KR20200013013A - System and method for anti-fishing or anti-ransomware application - Google Patents

Abstract

Provided is an external attack protection system. The external attack protection system comprises: a network file server; and a network file server (NFS) client installed in a user terminal or a service server and communicate-connecting with the network file server remotely located. The network file server determines whether or not it is eligible for at least one of user information and program information which has requested access or open when there is a request to access or open from the NFS client regarding an archive file in the network file server mounted on the user terminal or the service server in the form of a network drive; and blocks access to the file for which access is requested or provides the file for which open is requested to the NFS client only in a read-only mode when an ineligible determination is made according to the result of the determination. Accordingly, there is no need to perform backup operations from time to time to prepare for ransomware.

Description

How to stop phishing or ransomware attacks and systems {SYSTEM AND METHOD FOR ANTI-FISHING OR ANTI-RANSOMWARE APPLICATION}

The present invention is directed to a method and system for blocking phishing or ransomware attacks.

As phishing and ransomware distributed by hackers becomes more diverse, users' data is increasingly threatened. In general, phishing is an attack that leaks data stored in a user's terminal, and means an attack to steal account information, electronic certificate, and main data existing in the user's terminal. In addition, ransomware refers to an attack technique that requires money after encrypting data stored in a user's terminal or stored in a connected network storage so that the user cannot access it. In recent years, the method and format have been diversified from disabling data after a user leaks it to manipulating the disk partition of the terminal to prevent the user from using the PC terminal at all.

Conventional methods to counter this phishing attack used a technology that encrypts the storage space on the PC and checks whether the process accessing the specific storage space is a predetermined process, but even if the storage space is encrypted, the encrypted storage space is used. There is a case where the file constituting the file is taken and decrypted.

In addition, the existing method to counter the ransomware attack is to periodically back up the data in the PC to a safe storage area to retrieve the backed up data even if the PC is caught by ransomware. However, even with this method, there is a problem that the loss of files that have been recently worked cannot be avoided. Another existing method is to register the process that accesses the file server in advance and only the authorized processes in the PC can access the data, thereby preventing the unregistered process from accessing the data so that the ransomware process can access the data. There is a way to prevent this. However, this method has a disadvantage in that it is necessary to register an authorized process in advance, and when a program is installed from time to time, there is a limitation in that the process cannot be registered cumbersomely every time.

Recently, ransomware itself does not only encrypt data stored in the PC, but also encrypts the entire PC or requires a ransom money by encrypting the entire disk mounted on the PC. There is a situation that is not enough anymore.

In addition, attacks that encrypt not only PCs but also entire data on Linux or Unix service servers at once are necessary, requiring a fundamental alternative. Therefore, in order to prevent phishing, a new technology is needed to prevent an attack caused by ransomware even if the ransomware is run on a PC or service server while preventing encrypted storage spaces created on the PC or service server.

The present invention provides a drive and a client program that allows a network file server to be connected from a PC or a service server so that the file server allows access when only a predetermined program accesses a file in the storage space. Can effectively prevent phishing and create files on the PC or service server that are not normally located on the network drive. It provides a method and system to effectively block ransomware by providing files to PC or service server only in read-only mode to prevent encryption, modification, and deletion. More specifically, a custom file system driver is installed on a PC or service server so that files and folders stored in the network file server can be mounted and used as drives or partitions.

A network file server provides a method and system for making a file inaccessible unless a specific program or folder in the network file server is accessed through a predefined program. If a file open request is made within a drive mounted on a PC or a service server, the network file server can open the file to the PC only in read mode unless the file is set in edit mode to write to a specific file or folder. Provide a system.

According to an aspect of the present invention, a phishing or ransomware attack blocking system, Network file server; And an NFS client (Network File Server Client) installed in a user terminal or a service server and communicatively connected to the network file server located remotely, wherein the network file server is mounted on the user terminal or service server in the form of a network drive. If there is an access or open request from the NFS client regarding the archived file in the network file server, it is determined whether the user is eligible for at least one of the user information and the program information that made the access or open request, and according to the determination result When a determination is made, a phishing or ransomware attack blocking system is provided that blocks access to the requested file or provides the open requested file to the NFS client only in read-only mode.

According to another aspect of the present invention, a ransomware attack blocking system, the network file server; And an NFS client (Network File Server Client) installed in a user terminal or a service server and in communication with the remotely located network file server, wherein the network file server is configured as a network drive to the user terminal or the service server. If there is a file change request from the NFS client regarding the archived file in the mounted network file server, it is determined whether or not it is eligible for at least one of the user information and the program information that made the change request, and according to the judgment result, If so, a phishing or ransomware attack blocking system is provided that disallows the file change request.

According to another aspect of the present invention, a ransomware attack blocking system, the network file server; And an NFS client installed in a user terminal or a service server and communicatively connected to the network file server located remotely, wherein the NFS client is mounted in the form of a network drive on the user terminal or the service server. With respect to the archived file in the network file server, selection information may be provided to enable the user to select the transition to and from the edit mode. In addition, the network file server, when there is a request to open or change a file from the NFS client, if the open or change request is not a request according to the state that the switch to the edit mode is selected, the open file is requested. A phishing or ransomware attack protection system is provided that provides to the NFS client only in read-only mode or disallows the file change request.

According to an embodiment of the present invention, the ransomware attack prevention system may operate as follows.

In one embodiment, the network file server may use the file as Read / Write for the file access request of the Windows Explorer. On the other hand, for file requests other than Windows Explorer, files can be provided as Read Only.

In another embodiment, the network file server may provide a file in Read / Wirte for a file access request of a predetermined program, and provide a file only in Read Only for other cases.

In another embodiment, the network file server may provide a file as Read only for a file access request of a pre-designated program, and may deny access for other cases.

According to an embodiment of the present invention, the phishing attack prevention system may operate as follows.

In one embodiment, a program that selects a program to allow access when a network file system client program is installed in advance, extracts a hash value of a binary file of the selected program, and delivers the hash value to a server, and subsequently requests a file to the server. You can be prepared to verify this program.

In this case, when a file request occurs in the network file system, the program requested by the network file system custom drive may be checked, and a hash value of the corresponding program may be generated and transmitted to the server. Also, the network file server checks whether or not the program has been registered in advance, and if the program has been registered in advance, the file may be provided, but otherwise, the file may not be provided.

According to an embodiment of the present invention, when a user manipulates a PC terminal and uses various programs, a user in a network drive connected to the PC terminal even if ransomware is executed on the PC terminal by executing a malicious code by a hacker's trick. It has the effect of protecting data. This eliminates the need for frequent backups in preparation for ransomware, and overcomes the hassle of registering separate processes to access only authorized processes.

1 is a complete system block diagram including a PC with a network file server and a client program operating read-only.
2 is a screen example in which read only is displayed in a title bar when a file is opened for read only according to an embodiment of the present invention.
3 is a screen example of rejecting an attempt to change the name of a file in a network file system drive with a command in a DOS command window instead of Windows Explorer.
4 shows that after the network file server storage space is mounted as a drive in Windows Explorer, the user switches to the edit mode of the file in the storage space in the network file server using a network file server client program additionally installed in Windows Explorer. 'Screen example for when you want to.
5 is a screen example of displaying a lock icon together on a file icon when a file opened in edit mode by a specific user ID is displayed in the window explorer.
6 illustrates an example of a network file server client program execution screen that enables an edit mode exit command to be sent when a file locked by a specific user ID is released from the network file server.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, if it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, numerals (eg, first, second, etc.) used in the description of the present specification are merely identification symbols for distinguishing one component from another component.

Further, throughout the specification, when one component is referred to as "connected" or "connected" with another component, the one component may be directly connected or directly connected to the other component, but in particular It is to be understood that unless otherwise indicated, there may be connected or connected via another component in the middle.

In addition, throughout the specification, when a part is said to "include" a certain component, it means that it may further include other components, without excluding the other components unless otherwise stated. In addition, the terms "unit", "module", and the like described in the specification mean a unit that processes at least one function or operation, which means that it may be implemented in one or more pieces of hardware or software, or a combination of hardware and software. .

1 is a complete system block diagram including a PC with a network file server and a client program operating read-only. Hereinafter, a method and a system for blocking a ransomware attack according to an embodiment of the present invention will be described with reference to FIGS. 2 to 6 with reference to the system block diagram of FIG. 1. In the present specification, the case where the user terminal such as a PC is connected to the network file server by session is mainly described, but it is obvious that the service server may be implemented similarly to the following description even when the session is connected to the network file server. .

Referring to FIG. 1, a network file server client (NFS Client) is installed in a personal computer (PC) of a user. Your PC communicates with a remote Network File Server (NFS) via a network file server client.

In an embodiment of the present invention, if the user authentication is normally completed by running the network file server client program (NFS User Client Program of FIG. 1) to check whether the user is a normal user, a custom file system driver installed in the PC. The network file server (NFS) storage can be mounted as a PC drive. In other words, the drive mounted on the PC is a virtual drive.

Then, when a user attempts to open a file stored on a drive mapped to a network file server with Windows Explorer or other common application, the custom file system driver checks to see what program the requested file open request is from. At least one of the user information and the program name is added to the file open request and sent to the network file server. In the present specification, for convenience and concentration of description, it will be described on the assumption that a user ID is used as the user information. However, if the information can identify the corresponding user, various user information may be used in addition to the user ID.

However, according to the implementation method, if the network file server authenticates the user ID and password when the network file server client is running on the PC, the connection session may be regarded as the corresponding ID and may be configured not to transmit a separate ID value. Is self-explanatory.

A typical file server does not review a program requesting data after a user account of a terminal requesting a file is authenticated and a session connection is established. That is, according to the prior art, the network file server client driver only requested a file from the file server, but did not provide the server with information about which program requested which file.

However, in order to prevent ransomware from the center of file server, it is necessary to deliver not only the terminal that is requesting the file, but also which user is what program. Need to provide

Therefore, in the present invention, a custom file system driver requests a network file server together with an identification value of a program to access a file, and the network file server daemon reads only if the received program identification value is different from a predetermined program identification value. Only driven by providing data.

Depending on the configuration, the network file server daemon may not only specify the program requesting the file, but also a user ID in advance, so that if the ID is not a predefined ID, the custom file system driver can read the file open request in read-only mode. Can be provided to Accordingly, if a pre-designated program is not the default file explorer of the OS, the file provided from the network file server may be operated to be read-only accessible from the PC.

It also changes the configuration so that when the network file server client driver is running, it downloads a list of programs that can be requested from the server in advance, and then at the kernel level in the client program module if the program requesting the file is not a predefined program. You may be able to reply to the program requesting the file.

2 is a screen example in which read only is displayed on a title bar when a file is opened for read only according to an embodiment of the present invention.

In addition, according to an embodiment of the present invention, when a specific user program operates to open a file in a drive in read / write mode, the custom file system driver checks which program the current request is made by which program, While requesting to open a file in write mode, at least one of a user ID and a program name can be added and sent to a network file server.

In this case, the network file server daemon according to an exemplary embodiment of the present invention may transmit a denial message to a custom file system driver for a file access request entered into a read / write mode. Accordingly, the custom file system driver can receive it and send it to the program.

In addition, another method of operation is that if a typical program attempts to open a file in the file server in read / write mode, the custom filesystem driver checks which program the current request is making and opens the file in read / write mode. You can add a program name and send it to a network file server. In this case, the network file server daemon provides the file to the custom file system driver in read-only file open mode, unless it is a pre-defined program for that file open request. Accordingly, files provided from the network file server are provided as read-only files on the PC, unless the program is designated in advance.

These programs are usually general programs such as Word or PowerPoint. When the Office program itself attempts to open a file in the file system, it opens in read / write mode. When the file is provided as a read-only file attribute from the file system, View the file in read-only mode.

In addition, according to an embodiment of the present invention, when a user initially creates a file using a Windows Explorer or a general application program on a drive mapped with a network file server, the custom file system driver in the network file server client may be programmed or written. By adding file information, you can forward file creation requests to a network file server.

In this case, the network file server daemon can create the file as long as the file system in the network file server allows. Here, for example, the range allowed by the file system in the server, for example, the same file name does not exist in the file system of the server, or if there is additional storage space left in the file system of the server, or the file name rule that attempts to create a file on the server Etc., if the system limitations are not exceeded.

When a file is created on the network file server, the network file server daemon updates the write permission DB (see DB in FIG. 1) that the user ID has write permission for the file, and then applies the custom file system driver. Deliver the file for viewing in read / write mode.

In this case, the custom filesystem driver tells the program that the document is open in read / write mode for the file and allows you to make modifications to that file until the program exits.

Then, when the program closes, if closing the file is detected by the custom file system driver, the custom file system driver sends a file close event to the network file server daemon, which receives the network file server daemon. You can remove the user ID from the write permission DB that has the write permission information for the user.

Here, various file creation and closing functions may exist for each operating system file system. For example, even in the Windows operating system, you can create files with Openfile () and Createfile () when creating files, or close () and Closefile () when closing files. This specification will be described based on the operating procedure.

In addition, the network file server client may be a program implemented as a context menu by extending the window explorer, and may be driven by a separate program.

In addition, according to an embodiment of the present invention, when a user requests to change a file using a Windows Explorer or a general application to a drive mapped with a network file server, the custom file system driver may be assigned to a file located in the network file server. A file change command is detected, and at least one of file change command information, program information on which program the current command is generated, and a user ID can be added to the file information and sent to the network file server.

Here, the file change request means a request for file encryption, file deletion, file name change, file move, file time change, file body content change, file binary value change, and the like.

The network file server daemon can check whether the ID has the write permission on the target file in the corresponding user session through the write permission DB. According to the result of the check, the network file server daemon can allow the file change command only when the file change request is from a user ID that is granted write permission to the target file.

In some cases, according to another embodiment of the present invention, even if a write permission is not granted to a corresponding user ID, a file deletion command may be allowed if the program requesting the work request is Windows Explorer. It may be. If the file delete command is generated by Windows Explorer, it may be regarded as a user's direct manipulation, and the file delete command may be processed normally. As an example of this, FIG. 3 illustrates a screen for rejecting an attempt to delete a name of a file in a network file system drive using a command in a DOS command window instead of Windows Explorer. That is, FIG. 3 illustrates a case in which a user whose ID is not granted write permission through an application other than Windows Explorer attempts to delete a file and does not allow it.

For the same purpose as above, depending on the implementation method, the read command by the pre-designated program is allowed to be read. However, the read command by the other program is the network file server side (more specifically, the network file server). Daemons can also disable it (forbid reading).

In fact, if the certificate is stored in a general network file server and mounted in the operating system, all programs operating on the operating system can be accessed (read), but if the certificate client program is set to be accessed in advance, the file is opened by the certificate client program. You can provide a file only on request and block all other file-viewing requests. It is also obvious that only a predefined certificate generation program can write a file if it restricts only the certificate generation program to access the network drive and create a file.

 The network file server daemon can execute a file change command and then pass the results back to the custom file system driver. At this time, the result of the work request is finally delivered to the work request program through the custom file system driver, and the result is displayed to the user.

In the above, although the program designated in advance has taken Windows Explorer as an example, the type or program name and / or program name which are exception-handled as described above may be different depending on the operating system. For example, in Microsoft Windows, the name of a program that allows a user to directly manipulate a file is Windows Explorer, but it works as a finder in Apple Mac OS and a file explorer in X window on Linux.

Further, after the network file server completes processing, the future processing procedure may be different depending on the operating system operating method. The network file server may tell the custom file system driver that it has been processed after the final operation, but the custom file system driver may be able to see how the work request was fulfilled on the network file server.

In the above description, the case where the program or the user ID determines whether to allow the file change process according to whether or not write permission is given to the work file is mainly explained. However, various modifications are possible. For example, a check procedure regarding whether write permission is granted to the user may be omitted.

For example, as illustrated in FIG. 4, when a user opens a file by 'switching to an edit mode' so that the user can edit the file even if the user browses the file using a general program instead of a program designated in advance, Even if it is not a program, the file server can be implemented to provide a file with read / write attributes for the file. In some cases, it may be implemented to allow a file change request if it is recognized that the user is an intentional manipulation behavior that can be clearly distinguished from a ransomware attack. In FIG. 4, after the storage space of the network file server is mounted as a drive in Windows Explorer, the user 'edits a file in the storage space in the network file server using a network file server client program additionally installed in Windows Explorer. This is an example of the screen for the case of 'Switch Mode.'

Specific implementation manners for this may be as follows. If the network file server client selects to switch to edit mode for a file in a specific path with a normally authenticated user ID, the edit mode processing unit (see User edit mode processing unit in FIG. 1) on the network file server may have a different file. You can check if it is written by user ID. At this time, if another user ID is not registered, the edit mode processing unit grants write permission to the write permission DB file, and changes the setting so that only the user ID can read / write the network file server. The client can inform the client that the change is complete, and the network file server provides the file in read / write mode even if the user accesses the file with a program that is not specified in advance.

It is also apparent that, depending on the implementation, whenever a file in the network file server is switched to edit mode, it can be configured to leave a revision on the network file server. Separately, as shown in FIG. 6, the user may leave a revision file by directly selecting 'create revision'.

As described above, when the edit mode roll file is opened, as shown in FIG. 5, an icon for visually distinguishing that the file is running in the edit mode may be displayed together. 5 is a screen example of displaying a lock icon on a file icon when a file opened in an edit mode by a specific user ID is displayed in a window explorer.

In addition, the above-described editing mode may be processed to terminate the editing mode through a user's manipulation. An example of this is shown in FIG. 6, where FIG. 6 is an example of a network file server client program execution screen that enables an edit mode exit command to be sent when a file locked by a specific user ID is released from the network file server. . In this case, when the edit mode exit is selected, the edit mode processing unit of the network file server may delete the corresponding user ID for the file of the corresponding path from the write permission DB so that the user no longer opens the corresponding file in the write mode.

In addition, although the above-mentioned process of switching to the edit mode and / or terminating the edit mode may be performed on a unit file basis, in some cases, a plurality of files may be simultaneously performed within a range necessary for driving a file or within a set range. For example, when it is necessary to access and use a reference file having a subfolder at the same time as in a CAD or software development tool, even if the file is switched to / exited to edit mode for one file, It is also possible to switch to / out of editing the entire sub-folder or the reference files in the subfolder together.

 In addition, even when the network file server client attempts to open a file in the path by running a program installed in a PC connected to the extension of the corresponding file, the implementation method may differ slightly depending on the OS. For example, when running on MS Windows, if you attempt to view the document through "Open file path and file name" using ShellExecute supported by the Shell command, the operating system will see the file extension and execute the default link program. You can also retrieve the document by passing the file path to the default linker.

In the above description, the case where the custom file system driver delivers the unique value (hash) and user ID of the program requesting the file to the network file server daemon whenever a request for file viewing, creation, or modification is requested is described. Other variations are possible depending on the type. In other words, depending on the implementation method, if the network file server records the user ID for the connection session after the initial user authentication, the custom file system driver may be configured to request to view, create, or modify a subsequent file. It could be passed to a network file server daemon without attaching a user ID.

In addition, it is apparent that the present invention can be equally applicable to a case where a service server based on a Linux or Unix system as well as a user PC OS mounts a specific storage space of a network file server to use data.

More specifically, when a Linux or Unix service server attempts to access data by configuring a storage space of a network file server as a storage partition of a corresponding system, the service server sends a request to view or modify a file stored in the network file server. Even if the file server does not generate a file access request by a predetermined process, the file server may block access, and in the case of a predetermined process, the file server may be operated to provide a file for read only. Do.

The method for blocking a ransomware attack according to the embodiment of the present invention described above may be implemented as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording media having data stored thereon that can be decrypted by a computer system. For example, there may be a read only memory (ROM), a random access memory (RAM), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, and the like. The computer readable recording medium can also be distributed over computer systems connected over a computer network, stored and executed as readable code in a distributed fashion.

Although the above has been described with reference to embodiments of the present invention, those skilled in the art may variously modify the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. And can be changed easily.

Claims (12)

External attack protection system,
Network file server; And an NFS client (Network File Server Client) installed in a user terminal or a service server and in communication with the network file server located remotely.
The network file server,
If there is an access or open request from the NFS client regarding the archived file in the network file server mounted on the user terminal or service server in the form of a network drive, the program information requested for the access or open request is checked, Determining whether eligibility is determined according to the determination result, and when the ineligibility determination is made according to the determination result, block access to the requested file or provide the open requested file to the NFS client only in a read-only mode.
The method of claim 1,
The network file server,
Based on the information of the user who made the open request, the user checks whether or not the write permission is granted to the user through the write permission DB. If the write permission is not granted to the corresponding user, the requested file is opened only in read-only mode. Provided to the NFS client.
The method of claim 1,
The NFS client,
Identify the program through which the access or open request is requested, add program information to the request, and transmit the program information to the network file server;
The network file server,
Check whether the corresponding program corresponds to a predetermined program based on the received program information, and if the corresponding program does not correspond to the predetermined program, block access to the requested file or open the requested file. An external attack protection system provided to the NFS client only in read-only mode.
The method of claim 3,
The network file server,
When the open request is an open request according to a file search-only program provided by the corresponding operating system according to an operating system installed in the user terminal or the service server, the NFS client may be read in the read / write mode. Provided by, External Attack Protection System.
The method of claim 1,
If there is a request for creating a new file in the network drive mounted on the user terminal or the service server,
The network file server,
According to the request, a new file is created, and the user is registered in a write permission DB so that the user can edit the created new file based on the user information requesting the creation of the new file. If the editing is completed and the program is terminated, the external attack blocking system for deleting the user's write permission from the write permission DB.
External attack protection system,
Network file server; And an NFS client (Network File Server Client) installed in a user terminal or a service server and in communication with the network file server located remotely.
The network file server,
If there is a file change request from the NFS client regarding the archive file in the network file server mounted on the user terminal or the service server in the form of a network drive, check the program information that has requested the change and according to the confirmed program information. Determining whether eligibility is determined and disallowing the file change request if an ineligible determination is made according to the determination result.
The method of claim 6,
The file change request is at least one of file encryption, file deletion, file name change, file move, file time change, file body content change, and file binary value change.
The method of claim 6,
The network file server,
On the basis of the user information that requested the file change request, it is checked whether the write right is granted to the user through the write permission DB. If the write right is not granted to the corresponding user, the file change request is not allowed. Attack blocking system.
The method of claim 6,
The NFS client,
Identify the program through which the change request is requested, add program information to the change request, and transmit the program information to the network file server;
The network file server,
Checking whether the corresponding program corresponds to a predetermined program based on the received program information, and disallowing the file change request if the corresponding program does not correspond to the predetermined program.
External attack protection system,
Network file server; And an NFS client (Network File Server Client) installed in a user terminal or a service server and in communication with the network file server located remotely.
The NFS client,
Providing selection information for allowing a user to select switching to and exiting from an edit mode with respect to an archive folder or a file in the network file server mounted on the user terminal or the service server in the form of a network drive,
The network file server,
When there is a file open or file change request from the NFS client, if the open or change request is not a request according to the state in which the switch to the edit mode is selected, the NFS client is placed in the read-only mode only in the NFS client. By providing or disallowing the file change request, external attack blocking system.
The method of claim 10,
The NFS client, when the switch to the edit mode is made, an external attack that displays an icon that can visually distinguish that the folder or file that has been switched to the edit mode is running in the edit mode, together with the icon of the file Blocking system.
The method of claim 10,
In order to operate a specific file according to the property of an application program, the reference files associated with the file must be operated together.
And when the network file server executes the switching or ending of the edit mode for the specific file, the reference file or the folder to which the reference file belongs also performs the switching or ending of the edit mode.

Images