KR20190051194A - Self defending safety system based on task list, Method thereof, and Computer readable storage medium having the same method - Google Patents

Abstract

The present invention relates to a technique for preventing intrusion of a virus and/or a hacker of a small and light weight device. More specifically, provided are a task list-based a self-defense system determining whether a task list is self-polluted based on an executing task list to self-restore when the task list is polluted, and comparing and verifying a block of a storage medium to carry out self-restoration, and a method thereof. According to the present invention, since the device can self-defense itself, a manager does not have workload, and the hacking attempt is disabled because the intrusion attempt is totally blocked.

Description

TECHNICAL FIELD The present invention relates to a task list-based self-defense safety system, a method thereof, and a computer readable storage medium storing the method.

The present invention relates to a technique for preventing intrusion of a virus and / or a hacker of a small lightweight device, and more particularly, to a technique for preventing self-contamination of a task list based on a task list to be executed, And a task list-based self-defense security system and method for self-restoring a block of a storage medium by comparing and verifying blocks of a storage medium.

As the introduction of the Internet of Things (IoT) technology is rapidly increasing worldwide, security threats targeting various IoT devices are increasing day by day. Global research firm Gartner predicts that IoT devices will expand rapidly in the future, with global IOT devices growing to 8.4 billion units in 2017 and 24 billion units in 2020.

However, since a large number of IoT devices are closely related to an individual's life, if an attack occurs, it may threaten a user's life beyond simple information leakage or financial damage.

Hacking is an act that illegally accesses the weak security system of the network and has a detrimental effect on the operation on the terminal. To manipulate the code of the driven device arbitrarily, or to make the device operate in an unintended manner by planting the code secretly. The threat of hacking, aimed at various IoT devices connected to a network, is increasing day by day.

There are various firewall products that prevent hacking in the network, but it is a reality that various hacking cases that are invaded by bypassing them are occurring. In addition, it is difficult to actively defend against hackers because various virus variants continue to arise, and it is difficult to proportionally increase the number of employees operating and managing the network because many devices are connected to the network.

In conclusion, embedded and IoT devices can be used as hacker intrusions whenever security is not secured.

Therefore, data collection, vulnerability analysis and evaluation, and complementary countermeasures are needed for the increasingly intelligent hacker intrusion. Therefore, it is the biggest problem of the conventional technology that many labor and equipment are required.

In order to analyze and evaluate the vulnerability, it is necessary to manage the information protection as a whole and to maintain the physical control continuously. Finally, even if a certain attack pattern is defended, it is impossible to respond to a new vulnerability due to a newly occurring virus, a variant virus, or a defect. Therefore, since it is always exposed to security threats, it is technically necessary for the administrator to continuously update security patches. In other words, there is a managerial difficulty to constantly update security patches.

Since variant or new intrusion techniques can make multiple intrusion attempts, intrusion prevention products can be detected, but administrators can not think of the actual intrusion results and can think and ignore them as false positives.

In order to prevent new vulnerabilities from occurring, it is necessary to monitor the administrator carefully.

This can be difficult.

Embedded and IoT devices must operate with lightweight resources, so simple but powerful defense capabilities are required.

1. Korean Registered Patent No. 10-1380908 (Registered on Apr. 31, 2014) 2. Korean Registered Patent No. 10-0998284 (Registered on November 29, 2010) 3. Korean Registered Patent No. 10-1679578 (Registered on Nov. 31, 2016)

The present invention relates to a task list-based self-defense safety system and method for self-restoring self-corruption of a task list based on a task list, The purpose is to provide.

In addition, the present invention provides a task list-based self-defense safety system and method capable of self-defense with immediate execution denial by causing only a task list-based task to be executed at the time of execution without requiring the administrator's judgment or monitoring There is a purpose.

Further, according to the present invention, the presence or absence of an infection

Another object of the present invention is to provide a task-list-based self-defense safety system and method capable of executing a task immediately when there is no abnormality and returning a device block in a normal state when an abnormality occurs.

Also, according to the present invention, since the self-defense is executed by comparing the task list and the storage medium periodically at a time when there is no load on the network and judging whether or not the host computer is hacked, a task list based self-defense safety system and method There is another purpose to provide.

The present invention also relates to a task list-based self-defense security system capable of comparing a task list with a storage medium to delete an infected block when the infected block is installed and copying the normal block when the normal block is modified or deleted by intrusion, System, and method.

In order to achieve the above object, according to the present invention, there is provided a task list for self-restoring a task list based on a task list, Based self-defense safety system.

The task list-based self-defense safety system comprises:

A task list block for managing task list information indicating a device name and a module name to be executed;

A hash block storing hash functions for infecting defenses; And

Judges whether the corresponding module is infected by using the task list block and the hash block at the execution time of the corresponding module of the corresponding device, executes the corresponding module according to the determination result, or executes the primary self-defense mode, Recovery self-defense block.

Also, the task list-based self-defense security system may include a timer for managing preset schedule information; And a daily defense block that performs a list check of whether or not the task list information is contaminated according to the schedule information and then copies normal task list information or executes a secondary self defense mode .

In this case, the secondary self-defense mode may read the corresponding module, determine whether the corresponding module is infected, and execute one of maintenance, copy, and deletion of the corresponding module according to the determination result.

The restoration may be performed by copying a normal module of the other device from another device in the vicinity.

In addition, another apparatus nearby may be the same as the apparatus.

The device name may be a device name that identifies the presence or absence of the same device.

Also, the self-defense block may use the index value of the task list information to determine whether the infection is infected.

Also, in the primary self-defense mode, a check list is executed for the task list information to determine whether or not the task list information is contaminated. If there is a pollution, a normal module is copied. If there is no contamination, normal task list information is copied .

In addition, the contamination of the task list information may be determined by comparing the device name value of the task list information with the result of the hash result value for each module.

In addition, the infection of the corresponding module may be a match between the module value of the corresponding module and the hash result value of the corresponding module.

On the other hand, another embodiment of the present invention is a method of managing task list information, comprising the steps of: (a) managing task list information indicating a device name and a module name to be executed; (b) the hash block storing hash functions for infectious defense; And (c) determining whether the self-defense block is infected with the corresponding module using the task list block and the hash block at the execution time of the corresponding module of the corresponding device, executing the corresponding module according to the determination result, And restoring the module to its original state by executing the task-list-based self-defense function.

On the other hand, another embodiment of the present invention can provide a computer-readable storage medium storing program code for executing the above-described task list-based self-defense safety control method.

Conventional hacking technology has a lot of workload to monitor the system and protect the system from the threats of variants and new viruses and hackers. However, according to the present invention, since the device itself can self-defense, Hacking attempts are disabled because the intrusion attempts are blocked.

In addition, as another effect of the present invention, new and variant threats are updated through continuous technical support such as a conventional hacking protection product, and there is no need for technical support costs and no technical support costs are incurred .

Another advantage of the present invention is that the device itself can be defended without the control of a manager or a central server, simplifies the processing and does not require a large amount of resources, so that simple and strong defense is possible.

1 is a block diagram of a task-list-based self-defense security system 100 according to an embodiment of the present invention.
FIG. 2 is a detailed block diagram of the self-defense block 120 shown in FIG.
3 is a detailed block diagram of the daily defense block 140 shown in FIG.
FIG. 4 is a flowchart illustrating a self-defense execution process of the self-defense block 120 shown in FIG.
FIG. 5 is a flowchart showing a detailed procedure of the checker step S460 shown in FIG.
FIG. 6 is a flowchart showing a detailed procedure of the copying steps (S471 and S472) shown in FIG.
Fig. 7 is a schematic diagram showing the arrangement of common neighboring devices.
FIG. 8 is a flowchart showing the daily defense execution process of the daily defense block 140 shown in FIG.
FIG. 9 illustrates an example of pollution judgment of a task list according to an embodiment of the present invention.
10 is an embodiment of a storage medium contamination judgment according to an embodiment of the present invention.
11 is an embodiment showing the principle of daily pollution detection according to an embodiment of the present invention.
12 is an example of error detection according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Like reference numerals are used for similar elements in describing each drawing. The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The term " and / or " includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Should not.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a task list-based self defense system and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a task-list-based self-defense security system 100 according to an embodiment of the present invention. 1, the task list-based self-defense security system 100 includes a task list block 130 for managing task name information, a task list information indicating a module name to be executed, a hash block 150 ), Judges whether the infection is infected using the task list block and the hash block at the execution time of the module, executes the first self-defense mode according to the determination result, restores the module to its original state or executes the self- (120) for checking the task list block according to preset schedule information, and a daily defense block (140) for executing a secondary self-defense mode according to whether the task list block is normal using the external recovery mode or the task list block and the hash block A timer 131 for providing schedule information, a control block 110 for controlling these components, and the like Lt; / RTI >

Here, the task list block 130 performs a function of managing a device name for classifying the presence or absence of the same device and a module name to be executed.

The hash block 150 has hash functions to protect against infection from the outside.

The timer 131 performs a function of managing a schedule at a time when there is no load. In other words, according to the schedule, the defensive block 140 performs daily self-check of the device to prevent contamination, and if it becomes contaminated, it copies the same as the original state from the neighboring device, Devices self-defend themselves.

The self-defense block 120 compares the module value in the task list block 130 and the hash result value of the corresponding module of the hash block 150 when the module of the device is executed, Run the module and, if it is determined to be infected, run self-defense mode to restore the device to its original state.

At night time, the device performs a self-check on the defensive block 140 every day to prevent contamination, and if contaminated, it copies itself as if it were from nearby devices and self-defends itself to the devices themselves without the help of a central server.

The index of the task list block 130 is used to quickly determine whether the device is infected and the hash block 150 is used to determine whether the storage medium is contaminated. If the device value of the task list is modulated to match the module value, there is no possibility of decrypting and encrypting the two hashes again. Therefore, it is possible to determine whether the device is contaminated based on the task list (List).

FIG. 2 is a detailed block diagram of the self-defense block 120 shown in FIG. Referring to FIG. 2, the self-defense block 120 includes a determination unit 210 for determining whether a pollution has occurred, an execution unit 220 for executing a corresponding module according to the determination result, And a copying unit 230 for recovering and defending it immediately.

The determination unit 210 compares the hash result value of the hash block 150 and the module value in the task list block 130 when the execution request of the module is requested, and determines whether the hash is polluted. If the values match, the corresponding module is executed. If the values are different, it is necessary to determine whether the task list block 130 is contaminated or the module is contaminated.

The execution unit 220 performs a function of executing the module if there is no contamination according to the determination result of the determination unit 210. [ The copying unit 230 copies the normal module if it is contaminated according to the determination result of the determination unit 210, and restores the module to its original state.

3 is a detailed block diagram of the daily defense block 140 shown in FIG. Referring to FIG. 3, the daily defensive block 140 is a secondary self-defense that utilizes a load-free time according to a desired cycle. In the case where a high-level hacker decodes a hash by modulation and / Check the device task list (List) for contamination and self-defense. To this end, the daily defensive block 140 checks whether or not the task is contaminated, compares the hash result value of the storage medium module read according to the check result with the device value of the task list, A copying unit 320 for copying and restoring a normal module of the other device from another device in the vicinity, and the like.

FIG. 4 is a flowchart illustrating a self-defense execution process of the self-defense block 120 shown in FIG. 4, when the module is executed according to the execution command of the module, the self-defense block 120 compares the hash result value of the hash block 150 with the device value in the task list block 130, (Steps S410, S420, S430, S440). That is, a process of checking whether the module is contaminated is executed first.

In step S440, the self-defense block 120 executes the corresponding module if the values match, according to the determination result (step S450).

Otherwise, in step S440, if the values do not match according to the determination result, the self-defense block 120 checks the list of the task list block 130 to determine whether or not the task list information is contaminated (step S460 ). That is, the process of checking the contamination status of the task list information managed in the task list block 130 is executed.

After the list is checked, it is judged whether or not there is contamination of the task list information. If there is pollution, the normal module is copied. If there is no pollution, normal task list information is copied (steps S470, S471 and S472). That is, if the check result of the listener is "M", the normal module is copied and immediately defended through the copy module. If the check result of the listener is "L", the copy module copies the normal task list information, To be automatically restored.

The following table is an example of judging whether task list information or module of the storage medium is contaminated.

turn Execution Command Module Task List Remarks
Module name Hash result value Module name Device value One Module 1 hA Module 1 hA Normal, immediate execution 2 Module 2 hB Module 2 hC Judge contamination, run ListSelfCheck

Sequence number 1 is executed immediately because it is the same as "hA" which is the module 1 hash result value and "hA" which is the value of module 1 of the task list. Sequence number 2 is the execution result of module 2 hash result value "hB" Because the value "hC" is different, run ListSelfCheck to determine which is polluted.

FIG. 5 is a flowchart showing a detailed procedure of the checker step S460 shown in FIG. Referring to FIG. 5, the checker of the listener is a self check method for determining whether any of the information in the task list information or the storage medium is contaminated. In order to speed up the judgment, the index of the task list information and the hash result value are used to check the contamination of the task list first, thereby reducing the contamination determination time.

The device name value of the task list information is compared with the result of the hash result value for each module to determine whether they match or not (steps S510 and S520).

In step S510, if the result of the determination is affirmative, the task list is normal and therefore returns " M "; otherwise, the task list is contaminated.

FIG. 6 is a flowchart showing a detailed procedure of the copying steps (S471 and S472) shown in FIG. In particular, FIG. 6 is a process that can be self-protected if it is judged as contamination without depending on an administrator or a central server. Referring to FIG. 6, only the device values of the task list are compared in a plurality of neighboring devices, and the most device values are assumed to be true values. Even if it is modulated, this assumption is possible because ListSelfCheck determines the contamination.

Task list information of neighboring distance devices among the task list (List) selected as a true value is collected (step S610). Among the collected task list information, the nearest device selects the most same value as the task list, and checks whether there is a pollution through a list check (steps S620, S630, S640).

If it is determined that there is no abnormality in the task list information as a result of the check by the listener, the actual normal module is copied or the normal task list (List) information is copied according to the transfer value (steps S650, S651, S652). A diagram showing the concept of such list self check is shown in FIG. 9 will be described later.

It is unlikely that a plurality of task lists (List) of neighboring apparatuses are modulated. To modify the task list, it is very unlikely to decode the hash. Because, if you can not decrypt with a single intrusion, you will try several times, but it will not be decrypted because it will be blocked every time you try.

Fig. 7 is a schematic diagram showing the arrangement of common neighboring devices. Referring to FIG. 7, the first to third neighboring devices A1 to A3 may be disposed in the vicinity of the device A. Of course, the first to third nearby devices A1 to A3 have the same configuration as the device A. [

FIG. 8 is a flowchart showing the daily defense execution process of the daily defense block 140 shown in FIG. Referring to FIG. 8, a secondary self-defense mode is executed using a load-free time according to a desired period. That is, in order to prevent tampering and / or intrusion by decrypting a hash function, a high-level hacker checks whether or not the task list of the apparatus is contaminated and performs self-defense.

Referring to FIG. 8, the daily defensive block 140 performs a check by the listener according to a predetermined period of schedule information (step S810). That is, the process of checking the contamination of the task list information managed in the task list block 130 is executed before reading the module of the storage medium. After checking the task list (List) so that there is no contamination in the task list (List), self defense for the module of the storage medium is proceeded.

After the list is checked, it is judged whether or not the task list information is contaminated. If there is pollution, the normal list information is copied. If there is no contamination, the module of the storage medium is read (steps S820, S821 and S830).

Thereafter, the module is read and the module value of the module is compared with the hash value (step S840). If the module value of the corresponding module and the hash value match as a result of the comparison, the corresponding module is maintained (step S850). Otherwise, the normal module is copied or the corresponding module is deleted (step S841). A diagram showing this concept is shown in Fig. 12, and Fig. 12 will be described later.

FIG. 9 illustrates an example of pollution judgment of a task list according to an embodiment of the present invention. Referring to FIG. 5 and FIG. 9, Table 2 shown in FIG. 9 is a case of Sequence No. 2 in Table 1 as an embodiment in which the apparatus is judged to be contaminated and ListSelfCheck is executed. In the case of Task List (List) 1, when requesting module A with sequence number 1, the value of h1B, which is the hash value of module A and module B of task List1, is different from that of device List1.

In case of task list 2, it is regarded as contamination of task list because it is different from h1B value which is the hash result value of module A and module B of task list 2 and hAB which is the device value of task list 2 when executing module B of order number 2.

Task List2 is judged to be contaminated because both module A value and module B value are modulated.

In case of task list3, it is regarded as modification of task list because it is different from hA2 value which is the hash result value of module A and module B of task list3 and h3 which is the device value of task list3 when module B of order number 2 is executed. In case of Task List3, it is judged that Task List is contaminated because two values of device value and module B are modulated.

In the case of modulating the device values of the task list and modifying the device values to match the values, it is impossible to decrypt the two hash modules and re-encrypt them.

10 is an embodiment of a storage medium contamination judgment according to an embodiment of the present invention. 10 is an embodiment in which it is judged that the apparatus is contaminated and the list is checked (ListSelfCheck), and the module of the storage medium is modulated and judged as contamination.

In the case of the storage medium modulation 1, the hash value h1B of the module AB of the stored mixture modulation 1 is different from the device value hAB of the task list when the module A of the order number 1 is executed. Therefore, the execution is performed by the modulation of the module A of the storage medium modulation 1 And transmits the indication "M" indicating the contamination of the module.

In the case of the storage medium modulation 2, since the hash value hA2 of the module AB of the storage medium modulation 2 is different from the hAB, which is the device value of the task list, when the module B of the sequential number 2 is executed, Quot; M " indicative of contamination of the execution module.

Modifying the device value and the device value of the task list and modulating the module so that the hash value of the executable module of the storage medium coincides therewith is a case where it is almost impossible to decode the three hash modules by modulating them so that the values are matched no possibility.

11 is an embodiment showing the principle of daily pollution detection according to an embodiment of the present invention. Referring to FIG. 11, the principle of judging contamination at the time of comparison is whether or not the task list and the storage medium module coincide with each other. As in the case of sequence number 1, it is in the task list, but it does not exist in the task list as in the case where there is no module in the storage medium or in the case of sequence number 2, but the module of the storage medium exists. In case of No. 3, it treats the same concept as self defense as above.

12 is an example of error detection according to an embodiment of the present invention. Referring to FIG. 12, in case of Daily Error, the value hb of the task list (List) and the hash value hd of the storage medium module are different with respect to the module name A in the case of the order number 2, ListSelfCheck). In case of Sequence # 3, copy the medium and delete the C module with only the storage medium because there is no module name in the task list but it is not in the storage medium.

The terms " to block ", " to ", " module ", etc. in the specification mean units for processing at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software.

(DSP), a programmable logic device (PLD), a field programmable gate array (FPGA), a processor, a controller, a microprocessor, and the like, which are designed to perform the above- , Other electronic units, or a combination thereof. In software implementation, it may be implemented as a module that performs the above-described functions. The software may be stored in a memory unit and executed by a processor. The memory unit or processor may employ various means well known to those skilled in the art.

The task-list-based self-defense safety control method according to the present invention can be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination.

The program code (command) recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

The medium may be a transmission medium such as an optical or metal line, a wave guide, or the like, including a carrier wave for transmitting a signal designating a program command, a data structure, or the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

100: Self-defense system based on task list
110: Control module
120: self defense module
130: Task list block
140: Daily defense block
150: Hash block
210: determination unit 230:
220:

Claims (20)

A task list block for managing task list information indicating a device name and a module name to be executed;
A hash block storing hash functions for infecting defenses; And
Judges whether the corresponding module is infected by using the task list block and the hash block at the execution time of the corresponding module of the corresponding device, executes the corresponding module according to the determination result, or executes the primary self-defense mode, Self-defense block to recover;
Wherein the task-list-based self-defense security system comprises:
The method according to claim 1,
A timer for managing preset schedule information;
And a daily defense block for performing a list check of whether or not the task list information is contaminated according to the schedule information and copying normal task list information or executing a secondary self defense mode. Based self - defense safety system.
3. The method of claim 2,
Wherein the second self-defense mode reads one of the modules, judges whether the corresponding module is infected, and executes one of maintenance, copy, and deletion of the corresponding module according to the determination result. .
The method according to claim 1,
Wherein the recovery copies the normal module of the other device from another device in the vicinity.
5. The method of claim 4,
And the neighboring device is the same as the corresponding device.
The method according to claim 1,
Wherein the device name is a device name that identifies the presence or absence of the same device.
The method according to claim 1,
Wherein the self-defense block uses an index value of the task list information to determine whether the infection is infected.
The method according to claim 1,
In the primary self-defense mode, the list-checker of the task list information is checked to determine whether or not the task list information is contaminated. If there is contamination, the normal module is copied. If there is no contamination, normal task list information is copied A task-list based self-defense safety system.
The method according to claim 3 or 8,
Wherein the contamination of the task list information is determined by comparing a device name value of the task list information with a result of a hash result value for each module.
The method according to claim 1,
Wherein the infection of the corresponding module is a match between a module value of the module and a hash result value of the corresponding module.
(a) managing task list information indicating a device name and a module name to be executed in the task list block;
(b) the hash block storing hash functions for infectious defense; And
(c) The self-defense block determines whether the corresponding module is infected by using the task list block and the hash block at the execution time of the corresponding module of the corresponding device, executes the corresponding module according to the determination result, And restoring the module to its original state;
Wherein the task-list-based self-defense safety control method comprises:
12. The method of claim 11,
(d) managing schedule information in which a timer is preset;
(e) the daily defense block performs a list check of whether the task list information is contaminated according to the schedule information, and then copies the normal task list information or executes the secondary self-defense mode A task-list-based self-defense safety control method characterized.
13. The method of claim 12,
Wherein the second self-defense mode reads one of the modules, judges whether the corresponding module is infected, and executes one of maintenance, copy, and deletion of the module according to the determination result. Way.
12. The method of claim 11,
Wherein the recovery copies the normal module of the other device from another device in the vicinity.
12. The method of claim 11,
Wherein the device name is a device name that identifies the presence or absence of the same device.
12. The method of claim 11,
Wherein the self-defense block uses the index value of the task list information to determine whether the infection is infected. The method according to claim 1,
In the primary self-defense mode, the list-checker of the task list information is checked to determine whether or not the task list information is contaminated. If there is contamination, the normal module is copied. If there is no contamination, normal task list information is copied A task-list-based self-defense safety control method characterized.
The method according to claim 13 or 18,
Wherein the contamination of the task list information is determined by comparing a device name value of the task list information with a result of a hash result value for each module.
12. The method of claim 11,
Wherein the infection of the corresponding module is a match between a module value of the module and a hash result value of the corresponding module.
A computer-readable storage medium storing program code for executing a task-list-based self-defense safety control method according to any one of claims 11 to 19.

Images