KR102542007B1 - Method and apparatus for portecting files of external storage - Google Patents

Abstract

A method and apparatus for protecting files stored in an external storage in a Unix-like operating system environment are disclosed. The disclosed method includes, in response to a request for access to a target file stored in an external storage, checking an access right to the access request; and allowing access to the target file according to a result of checking the access authority.

Description

Method and device for protecting files stored in external storage {METHOD AND APPARATUS FOR PORTECTING FILES OF EXTERNAL STORAGE}

The present invention relates to a method and apparatus for protecting files stored in external storage, and more particularly, to a method and apparatus for protecting files stored in external storage in a Unix-based operating system environment.

Unix-like operating systems such as Linux and Android operating systems divide and manage storage into internal storage and external storage. In general, a non-volatile memory mounted inside a terminal corresponds to internal storage, and a removable storage such as a microSD card corresponds to external storage.

In a Unix-like operating system environment, FUSE Daemon is used to manage external storage. However, the FUSE daemon does not provide a function to control access to important files such as installation files, firmware, user personal information, and certificates in external storage commonly used by various software.

In addition, according to the Android external storage access policy, if the Android software has external storage access rights, all files and directories in the external storage can be accessed. Because these access rights are requested and used by a lot of software, the protection of important files can be weakened.

Accordingly, hash verification is used to prevent forgery of important files existing in external storage. However, since many softwares have external storage access rights, TOCTOU (check time and use time) vulnerabilities exist, and through attacks using the vulnerability (forgery through file movement, deletion, writing, etc. immediately after hash verification), Counterfeiting is possible.

As a related prior literature, there is Korean Patent Registration No. 10-1041348, which is a patent document.

An object of the present invention is to provide a method and apparatus capable of effectively protecting files stored in an external storage in an environment where a Unix-type operating system is used.

In addition, the present invention is to provide a file protection method and apparatus capable of preventing malicious software forgery of important files stored in an external storage.

According to one embodiment of the present invention for achieving the above object, a computing device using a Unix-like operating system is a method for protecting a file stored in an external storage, in response to a request for access to a target file stored in the external storage, Checking the access authority for the access request; and allowing access to the target file according to a result of checking the access authority.

In addition, according to another embodiment of the present invention for achieving the above object, as a device for protecting a file stored in an external storage in a Unix-like operating system environment, in response to a request for access to a target file stored in the external storage, the access an access authority confirmation unit that verifies access authority to the request; And an apparatus for protecting a file stored in an external storage including an access control unit processing a request for access to the target file according to a result of checking the access authority is disclosed.

According to one embodiment of the present invention, it is possible to set access rights to important files among files stored in external storage, and by checking the access rights of the person requesting access to the important files and allowing access, forgery and falsification attacks on important files can be blocked. can

In addition, according to an embodiment of the present invention, by checking whether or not an access authority for a file referred to by a symbolic link is checked, a detour attack using a symbolic link can be effectively blocked.

1 is a diagram for explaining a method of protecting a file stored in an external storage according to an embodiment of the present invention.
2 is a diagram for explaining a method of protecting a file stored in an external storage according to another embodiment of the present invention.
3 is a diagram for explaining an apparatus for protecting files stored in an external storage in a Unix-like operating system environment according to an embodiment of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. Like reference numerals have been used for like elements throughout the description of each figure.

The present invention proposes a method and apparatus capable of protecting a file in an external storage using an access right to a file stored in the external storage in an environment where a Unix-type operating system is used.

According to one embodiment of the present invention, access rights are granted for each file in the external storage. In addition, such access rights may be granted for each requester's identification information requesting access to the file. Here, the requestor may be a user or an application of a terminal equipped with an external storage.

An embodiment of the present invention protects a file stored in an external storage by checking an access right to the access request and allowing access to the corresponding file according to the access right when a request for access to a target file occurs.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram for explaining a method of protecting a file stored in an external storage according to an embodiment of the present invention.

A file protection method according to an embodiment of the present invention may be performed in a computing device using a Unix-based operating system, and such a computing device may be, for example, an Android terminal or a Linux terminal.

Referring to FIG. 1 , the computing device according to an embodiment of the present invention responds to a request for access to a target file stored in an external storage and checks the access authority for the access request (S110). Then, access to the target file is allowed according to the confirmation result of the access authority (S120). That is, if the access authority for the access request exists, the computing device allows access to the target file, and as the access is permitted, a read or write operation may be performed on the target file.

Access rights can be set differently for each file stored in the external storage. Since it is inefficient to grant access only to specific access requesters to all files stored in external storage, among files stored in external storage, only very important files such as installation files, firmware, user personal information, certificate files, etc. Access rights can be set.

As an embodiment, access permission setting may be implemented by a derive_permissions_locked method, and access permission may be set according to identification information of a target file. The identification information of such a file may be a file format, header information, file extension, etc., and access authority may be selectively set for a file composed of a format or extension corresponding to an important file.

In step S110, the computing device can check the access right for the access request by using the identification information of the access requester requesting access to the target file and the access right information on the target file assigned to the access requester's identification information. For example, when access rights to a certificate file are granted to identification information such as an Android terminal user's ID or a group ID, the computing device checks the access rights information granted to the identification information, and the access rights to the certificate file are granted. You can check whether it exists or not. As an embodiment, verification of authority information may be implemented by a check_caller_access_to_name method.

According to one embodiment of the present invention, it is possible to set access rights to important files among files stored in external storage, and by checking the access rights of the person requesting access to the important files and allowing access, forgery and falsification attacks on important files can be blocked. can

Meanwhile, the computing device according to one embodiment of the present invention, in order to efficiently respond to an attack of stealing user identification information and accessing a file in an external storage, when the state of a target file is changed by an access request, the target file The state change history may be stored and managed (S130). In addition, the computing device may match and store identification information of an access requester with the state change history along with the state change history. Here, the state change history includes movement, deletion, renaming, copying, etc. of the target file, and may further include a time when the state of the target file is changed. And saving the state change history can be implemented by the handle_rename method.

Therefore, when the state of the target file is changed by an attacker, the identification information used in the attack and the attack time can be confirmed through the state change history, and an appropriate response to the attack is possible.

In addition, in order to efficiently check the attack route, the state change history may further include an Internet access address prior to the time when the state of the target file was changed. Through the Internet access address included in the state change history, the address where the malicious code used in the attack was distributed can be easily identified.

In this case, the Internet access address is preferably an Internet access address at which the frequency of Internet access of the computing device is less than or equal to a threshold frequency. Since Internet addresses frequently accessed by users are unlikely to be used as attack routes, Internet access addresses that are highly likely to be used as attack routes and are used less than a critical frequency may be included in the state change history.

2 is a diagram for explaining a method of protecting a file stored in an external storage according to another embodiment of the present invention.

If the target file is a symbolic link in step S110, the computing device according to an embodiment of the present invention may check the access authority for the file referred to by the symbolic link. A symbolic link is a file containing a reference to another file or directory in the form of an absolute path or a relative path, and as shown in FIG. 2 , it may refer to a plurality of files 210 .

Since an attacker can access the file referenced by the symbolic link via a symbolic link, the computing device checks the access rights to the file referenced by the symbolic link, so that the attacker cannot access the file referenced by the symbolic link, Access is allowed according to the verification result.

If there is only one file referred to by the symbolic link, in step S120, the computing device grants access to the file referred to by the symbolic link depending on whether or not the access requestor has access rights. However, when there are multiple files referenced by symbolic links, access rights may or may not exist depending on the files, and in this case, the method for allowing access to the multiple files may vary according to a preset security level.

At the first security level, the computing device may disallow access to all of the plurality of files when the access authority for at least one of the plurality of files referred to by the symbolic link is not confirmed. Even if the access authority for some of the files referenced by the symbolic link is not set, the attacker's file access can be blocked through this approach.

Alternatively, at a second security level lower than the first security level, the computing device may selectively allow access to files for which access rights are confirmed among a plurality of files referred to by symbolic links.

Alternatively, in the third security level lower than the second security level, the computing device, if there is at least one file whose access right is confirmed among a plurality of files referred to by the symbolic link, not only the file whose access right is confirmed, but also the access right. Access can also be granted to files of the same type as this identified file. As an embodiment, the file type may correspond to the extension of the file, and even in a situation where the access right to the file having the same extension as the file for which the access right is checked is not confirmed, the file of the same type as the file for which the access right is confirmed. access may be granted.

3 is a diagram for explaining an apparatus for protecting files stored in an external storage in a Unix-like operating system environment according to an embodiment of the present invention.

Referring to FIG. 3 , the file protection device according to an embodiment of the present invention includes an access authority confirmation unit 310 and an access control unit 320 .

The access authority checking unit 310 responds to a request for access to a target file stored in an external storage and checks the access authority for the access request. The access right confirmation unit 310 may check the access right for the access request according to the above-described access right checking method.

Further, the access control unit 320 processes the access request for the target file according to the access authority check result of the access authority confirmation unit 310 . The access control unit 320 may process an access request for a target file according to the above-described access permission method.

The technical contents described above may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiments or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. A hardware device may be configured to act as one or more software modules to perform the operations of the embodiments and vice versa.

As described above, the present invention has been described by specific details such as specific components and limited embodiments and drawings, but these are provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , Those skilled in the art in the field to which the present invention belongs can make various modifications and variations from these descriptions. Therefore, the spirit of the present invention should not be limited to the described embodiments, and it will be said that not only the claims to be described later, but also all modifications equivalent or equivalent to these claims belong to the scope of the present invention. .

Claims (11)

A method of protecting a file stored in an external storage by a computing device using a Unix-type operating system, the method comprising:
In response to a request for access to a target file stored in an external storage, checking an access right to the access request; and
Allowing access to the target file according to the confirmation result of the access authority,
The step of checking the access authority for the access request is
Confirming the access right for the access request using the identification information of the requester who requested access to the target file and the access right information for the target file given to the identification information
How to protect files stored on external storage.
delete According to claim 1,
When the state of the target file is changed by the access request, storing a state change history of the target file and identification information about the requester.
How to protect files stored on external storage that further includes.
According to claim 3,
The status change history
At least one of moving, deleting, renaming, and copying the target file, the time the state of the target file is changed, and the Internet access address before the time the state of the target file is changed
How to protect files stored on external storage including .
According to claim 4,
The Internet access address is
An Internet access address in which the Internet access frequency of the computing device is less than or equal to the threshold frequency
How to protect files stored on external storage.
According to claim 1,
The step of checking the access authority for the access request is
If the target file is a symbolic link, checking the access rights to the file referenced by the symbolic link
How to protect files stored on external storage.
According to claim 6,
The step of allowing access to the target file is
In the first security level, if the access authority for at least one of the plurality of files referred to by the symbolic link is unconfirmed, access to all of the plurality of files is not permitted.
How to protect files stored on external storage.
According to claim 7,
The step of allowing access to the target file is
At a second security level lower than the first security level, allowing access to a file whose access authority is confirmed among a plurality of files referred to by the symbolic link
How to protect files stored on external storage.
According to claim 8,
The step of allowing access to the target file is
In a third security level lower than the second security level, if there is at least one file whose access authority is confirmed among a plurality of files referred to by the symbolic link, the file for which the access authority is confirmed and the access authority are confirmed. Allows access to files of the same type as the
How to protect files stored on external storage.
According to claim 1,
The above access rights
Access authority set according to the identification information of the target file
How to protect files stored on external storage.
In a Unix-like operating system environment, in a device for protecting files stored in external storage,
In response to a request for access to a target file stored in an external storage, an access authority confirmation unit confirming an access authority for the access request; and
An access control unit that processes a request for access to the target file according to a result of checking the access authority,
The access authority verification unit
Confirming the access right for the access request using the identification information of the requester who requested access to the target file and the access right information for the target file given to the identification information
A device that protects files stored on external storage.

Images