program that allows overwriting of the main storage device of the device and reboots the first IoT device when the overwriting is completed; and
a remote power supply for activating the restoration device by supplying power to the restoration device based on the first control signal or a separate trigger signal or activation signal;
A P2P disk restore device comprising a. 9. The method of claim 8,
The P2P disk restoration apparatus further comprising a function maintenance program for performing the original function of the first IoT device until the restoration or the rebooting of the first IoT device is completed in response to the first control signal. 9. The method of claim 8,
When the contents of the data part of the first IoT device are modified in the normal operating state of the first IoT device, the contents of the corresponding modification operation are stored as a log, and after the overwriting is completed, the second IoT device is stored based on the previously stored log. 1 Data log program to recover data from IoT devices; and
The P2P disk restoration device further comprising a; storage space for storing the log specified by the data log program. A P2P (pear to pear) disk restoration device for restoring a disk infected by ransomware or malware, comprising a network-connected restoration management server and a restoration device, the restoration management server comprising:
a control signal generator configured to generate a first control signal to be transmitted to a first restoration device connected to the first IoT device according to the detection of ransomware or malware damage of the first IoT device in the network;
a message processing unit receiving a search request for a second IoT device of the same type as the first IoT device from the first restoration device, and extracting device information of the first IoT device included in the discovery request; and
P2P disk restoration apparatus comprising a; a search unit for searching for the second IoT device in the network based on the device information of the first IoT device. 12. The method of claim 11,
The P2P disk restoration apparatus further comprises a detection unit for detecting ransomware or malware damage of the first IoT device in the network, wherein the output signal generated by the detection unit is transmitted to the control signal generation unit. 13. The method of claim 12,
When the normal state of the first IoT device on the network is detected by the sensing unit according to the restoration of the main storage device of the first IoT device, the control signal generating unit according to the signal of the sensing unit may include the first restoration device and the second storage device. 2 A P2P disk restoration device that generates a control signal or an operation termination signal for terminating the operation of the second restoration device connected to the IoT device.

Images