Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
  • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
  • G06F11/0766—Error or fault reporting or storing
  • G06F11/0772—Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
  • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
  • G06F11/0727—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a storage system, e.g. in a DASD or network based storage system
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
  • G06F11/10—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
  • G06F11/1004—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's to protect a block of data words, e.g. CRC or checksum
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

• the present invention relates to a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network.
• the present invention relates to a method for detecting malicious code changes from hacking of a program loaded and executed on the memory under the client-server model in real time.
• a program provided at a server in general under client-server model is often executed at a client terminal in real time. At this time, a hacking is tried to hinder from fulfilling the original objective of the program in execution.
• a hacking method is divided into a method that prohibits from executing the intended original objective of a program by creating a crack in the code of executing the program that exists in a file type, and a method that makes changes in a program that is loaded on the memory for execution.
• a method of the latter gets more problematic in recent days in that this method will bring about a fatal damage that is similar to the effect of the former, and the latter is more effective in hacking in real time, thus a preventative measure is necessary.
• the present invention will provide a new method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network.
• An objective of the present invention is to provide a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network under client-server model.
• a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network comprises the following steps of: creating a first data for confirming errors with regard to the program code area that a server wishes to protect; transmitting a request message created based on the first data for confirming errors to a client; creating a second data for confirming errors with regard to the code area according to the request message at the client; transmitting an answer message created based on the second data for confirming errors to the server; and comparing the first data for confirming errors with the second data for confirming errors at the server.
• Both the first data for confirming errors and the second data for confirming errors may be created with regard to the entire area of the program to be protected or with regard to a part of the code area by extracting the starting point and ending point of at least one function constituting a program.
• At least one part of the code area exists, and both the first data for confirming errors and the second data for confirming errors may be created with regard to a part of each of the code area.
• An ending point is the area where a return code is extracted in prearranged numbers by executing a disassembling step from a starting point, a point right before the starting point of a different function after the starting point of the different function is extracted by executing a disassembling step from the starting point of the different function, and the ending point is the point away from a starting point by a prefixed length.
• the first data for confirming errors and the second data for confirming errors comprises an instruction constituting a function, or further comprises an operand constituting a function.
• a CRC (Cyclic Redundancy Check) data, a Check Sum data, or a Hash data are used as a first data for confirming errors and a second data for confirming errors.
• Both the request message and the answer message are encrypted and transmitted based on session key shared by a server and a client, both the request message and the answer message are decrypted based on the session key, and thereby security in data transmission is duly considered.
• FIG. 1 is a flowchart of a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network under client- server model according to the present invention.
• the present invention will be described in detail in the following with reference to the drawing attached herein. [21]
• the present invention relates to a method for detecting an outside attack that changes a program code is loaded on the memory when the program code that is executed through a network under client-server model.
• the present invention communicates data by transmitting a request message and an answer message between a client and a server under client-server model. Further, a session key is shared for encrypting and decrypting of data in transmission for a security purpose.
• Whether a program code is modified or not is detected in the present invention by the following steps of: creating a first data for confirming errors at a server with regard to the executing the program code, creating a second data for confirming errors corresponding to the first data for confirming errors, and comparing the first data for confirming errors and the second data for confirming errors.
• the first data for confirming errors and the second data for confirming errors in accordance with the present invention are selected from the group consisting of a CRC (Cyclic Redundancy Check) data, a Check Sum data, and a Hash data that contain an instruction only or both an instruction and an operand.
• CRC Cyclic Redundancy Check
• FIG. 1 illustrates a method for detecting malicious code changes from hacking of a program loaded and executed on the memory through a network under client-server model according to the present invention.
• a first data for confirming errors with regard to the program code area on the memory is firstly created when the program that a server wishes to protect is loaded and executed on the memory at step 101.
• the first data for confirming errors may be created with regard to the entire program code to be protected or with regard to a part of the program code.
• more than one part may be set up.
• functions in a fixed number may be selected from the functions constituting the program for executing.
• the number of functions are determined depending on the number of the functions that constitutes the code to be protected and thereby is set up particularly according to the program to be protected. In other words, if a part of the code to be protected is comprised of ten functions, the ten functions shall be selected. Further, it may be all right to select a part of the memory address at which executing code is loaded.
• an ending point of a function is determined by executing a disassembling step from starting point.
• ending point may be the point where a return code is extracted in a prescribed number during the process of disassembling.
• a point right before the starting point may be set up as an ending point of the function.
• a point which is away from the starting point of a function by a certain length may be the ending point. Not to mention, the length shall fall within the scope of the entire code area.
• an instruction in charge of real calculation of a function is drawn out by executing a disassembling step from a starting point to an ending point, and a first d ata for confirming errors is created to include the instruction.
• the first data for confirming errors including an instruction further comprises an operand which executes a function for calculation.
• the first data for confirming errors may be created in consideration of the address which is relocated.
• a request message corresponding to the first data for confirming errors is transmitted to a client.
• the content of the request message is that a second data for confirming errors shall have a random order based on the first data for confirming errors.
• the request message is preferably transmitted in an encrypted form based on a session key in consideration of security during data communication.
• a client creates a second data for confirming errors corresponding to the first data for confirming errors according to the request message.
• the request message is encrypted
• the encrypted request message is decrypted based on the session key.
• the second data for confirming errors creates a second data for confirming errors including an instruction that is detected at applicable area while executing the disassembling step requested by the server from starting point of the memory address to ending point.
• a second data for confirming errors is created including not only an instruction but also an operand.
• a second data for confirming errors with respect to each address is created, and the second data for confirming errors can be created by arranging in a random order according to the request of a request message.
• the client creates an answer message at step 104, based on the second data for confirming errors created in that manner, and transmits the answer message to the server.
• an answer message may be encrypted and transmitted in the same manner as in a request message.
• step 105 after the server receives the answer message, the first data for confirming errors and the second data for confirming errors are compared, and thereafter it is determined whether both are identical or not. At this time, if an answer message is found out to be encrypted, the answer message is decrypted and thereafter the original second data for confirming error is restored.
• a program may run continuously as in step 106, and thereafter whether a code on the memory is changed or not is periodically or randomly inspected from step 101 regarding the code area to be protected if there is a need for that.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Software Systems (AREA)
• Quality & Reliability (AREA)
• Computer Hardware Design (AREA)
• Health & Medical Sciences (AREA)
• Bioethics (AREA)
• General Health & Medical Sciences (AREA)
• Storage Device Security (AREA)
• Detection And Correction Of Errors (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=37866488

Family Applications (1)

Country Status (2)

Cited By (1)

Families Citing this family (4)

Citations (4)

• 2005
  • 2005-12-26 KR KR1020050129616A patent/KR100663034B1/ko active IP Right Grant
• 2006
  • 2006-12-19 WO PCT/KR2006/005582 patent/WO2007074992A1/en active Application Filing

Patent Citations (4)

Also Published As

Similar Documents

Legal Events