WO2012034349A1

WO2012034349A1 - Method and system for protecting computer safety

Info

Publication number: WO2012034349A1
Application number: PCT/CN2011/001037
Authority: WO
Inventors: 胡志水
Original assignee: Hu Zhishui
Priority date: 2010-09-14
Filing date: 2011-06-21
Publication date: 2012-03-22
Also published as: CN101950339B; CN101950339A

Abstract

A method and a system for protecting computer safety are disclosed. The method involves generating a characteristic code and a kind identification code corresponding to the safe executable module, dividing the client machine into the social area, the system area, and the working area, computing the characteristic code of the progress or the thread when the progress or the thread is running on the client machine, and marking the progress or the thread as a working attribution or a social attribution according to that if the characteristic code of the progress or the thread is known, if the websites except the safe websites and the catalogue thereof are accessed, thereby obtaining different rights to the resources of the client machine. The method enables prevention of a customer computer from being identified by a virus base and software, to operate the unknown executable module without damaging the data of the operation system and the application progress data.

Description

Computer security protection method and system

The invention relates to a computer security protection method and system. Background technique

In response to the emergence of endless virus Trojans, no matter whether passive or active defense technology is used, the virus database is getting larger and larger. Even this does not completely prohibit the destruction of the computer system by the unknown virus Trojan. Due to the diversity, complexity and changing characteristics of computer programs, it is decided that active defense technology can only identify some programs, and cannot identify all programs or modules. It depends on the virus database and software behavior to identify them. It provides an opportunity for the invasion of unknown virus activities. Although it has been found in the literature that it is theoretically impossible to prevent all unknown programs in the client from running by establishing a trusted signature database, it is impossible to guarantee that all modules are known. Therefore, there is no practical significance. Summary of the invention

The technical problem to be solved by the present invention is to provide a computer security protection method and system that allows an unknown executable module to be run without relying on virus database and software behavior recognition without causing damage to the operating system and secure application data.

In order to solve the above technical problem, the technical solution of the present invention is as follows:

A computer security protection method includes the following steps:

Generating a feature code and a classification identification code corresponding to the secure executable module at the central server, the classification identification code including a type code and a product name code;

Establishing a social zone, a system zone, and a work zone at the client, the social zone (which may be one or more) includes a specified directory established on the client disk, and a designated branch established in the registry; The system area includes an operating system directory; the work area includes a directory and a registry other than the system area and the social area;

When the client runs a process or a thread, the signature of the process or thread is calculated. If the signature is executed for the first time and there is no matching signature in the local, the signature is retrieved in the central server, such as the presence and the signature of the central server. Corresponding product name code, then download the corresponding product name code Have a signature, join the local module signature library;

For the process or thread running by the client, determine if the following conditions are true:

The process itself file path is not a social attribute in the specified directory and parent process of the system area; or the current process or thread is automatically set as a system attribute by other policies; if it is established, the process or thread is marked as a system attribute: is marked as a system attribute Process or thread, can operate on all partitions;

The feature code of the process itself is a feature code in the feature library of the local module;

The feature code of the loaded executable module is the feature code in the local module feature library; there is no access to the URL other than the secure URL;

The process file path itself is not in the specified directory of the social zone;

The process file path itself is not in the specified directory of the system area;

The parent process attribute is not a social attribute;

If both are true, the process or thread is marked as a work attribute: A process or thread marked as a work attribute can perform all operations on the system area and the work area, and cannot view and modify social area information; otherwise, the process or thread is marked For social attributes: processes or threads marked as social attributes, except for the directory where the process or thread is located, do not see any information in the work area, and the registry and disk operations outside the social area are redirected to the designation of the social area. Branches and designated directories, and if there are multiple social zones, each social zone is completely isolated, and each other's information is not visible to each other.

The step of generating a signature corresponding to the secure executable module includes: determining a format of the executable module, and calculating a checksum; and calculating an indication of the length of the executable module.

The computer security protection method may further include automatically adding a signature of a new executable module generated by a process or thread marked as a work attribute to the local module feature library.

The computer security protection method may further include prohibiting a process or thread that is marked as a social attribute from installing an unknown module feature driver.

The computer security protection method may further include a process marked as a social attribute or a thread that returns a failure when the hook is applied globally.

The computer security protection method may further include returning a failure when the process marked as a social attribute or the thread remote thread is injected;

The computer security protection method may further include prohibiting a process or line marked as a social attribute The process terminates a process other than the process marked as a social attribute;

The computer security protection method may further include prohibiting a process or thread marked as a social attribute from directly reading and writing a disk and a memory;

The computer security protection method may further include prohibiting a process or thread marked as a social attribute from editing an operating system account, restarting or shutting down the machine, and formatting the disk operation.

According to another aspect of the present invention, a computer security protection system is provided, including: a central server, which generates a signature code and a classification identification code corresponding to a secure executable module, the classification identification code including a type code and a product name code;

a computer security protection client that establishes a social zone, a system zone, and a work zone at the client, the social zone including a specified directory established on the client disk, and a designated branch established in the registry; the system zone includes an operating system directory The work area includes directories and registries other than the system area and the social area;

When the client runs a process or a thread, the computer security protection client calculates a signature of the process or the thread, and if the signature is performed for the first time, and there is no matching signature in the local, the signature is retrieved in the central server by using the signature. If the central server has a product name code corresponding to the feature code, download all the feature codes corresponding to the product name code, and join the local module feature database;

For the process or thread running by the client, the computer security client determines whether the following conditions are true:

The parent process attribute is not a social attribute;

If both are true, the process or thread is marked as a work attribute: a process marked as a work attribute Or thread, can perform all operations on the system area and the work area, can not view and modify the social area information; otherwise, the process or thread is marked as a social attribute: a process or thread marked as a social attribute, except the directory where the process or thread is located , can not see any information in the work area, and the registry and disk operations outside the social area, are redirected to the designated branch and designated directory of the social area, and if there are multiple social partitions, each social partition is completely Isolated, they can't see each other's information.

The operating system directory can also be set manually through the software window. For example, the windows system directory is generally c:\\windows, but it can also be set by software to set c:\\mydata to the system directory, so that the directory is for the social area. In fact, it has read-only permissions.

A computer security protection method and system according to the present invention divides client resources into a system area, a work area, and a social area, and sets different access rights to the three areas by processes or threads marked as different running attributes, Separation of work areas and social areas, isolation between social areas. For a large number of unknown executable modules, they are marked as social attributes at runtime, processes or threads marked as social attributes, read-only operations on the system area and current directory, all other operations outside the social area are heavy Directed to the social zone operation, because the work area and other social zone information are not visible, the data separation between the social zone and the work zone data and the social zone is achieved. At the same time, the damage to the system is blocked. Therefore, even if there are a large number of virus programs, no damage to the system area, work area and other social area data or leakage of work area data will be achieved, and the effect of completely blocking the virus Trojan will be achieved. DRAWINGS

1 is a flow chart of the protection of the computer security protection client of the present invention. detailed description

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The computer security protection system of the present invention includes a central server and a computer security protection client. The central server generates signatures corresponding to the secure executable modules, and collects the signatures as part of the executable module identification and joins the central module signature library.

The format of the executable module file includes com, MZ, NE, LE, PE, and most of the executable modules are in PE format. The corresponding signature construction method is as follows: 1. Calculate the checksum:

For the executable modules of the com and MZ formats, the checksum is generally calculated for the entire file; for the executable modules of the NE and LE formats, only the checksum calculation is performed on the DOS header and the corresponding NE header and LE header;

For the executable module in PE format, only the DOS header and the corresponding PE header and section table are checked and calculated.

2. Calculate the length indication of the executable module - if the actual length of the executable module does not exceed 2 bytes, the actual length of the executable module is used as the length indication of the executable module; otherwise, by the actual implementation of the executable module The length is divided by a double-byte unsigned integer to obtain a remainder of 2 bytes, with the remainder being the length indication of the executable module.

The calculated checksum and length indication are both 2 bytes, which together form the signature of the 4-byte executable module. For example, for the executable module qq.exe, its signature is:

10110000 00000000 00000111 00000000

It will be understood by those skilled in the art that the above feature code can be constructed by other methods as long as the executable module can uniquely correspond to the feature code.

In order to classify and manage the executable modules in the central server and facilitate the computer security protection client to download the feature codes associated with the current computer, the executable module identifier of each executable module has 4 bytes of signature code, and 4 The byte identification code is generated by the central server, and the classification identification code includes a type code and a product name code.

Type Code: Considering that 512 types should be sufficient to classify executable modules, 8 bits are arranged. For example, the type of instant messaging can be represented by 00110000.

Product Name Code: Considering the variety of products, each type is arranged 24 bits to indicate the product name. For example, Tencent instant messaging products can be represented by 00000000 00000000 00110001.

Therefore, each executable module identifier contains 8 bytes, of which 4 bytes are classification identification codes and the other 4 bytes are signature codes.

The above method of generating the signature and the classification identifier is also applicable to an executable module whose security is not determined.

After the client is installed, the current operating system version and installed application software are scanned on the first run. For the operating system, directly download the signature corresponding to the operating system version; For the installed application software, the 4-byte signature of any executable module in the installation directory can be calculated and retrieved in the central server by the signature, for example, if the central server has a product name code corresponding to the signature, Download all the signatures corresponding to the product name code and add them to the local module signature database. For the new application software that is subsequently installed, the corresponding signature will be downloaded by the above method for the first time. These signatures form a local module signature library.

The social zone, system zone, and workspace are created on the client after the client is installed.

The system area includes the operating system directory. For the Windows operating system, it refers to the Windows or WINNT directory and other directories customized to the system directory.

The social area includes the specified directory on each disk partition, that is, the social area directory, such as the HU119VMX directory in the root directory. For the Windows operating system, it also includes all the specified branches in the registry, that is, social area branches, such as the HU119VMX branch.

The workspace includes all directories and registries except the system area and the social area.

System Attributes: When a process or thread is running, if the current directory of the process is in the system area, it is marked as a system attribute, and the process or thread with system attributes can perform all operations.

Work attribute: When the process or thread runs, if the signature of the loaded executable module is the signature in the local module signature database, and there is no access to the URL other than the secure URL (the secure URL is provided by the central server), and the current directory of the process Not in the system area and social area, it is marked as a work attribute. A process or thread marked as a work attribute can perform all operations on the system area and the work area, and only the system attribute process can access the social area information. A process or thread with a working attribute accesses the operating system and the operation of the file data is a real operation.

Social attribute: When the process or thread is running, if the signature of the loaded executable module is a signature other than the local module signature, or a URL other than the secure URL is accessed, or the current directory of the process is located in the social area, it is marked as Social attributes. Processes or threads marked as social attributes, except for the current directory, do not see any information in the workspace and are virgin to the registry and disk operations outside the social zone, being redirected to the social zone branch and social zone directory , but it is completely transparent to the current process or thread.

The following example describes the allocation management of the social area in the registry. For any registry operation, there are only two cases that reflect the core operation path:

\\\\Registry\\Machine\\xxxxxx\\xxxxxx, and

\\\\Registry\\USER\\xxxxxx\\xxxxxx. The social zone registry branch is fixed behind the third section:

\\\\Registry\\Machine\\xxxxxx\\hu 119vmx\\xxxxxx, and

\\\\Registry\\USER\\xxxxxx\\hu 119vmx\\xxxxxx.

So when the process or thread marked as a social property modifies the registry \\\\Registry\\Machine\\system\\testapp, it is actually \\\\Registry\\Machine\\system\\hul 19vmx\\testapp modify.

The following example describes the allocation management of social zones in disk partitions. For any file system partition, the partition root directory will be assigned a social zone directory "/hul 19vmx"o

Depending on the module characteristics of the executable module loaded by the process or thread, the way the web page is requested, and the location of the current directory of the process, the process or thread is dynamically tagged with three operational attributes: system attributes, work attributes, and social attributes. Processes or threads with different attributes, with different access to client resources: Processes or threads of social attributes, except for their current directory, can't see the work area and other social area information; Processes and threads of work attributes, can't see Go to social zone information; processes and threads of system properties can do all the work. In this way, the data of the work area and the social area are isolated, and the process or thread of the social attribute cannot actually modify any information outside the social area, and the stability of the operating system is also ensured.

In order to guarantee the operation of the unknown program without any damage to the system area and the workspace data, the process or thread permissions marked as social attributes are set as follows:

a) All unknown module feature drive installation is prohibited;

b) global application hook call, return failure;

c) remote thread injection, return failure;

d) prohibit the termination of processes other than those marked as social attributes;

e) direct reading and writing of disks and memory is prohibited;

f) cannot access the files of the workspace except for its own directory;

g) All writes to the registry and files outside the social zone are redirected to the social zone branch and the social zone directory;

h) It is forbidden to edit the operating system account, restart or shut down the machine, and format the disk operation.

The following example shows access to client resources by a process or thread marked as a social property:

1. Write to files outside the social zone, all redirected to the social zone directory of the current disk partition. For example: When writing the file c:\\windows\\system32\\smon.dll, the file filter driver will write Enter c:\\hul l9vm\\windows\\system32\\smon.dll; To write the file d:\Vwtsoft ss.dat, the file filter driver will write d:\\hul 19vmx wtsoftWss.dat.

2. Read the file, except that you can see the system area directory, you can only see the current path of the program itself and the information in the social area (hul l9vm) directory under each disk partition. For example, if you read the file c:\\windows\\system32\\smon.dll, the file filter driver will read c:\\hul 19vmx\\windows\\system32\\smon.dll first. If the file does not exist, it will go. Read the real file c:\\windows\\system32\\smon.dll. If you read the file d:\\wtsoft\\ss.dat, the file filter driver will read d:\\hul 19vmx wtsoft ss.dat directly. If it fails, it will return directly because the workspace is not allowed to have social attributes. If the corresponding directory in the social zone does not exist, it means that the file does not exist.

3. The write operation to the registry is redirected to a fixed social zone branch corresponding to the registry, and the social zone branch distribution is described in the previous section. Such as: write the registry \\\\Registry\\Machine\\system\\testapp, the registry filter driver will write WWRegistryWMachineWsystemWhul 19vmx\\testapp; write the registry \\\\Registry\\user\\HKEY_CURRENT_USER\\testapp The registry filter driver writes to \\\\Registry\\user\\HKEY_CURRENT_USER\\hu 119vmx\\testapp.

4. Read the registry. Such as: read the registry \\\\Registry\\Machine\\system\\testapp, the registry filter driver will read WRegistryWMachineWsystemWhul 19vmx\\testapp first, if it fails, read the real place \\\\Registry\\Machine\\ System\\testapp;

According to the access file and the registry mentioned above, the file filter driver is used to realize the invisibility between the work area and the social area, and the registry protection is implemented by the registry filter driver.

Processes or threads marked as social attributes above can also be implemented in other ways for files and registry operations:

For the case where the system has multiple disk partitions, it is not necessary to create a social partition directory in each disk partition, and you can arbitrarily specify a directory or file, and then implement different disk area operations in the directory or file. It is implemented in different places in the registry, and the social area registry can also be implemented through separate files.

For installation packages that run with social properties, the installed programs are written to the social area so that the newly installed application is not visible from the start menu without the merge process. At this time, the system process performs the memory in the memory by setting the corresponding menu of the start menu, such as the corresponding menu in the social area. Merge processing, so that the operating system process can display the newly installed application on the start menu, other special processing, and so on.

Referring to FIG. 1, the protection process of the computer security protection client is as follows (for convenience of description, the executable module whose feature code is recorded in the local module feature library is defined as a known module, and the feature code is not recorded in the executable module of the local module feature library. Defined as an unknown module):

Start a new process: first calculate the 4-byte signature of the executable module, calculate the signature of the process or thread, if it is the first execution, and there is no matching signature locally, then the signature is used in the central server. Retrieval, if the corresponding product name code exists in the central server, download all the feature codes corresponding to the product name code, and join the local module feature library;

The parent process attribute is not a social attribute;

If both are true, the process or thread is marked as a work attribute: A process or thread marked as a work attribute can perform all operations on the system area and the work area, and cannot view and modify social area information; otherwise, the process or thread is marked For social attributes: processes or threads marked as social attributes, except for the directory where the process or thread is located, do not see any information in the workspace, and are redirected to the social zone branch and registry and disk operations outside the social zone. The social zone directory, and if there are multiple social zones, each social zone is completely isolated, and each other's information is not visible to each other.

The new executable module generated by the process or thread marked as a work attribute automatically adds the feature code of the executable module to the local module feature library.

It is apparent that various modifications and variations of the present invention are possible in the light of the scope of the appended claims.

Claims

Claim

1. A computer security protection method, comprising the following steps:

(1-1) generating, in the central server, a feature code and a classification identification code corresponding to the secure executable module, the classification identification code including a type code and a product name code;

(1-2) establishing, in the client, a social zone, a system zone, and a work zone, the social zone including a specified directory established on the client disk, and a designated branch established in the registry; the system zone includes an operating system directory; The work area includes directories and registries other than the system area and the social area;

(1-3) When the client runs a process or a thread, the signature of the process or thread is calculated. If the signature is executed for the first time and there is no matching signature in the local, the signature is retrieved in the central server, such as the central server. If there is a product name code corresponding to the feature code, all the feature codes corresponding to the product name code are downloaded, and the local module feature library is added;

( 1-4) For the process or thread running by the client, determine whether the following conditions are true:

The parent process attribute is not a social attribute;

If both are true, the process or thread is marked as a work attribute: A process or thread marked as a work attribute can perform all operations on the system area and the work area, and cannot view and modify the social area information; otherwise, the process or thread is Marked as a social attribute: a process or thread marked as a social attribute, except for the directory where the process or thread is located, does not see any information in the work area, and is redirected to the social area for registry and disk operations outside the social area. Specify branches and specified directories, and if there are multiple social partitions, each social partition is completely isolated, and each other's information is not visible to each other.

2. The method of claim 1, the step of generating a signature corresponding to a secure executable module comprising -

(2-1) Determine the format of the executable module and calculate the checksum:

If the executable module is in com or MZ format, a checksum is calculated for the entire file;

If the executable module is in the NE or LE format, the checksum is calculated only for the DOS header and the corresponding NE header and LE header;

If the executable module is in the PE format, the checksum is calculated only for the DOS header and the corresponding PE header and the section table;

(2-2) Calculate the length indication of the executable module:

If the actual length of the executable module does not exceed 2 bytes, the actual length is used as an indication of the length of the executable module;

Otherwise, the actual length is divided by the double-byte unsigned integer to obtain a remainder of 2 bytes, with the remainder being the length indication of the executable module.

3. The method of claim 1 further comprising automatically adding a signature of a new executable module generated by a process or thread marked as a work attribute to a local module feature library.

4. The method of claim 1 further comprising disabling a process or thread tagged as a social attribute to install an unknown module feature driver.

5. The method of claim 1 further comprising returning a failure when the process or thread marked as a social attribute applies a hook call globally.

6. The method of claim 1 further comprising returning a failure when the process is marked as a social attribute or the thread is injected remotely.

7. The method of claim 1 further comprising disabling processes or threads marked as social attributes from terminating processes other than processes marked as social attributes.

8. The method of claim 1 further comprising disabling processes or lines marked as social attributes Directly read and write disk and memory and edit operating system accounts, restart or shut down the machine, format disk operations.

9. A computer security system, comprising:

a central server, which generates a signature code and a classification identifier code corresponding to the secure executable module, where the classification identifier code includes a type code and a product name code;

a computer security protection client that establishes a social zone, a system zone, and a work zone at the client, the social zone including a specified directory established on the client disk, and a designated branch established in the registry; the system zone includes an operating system directory And other specified directories; the work area includes directories and registries other than the system area and the social area;

The process itself file path is not a social attribute in the specified directory of the system area and the parent process; or automatically set the current process or thread as a system attribute through other policies; if established, the process or thread is marked as a system attribute: marked as a system The process or thread of the attribute, which can operate on all partitions;

The parent process attribute is not a social attribute;

If both are true, the process or thread is marked as a work attribute: A process or thread marked as a work attribute can perform all operations on the system area and the work area, and cannot view and modify social area information; otherwise, the process or thread is marked For social attributes: processes or threads that are marked as social attributes, Except for the directory where the process or thread is located, you can't see any information in the workspace, and the registry and disk operations outside the social zone are redirected to the designated branch and the specified directory of the social zone, and if there are multiple social zones, each The social divisions are also completely isolated, and they cannot see each other's information.

10. The system of claim 9, the signature corresponding to the secure executable module comprising a checksum and a length indication of the executable module, wherein:

11. The system of claim 9, the computer security client automatically adds a signature of a new executable module generated by a process or thread marked as a work attribute to a local module feature library.