KR20110036420A - Virtual firewall system for cloud computing environment and method thereof - Google Patents

Abstract

PURPOSE: A virtual firewall prevention apparatus for a cloud computing environment is provided to minimize the leakage of company security or personal information by a hacking tool. CONSTITUTION: A program identifier extracting unit(120) extracts an identifier of a program that generates a detected event of en event detecting unit(110). A security policy determining unit(130) uses the extracted program identifier and the detected event as a search condition. The security policy determining unit determines a security polity about the event through the search of a program database(170). An event processing unit(150) permits or blocks the event.

Description

Virtual firewall system for cloud computing environment and method

The present invention relates to a fire protection apparatus and method for controlling the operation of a program executed in a computer, and more particularly, to establish a database for known programs and to use it to generate various security-related events of a program executed in the computer. It relates to a security device and method using a program database to control.

With the development of high-speed communication networks, the threat of viruses and hacking tools using computer networks is increasing day by day. In particular, recently, the damage caused by viruses and hacking tools has not only hindered the normal operation of computer hardware or software, but also brought about direct economic damage. According to the JoongAng Ilbo of February 11, 2009, there were cases of unauthorized withdrawal of 14 million won from credit card account by hacker on December 29, 2008. Even on January 5, 2009, 21 million won was deposited through internet banking. There is a case of unauthorized withdrawal. The police believe that the hacker used a hacking tool to hack into the computer by intercepting the user's keyboard input. As shown in these examples, the damage of hacking by unknown hacking tools has recently increased rapidly. Therefore, it is urgent to develop and disseminate security devices that can effectively block not only known viruses but also threats of unknown viruses or hacking tools.

Currently, security devices that are mainly used to block security threats of personal computers by viruses or hacking tools include vaccines and personal firewalls.

The vaccine builds a signature of a known virus or hacking tool into a database and uses it to block known viruses or hacking tools. In other words, the vaccine works by blocking viruses or hacking tools known by the developer of the vaccine, but allowing all other programs to operate. Therefore, the vaccine has the advantage that it is easy to use even those who do not have expert knowledge on the computer, but there is a problem that it cannot defend against unknown viruses or hacking tools.

A firewall is a security device that monitors network traffic and blocks unwanted traffic from computer users. Firewalls can be classified into two types, which are implemented as independent network equipment and installed in the middle of a network and mainly implemented in software, and installed in a computer. The latter is called a personal firewall for convenience.

Looking at the development process of the personal firewall, it can be divided into the initial type of personal firewall and the more advanced type of personal firewall, which is divided into the first generation personal firewall and the second generation personal firewall for convenience. In other words, the first generation personal firewall and the second generation personal firewall are distinctions for explaining the development process of the personal firewall, and they are not functionally mutually exclusive. Therefore, various personal firewall products currently on the market are often complementary to the functions of the second generation personal firewall and the first generation personal firewall.

The first generation of personal firewalls are the earliest personal firewalls that allow and block traffic based on the packet's source address and port number, the packet's destination address and port number, and transport layer protocols (TCP, UDP, etc.). It is a personal firewall. In other words, it allowed and blocked policies based only on information obtained from the network layer (IP, etc.) and the transport layer (TCP, UDP, etc.). The problem with this type of personal firewall is that it cannot flexibly cope with P2P programs or messenger programs that use the temporary port number, and personal computers are often used as administrators. If the tool works only within the rules allowed by your personal firewall, you will not be able to distinguish and block it.

The second generation personal firewall is a personal firewall to solve the above problems of the first generation personal firewall. The second generation personal firewall creates a list of programs that allow a computer user to allow and block communication on the computer, and allow and block communication based on this rule. Is a personal firewall. The list of programs to allow and block communication is entered manually, or when any program attempts to communicate with the network, the user is asked whether to allow communication using a pop-up window, etc., and then stored in the list of programs to allow and block the user's answer. It is common to use a form that does.

The second generation of personal firewalls differs greatly from the way they work with vaccines: vaccines block only known viruses and allow all remaining programs to work, while personal firewalls involve querying users for all network communications. have. In other words, the personal firewall is to check whether the user is allowed to communicate even if an unknown virus or hacking tool attempts to communicate with the outside, this can be said to be superior in terms of security.

This second generation personal firewall solves the problems of the first generation personal firewall described above, but causes another problem as described below.

Problems with second-generation personal firewalls include: (a) a complex initial setup process that forms a list of programs to allow and block communications; and (b) new programs are added to the personal firewall as the network communications program is updated. Registration and setting, (c) it is difficult to determine whether to allow communication even if the user has expertise in the computer because only limited information is provided when inquiring whether to allow the communication. (d) the use of a dichotomous policy of allowing and blocking communications, so that once communication is allowed by a user, abnormal traffic through authorized programs is allowed thereafter; and (e) blocking policies only for network communications. Directly or indirectly from inside the computer It does not block one operation.

Looking at the above (a) problem in more detail, it is an advantage and a disadvantage of the personal firewall to go through a complicated configuration process after installing the personal firewall on the computer. From a security point of view, it allows the communication after all programs that attempt to communicate with the network have been confirmed by the user, so that even if an unknown virus or hacking tool tries to communicate, the advantage is that it can be blocked. However, from the viewpoint of user convenience, the setting process is complicated, so it is difficult to set up and use effectively unless it is a person who has expert knowledge in computer. This difficulty in use is the reason that although the personal firewall is the most effective means of preventing the leakage of personal information or corporate secrets, it is widely used and is not effective.

Looking at the problem (b) in more detail, the recent programs are often provided with an automatic update function through the network, if the program is updated from time to time by using the update function, the corresponding program is updated every time There is a problem that needs to be registered and configured in the personal firewall again. Some personal firewalls may apply the settings that were applied to the previous version to the updated program if the path of the file is not changed even if the program is updated, but this type of approach has various problems again. First of all, if you maintain the communication permission setting based on the path of the file, there is no way to distinguish the case where the file is infected with a virus from the case of normal update. Therefore, it is not possible to block the case where a program to which network communication is applied by a user is modified by a virus or the like. Another problem is that software distributed over the Internet, such as .NET's ClickOnce, which is increasingly used recently, communicates based on file paths because the installation path on disk changes to a random path every time it is updated. Maintaining the permission setting is not available. Therefore, even if the contents of the file are changed, it is obvious that maintaining the communication permission setting based on the path of the file is not a reliable method of security of the computer.

Looking at the problem (c) in more detail, the personal firewall is provided between a program running in a computer and a network interface card (NIC) to operate in a way to detect traffic to and from between, where the personal firewall is detected. The information that can be obtained from the traffic is limited to the program file name involved in the communication, the source address and port number of the packet, the destination address and port number of the packet, and the transport layer protocol (TCP, UDP, etc.). Therefore, the personal firewall queries the user whether the communication is allowed based on the limited information, and the user must determine whether to allow the communication based on the limited information. An example of a message that asks a user whether or not to allow communication by the conventional firewall is “Update.exe file attempted a TCP connection to port 5000 on host 192.168.0.100. Do you want to allow this? ” However, even with such limited information, it is difficult for a person with computer expertise to determine whether to allow communication. In the above example, the determination of what the Update.exe file is, whether the file has been tampered by an unknown virus, what the host is 192.168.0.100, whether the host is not a malicious host, etc. Even an expert is not easy.

Looking at the problem (d) in more detail, the conventional personal firewall is a program that is allowed to communicate once by the user can communicate with the outside without limitation. For example, if a messenger program allows communication in a personal firewall setting, the messenger program is free to communicate with the outside world. The problem is that even a normal program can operate abnormally under the remote control of a malicious program. For example, in the case of a messenger program, even if the messenger program itself has not been tampered with by a virus, other malicious programs running inside the computer can remotely control the messenger program, so that other viruses registered in the messenger can be sent to other users registered with the messenger. It can also propagate. In another example, a user has registered an Outlook program with a personal firewall to send mail. A malicious program running on a computer may remotely control the Outlook program and send a large amount of spam. In another example, a malicious program could remotely control a web browser program to launch a DDOS attack on a particular site. The malicious program may remotely control a normal program by sending an artificial Windows message to the normal program, artificially inputting a keyboard or mouse input into the target program, or using a DLL injection. Either way, in this case, a messenger program that actually attempts to communicate and spreads viruses, an Outlook program that sends out a large amount of spam mail, and a web browser program that launches a DDOS attack are programs that the user authorizes communication. Conventional personal firewalls cannot defend against attacks that are remotely controlled and malicious.

Looking at the problem (e) in more detail, the personal firewall is a method that allows only the program authorized by the user to communicate with the outside, it is not enough to block the network in order to block the security threat that is intelligent in recent days. As mentioned above, a malicious hacking tool operated by remotely controlling a normal program to which communication is authorized by a user to avoid detection from a personal firewall cannot be blocked by a conventional personal firewall.

The present invention has been made to solve the above problems, it is not necessary to build a database of known programs and complex initial setup process based on this, and even if the program is updated, there is no need to reset the security policy of the updated program, When asking the user whether to allow the operation of the program, it provides easy-to-understand information so that the user can make accurate judgments. Even if the program is permitted by the user, it can detect and block the abnormal operation. It is an object of the present invention to provide a security device and method using a program database that can control not only network communication but also various security related events occurring in a computer.

Other objects and advantages of the invention will be described below.

The present invention for achieving the above object is a security device installed in the computer for controlling the operation of the program, for storing the program identifier and the recommended security policy of each program that can uniquely identify each program for the known programs Program database; An event detector for detecting an event of a program executed in a computer; A program identifier extractor configured to extract an identifier of a program that generated the event detected by the event detector; A security policy determination unit that searches a program database based on a program condition extracted from the program identifier extraction unit and an event detected by the event detection unit, and determines a security policy to be applied to the event; And an event processing unit for allowing and blocking the event according to a security policy determination result of the security policy determination unit.

The present invention for achieving the above object is a security method installed on a computer to control the operation of the program, for storing the program identifier and the recommended security policy of each program that can uniquely identify each program for known programs A program database building step of constructing a program database; An event detecting step of detecting an event of a program executed in the computer; A program identifier extracting step of extracting an identifier of a program that generated the event detected in the event detecting step; A security policy determination step of determining a security policy to be applied to the event by searching a program database based on a search condition of the program identifier extracted in the program identifier extraction step and the event detected in the event detection step; And an event processing step of allowing and blocking the event according to the security policy determination result of the security policy determination step.

According to the security device and method using the program database of the present invention, while providing a security device and method that can block unknown viruses or hacking tools, no complicated initial configuration process is required, even if the program is updated, the security policy of the updated program There is no need to reset the function, and even when the user is asked whether the program is allowed to be operated, it provides easy-to-understand information so that the user can make an accurate judgment. It can detect and block it, and control not only network communication but also various security-related events occurring within the computer.

Therefore, even if the user does not have specialized computer knowledge, hacking damage such as the leakage of personal information or corporate secrets caused by unknown viruses or hacking tools can be minimized.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a security device using a program database according to a preferred embodiment of the present invention. Referring to FIG. 1, the program 200 is a computer program to be controlled by using a security device using the program database of the present invention. The program may already be executed and exist in the form of a process, or may exist on the disk in a state that has not yet been executed. The operating system 300 provides an environment in which the program 200 is executed, and the program 200 makes a system call to the operating system 300 to execute processes from the operating system, file I / O, interprocess communication, and network. Receive services such as communication. The security device 100 using a program database is logically provided between the program 200 and the operating system 300 to monitor various requests requested by the program 200 to the operating system 300 and perform a security function.

The security device 100 using the program database includes a program database 170 that stores a program identifier capable of uniquely identifying each program and a recommended security policy of each program with respect to known programs; An event detector 110 for detecting an event of a program executed in the computer; A program identifier extracting unit (120) for extracting an identifier of a program that generated the event detected by the event detecting unit; A security policy determination unit (130) for determining a security policy to be applied to the event by searching a program database based on a program condition extracted from the program identifier extraction unit and an event detected by the event detection unit; And an event processing unit 150 for allowing and blocking the event according to the security policy determination result of the security policy determination unit.

The event detector 110 detects various events related to security generated by the program 200. Security-related events occurring in the program may include program execution, network communication, registry I / O, file I / O, other process debugging, other process hooking, and interprocess communication.

An implementation example of the event detector 110 will be described based on the Windows operating system environment. The event detector 110 may be implemented in the user mode according to the characteristics of the event to be detected, or may be implemented as a driver in the kernel mode.

When the event detector 110 is implemented in the user mode, an API hooking scheme may be used. API hooking refers to a technique for intercepting a system call requested by the program 200 to the operating system 300. The developer implements a DLL file of a function that has the same prototype as a system call provided by the operating system, maps the DLL file to the memory space of the process to monitor the system call, and then executes the function of the DLL provided by the operating system. Replace the calling address with the address of a function in your DLL. The system calls that the program calls can then be intercepted before they reach the operating system's kernel, allowing you to monitor or control what services the program requests to the operating system. API hooking allows you to monitor and control most of the events that occur in your program. Among the DLLs provided by the Windows operating system, DLLs that are subject to API hooking for detecting security-related events occurring in a program are KERNEL32.DLL, USER32.DLL, GDI32.DLL, PSAPI.DLL, and WS2_32.DLL. . KERNEL32.DLL provides functions such as process and thread creation, memory management, USER32.DLL provides window creation, window message handling, GDI32.DLL provides graphic output function, and PSAPI.DLL Provides status information of processes and threads. WS2_32.DLL provides network communication related functions. For example, to hook a system call to run a new program, you hook the CreateProcess () function of KERNEL32.DLL. In other words, API hooking may be implemented by manipulating a System Service Descriptor Table (SSDT) in kernel mode.

The method of implementing the event detector 110 as a driver in the kernel mode is suitable for detecting system-wide I / O-related events such as file I / O and network I / O. By implementing a kernel mode driver as a filter driver on top of an I / O related device provided by an operating system, an I / O request packet (IRP) delivered to the corresponding device can be monitored or controlled. For example, to monitor I / O related to TCP communication, you can implement a filter driver installed on top of the \ Device \ Tcp device. An advantage of implementing a kernel mode driver is that event detection can be performed on all programs running in the computer.

Since the API hooking and the creation of the filter driver are well known techniques known to those skilled in the art, a detailed description thereof will be omitted.

The program identifier extractor 120 extracts an identifier capable of uniquely identifying the program that generated the event detected by the event detector 110. Examples of identifiers that can uniquely identify each program can be in any form, such as the absolute path where the program is installed, the signature of the program file, the name, date, attribute, or a combination of the program files. It is preferably a hash value obtained by applying a hash function to (DLL, EXE, etc.). The hash function refers to a function that receives an arbitrary length of input and generates a fixed short length output. Examples of commonly used hash functions include MD5 and SHA-1. Signatures are unique values that appear in each file and are widely used as a way to uniquely identify each virus in existing vaccine programs. The advantage of using the hash value of each module as the program identifier is that it is easy to uniquely identify each program without conflicting identifier values, while keeping the size of the identifier below the appropriate size (eg 32 bytes). In addition, when using a hash value as a program identifier, the hash value is greatly changed even if the file of the program is slightly changed by the virus, so that it can be easily detected when the program is modified by a virus or the like. Embodiments of various hash functions are well known to those skilled in the art, and thus detailed descriptions thereof are omitted.

When the event detection unit 110 detects an event, the program identifier extractor 120 identifies a process associated with the event, obtains a program associated with the process therefrom, and uniquely identifies the program. It can be implemented by calculating the. Therefore, the program identifier extractor 120 may be implemented to work closely with the event detector 110.

When the event detector 110 is implemented by API hooking in the user mode, the process handle can be obtained by using the GetCurrentProcess () function, and the path on the disk of the program can be obtained by passing the process handle to the GetModuleFileNameEx () function. . If you read the file and input it to the hash function, you can get a hash value that can be used as a program identifier that uniquely identifies each program.

When the event detector 110 is implemented as a filter driver in kernel mode, a process ID can be obtained by using the PsGetProcessId () function. The process handle can be obtained by passing it to the OpenProcess () function, and the process handle is obtained by the GetModuleFileNameEx () function. You can get the program's on-disk path by passing. If you read the file and input it to the hash function, you can get a hash value that can be used as a program identifier that uniquely identifies each program.

The security policy determiner 130 determines a security policy to be applied to the event by using the event detected by the event detector 110 and the program identifier extracted by the program identifier extractor 120. The determination result of the security policy determination unit 130 is preferably one of allow and block. Allow is to allow the event to proceed, and block is to block the progress of the event. A detailed determination process of the security policy will be described later.

The event processor 150 functions to allow or block the event according to the determination result of the security policy determiner 130. The event processor 150 may be implemented to work closely with the event detector 110. Therefore, when the event detection unit 110 is implemented by API hooking in the user mode, the event processing unit 150 may also control the event by using the API hooking method. When the event detection unit 110 is implemented as a driver in the kernel mode, the event processing unit 150 also preferably controls the event within the driver. When the event processing unit 150 is implemented by the API hooking method, the hooked original function may be called as it is to allow the event, and to block the event, the event processing unit 150 may return a failure to the application as it is without calling the original function. In addition, when the event processing unit 150 is implemented in the kernel-mode filter driver method, to allow the above event, IoCallDriver () may be called as a subordinate driver and the IRP may be passed. To block the event, the IRP is passed to the subordinate driver. You can simply call IoCompleteRequest () to treat the IRP as a failure.

The functions provided by the Windows API and kernel mode are described in detail in MSDN Help and in the Help in the Windows Driver Kit (WDK).

The program database 170 stores a list of known programs with various information. The program database 170 is preferably built by a service provider and distributed to each individual user rather than being built by each individual computer user. The reason for building the program database 170 is to provide the user with a list of programs that have been checked by the service provider, so that the user can secure a safe initial setting state without a separate initial setting, and whether the user is allowed to operate the program. It provides easy-to-understand information even when querying the user to make accurate judgments. Even if the program is allowed to be operated by the user, it can detect and block abnormal operation. This is to provide a function to control various security related events. Hereinafter, with reference to FIG. 3, the information included in the program database 170 and the operation and function of each information will be described.

3 is an exemplary diagram of a program database for explaining a preferred embodiment of the present invention. Referring to FIG. 3, the program database 170 includes a program identifier 310 that can uniquely identify a program, a recommended security policy 330 for each program, and preferably further includes program information 320. do.

The program identifier 310 included in the program database 170 is an identifier capable of uniquely identifying each program for each known program. The program identifier 310 serves as an index of the program database 170.

The recommended security policy 330 included in the program database 170 includes an event 331 that may occur in the program and a policy 332 that is generally recommended for it. The recommended security policy 330 allows the service provider to verify the operation of each program and define events that should be allowed or blocked universally when each program is operating normally, so that each user installs a security device in accordance with the present invention on each computer. After that, it is possible to directly apply the generally recommended security policy without any individual setting like the conventional personal firewall.

The recommended security policy 330 contains a universally recommended policy for various motion events that can occur in each program. Events that may occur in a program may include program execution, network communication, registry I / O, file I / O, debugging other processes, hooking other processes, and interprocess communication. The policy 332 for this event means a security policy to be taken when each event occurs, and preferably, one of allow, block, and query. Allow is to allow the progress of the event, block is to block the progress of the event, and query is to query the user whether the event is progressing and process accordingly. For example, in the case of well-known web browser programs, the recommended policy for events such as execution, network communication, disk I / O, etc. may be “allowed”, but P2P server programs, which require user's attention when used, may be used for network communication events. The recommended policy may be a "query." In addition, in the case of a program identified as a hacking tool by the service provider, the recommended policy of all events, including execution and network communication events, may be "blocked".

Since the event 331 of the program defined in the recommended security policy 330 is not limited to network communication like a conventional personal firewall, but may include various events, unlike a conventional personal firewall, a hacking tool remotely controls a normal program. Blocking can also be achieved against malicious forms of attack. In the conventional personal firewall, the program authorized by the user to communicate with the network was able to communicate with the outside without restriction. Therefore, the hacking tool desired malicious by remotely controlling the program authorized to the user in order to avoid the surveillance of the personal firewall. The goal could be achieved. However, according to the present invention, by defining a recommended policy for not only network communication but also other process hooking or inter-process communication events, the hacking tool can block an attempt to communicate with the outside by remotely controlling a normal program.

Each event may also have more granular conditions. For example, if an event called execution is further broken down, it may be classified into execution at boot, execution by a user, execution by another program, etc., and the security policy may be different for each detailed condition. 4 is an exemplary diagram illustrating an example of a detailed condition of a network communication event. Referring to FIG. 4, the network communication event may include a domain address, a port number, a connection direction, a transport layer protocol, a traffic threshold, and the like as detailed conditions. The detailed conditions of the network communication event as described above have various effects as well as the effect of finely setting a security policy related to the network communication event.

First, when the domain address 410 asks the user whether the program attempting to connect to the server is network communication, the domain address 410 converts the IP address of the server to which the program is connected into a domain name that is easy for the user to understand or mark. Make it possible. Conventional personal firewalls present users with a dotted decimal notation that consists only of numbers when asking the user whether to allow network communication. The reason why the conventional personal firewall works so is that the information that can be obtained when the program detects a network communication attempt is limited to the IP address and port number of the packet's source and destination, and the domain address used when the program connects to the server. Because I do not know. Therefore, in the conventional personal firewall, it is difficult for a user to see the address of a server indicated only by an IP address and determine whether to allow communication to the corresponding server as intended.

However, using the domain address 410 information stored as a detailed condition of the network communication event, if the IP address of the DNS resolution of the domain address and the IP address of the server to which the program communicates match, the user is given a domain address instead of an IP address. By presenting (or presenting IP and domain addresses in parallel) the user can make a more accurate judgment. For example, when the program detects an event to communicate with the address 192.168.0.100, the program extracts the network communication event condition of the program and connects the IP address of the DNS resolution of the domain address included in the network communication event condition to the program. If the IP address you attempt to match matches, you can present the domain address to the user.

In addition, the traffic threshold 420 included in the network communication event 400 prevents operations that are remotely controlled by the hacking tool even if the program is authorized for network communication by the user and operate against the user's interests and intentions. Examples of operations contrary to the interests and intentions of the user may include sending spam mails using a computer, spreading viruses using a messenger program, and performing a DDOS attack using a web browser.

Personal firewall according to the prior art was able to communicate with the outside without any restrictions to the program that the network communication is authorized by the user. However, such a conventional technique cannot be prevented by a hacking tool that does not directly communicate with the outside network and performs malicious operation by remotely controlling a normal program authorized by a user. Hacking tools can remotely control normal programs by using Windows messages, artificially generating keyboard and mouse input, and injecting DLLs. By remotely controlling a normal program, a hacking tool can perform malicious operations such as spreading a virus to a large number of users or sending a large amount of spam mail. Traffic threshold 420 of network communication event 400 allows for the detection and blocking of this type of attack. For example, even if a web browser is allowed to connect to the www.microsoft.com server and browse the web, if it exceeds the traffic threshold 420, which is generally set at a reasonable level, it will not meet network communication event conditions. It will not be allowed. Therefore, even if a hacking tool attempts to perform malicious actions by remotely controlling a normal program, it can be detected and blocked. In addition, such a universally reasonable level of traffic thresholds can be constructed by the service provider in the form of a program database 170 and distributed to individual users so that users can achieve this effect without any individual setting.

The program information 320 included in the program database 170 may include information such as a name of a developer or a developer of a program, a program name, a version of a program, a type of a program, and the like. By including information about the program in the program database 170, it is possible to give the user more detailed information when inquiring whether to allow events occurring in the program, which helps the user to make accurate judgments as intended. .

For example, in a conventional personal firewall, when detecting a program's communication attempt and asking the user for permission, the “msn.exe file attempted a TCP connection to port 25 of the 192.168.0.100 server. Do you allow it? ”, But the user is queried based on the limited information such as“ If you use the program information 320 included in the program database and the detailed network communication event 400 information, In version 6.0 of the MSN Messenger program, the msn.exe file attempted a TCP connection to port 25 on the mail.microsoft.com server. Would you like to allow this? ”. Therefore, the user is told that the msn.exe file is an MSN messenger program developed by Microsoft, and that the file has not been tampered with by a virus and attempts to connect to the mail.microsoft.com server, which is a trusted domain address. As it can be seen, it will be much easier to determine whether to allow as compared to the prior art as intended.

Looking at the process of determining the security policy to be applied to the event generated by the program 200 by the security policy determination unit 130 using the program database 170, the program identifier extracted from the program identifier extraction unit 120 Extracts information related to the program from the program database 170, and retrieves the security policy corresponding to the event detected by the event detector 110 from the recommended security policy 330. If the retrieved security policy is "Allow" or "Block", the security policy is determined to be the last to apply. If the detected security policy is "Query", the user is asked whether the event is allowed and the user's choice. Based on the result, the policy to be applied to the event is finally decided as "allow" or "block".

The program database 170 may be provided in a computer in which a security device using a program database according to the present invention is installed. However, the program database 170 is provided on a remote host so that the security policy determination unit 130 may use a network communication means. It is also possible to access the program database 170 residing on the remote host. As a specific example, the program database 170 exists in the server of the service provider, and the security policy determination unit 130 controls the program database 170 existing in the server through a TCP / IP socket connection or a remote connection of the database management system. You can also access it. This type of implementation has the advantage that it is always possible to use the latest program database built by the service provider.

Preferably, the security device 100 using the program database further includes a regional security policy database 160. The regional security policy database 160 functions to override the recommended security policy of the program database 170 or add a local security policy for a program not registered in the program database 170. Unlike the program database 170, which is constructed by a service provider and distributed to a user, the local security policy database 160 is preferably set up to suit a user and a usage environment independently for each individual computer. The security device using the program database according to the present invention can constitute an excellent security device from a universal point of view only with a program database 170 including a list of known programs and a recommended security policy of the program. Each time, it may be necessary to redefine the security policy of the program database 170 or add a security policy of a new program, where the local security policy database 160 is used.

5 is an exemplary diagram of a regional security policy database 160 for describing a preferred embodiment of the present invention. Referring to FIG. 5, the regional security policy database 160 includes a program identifier 510 and a local security policy 520, and preferably further includes a version association 530 setting. Local security policy 520 includes an event of the program and policy information of that event.

The program identifier 510 is a value that can uniquely identify each program and serves as an index of the local security policy database 160. In addition, like the program identifier 310 of the program database 170, it is preferable that the hash value is obtained by applying a hash function to each program module.

For example, the function of redefining the recommended policy of the program database 170 using the local security policy database 160, the policy of other process debugging event of the program whose program identifier 310 is E44F5 is “ Blocking ", or the policy of other process debugging of the program whose program identifier 510 is E44F5 is" Allow ". In this case, the setting of the local security policy database 160 functions to override the setting of the program database 170, and the security policy can be set to suit each individual user or the use environment.

For example, a function of adding a local security policy for a program not registered in the program database 170 using the local security policy database 160 will be described with reference to FIG. 5. ) Is a new program not registered, and the policy for the network communication event of the program is set to "allow". In this way, additional security policies can be set for new programs used by each individual user.

In order to redefine and add such a security policy, the security policy determiner 130 may search the event detected by the event detector 110 and the program identifier extracted by the program identifier extractor 120 as a search condition. The security policy to be applied to the event is determined using the database 160, and the security policy is determined using the program database 170 only when the security policy is not determined using the local security policy database 160. desirable. By using this method, the user can immediately apply the generally recommended security policy without any initial setting after installing the security device using the program database of the present invention on the computer, and also depending on the user or the environment. You can also change or add additional settings.

Version linkage (530) setting allows the security policy that was applied to the existing version to be applied to the newly updated program in conjunction with the existing security program even if a predetermined program is updated in the local security policy database 160. Conventional personal firewalls have not been able to link security policy settings between different versions of the same program. However, according to the present invention, it is possible to implement such functions in a reliable manner using the program database 170.

3 and 5, the operation of the version linking function will be described in detail. Referring to FIG. 5, a local security policy is set for a program whose program identifier 510 is E44F5, and version association 530 is set to "Yes". Referring to FIG. 3, the program whose program identifier 310 is E44F5 is MSN Messenger version 6.0. In this case, assuming that the user updates the MSN messenger installed in the computer from version 6.0 to version 7.0, the security policy determination unit 130 extracts the program identifier of the MSN messenger version 7.0 extracted from the program identifier extraction unit 120. The program identifiers for all versions of MSN Messenger can be extracted by searching the program database 170 using the 7526D, and the old version settings exist in the local security policy database 160 using the extracted program identifiers. In addition, local security policies for older versions of the program can be linked to and applied to newer versions of the program.

In particular, the version linking function according to the present invention is different from the conventional technology based on unreliable information such as the installation path of a program. The advantage is that you can tell exactly which files have been tampered with and are actually updated. If the file is modified by a virus or the like instead of a normal update, the hash value obtained for the program module does not exist in the program database 170 or is determined as a hacking tool to distinguish it from the normal update.

Preferably, the security device 100 using the program database further includes a basic security policy database 180. The basic security policy database 180 is basically applied when a program corresponding to the program identifier extracted by the program identifier extracting unit 120 is not registered in both the local security policy database 160 and the program database 170. Save the security policy. The basic security policy database 180 may have a universally reasonable default value as an initial value when the security device using the program database of the present invention is installed in a computer, or may be arbitrarily set by a user. The basic security policy database 180 can be set according to the security strength required for each user or environment. For example, if a high level of security is required, the default policy can be set to "block" or "query", and if a low level of security is sufficient, it can be set to "allow".

6 is an exemplary diagram of a basic policy database for explaining a preferred embodiment of the present invention. Referring to FIG. 6, the basic security policy 610 included in the basic security policy database 180 includes an event and a policy thereof. For example, if a program attempted network communication and the program is not registered in the local security policy database 160 and the program database 170, then the default security policy database 180 may be responsible for network communication events. Retrieve the policy. In this case, referring to the example of FIG. 6, the policy to be applied to the network communication event is “query”.

The security policy determiner 130 may apply the event detected by the event detector 110 from the local security policy database 160 and the program database 170 by using the program identifier extracted by the program identifier extractor 120. If the security policy is not determined, the security policy to be applied to the event is determined by using the basic security policy database 180.

The basic security policy database 180 may be implemented as a separate configurable file or a database management system (DBMS), or may be implemented as a part of program code for implementing the security policy determination unit 130.

Preferably, the security device 100 using the program database further includes a program database updater 140. The program database updater 140 updates the program database 170 of the user computer to the latest version periodically or at the user's manual request. Preferably, if the service provider constructs a program database and registers it in a server (not shown), the program database updater 140 downloads the program database from the server, updates the program database of each individual computer, and is always up-to-date. Maintain a program database. The update of the program database may be performed by downloading the entire program database each time, or may be performed in an incremental update manner. Since the related art is well known to those skilled in the art, a detailed description thereof will be omitted.

Hereinafter, a security method using a program database will be described in detail with reference to FIG. 2. In the description, the description of the parts overlapping with the above description will be omitted.

2 is a flowchart of a security method using a program database according to a preferred embodiment of the present invention.

The program database building step S110 establishes a program database 170 that stores a program identifier that can uniquely identify each program and a recommended security policy for each program for known programs.

Event detection step (S150) detects events related to security generated in the program (200).

The program identifier extracting step S160 extracts a program identifier that can uniquely identify the program that generated the event detected in the event detecting step S150.

The security policy determining step S170 may search the program database 170 based on the search condition and apply the event detected in the event detecting step S150 and the program identifier extracted in the program identifier extracting step S160 to apply to the event. Determine your security policy.

The event processing step (S180) performs a process of allowing or blocking the event using the security policy determined in the security policy determination step (S170).

Preferably, the method further includes setting a local security policy database step S130, and redefining the security policy of the program database 170 established in the program database building step S110 or not registering the program in the program database 170. Add. At this time, the security policy determination step (S170) is based on the event detected in the event detection step (S150) and the program identifier extracted in the program identifier extraction step (S160) using the local security policy database 160 as a search condition. It is preferable to determine the security policy to be applied and to determine the security policy using the program database 170 only when the security policy cannot be determined using the local security policy database 160.

Preferably, the method further includes a basic security policy database setting step (S140), wherein a program corresponding to the program identifier extracted in the program identifier extracting step (S160) is registered in the local security policy database 160 and the program database 170. Set the security policy to apply by default when it is not. At this time, the security policy determination step S170 is based on the event detected in the event detection step S150 from the local security policy database 160 and the program database 170 using the program identifier extracted in the program identifier extraction step S160. If the security policy to be applied is not determined, the security policy to be applied to the event is determined using the basic security policy database 180.

Preferably, the program database update step S120 is further included. The program database 170 existing in the remote server is downloaded and the program database 170 stored in the computer is updated to the latest version.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. It should be understood that the technical spirit of the present invention to the extent that various changes or modifications can be made by those skilled in the art.

1 is a block diagram of a security device using a program database according to a preferred embodiment of the present invention;

2 is a flowchart of a security method using a program database according to a preferred embodiment of the present invention;

3 is an exemplary diagram of a program database for explaining a preferred embodiment of the present invention;

4 is an exemplary diagram showing an example of detailed conditions of the network communication event and policy 333 of FIG.

5 is an exemplary diagram of a regional security policy database for explaining a preferred embodiment of the present invention;

6 is an exemplary diagram of a basic policy database for explaining a preferred embodiment of the present invention.

<Description of Major Reference Marks in Drawings>

100: security device using the program database

Claims (3)

A security device installed on your computer that controls the operation of a program. A program database that stores a program identifier that can uniquely identify each program for known programs and a recommended security policy for each program; An event detector for detecting an event of a program executed in a computer; A program identifier extractor configured to extract an identifier of a program that generated the event detected by the event detector; A security policy determination unit that searches a program database based on a search condition of a program identifier extracted by the program identifier extraction unit and an event detected by the event detection unit, and determines a security policy to be applied to the event; An event processing unit allowing and blocking the event according to a security policy determination result of the security policy determination unit; Virtual fire protection device for a cloud computing environment comprising a. The method of claim 1, A local security policy database for overriding a recommended security policy of the program database or for adding a local security policy of a program not stored in the program database; More, The regional security policy database includes a program identifier capable of uniquely identifying a program and a local security policy of the program, The security policy determiner determines a security policy to be applied to the event by searching a local security policy database before the program database based on a program condition extracted from the program identifier extractor and an event detected by the event detector. Virtual fire protection device for a cloud computing environment, characterized in that. A security method installed on your computer that controls the operation of a program. A program database construction step of constructing a program database for storing a known program identifier and a recommended security policy of each program for each known program; An event detecting step of detecting an event of a program executed in the computer; A program identifier extracting step of extracting an identifier of a program that generated the event detected in the event detecting step; A security policy determination step of determining a security policy to be applied to the event by searching a program database based on a search condition of the program identifier extracted in the program identifier extraction step and the event detected in the event detection step; An event processing step of allowing and blocking the event according to a security policy determination result of the security policy determination step; Virtual fire prevention method for a cloud computing environment comprising a.

Images