TWI728637B - Information security protection method and computer-readable medium - Google Patents

Abstract

This invention provides an information security protection method and a computer-readable medium. Said method comprises the following steps: searching for vulnerability information of a target program; developing defense methods based on vulnerability information; locating the vulnerability address of the target program; setting an interruption point based on the vulnerability address; optimizing the process of monitoring the target program; running and monitoring whether the target program triggers a vulnerability: if not, recording the executed process and continuously monitoring the target program, otherwise, interrupting the target program based on the interruption point address; determining whether the vulnerability of the target program has a corresponding vulnerability defense method: if not, performing a version update on the target program, otherwise, performing a vulnerability repair mechanism on the target program, executing a vulnerability defense method on the target program, and recording the executed process and continuously monitoring the target program.

Description

Information security protection method and computer readable medium

The present invention relates to an information security protection technology, more specifically, an information security protection method and a computer-readable medium for software vulnerabilities.

With the development of the information field, the protection of information security is becoming more and more important. Generally speaking, when the existing information security protection method finds that the target program (or software) has vulnerabilities, it will search for an updated version of the target program and update it to fix the vulnerabilities.

However, once the program is updated and the original code is modified, the existing functions and operations may be affected; if you choose not to update the version, loopholes will be left to affect information security. Therefore, how to provide an information security protection technology that has a vulnerability protection mechanism and can reduce or avoid the impact on target program functions has become an urgent issue in the industry.

In order to solve the various problems of the aforementioned conventional technology, one purpose of the present invention is to provide an information security protection method and a computer readable medium that can prevent loopholes and reduce or avoid the impact on the function of the target program.

In order to achieve the foregoing objective, the information security protection method of the present invention includes the following steps: searching for vulnerability information of a target program; formulating a vulnerability defense method based on the vulnerability information; The vulnerability address of the target program; set interrupt points according to the vulnerability address; optimize the process of monitoring the target program; execute and monitor whether the target program triggers the vulnerability, if not, record the executed process and continuously monitor the target program, otherwise The target program is interrupted according to the address of the interruption point; it is judged whether the vulnerabilities of the target program have a corresponding vulnerability defense method, if not, the target program version update is performed, otherwise, the target program is implemented with the vulnerability repair mechanism and the target program implements the vulnerability defense method , And record the executed process and continuously monitor the target program.

In one embodiment, the step of formulating a vulnerability defense method based on the vulnerability information further includes: classifying the vulnerability; and formulating a corresponding vulnerability defense method according to the category of the vulnerability.

In one embodiment, the step of locating the vulnerability address of the target program further includes: tracking the underlying system information of the target program according to the vulnerability information to obtain the relevant data of the vulnerability; and locating the vulnerability address according to the relevant data .

In one embodiment, the bottom-level information of the system includes Symbol Table information or DWARF information.

In one embodiment, the related data of the vulnerability includes an inode value and an offset value.

In one embodiment, the step of setting a breakpoint based on the vulnerability address further includes: registering a checkpoint at the address before executing the function containing the vulnerability of the target program; inserting a breakpoint instruction at the checkpoint; and The detection point sets an alarm mechanism.

In one embodiment, the step of optimizing the process of monitoring the target program includes: filtering the function that does not contain the vulnerability in the target program; and recording the execution status of the function that contains the vulnerability in the target program.

In one embodiment, the step of executing the vulnerability repair mechanism on the target program further includes: implanting a protection program at the vulnerability address, and the protection program is used to eliminate the abnormal data of the vulnerability or interrupt the execution of the vulnerability.

The present invention also provides a computer-readable medium for information security protection, which is applied to a computer with a processor and a memory. The computer executes a target program and the computer-readable medium through the processor and the memory, and is used to execute the computer-readable medium. When reading media, implement the information security protection method described above.

Compared with the conventional technology, the information security protection method of the present invention formulates a vulnerability defense method and locates the vulnerability address based on the vulnerability information of the target program provided by the database, and then sets the interruption point according to the vulnerability address and monitors whether the target program triggers the vulnerability Once the vulnerability is found to be triggered, the target program will be interrupted. After determining the impact of the vulnerability, the vulnerability repair mechanism and the implementation of vulnerability defense methods will be implemented as appropriate. Since the vulnerability repair mechanism and the vulnerability defense method do not directly modify the original program, it can reduce or avoid the impact on the target program function, and fully solve the problems of the existing technology. In addition, it can also track the underlying information of the system, set an alarm mechanism at the vulnerability address, or increase the process of optimizing the monitoring target program to further conduct behavioral analysis and security protection of the vulnerability.

S10~S20‧‧‧Step

S110~S111‧‧‧Step

S120~S121‧‧‧Step

S130~S132‧‧‧Step

S140~S141‧‧‧Step

Figure 1 is a flowchart of the steps of the information security protection method of the present invention.

Figure 2 is a partial flow chart of the information security protection method of the present invention.

Figure 3 is a partial flow chart of the information security protection method of the present invention.

Figure 4 is a partial flow chart of the information security protection method of the present invention.

Figure 5 is a partial flow chart of the information security protection method of the present invention.

The following specific examples illustrate the implementation of the present invention. Those familiar with the art can easily understand the other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied by other different specific embodiments, and various details in this specification can also be based on different viewpoints and applications, and various modifications and changes can be made without departing from the spirit of the present invention.

The information security protection method of the present invention is shown in FIG. 1 in combination with the steps in FIGS. 2 to 5. As shown in Figure 1, the information security protection method of the present invention mainly includes the following steps:

S10. Search for vulnerability information of a target program.

S11. Develop vulnerability defense methods based on vulnerability information.

S12. Locate the vulnerability address of the target program.

S13. Set the break point according to the vulnerability address.

S14. Optimize the process of monitoring the target program

S15. Execute and monitor whether the target program triggers the vulnerability, if not, record the executed process and continuously monitor the target program, if yes, proceed to the next step.

S16. Interrupt the target program according to the interrupt point address.

S17. Determine whether the vulnerability of the target program has a corresponding vulnerability defense method, if not, perform a version update of the target program, and if it is, perform the next step.

S18. Implement a vulnerability patching mechanism for the target program.

S19. Implement vulnerability defense methods to the target program.

S20. Record the executed process and continuously monitor the target program.

In step S10, the information security protection method of the present invention automatically collects vulnerability information to create a vulnerability database. The vulnerability information can be collected from the Common Vulnerabilities and Exposures (CVE, Common Vulnerabilities and Exposures) database, but not limit.

In step S11, a vulnerability defense method is formulated according to the vulnerability information.

In the alternative embodiment in Figure 2, the step S11 of formulating a vulnerability defense method based on vulnerability information further includes:

S110. Classify vulnerabilities.

S111. Formulate corresponding vulnerability defense methods according to the categories of vulnerabilities.

In steps S110~S111, first classify the vulnerabilities based on the vulnerability information, such as configuration errors, authentication and authorization issues, code injection attacks, or access control, etc., and formulate corresponding defense methods according to the vulnerability categories. The defense methods can be, for example, Compile the security update version of the target program, add strict network firewall whitelist rules, restrict the external file access rights of vulnerable programs, or import and execute the program whitelist mechanism, but not limited to this. In addition, a variety of defense methods can also be combined to reduce the risk of vulnerability damage.

For example, when the CVE-2017-15804 vulnerability information is collected, it is pointed out that the glob function in GNU C Library version 2.12 has high-risk vulnerabilities, and the vulnerability information can know that this glob function will cause buffer overflow. Makes other memory locations perform wrong read and write operations. At this time, if the new version of the GNU C Library has not been announced by the vulnerability information, the information security protection method of the present invention will first compile the security update version of the target program and use the sandbox Test to understand the target program that may be affected by the vulnerability, and analyze the corresponding vulnerability defense methods, for example, increase or limit the permissions of reading, writing, and execution.

In step S12 in Figure 1, locate the vulnerability address of the target program.

In the alternative embodiment shown in Figure 3, the step S12 of locating the vulnerability address of the target program includes:

S120. According to the vulnerability information, track the underlying information of the system to obtain the relevant data of the vulnerability.

S121. Locate the vulnerability address based on the relevant data of the vulnerability.

In steps S120~S121, in addition to the vulnerability information, the underlying system information of the target program (such as Symbol Table information or DWARF information used to execute the target program) is also used to obtain vulnerability-related data (such as inode value and offset value) to infer whether the target program may trigger the vulnerability. The vulnerability may be triggered by a function, code section, or specific number of lines of the target program.

In a further embodiment, the information security protection method of the present invention can obtain, for example, the offset value of the vulnerability glob based on the Symbol Table information, and obtain the storage address of the file through the inode value to calculate the memory address of the vulnerability for subsequent steps Observe whether the vulnerability is triggered when the target program is executed. In addition, the information security protection method of the present invention can also calculate the corresponding lines of the code and memory that trigger the vulnerability based on the DWARF information.

In step S13, an interruption point is set according to the vulnerability address.

As shown in the alternative embodiment shown in Figure 4, the step S13 of setting the interruption point according to the vulnerability address includes:

S130. Register a detection point at the address before executing the vulnerability.

S131. Insert a breakpoint instruction at the detection point.

S132. Set an alarm mechanism at the detection point.

In steps S130~S132, the information security protection method of the present invention registers the detection point at the memory address before the function containing the loophole may be executed by the target program, inserts a breakpoint instruction (for example, INT3 instruction), and sets an alarm mechanism . By inserting this breakpoint instruction, when the target program is executed to the memory address in the subsequent steps, the breakpoint instruction will issue a "program breakpoint" exception to avoid execution loopholes, and the alarm mechanism will be sent when the target program is interrupted Warning message to the user.

Continue to step S14 to optimize the process of monitoring the target program.

As shown in the alternative embodiment shown in Fig. 5, the step S14 of optimizing the process of monitoring the target program includes:

S140. A function to filter non-vulnerabilities in the target program.

S141. Record the execution status of the vulnerable function.

In steps S140~S141, search for vulnerable programs or function names to filter normal functions (that is, functions that do not contain vulnerabilities) in the code of the target program to find all functions that use vulnerabilities, and When the program of the target program is executed to the function containing the vulnerability, its execution status is recorded. The execution status can record, for example, the name of the vulnerable function, the type of parameter used by the vulnerability, the name of the parameter and the content of the parameter or memory location, the name of the variable in the vulnerability, the type of the variable, the content of the variable or the memory location, but not limited to this . Through the above methods, unnecessary burdens can be reduced and the dynamic tracking process can be accelerated.

For example, the information security protection method of the present invention can set a filter variable glob and find all the functions that may trigger the vulnerable glob, and record the execution status of the function containing the glob when it is triggered, including the function name glob, Parameter category cont char, int, int*, glob_t, parameter name pattern, flags, errfunc, pglob, parameter memory location 0x7ffc******** and the variables fulename, dirname, dirle, p, q in the function ,end_name...etc.

Continue to step S15, execute and monitor whether the target program triggers the vulnerability, if not, record the executed process and continuously monitor the target program, if yes, execute the next step S16. Although the target program has vulnerabilities, it does not mean that it will be executed to the point where the vulnerabilities occur. At this time, the information security protection method of the present invention will assist the management personnel of the target program to evaluate the impact of security updates (such as the extent to which the system and service operations are affected) In order to reduce the cost of discovering vulnerabilities to security updates. If the target program will trigger the vulnerability, follow-up steps are required.

In step S16, the target program is interrupted according to the interrupt point address to avoid execution loopholes, and step S17 is continued.

In step S17, it is determined whether the vulnerability of the target program has a corresponding vulnerability defense method (for example, the vulnerability defense method formulated in step S11), if not, the target program is updated, and if so, the next step S18 is performed. If there is a corresponding vulnerability defense method, follow-up steps can be taken to ensure that the execution of the target program is not affected by the vulnerability.

In step S18, the execution of the vulnerability repair mechanism for the target program includes: implanting a protection program at the vulnerability address, and the protection program is used to eliminate abnormal data of the vulnerability or interrupt the execution of the vulnerability.

In step S18, the protection program can be used to check the content of the relevant variables or execution logic affected by the vulnerability, and eliminate the abnormal data of the vulnerability or interrupt the execution of the vulnerability. The protection program only protects where the vulnerability occurs and will not cause any functional changes, so it can avoid unnecessary security version updates and achieve the effect of vulnerability protection.

In step S19, the vulnerability defense method is performed on the target program. Similarly, the vulnerability defense method only protects the vulnerabilities of the target program, which can avoid or reduce the impact on the function of the target program, and at the same time achieve the effect of vulnerability protection.

A further embodiment of step S19 takes the execution of the program whitelist mechanism as an example: in order to avoid the execution of malicious programs after vulnerability intrusion, the program whitelist mechanism restricts only whitelisted programs from being executed, and intercepts all files at the bottom of the operating system The access message is used to terminate all non-whitelisted file access behaviors, thereby protecting high-risk hosts.

In step S20, the executed process is recorded and the target program is continuously monitored to ensure that the target program will not be affected by the vulnerability.

The present invention also provides a computer-readable medium for information security protection, which is used in a computer with a processor and a memory. The computer executes a target program through the processor (for example, CPU, GPU, etc.) and the memory, and the computer can Read the medium, and execute when the computer-readable medium is executed Information security protection methods as described above. In addition, the computer system includes general desktop computers, notebook computers, and various mobile devices.

In summary, the information security protection method of the present invention formulates a vulnerability defense method and locates the vulnerability address based on the vulnerability information of the target program provided by the database, and then sets the interruption point according to the vulnerability address and monitors whether the target program triggers the vulnerability. When a vulnerability is found to be triggered, the target program will be interrupted. After determining the impact of the vulnerability, the vulnerability repair mechanism and the implementation of vulnerability defense methods will be implemented as appropriate. Since the vulnerability repair mechanism and the vulnerability defense method do not directly modify the original program, it can reduce or avoid the impact on the target program function, and fully solve the problems of the existing technology. In addition, it can also track the underlying information of the system, set an alarm mechanism at the vulnerability address, or increase the process of optimizing the monitoring target program to further conduct behavioral analysis and security protection of the vulnerability.

The above-mentioned embodiments are merely illustrative to illustrate the principles and effects of the present invention, and are not intended to limit the present invention. Anyone who is familiar with this technique can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the rights of the present invention should be listed in the scope of patent application described later.

S10~S20‧‧‧Step

Claims (8)

An information security protection method includes: searching for vulnerability information of a target program; formulating a vulnerability defense method based on the vulnerability information; locating the vulnerability address of the target program, including: tracking the underlying system information of the target program based on the vulnerability information To obtain the relevant data of the vulnerability; and locate the vulnerability address based on the relevant data; set a break point based on the vulnerability address; optimize the process of monitoring the target program; execute and monitor whether the target program triggers the vulnerability, if not, then Record the executed process and continuously monitor the target program. If so, interrupt the target program according to the address of the interruption point; and determine whether the vulnerability of the target program has a corresponding defense method for the vulnerability, if not, then the target The program execution version is updated. If yes, execute the vulnerability repair mechanism for the target program, execute the vulnerability defense method for the target program, record the executed process and continuously monitor the target program. For example, in the information security protection method described in item 1 of the scope of patent application, the steps of formulating a vulnerability defense method based on the vulnerability information include: classifying the vulnerability; and formulating a corresponding vulnerability defense method according to the category of the vulnerability. Such as the information security protection method described in item 1 of the scope of patent application, wherein the underlying information of the system includes Symbol Table information or DWARF information. For example, the information security protection method described in item 1 of the scope of patent application, wherein the related data of the vulnerability includes the inode value and the offset value. An information security protection method includes: searching for vulnerability information of a target program; formulating vulnerability defense methods based on the vulnerability information; locating the vulnerability address of the target program; setting interrupt points based on the vulnerability address; optimizing the process of monitoring the target program ; Execute and monitor whether the target program triggers a vulnerability, if not, record the executed process and continuously monitor the target program, if yes, interrupt the target program according to the address of the interruption point; and determine whether the target program has a vulnerability There is a corresponding vulnerability defense method. If not, execute the version update for the target program. If yes, execute the vulnerability repair mechanism for the target program, execute the vulnerability defense method for the target program, and record the executed process and continue Monitoring the target program, where the step of setting a break point based on the vulnerability address further includes: registering a checkpoint at the address before executing the function containing the vulnerability of the target program; inserting a breakpoint instruction at the checkpoint; And set an alarm mechanism at the detection point. An information security protection method, including: Search for vulnerability information of a target program; develop vulnerability defense methods based on the vulnerability information; locate the vulnerability address of the target program; set interrupt points based on the vulnerability address; optimize the process of monitoring the target program; execute and monitor whether the target program Trigger the vulnerability. If not, record the executed process and continuously monitor the target program. If yes, interrupt the target program according to the address of the interruption point; and determine whether the vulnerability of the target program has a corresponding defense method for the vulnerability, If not, execute the version update for the target program, if yes, execute the vulnerability patching mechanism for the target program, execute the vulnerability defense method for the target program, record the executed process and continuously monitor the target program. The steps of optimizing the process of monitoring the target program include: filtering the function that does not contain the vulnerability in the target program; and recording the execution status of the function that contains the vulnerability in the target program. An information security protection method includes: searching for vulnerability information of a target program; formulating vulnerability defense methods based on the vulnerability information; locating the vulnerability address of the target program; setting interrupt points based on the vulnerability address; optimizing the process of monitoring the target program ； Execute and monitor whether the target program triggers the vulnerability, if not, record the executed process and continuously monitor the target program, if yes, interrupt the target program according to the address of the interruption point; and determine whether the target program has a vulnerability Corresponding to the vulnerability defense method, if not, execute the version update for the target program, if yes, execute the vulnerability patching mechanism for the target program, execute the vulnerability defense method for the target program, and record the executed process and continuously monitor The target program, wherein the steps of executing a vulnerability repair mechanism on the target program include: implanting a protection program at the vulnerability address, and the protection program is used to eliminate the abnormal data of the vulnerability or interrupt the execution of the vulnerability. A computer-readable medium for information security protection, applied to a computer with a processor and a memory, the computer executes a target program and the computer-readable medium through the processor and the memory, and is used to execute the computer When the medium is readable, the information security protection method described in any one of items 1 to 7 of the scope of patent application is implemented.

Images