KR20110055081A - Method of protecting integrity of computer - Google Patents

Abstract

PURPOSE: A method for protecting the integrity of a computer is provided to efficiently prevent the illegal file writing operation by monitoring the operation of a computer file. CONSTITUTION: A method for protecting the integrity of a computer comprises the steps of: installing a program at a computer having no virus; generating an authentication file list of the program(S201); scanning all files existing in the computer(S202); judging the existence of a scan-target file(S203); extracting the information which is supposed to be stored in the authentication file list DB(S204); adding the information to the authentication file list DB(S205); and terminating the generation procedure of the authentication file list of the scan-target file(S206).

Description

{Method of protecting integrity of computer}

TECHNICAL FIELD The present invention relates to computer software and computer security, and in particular, monitors an operation (file event) such as writing or executing on a computer, and compares it with a list of previously created authentication files (such as a simple text file or a database file). If the file violates (unauthenticated), the computer integrity protection method that blocks the action to ensure that only authorized files exist on the computer at all times. Backdoor, virus, and malware (by malicious hacking) Its purpose is to protect the integrity of the computer by blocking the execution and writing of files with malicious purposes.

In general, in order to hack into a computer and infect a virus or use it as a host for a DDOS attack, it is necessary to first copy and execute files for this purpose on the computer. Current anti-virus programs can't diagnose malicious files with unknown new patterns, and malicious files created on these computers can be infected by viruses or other DDOS attacks on other computers. Also wears. As such, the technology used in the existing anti-virus products cannot prevent the attack of unknown new malicious files. Of course, for malware with unknown patterns, anti-virus products will update the pattern after they have obtained a sample, but it's possible that the computer is not always safe from new malware or hacking attacks because it is likely that the infection has already spread. It is a reality.

The present invention was devised to improve the conventional problems as described above, and events, such as creation or execution, are generated, rather than an after-measure to determine whether the file is a malicious file through pattern recognition, such as an existing anti-virus. It is a method to protect the integrity of the computer so that the file always violates the integrity of the computer to ensure that the computer is always in an intact state. Its purpose is to block activities such as backdoor creation and virus infection by hacking.

When the program is installed in a computer, the system according to the present invention scans all files (or only necessary files such as executable files) existing in the computer, extracts information necessary for authentication such as a full path of a file, a signature, and the like, and lists the authentication files. It includes an authentication file list builder (creation) module that writes to a database, and the authentication file list does not necessarily need to exist locally, but may exist remotely for security reasons.

In addition, the module includes a monitoring module that monitors, authenticates, and blocks file operations, and the monitoring module may be configured as a driver that monitors file events or a DLL that hooks an API. In this way, it may be implemented as a module that performs a function of the corresponding purpose.

Preferably, the monitoring module adds or updates the authentication file list database according to the situation if the event generating file or the parent file of the event generating file is a file in the authentication file list when the file event occurs, and the files are frequently updated such as a web server. For this case, the policy may be defined in advance, and a module that performs a function of processing a procedure according to the policy, such as not blocking a file that meets the policy, may be included. It may be configured to be.

Preferably, the predefined policy is similar to the policy setting of general security products (firewalls, intrusion prevention systems, intrusion prevention systems, etc.) such as blocking and allowing file events according to IP, blocking and allowing file events by rank, and the like. It can be configured to include a policy configured in a way.

Preferably, the system may be implemented or configured to be applied to various platforms such as various operating systems and various mobile phones, smart phones, and embedded systems.

As described above, the present invention has the effect of blocking malicious purposes such as backdoor infiltration, virus infection, host of DDOS, etc. for the purpose of protecting the integrity of the computer.

On the other hand, the present invention is not limited to the specific details for the practice of the following invention, anyone of ordinary skill in the field of the invention without departing from the gist of the invention claimed in the claims various modifications Would be possible.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms or words used in the specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly explain the concept of terms in order to best explain their own invention. Based on the principle that can be defined, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention. Therefore, it is not intended to represent all of the technical idea of the present invention, it should be understood that there may be various equivalents and modifications that may replace them at the time of the present application.

1 is a conceptual diagram illustrating a system according to the present invention.

First, the file scan module scans all files of the computer (S101) and adds them to the authentication file list DB (S102), and the monitoring module (S104) searches for the file (S103) in which the event occurred in the authentication file list DB (S102). If file authentication fails, blocking the file event (S105) is a basic concept of the present invention.

2 is a flowchart illustrating a process of generating a list of authentication files when installing a system according to the present invention.

First, install this program on a clean computer that is free of any virus or malware. When the administrator starts to generate the authentication file list of the program at the time of installation or later (S201), all files existing in the computer are scanned (S202) to determine whether a file to be scanned exists (S203). Then, the information to be stored in the authentication file list DB (path, signature that can be uniquely identified, such as MD5) is extracted (S204) and added to the authentication file list DB (S205). If the file to be scanned no longer exists, the generation of the authentication file list is terminated (S206).

Creating a list of authentication files can be a bit cumbersome, but only one installation is performed at the time of installation, and additional authentication files are added automatically. However, if it is not the first time and the administrator wants it for a special reason such as damage of the authentication file list DB, it can be rebuilt (regenerated).

3 is an operation flowchart illustrating a process of monitoring and authenticating a file by a monitoring module.

After the authentication file list DB is generated as described above, the monitoring function of the program is started (S301) to protect the integrity of the computer.

To this end, all file events generated are monitored (S302), and if a file event occurs (S303), first determine whether a parent process exists (S304), and if the parent process does not exist, extract file authentication information (S306). Access the authentication file list DB and search whether there is the same authentication information (S307). Based on the search result, it is determined whether the file is an authenticated file (S308). If the file is not authenticated, the file event is blocked (S310). If the file is an authenticated file (S309), the file event is detected because the parent process does not exist. It executes normally (S312).

In this general case, if the file where the event occurred is not in the authentication file list DB, it is a relatively simple process to block the event. In this case, if a normal program such as Microsoft Windows Update creates a new file that is not in the authentication file list DB, and executes this file, the event will be blocked because this file is not in the authentication file list DB. In practice, however, it should not be blocked because it is a normal procedure for contents executed by a normal program such as Microsoft Windows Update. To solve this problem, the present invention assumes that Microsoft Windows Update is a parent process, and if the parent process exists in the authentication file list DB (authenticated), the operation performed by the parent process is regarded as a normal procedure. The file created by the parent process will also be considered a normal file and added to the authentication file list DB.

In fact, when a file event occurs by a normal procedure such as Microsoft Windows Update (S303), it is determined whether a parent process (here, Micorsoft Windows Update) exists (S304), and if so, extracts authentication information of the parent file (S305). Then, access to the authentication file list DB to search for the same authentication information (S307). Based on the search result, it is determined whether the file is an authenticated file (S308). If the file is not authenticated, the file event is blocked (S310). If the file is authenticated, it is determined whether the parent process exists and the file is generated at the same time. (S309) If this condition is satisfied, this file must also be authorized, so for this purpose, the file authentication information is extracted and added to the authentication file list DB (S311), and then the file event is normally executed (S312).

In addition, since the execution event of the file may be executed only when the file exists, it is added to the authentication file list DB in the process of generating a file before the execution event occurs, thereby determining whether the parent process exists and simultaneously generates the file (S309). ) Condition is required, but if the file is modified to be added to the authentication file list DB in the course of another file event, the condition of S309 may be modified when a file event other than the file creation event occurs. As such, the present invention will not necessarily be implemented according to the above-described flows, and various changes can be made by those skilled in the art without departing from the gist of the present invention claimed in the claims. will be.

1 is a conceptual diagram illustrating a system according to the present invention;

2 is an operation flowchart for explaining a process of generating a list of authentication files when installing a system according to the present invention;

3 is an operation flowchart for explaining a process of monitoring and authenticating a file by a monitoring module;

Claims (5)

When a file event occurs on your computer, such as executing a file or writing a file, Extracting information necessary for authentication from the file to identify whether the file is an authenticated file; If the extracted information necessary for authentication is in the authentication file list, the file proceeds with the event if the file is in the authentication file list, and if the file is not in the authentication file list, the file is always on the computer by blocking the event. And also allow only authorized file events to be executed. The method of claim 1, wherein the authentication file list is pre-created by scanning all files (or only necessary files) of the computer to extract information necessary for authentication, and may be dynamically updated. Computer system. The method of claim 1, further comprising: extracting information necessary for authentication from the file or from a file of a parent process of the file when a file event occurs; If the extracted authentication information is in the authentication file list and the file or the parent process file is an authenticated file, proceed with the event and add or update the file to the authenticated file list, and if the file is not authenticated, the event Computer system, characterized in that for blocking. 2. The computer system of claim 1, wherein the list of authorized files may exist locally for faster speed, and may be external and remotely accessed for security. 2. The computer system of claim 1, wherein the event is blocked according to a predefined policy to prevent blocking a normal event.

Images