KR20200122014A - Data security method based on program protection - Google Patents

Abstract

According to an embodiment of the present invention, provided is a computer implemented method for data security of a program executed by a security client installed on a computing device. A provided data security method of a program comprises the steps of: obtaining a list of security programs permitted to access a pre-designated security storage area in accordance with a program security policy; and blocking a disk event so that a file having the same file name as an executable file of the program designated as the security program is not generated on a local disk by the computing device.

Description

Data security method based on program protection {DATA SECURITY METHOD BASED ON PROGRAM PROTECTION}

The present invention relates to a method of protecting data of a program designated in advance in various computing devices, such as a user PC (personal computer) and a server, from being changed.

Various software threats to information security, such as viruses, malware, and ransomware, are disguised as trusted programs or are being operated in a way that prevents the user from recognizing them, causing a lot of damage. In order to manage security-critical computing devices, it is necessary to block untrusted programs and protect trusted programs.

Accordingly, the following methods exist in the prior art for program security.

First, there is a method of comparing the hash value of the accessing program. According to this, when designating a security program in advance, the program's binary hash value is extracted and registered, and the program is protected by classifying the authenticity of the program based on the registered program hash value. However, this method has a problem in that the hash value of the program is updated as the corresponding program is frequently updated, so that the administrator has to update the hash value of the program each time the program is changed.

Second, there is a method of comparing the PKI signature value of the accessing program. However, even according to this, it was not possible to prevent the hacker from stealing the program's program developer's program certificate (PKI signature value) and distributing the disguised program and then running it.

Third, there is a method of comparing the file name of the accessing program. However, even with the method of comparing file names in this way, in the case of conventional technology, until the malicious program changes to the same file name (i.e., name and extension) and disguises as a normal program or overwrites the file pretending to be a normal file. Couldn't be stopped.

The present invention has been devised to solve the above-described problems, and does not require cumbersome program designation and registration management procedures such as resetting the hash value, and the malicious program is run with the same file name and extension as the protected program. It is intended to provide an improved program data security method capable of blocking attempts to change or alter normal programs.

According to an aspect of the present invention, as a computer implemented method for data security of a program executed by a security client installed in a computing device, access to a predetermined security storage area is allowed according to a program security policy. Obtaining a list of the security programs that have been created; And blocking a disk event so that a file having the same file name as an executable file of a program designated as the security program is not generated on a local disk by the computing device.

According to an embodiment, comprising the step of blocking a disk event related to a change of a program designated as the security program,

The disk event related to the change of the program may include a disk event related to at least one of modification, deletion, overwrite of the execution file, file name change to the execution file name, and program update of the corresponding program. I can.

According to an embodiment, the determination as to whether or not the executable file of the program designated as the security program has the same file name may be determined according to whether the file name including the extension matches.

According to an embodiment, in the case of a disk event requiring access to the secure storage area in the process of monitoring a disk event, if the program that initiated the disk event is by a pre-designated security program, the security It may include allowing access to the storage area and blocking access to the secure storage area in case of a disk event caused by another program.

According to an embodiment, in the case of a disk event generated by a process registered as the security process, data is generated only in the secure storage area, and attempts to save to a storage area other than the security storage area can be blocked. have.

According to an embodiment, when a file having the same file name as the executable file of the program designated as the security program is executed on a removable disk or a network drive disk, a disk event requesting access to the secure storage area occurs, Access to the secure storage area may be blocked.

According to an embodiment, when a program update request for the security program is requested and a mode change request is received by an authority having the authority to switch the program security mode, the security operation mode is changed to the program installation mode. Further comprising the step of switching to,

In the program installation mode, it is possible to create, modify, and delete files of the security program, and to block access to the security storage area by the security program being updated.

According to the data security method of a program according to an embodiment of the present invention, data of a pre-designated program (eg, authoring software, etc.) running on a computing device such as a user PC can be protected only by the file name (including the extension) of the program. There is an effect. This allows the administrator to implement program security only with the file name and extension of a program that is easy to manage, rather than a hash value of a program that is difficult to manage in reality. Accordingly, it is possible to block the creation and modification of files with the same file name (name and extension) as the designated security program, thereby preventing forgery and alteration of the security program that needs to be protected, and the execution of malicious programs that disguise the program.

1 is a diagram schematically illustrating main components of a client program (ie, a security client) that performs program security according to an embodiment of the present invention installed in a computing device.
2 and 3 are flowcharts of an embodiment of a data security method of a program through a secure client according to an embodiment of the present invention.
4 is an example of a screen in which a corresponding disk event is blocked when an attempt is made to create or change a file having the same file name as an executable file of a security program according to an embodiment of the present invention.
5 is a screen example of managing a list of security programs by file name and extension.

Since the present invention can apply various transformations and have various embodiments, specific embodiments are illustrated in the drawings and will be described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it is to be understood to include all conversions, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that a detailed description of related known technologies may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, throughout the specification, when one component is referred to as "connected" or "connected" to another component, the one component may be directly connected or directly connected to the other component, but specially It should be understood that as long as there is no opposing substrate, it may be connected or may be connected via another component in the middle. In addition, throughout the specification, when a certain part "includes" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, terms such as "unit" and "module" described in the specification mean a unit that processes at least one function or operation, which means that it can be implemented as one or more hardware or software, or a combination of hardware and software. .

1 is a diagram showing the main components of a client program (ie, a security client) for performing program security according to an embodiment of the present invention installed in a computing device, and FIGS. 2 and 3 are Flow diagrams of an embodiment of a method for securing data of a program through a security client, and FIG. 4 is a corresponding disk event when an attempt is made to create or change a file having the same file name as an executable file of a security program according to an embodiment of the present invention An example of a screen to be blocked, and FIG. 5 is an example of a screen for managing a list of security programs by file name and extension. Hereinafter, an embodiment of the present invention will be described with reference to FIGS. 1 to 3 together with reference to FIGS. 4 and 5. Here, the security client, which will be described later, refers to a kind of agent program installed in a predetermined computing device (in this example, a user's work PC is assumed) to perform a specific function of program security.

Referring to FIG. 1, a security client according to an embodiment of the present invention may include a security policy unit, a disk protection unit, a process access control unit, a process monitor driver, and a disk I/O filter driver. Here, the security policy unit, the disk protection unit, and the process access control unit may be installed in the application layer as User Mode, and the process monitor driver and disk I/O filter driver may be installed in the kernel layer as Kernel Mode. .

The overall operation flow of a data security method of a program by a security client according to each embodiment of the present invention will be described with reference to FIGS. 2 and 3 as follows.

First, referring to FIG. 2, when the security client is installed in a computing device such as a user's work PC, when user authentication is normally completed, the security client is driven [see S100]. At this time, the security mode by the security client can be divided into a security operation mode and a program installation mode. The security operation mode is basically a security operation mode unless the program installation mode is specifically set (selected) by a pre-designated authority such as an administrator. Is executed by default [see S105]. When the security operation mode is running, it is impossible to create, modify, or delete files with the executable file name of the program designated as the security program in the process of detecting all file events.

In this security operation mode, the security client acquires a list of security programs that are permitted to access a pre-designated security storage area according to the program security policy [see S110]. At this time, the program security policy or the list of security programs according to the policy is received from a network-connected remote file management server (for example, a separate central server pre-designated for management of internal business files) or local It can be obtained by loading the corresponding policy file from the security policy unit existing in the. When business files are centrally managed by the file management server, the secure storage area may be set as a predetermined storage space in the file management server, and may be encrypted and managed.

In addition, as shown in FIG. 5, the security program list may be managed by the file name (ie, including the name and extension, for example, WORD.EXE) of the execution file of the corresponding program designated as the security program. . Such a list of security programs may be managed directly from a database, or an administrator or the like may register the file name (ie, name and extension) and description of the appropriate program through a user interface such as a general management website to manage the list and history.

According to an embodiment of the present invention, in the secure operation mode, the security client monitors all disk events that occur [see S115], and when an event related to file creation or change is confirmed [see S120], FIG. The security operation according to S125, S130, and S135 of 2 is executed.

According to the embodiment, when the corresponding disk event is an event that requests the creation of a file with the same file name as the executable file of the program designated as the security program, the security client sends a file with the same executable file name as the security program to the computing device. The disk event is blocked so that it is not created on the local disk by the user.

Also, even if the corresponding disk event is a disk event related to a change of a program designated as a security program, the security client blocks the corresponding disk event. Here, the disk event related to the change of the program includes modifying, deleting, overwriting, renaming of the executable file, and updating the program of the corresponding program. ) May include a disk event for at least one of.

In this case, the determination as to whether or not the executable file of the program designated as the security program has the same file name may be determined according to whether the file name including the extension matches. In addition, the blocking of the disk event as described above immediately recognizes that the event is blocked to the user through a general notification provided by the operating system (OS) or a notification from a security client using a call-back file system. Can be made (see Fig. 4). In addition, the blocking of the disk event as described above may be performed by the disk protection unit of the security client.

In addition, according to another embodiment of the present invention, only the program designated as the security program can access the security storage area, and the data generated by the execution of the security program is also stored in the corresponding security storage area. Security can be enhanced. Hereinafter, this will be described with reference to FIG. 3.

Referring to FIG. 3, in the security operation mode, when it is determined that the security client monitors all disk events that occur [see S115], and that the generated disk event is an event requesting access to a predetermined security storage area [See S140], security operations according to S145, S150, S155, and S160 of FIG. 3 are executed. The security operation at this time means a control operation that allows or disallows access to or/and storage of the security storage area, which may be performed by the process access control unit of the security client.

That is, when a disk event requiring access to the security storage area occurs during the process of monitoring a disk event, the security client is the security storage area if the program that initiated the disk event is a pre-designated security program. Access to (for example, creation, reading, writing, deletion, etc.) is allowed, and in case of a disk event caused by another program, access to the secure storage area may be blocked [see S145 and S160].

Unlike the above, in the secure operation mode, even if a file with the same file name as the executable file of the program designated as the security program triggers a disk event requesting access to the secure storage area, the executable file is not local. If it is a disk event that is generated by execution from a removable disk (ex. USB, etc.) or a network drive disk, access to the secure storage area may be blocked [see S150 and S155].

In the above, the security operation mode was mainly described. Hereinafter, the security operation by the security client in the program installation mode will be described. As a program update for the security program is requested, when a mode change request is received by an authority having authority to switch the program security mode, the security client may switch the existing security operation mode to the program installation mode. have. When using such a program installation mode, the security client enables the creation, modification, and deletion of files of the security program, but controls blocking so that access to the security storage area by the security program being updated is blocked. I can. This is to prevent the possibility of forgery and alteration of data in the secure storage area by installing malicious codes during the program update process.

The data security method of a program according to the embodiment of the present invention described above may be implemented as a computer-readable code in a computer-readable recording medium. Computer-readable recording media include all types of recording media in which data that can be decoded by a computer system are stored. For example, there may be read only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, and the like. In addition, the computer-readable recording medium can be distributed to a computer system connected through a computer communication network, and stored and executed as code that can be read in a distributed manner.

The above has been described with reference to the embodiments of the present invention, but those of ordinary skill in the relevant technical field variously modify the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. And it will be easily understood that it can be changed.

Claims (7)

As a computer implemented method for data security of a program executed by a security client installed on a computing device,
Obtaining a list of security programs permitted to access a pre-designated security storage area according to a program security policy; And
Blocking a disk event so that a file having the same file name as the executable file of the program designated as the security program is not created on the local disk by the computing device
Data security method of a program comprising a.
The method of claim 1,
Including the step of blocking a disk event related to the change of the program designated as the security program,
The disk event related to the change of the program includes a disk event related to at least one of a modification, deletion, overwrite of a corresponding executable file, a file name change to a corresponding executable file name, and a program update of the corresponding program. , The program's data security method.
The method of claim 1,
The determination as to whether or not the security program has the same file name as the executable file of the program designated as the security program is determined according to whether the file name including the extension matches.
The method of claim 1,
In the process of monitoring a disk event, if a disk event requiring access to the secure storage area occurs, access to the secure storage area is allowed if the program that initiated the disk event is a pre-designated security program. , Blocking access to the secure storage area in case of a disk event caused by a program other than that of the program.
The method of claim 4,
In the case of a disk event generated by a process registered as the security process, data is generated only in the secure storage area, and attempts to save to a storage area other than the security storage area are blocked. Security method.
The method of claim 1,
When a file having the same file name as the executable file of the program designated as the security program is executed on a removable disk or a network drive disk and a disk event requesting access to the secure storage area occurs, access to the security storage area Blocking, the data security method of the program.
The method of claim 1,
As a program update for the security program is requested, when a mode change request is received by an authority having authority for switching the program security mode, switching the security operation mode to a program installation mode, ,
In the program installation mode, it is possible to create, modify and delete files of the security program, and block access to the security storage area by a security program being updated.

Images