KR20010103201A - The checking system against infiltration of hacking and virus - Google Patents

Abstract

The present invention relates to a system for preventing hacking and virus intrusion, and a program for monitoring the state of a computer recognizes a sudden change in the number of files or the use of shadow files on a user's computer and delivers them to a server.

The server loads the compromised port of the user's computer, slows down the hack, opens another port, and sends out the status through the open port without interrupting the network connection. To capture the signal and trace back, to capture the location and the computer,

Encrypt all folders to be read only by the server-provided password to prevent hackers from unauthorized reading or virus penetration, while users can access the server and obtain permission to decrypt and use them.

A system that executes communication through a communication network by allowing the server to hold an image of the disk so that the data of the computer does not fly, so that even when the work is performed outside, the file of the server can be retrieved and operated without using a storage medium. It prevents the penetration of internal and external hacking, as well as the penetration of viruses, so that the protection of information stored inside and the damage of hardware can be completely prevented.

Description

The checking system against infiltration of hacking and virus

The present invention relates to a hacking and virus intrusion prevention system, and in particular, to prevent the penetration of viruses as well as the penetration of internal and external hacking for a data communication system that performs data communication through a public communication network or a dedicated information communication network. The present invention relates to a hacking and virus intrusion prevention system that can protect information stored inside and prevent damage to hardware completely.

At present, data communication for exchanging a large amount of information through a high-speed information communication network is in the spotlight, and a server-side computer terminal and / or a client-side computer terminal constituting such a data communication network are required to occupy the communication channel of the information communication network. In general, a user ID code (User ID) and a password (Password) are given.

Therefore, for server-side computer terminals that provide such information and communication services, a large number of client-side computer terminals may be connected to an organization or individual that is in charge of various fields of business through a data communication network (eg, an Internet communication network). Exchange or information retrieval and copying (ie, down load) are possible.

Here, for server-side computer terminals and / or client-side computer terminals that are connected online through an information and communication network, if a user identification code and password are recognized, the server-side computer terminal and / or the client-side computer terminal may be online whenever necessary without relying on network components or communication path disturbances. Access is made possible, which exploits the loopholes in such telecommunications services to illegally invade organizations, businesses and individuals' telecommunications systems and destroy, alter, and / or download data resources stored in the database of the corresponding computer terminals. The so-called 'hacking' received frequently occurs.

That is, for any data communication system connected online to a data communication network, a hacker uses a hacking program to connect online to a database of a data communication system to destroy, change or download the resources contained in the database to illegally exploit it. do.

Therefore, in consideration of such a point, in recent years, a considerable effort and effort are required to establish a hacking prevention system (Fire wall) for hacking prevention in data communication systems.

FIG. 1 illustrates such a conventional network configuration 100 using, as an example, an anti-hacking scheme server 120 and a proxy server 140 as a separate server for providing security of the anti-hacking scheme to the data communications network 130. Illustrated.

As shown in Figure 1, the anti-hacking scheme server 120 is a separate computer located between the public network 110 and the private network 130 to provide network safety measures for communications exchanged between networks. System.

In terms of hardware facility management and network management, investment in providing the server-based anti-hacking scheme of FIG. 1 is important.

Of course, the cost of installing and maintaining such a dedicated server-based anti-hacking scheme for very large data networks is justified in terms of the potential damage that a network safety compromise can impose on the data network.

However, for small / medium network and personal computer users, the stable configuration of the server-based anti-hacking scheme can be expensive.

Thus, there is a need for client-based anti-hacking scheme technology to provide network security in a private network as an example.

The present invention for solving the conventional problems as described above to prevent the penetration of the virus as well as internal and external hacking into the data communication system for performing data communication through a public communication network or a dedicated information communication network to It is an object of the present invention to provide a hacking and virus intrusion prevention system that can protect stored information and at the same time completely prevent hardware damage.

In order to achieve the above object, the present invention provides a program for monitoring the state of a computer and suddenly recognizes a state in which the number of files suddenly change or the shadow files are used in a user's computer.

In addition, the server receives the web trace route and traces all connected points, and loads the intruded port of the user's computer to slow down the hack and open other ports without affecting the network connection. By monitoring the status through the port and sending it to the server, the server captures the signal from the hacker and traces it back, capturing its location and computer.

Information about the detected hackers will be forwarded to the police department's hacker garrison so that criminal penalties can be imposed.

Encrypt all folders on user's computer so that when files are requested from external storage device, all files are encrypted to read by server's password to prevent hackers from reading files or virus infiltrating files.

In the case of normal use by the user, when the user connects to the server and obtains the approval by the user's password, the password is automatically released and can be used.

The above encryption method uses a random method and keeps the source of the encryption code only on the server so that a hacker (cracker) cannot produce a crack for decryption.

By keeping the image of the disk in the server so that valuable data of the computer does not fly away, even when the user is doing the work externally, the user can retrieve the server file from the outside and continue working without using a separate storage medium. .

When connecting to the server, even if you forget your ID and password, the server will tell you the ID and password you have stored so that the user can access it. It prevents the penetration of internal and external hacks as well as the intrusion of viruses to completely protect the information stored inside and damage the hardware.

1 is a block diagram showing the configuration of a network having a conventional server hacking prevention scheme.

2 is a block diagram showing a data communication network to which the hacking prevention apparatus according to an embodiment of the present invention is applied.

* Description of the symbols for the main parts of the drawings *

1: user computer 2: microprocessor

3: Communication buffer 4: Status check program

5: input / output interface 9: connector

10: external network 11: server

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Figure 2 shows the overall configuration including a safety device according to an embodiment of the present invention,

A microprocessor (2) which enables the supply of an anti-hacking scheme in association with the anti-hacking scheme routine and the encryption routine,

A communication buffer 3 having a software driver, not shown in the drawing, for enabling the orientation of all communication calls connected and exchanged with the user terminal,

A state check program (4) connected to the communication buffer (3) in the user computer (1) and suddenly recognizing a state in which the number of files suddenly changes or the shadow files are used and transmitted to the server;

An input / output interface 5 for enabling the exchange of data communication between the external terminal 10 and the user terminal to which the anti-hacking system safety device 6 and the encryption routine 7 are connected;

A memory element 8 comprising a RAM for storing a specific calculation result,

Available from anti-hacking scheme application software that defines at least one safety level that a communication stream of a user terminal must follow and provides an anti-hacking scheme such as filtering and auditing the communication stream at the packet, circuit, and / or application level. Anti-hacking system routines (6) supplied by the Lucent Managed Firewall,

An encryption routine (7) that defines at least one level of safety that a communication stream of a user terminal must follow and includes an asymmetric encryption routine such as a data encryption standard (DES) routine or a well-known Harvest-Shamir-Adlman (RSA) routine. )and,

A connector 9 having a software driver for enabling the orientation of all communication calls connected to and exchanged with the user terminal and the external network 10;

It is connected to the user computer 1 through the connector 9 and the external network 10 and receives information according to the usage status checked by the status check program 4 to prevent hackers and prevent infiltration of viruses. It consists of servers (11) to control.

According to the present invention configured as described above, the state check program 4 for monitoring the state of the computer recognizes a sudden change in the number of files or the use of shadow files in the user's computer 1 and transmits the state to the server 11.

The server 11 receives the back trace of the web connection path and all the places connected to it, and at the same time, loads the port of the intruded connector 9 of the user computer so that the speed of hacking is reduced.

In addition, the server 11 is sent from the hacker by the connection state sent out through the open port of the connector 9 without interrupting the connection of the external network 10 by opening another port of the connector 9. Capture and trace back signals to capture their location and computer.

The above information about the hacker is transmitted to the hacker garrison of the National Police Agency so that the criminal offense can be imposed.

By encrypting all folders controlled by the microprocessor 2 of the user computer 1 and requesting data from an external storage device, the hacker encrypts all files so that they can be read only by a password given by the server 11. To prevent unauthorized reading or virus penetration into files.

When a user normally wants to use a computer, the user can access the server 11, input the user's password, and then obtain the approval of the server 11 to automatically unlock the password.

The encryption method uses a random method and keeps the source of the encryption code only in the server 11 so that a hacker (cracker) cannot produce a crack for decryption.

The server 11 retains an image of the hard disk in use so that valuable data of the user's computer 1 does not fly away. Even if the medium is not used, the file of the server 11 can be called out to continue working.

The above file is extracted from the image of the hard disk stored in the server 11.

When the user forgets the ID and password and enters the user's information correctly instructing the server 11 to input the server 11, the server 11 informs the ID and password. Allow users to connect from time to time.

Therefore, according to the hacking and virus intrusion prevention system of the present invention, the program for monitoring the state of the computer to recognize the sudden change in the number of files or the shadow files are used in the user computer and to deliver to the server,

The server sends a load to the intruded port of the user's computer so that the speed of hacking can be slowed down, and other ports can be opened so that the server can be sent from the hacker by the connection state sent through the open port without interrupting the network connection. Captures the signal and traces it back, capturing its location and computer,

Encrypt all folders to be read only by the server-provided password to prevent hackers from unauthorized reading or virus penetration, while users can access the server and obtain permission to decrypt and use them.

A system that executes communication through a communication network by allowing the server to hold an image of the disk so that the data of the computer does not fly, so that even when the work is performed outside, the file of the server can be retrieved and operated without using a storage medium. In addition to the penetration of internal and external hacking, as well as to prevent the penetration of viruses, there is an advantage that can protect the information stored inside and damage to hardware.

Claims (3)

Causing the status checking program 4 to recognize the sudden change in the number of files or the use of shadow files in the computer 1 and to transmit them to the server 11; The server 11 performs a task of backtracking all the places connected to the web connection path and at the same time loads the ports of the invasive connector 9 of the user computer to slow down the hacking speed, Open the other port of the connector 9 so that the information about the connection status with the external network 10 can be sent to the server 11 without interrupting the connection of the external network 10 to send a signal from the hacker. To capture and trace back the location and the computer, Encrypting all folders controlled by the microprocessor 2 of the user computer 1 to encrypt all files so that they can be read only by a password given by the server 11 when data is requested from an external storage device; Hacking and virus intrusion prevention system, characterized in that performed by the user to access the server (11) to enter the correct password to obtain the approval, the password is automatically released to use. The hacking and virus intrusion prevention system of claim 1, wherein the encryption method uses a random method and keeps the source of the encryption code only in the server (11) to prevent hackers from making cracks for decryption. The method of claim 1, wherein the server 11 retains an image of a hard disk used in the user computer 1 so that the user can perform an operation performed through the hard disk by using another computer from the outside. Even if you do not use a separate storage medium hacking and virus intrusion prevention system that allows you to continue working by calling the file of the server (11).