KR20210037895A - Secure coding system and method thereof - Google Patents

Abstract

The present invention relates to a secure coding system and a method thereof and, more specifically, to a secure coding system, wherein when a code is written from a client computer and transmitted to a web server, a Java Server Pages (JSP) file is created based on the corresponding code and the client computer is redirected to the JSP file, and then, when the client computer transmits an attack code or a code to which secure coding is applied by inserting the same into a function to which a code is applied (for example, a bulletin board or a login window), the web server delivers the function to which the code is applied to the client computer by inserting hacking information into the function or without inserting the hacking information to enable the practice of a secure coding procedure, and a method thereof.

Description

Secure coding system and method {SECURE CODING SYSTEM AND METHOD THEREOF}

The present invention relates to a secure coding system and method. In particular, when a code is created from a client computer and transmitted to a web server, a JSP (Java Server Pages) file is generated based on the code, and the JSP generated by the client computer is generated. After redirecting to a file, the client computer inserts the attack code or secure coded code into the code-applied function (e.g., bulletin board or login window) and transmits it, and the web server inserts hacking information into the code-applied function. The present invention relates to a secure coding system and method for practicing a secure coding process by transferring the information to a client computer without inserting or inserting hacking information.

Vulnerability checks in the existing network include sniffing packets or accessing an open port to identify software version information running on the target system, and use the identified version information to identify vulnerability information databases (CVE, NVD, ETC, etc.) Check whether it is vulnerable by referring to.

If a specific software version is found to be vulnerable, information about it is notified to the target system, and if the target system is found to be a vulnerable version, it is configured to take follow-up measures.

However, in recent years, the version of the software is not exposed to the outside in many cases, so it is not possible to properly check for vulnerabilities with the existing method. Moreover, it is not easy to check for vulnerabilities in software that does not use the network. For example, document editing software, etc., do not use the network in the process of operation, so it is very difficult to check vulnerabilities.

Files that attack the vulnerability are introduced into the inside through network protocols such as e-mail and HTTP, and when these files are executed, they can hack or attack the target system or extract important information through a vulnerability attack of the corresponding software.

Therefore, it is necessary to check the vulnerabilities of the software that executes this file before opening the malicious file, and in particular, it is necessary to check the dynamic vulnerability of the software that executes this file before the execution of the file that flows through the network.

Due to this necessity, Korean Patent Publication No. 2019-0090436 (hereinafter referred to as cited literature) discloses a vulnerability inspection device, method, and system that can check vulnerabilities of software executing files through a simulated attack file without checking the software version. Is disclosed.

However, since the cited literature is a method of sending a simulated attack file for checking the software executed by the host device to the host device for analysis, there was a hassle of creating and analyzing a simulated attack file for each software to be checked. There is a problem that development costs are high because a development environment is required.

Korean Patent Publication No. 2019-0090436 (Publication date: 2019.08.02)

Therefore, the present invention has been made to solve the conventional problems as described above, and an object of the present invention is to perform vulnerability defense practice by simply accessing a web page without the need for a development environment for creating and analyzing a mock attack file for each software. It is to provide a secure coding system and method to enable it.

In order to achieve the above object, the secure coding system according to the embodiment of the present invention writes and transmits a code using a code writing tool, and inserts and transmits an attack code or a code to which secure coding is applied to a function to which the code is applied, A client computer configured to display a screen in which hacking information is inserted or not inserted into the function to which the code is applied; And upon receiving the code written by providing the code writing tool to the client computer, a Java Server Pages (JSP) file is dynamically generated based on the code, and the client computer is redirected to the generated JSP file, and the Web configured to transmit hacking information to the function to which the code is applied or to transmit hacking information to the client computer without inserting hacking information when an attack code or a code to which secure coding is applied is inserted and transmitted to the function to which the code is applied by the client computer It characterized in that it comprises a; server.

In the secure coding system according to the above embodiment, the web server comprises: a code generator for providing a code writing tool to the client computer; A code receiving unit for receiving a code from the client computer; A JSP file generator that generates a JSP file based on the code received from the code receiver; A redirect unit for redirecting the client computer to the generated JSP file; When an attack code or a code to which secure coding is applied is inserted and transmitted to the function to which the code is applied by the client computer, the secure transmitting the hacking information to the function to which the code is applied or without inserting the hacking information to the client computer It may include a; coding application confirmation unit.

In the secure coding system according to the above embodiment, the function to which the code is applied may be a bulletin board or a login window.

In order to achieve the above object, a secure coding method according to another embodiment of the present invention includes the steps of creating and transmitting a code using a code generator of a web server by a client computer; Receiving the code written by the web server; Generating, by the web server, a Java Server Pages (JSP) file based on the code, and redirecting the client computer to the generated JSP file; Inserting and transmitting an attack code or a code to which the secure coding is applied to the function to which the code is applied by the client computer; Inserting hacking information into the function to which the code is applied and transmitting the hacking information to the client computer when the attack code is inserted into the function to which the code is applied; And transmitting the hacking information to the client computer without inserting hacking information into the function to which the code is applied when the code to which the secure coding is applied is inserted into the function to which the code is applied.

According to the secure coding system and method according to embodiments of the present invention, when a web server provides a code writing tool to a client computer and receives a code written, a JSP file is dynamically generated based on the code, and the client computer is After redirecting to the generated JSP file, an attack code or a code applied with secure coding is inserted and transmitted to the function to which the code is applied by the client computer, and the function to which the code is applied when the attack code is inserted into the function to which the code is applied. The hacking information is inserted into the client computer and transmitted to the client computer, and when a secure coded code is inserted in the function to which the code is applied, the hacking information is not inserted into the function to which the code is applied, and transmitted to the client computer, There is an excellent effect that it allows you to practice vulnerability defense by simply accessing a web page without the need for a development environment to create and analyze a mock attack file for each software.

1 is a block diagram of a secure coding system according to a first embodiment of the present invention.
2 is a block diagram of a secure coding system according to a second embodiment of the present invention.
3 is a flowchart showing a secure coding method according to the first embodiment of the present invention.
4 is a flowchart showing a secure coding method according to a second embodiment of the present invention.
5 is a diagram illustrating a function to which a code is applied.
6 is a diagram in which hacking information is inserted into a function to which the code of FIG. 5 is applied.
FIG. 7 is a diagram in which hacking information is not inserted into the function to which the code of FIG. 5 is applied

In describing the embodiments of the present invention, when it is determined that a detailed description of known technologies related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of users or operators. Therefore, the definition should be made based on the contents throughout the present specification. The terms used in the detailed description are merely for describing the embodiments of the present invention and should not be construed as limiting. Unless explicitly used otherwise, expressions in the singular form include the meaning of the plural form. In the present description, expressions such as "comprising" or "feature" are intended to refer to certain features, numbers, steps, actions, elements, some or combination thereof, and one or more It should not be construed as excluding the presence or possibility of other features, numbers, steps, actions, elements, any part or combination thereof.

In each of the systems shown in the drawings, the elements in some cases each have the same reference number or a different reference number, suggesting that the elements represented may be different or similar. However, elements may have different implementations and operate with some or all of the systems shown or described herein. The various elements shown in the figures may be the same or different. Which is referred to as the first element and which is referred to as the second element is arbitrary.

In the present specification, "transmitting", "transmitting" or "providing" data or signals from one component to another component means that one component directly transmits data or signals to another component, as well as It includes transmitting data or signals to other components through at least one other component.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[First Example]

1 is a block diagram of a secure coding system according to a first embodiment of the present invention.

The secure coding system according to the first embodiment of the present invention includes a client computer 100 and a web server 200 as shown in FIG. 1.

The client computer 100 writes a code using a code writing tool imported from the web server 200 and transmits the code to the web server 200, and a function to which the code is applied (eg, a bulletin board or a login window) (illustrated in FIG. 5 ). ), an attack code or code applied with secure coding is inserted and transmitted to the web server 200, and a screen (illustrated in FIG. 6) in which hacking information is inserted into the function to which the code is applied is displayed, or hacking information is not inserted. It serves to display a screen (illustrated in Fig. 7).

The web server 200 provides a code writing tool to the client computer 100 to create a code. Upon receiving the code, the web server 200 dynamically generates a JSP (Java Server Pages) file based on the code, and a client computer ( 100) is redirected to the generated JSP file, and if an attack code or a secure coded code is inserted and transmitted to a function to which the code is applied by the client computer 100, hacking information is inserted into the function to which the code is applied, or hacking It serves to transmit information to the client computer 100 without inserting it.

The web server 200 includes a code generation unit 210, a code reception unit 220, a JSP file generation unit 230, a redirection unit 240, and a secure coding application confirmation unit 250.

The code generation unit 210 serves to provide a code writing tool necessary for writing a code upon request of the client computer 100.

The code receiving unit 220 serves to receive a code written from the client computer 100.

The JSP file generation unit 230 serves to generate a JSP file based on the code received from the code receiving unit 220.

The redirect unit 240 serves to redirect the client computer 100 to the JSP file generated by the JSP file generation unit 230.

The secure coding application confirmation unit 250 inserts hacking information into the function to which the code is applied when the attack code or the code to which the secure coding is applied is inserted and transmitted to the function to which the code is applied by the client computer 100. While transmitting the code to the client computer 100, it serves to transmit the hacking information to the client computer 100 without inserting the code when the secure coding is applied.

Hereinafter, a secure coding method using the secure coding system according to the first embodiment of the present invention constructed as described above will be described.

3 is a flowchart showing a secure coding method according to the first embodiment of the present invention, where S represents a step.

First, when the client computer 100 accesses the web server 200, calls the code generator 210, writes a code using this, and transmits the code to the web server 200 (S10), the web server 200 The code created in step S10 is received (S20).

Subsequently, the web server 200 generates a JSP file based on the created code (S30), and redirects the client computer 100 to the JSP file generated in step S30 (S40).

At this time, the client computer 100 inserts an attack code or a code to which secure coding is applied to the function to which the created code is applied and transmits it to the web server 200 (S50).

The web server 200 receives an attack code or a function to which a code to which a secure coding is applied is applied is applied (S60).

When the attack code is inserted into the function to which the code is applied (YES in S70), the web server 200 inserts hacking information into the function to which the code is applied and transmits it to the client computer 100.

On the other hand, when the code to which the secure coding is applied is inserted in the function to which the code is applied (NO in S70), the web server 200 transmits the hacking information to the client computer 100 without inserting the hacking information to the function to which the code is applied.

According to the secure coding system and method according to the first embodiment of the present invention, when a web server receives a code written by providing a code writing tool to a client computer, a JSP file is dynamically generated based on the code, and the client computer Is redirected to the generated JSP file, an attack code or a code applied with secure coding is inserted and transmitted to the function to which the code is applied by the client computer, and the code is applied when the attack code is inserted into the function to which the code is applied. By inserting hacking information into a function and transmitting it to the client computer, it is configured to transmit the hacking information to the client computer without inserting the hacking information into the function to which the code is applied, when a secure coded code is inserted into the function to which the code is applied. , Without the need for a development environment to create and analyze a mock attack file for each software, it is possible to practice vulnerability defense by simply accessing a web page.

[Second Example]

2 is a block diagram of a secure coding system according to a second embodiment of the present invention.

The secure coding system according to the second embodiment of the present invention includes a client computer 100 and a web server 200 as shown in FIG. 2.

The client computer 100 writes a code using a code writing tool imported from the web server 200 and transmits the code to the web server 200, and a function to which the code is applied (eg, a bulletin board or a login window) (illustrated in FIG. 5 ). ), an attack code or code applied with secure coding is inserted and transmitted to the web server 200, and a screen (illustrated in FIG. 6) in which hacking information is inserted into the function to which the code is applied is displayed, or hacking information is not inserted. It serves to display a screen (illustrated in Fig. 7).

The web server 200 provides a code writing tool to the client computer 100 to create a code, and upon receiving the written code, a JSP file is dynamically generated based on the code, and the client computer 100 is generated. After redirecting to a JSP file, when an attack code or a code applied with secure coding is inserted and transmitted to a function (eg, a bulletin board or login window) to which the code is applied by the client computer 100, the attack code query is executed and the docker 260 Attacks the data in the data, receives the attack result from the docker 260 and delivers it to the client computer 100, terminates execution according to the attack result, or provides a code writing tool to the client computer 100 to continue the code Have them write.

The web server 200 includes a code generation unit 210, a code receiving unit 220, a JSP file generation unit 230, a redirect unit 240, a secure coding application confirmation unit 250, and a docker 260. .

The code generation unit 210 serves to provide a code writing tool necessary for writing a code to the client computer 100.

The code receiving unit 220 serves to receive a code written from the client computer 100.

The JSP file generation unit 230 serves to generate a JSP file based on the code received from the code receiving unit 220.

The redirect unit 240 serves to redirect the client computer 100 to the JSP file generated by the JSP file generation unit 230.

When the client computer 100 inserts and transmits an attack code or a code to which secure coding is applied to a function to which the code is applied, the secure coding application check unit 250 receives it, and the attack code or secure coding inserted in the function to which the code is applied is transmitted. After attacking the data in the docker 260 by executing an attack code query according to the applied code, the attack result is received from the docker 260 and transmitted to the client computer 100, and the result of the attack is determined and executed. Or providing a code writing tool to the client computer 100 to perform the secure coding process again.

The docker 260 stores security-required data (e.g., user ID and password) (see FIG. 6), and when the data is attacked by executing an attack code query by the web server 200, the result of the attack (i.e., successful attack) Or attack failure).

Hereinafter, a secure coding method using the secure coding system according to the second embodiment of the present invention constructed as described above will be described.

4 is a flowchart showing a secure coding method according to an embodiment of the present invention, where S represents a step.

First, when the client computer 100 accesses the web server 200, calls the code generation unit 210, writes a code using this, and transmits the code to the web server 200 (S10'), the web server 200 Receives the code written in step S10 (S20').

Subsequently, the web server 200 generates a JSP file based on the created code (S30'), and redirects the client computer 100 to the JSP file generated in step S30' (S40').

At this time, the client computer 100 inserts an attack code or a code to which secure coding is applied to the function to which the created code is applied and transmits it to the web server 200 (S50').

The web server 200 receives an attack code or a function to which a code to which a secure coding is applied is applied (S60'), and executes an attack code query to attack data in the docker 260 (S70').

Subsequently, the web server 200 receives the attack result from the docker 260 (S80'), and transmits the attack result to the client computer 100 (S90').

At this time, if the attack fails (the attack fails in S100'), the secure coding operation is terminated.

On the other hand, if the attack is successful (the attack is successful in S100'), the process proceeds to step S10'.

According to the secure coding system and method according to the second embodiment of the present invention, when a web server receives a code written by providing a code writing tool to a client computer, a JSP file is dynamically generated based on the code, and the client computer Is redirected to the generated JSP file, and when the attack code or code applied with secure coding is inserted and transmitted to the function to which the code is applied by the client computer, the attack code query is executed to attack the data in Docker, and the result of the attack. Is delivered from the Docker and delivered to the client computer, and is configured to terminate execution according to the attack result or provide a code writing tool to the client computer, so that there is no need for a development environment for creating and analyzing a mock attack file for each software. It allows you to practice vulnerability defense by simply accessing a web page.

In the drawings and specification, an optimal embodiment has been disclosed, and specific terms are used, but these are used only for the purpose of describing the embodiments of the present invention, and are used to limit the meaning or the scope of the present invention described in the claims. Was not done. Therefore, those of ordinary skill in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

100: client computer
200: web server
210: code generation unit
220: code receiver
230: JSP file generation unit
240: redirect part
250: secure coding application confirmation unit
260: docker

Claims (4)

Write and transmit a code using a code writing tool, insert and transmit an attack code or a code with secure coding applied to the function to which the code is applied, and display a screen with or without hacking information inserted into the function to which the code is applied. Configured client computer; And
When a code written by providing a code writing tool to the client computer is received, a Java Server Pages (JSP) file is dynamically generated based on the code, and the client computer is redirected to the generated JSP file, and then the client A web server configured to transmit hacking information to the function to which the code is applied or to transmit hacking information to the client computer without inserting the hacking information or when the code to which the code is applied is inserted and transmitted by the computer. Secure coding system including;
The method of claim 1,
The web server,
A code generation unit providing a code writing tool to the client computer;
A code receiving unit for receiving a code from the client computer;
A JSP file generator that generates a JSP file based on the code received from the code receiver;
A redirect unit for redirecting the client computer to the generated JSP file;
When an attack code or a code to which secure coding is applied is inserted and transmitted to the function to which the code is applied by the client computer, the secure transmitting the hacking information to the function to which the code is applied or without inserting the hacking information to the client computer A secure coding system comprising a; coding application confirmation unit.
The method of claim 1,
The function to which the code is applied is a bulletin board or a login window, a secure coding system.
As a secure coding method using the secure coding system according to claim 1,
Creating and transmitting a code by using a code generator of a web server by a client computer;
Receiving the code written by the web server;
Generating, by the web server, a Java Server Pages (JSP) file based on the code, and redirecting the client computer to the generated JSP file;
Inserting and transmitting an attack code or a code to which the secure coding is applied to the function to which the code is applied by the client computer;
Inserting hacking information into the function to which the code is applied and transmitting the hacking information to the client computer when the attack code is inserted into the function to which the code is applied; And
And transmitting the hacking information to the client computer without inserting hacking information into the function to which the code is applied when the code to which the secure coding is applied is inserted into the function to which the code is applied.

Images