KR101017258B1 - Process protection system and method using object manager - Google Patents

Abstract

The present invention relates to a system and method in which a security process protects itself or protects other processes using an object manager in a 64-bit Windows operating system environment in which PatchGuard operates.

The process protection system using the object manager according to the present invention comprises: an object manager that receives an object access message and manages all tasks targeting the object; and an object register to cause the object manager to output a callback signal when the object access message is received. An object callback registration unit for registering a callback function, an object access detection unit for receiving the callback signal from the object manager, a filtering unit for extracting a subject process, a target process, and a job type of the object access message from the callback signal; An analysis unit for analyzing the subject process, the target process and the job type extracted by the filtering unit, and a result processing unit for returning the callback signal to the object manager according to the analysis result of the analysis unit.

Object Resist Callback, Object Manager, Security Process, Protection, Callback Signal

Description

Process protection system and method using object manager {protecting system and method of process using Object Manager}

The present invention relates to the protection of a process, and more particularly, to a system and a method in which a security process protects itself or protects other processes using an object manager in a 64-bit Windows operating system environment in which PatchGuard operates. .

With the widespread use of high speed internet, various tasks are performed through the internet, and online banking, online games, purchase of goods and information are made through the website of the internet.

When a user accesses an online banking website or an e-commerce website and uses an online banking service or an item purchasing service, a keyboard security program is downloaded and installed from the website to the client system. A program or file containing this keyboard security program refers to a collection of commands written in order to run the computer, and a process refers to a program running on the computer.

Therefore, when the keyboard security program is downloaded and installed in the client system, the keyboard security process is driven to secure the information such as the ID or password input by the user to the outside. Thus, a malicious process attempts to crack information entered by a user by disabling this keyboard security process.

On the other hand, in the case of online games, gamers like to use game hacks. This allows the game hack to manipulate the game's memory to change certain data such as stats and stamina, increase the speed or number of hits in martial arts games, or provide macro functions, allowing gamers to easily win the game. Because. The use of game hacks in online games can cause problems such as a loss of balance among users and a heavy load on the game server. Therefore, online game companies install online game security processes to block game hacks while serving online games on client systems. However, malicious processes attempt to use game hacks in online games by disabling this online game security process.

As all security processes serviced on websites today are likely to be attacked by malicious processes, most security processes include a function to protect themselves from malicious processes. Self-protection is called self-protection. In addition, the security process may include a function of protecting another process (eg, a game process or another security process) from a malicious process.

In general, in a 32-bit Windows operating system environment, the security process hooks an application programming interface (API) function to perform self protection or other process protection.

That is, an API hooking routine is installed in the kernel area of a computer system that hooks specific API functions. When a specific API function is hooked by an API hooking routine using this specific API function, the specific API function is analyzed by analyzing the authority, operation type, and target process of the subject process using the specific API function. Determines whether to continue processing. If, as a result of the analysis of the hooked specific API function, the malicious function is determined to be a function to terminate the security process, the API function adversely affects the security of the computer system, so that the hooked specific API function is not processed. However, if the result of analysis of hooked API function is a function that is not related to malicious process or security process, the relevant hooked API function can be processed normally.

1 is a flowchart illustrating a process protection method according to the prior art.

First, the security process installs an API hooking routine for hooking a specific kind of API in the kernel region of the operating system (S11). The specific types of APIs here include a process termination API (eg, killProcess API, exitProcess API, TerminateProcess API, etc.), a process read API (eg, ReadProcess API, etc.), a process write API (eg, WriteProces API, etc.).

When the above specific API is used by any subject process, API hooking routine is executed to hook the API. When a specific API is hooked (S12), the security process analyzes the hooked API and analyzes the subject process, the job type, and the target process using the API (S13).

For example, when a user double-clicks a word file in the window explorer, the window explorer process operates to open the word process. At this time, the OpenProcess API is generally used. The main process of the OpenProcess API is a Windows Explorer process, the job type is Open Process, and the target process is a word process. On the other hand, when a malicious process wants to terminate the security process, the malicious process generates a process termination API (eg, killProcess API, exitProcess API, TerminateProcess API, etc.) for the security process. In this case, the security process hooks and analyzes this process termination API, where the subject process is a malicious process, the target process is a security process, and the task termination is a process termination.

In step S13, the security process analyzes the hooked API to check the type of work, whether the subject process has permission to use the work, and whether the target process of the API is to be protected. If the subject process does not have permission to use the work and the target process is protected (S14), execution of the hooked API is blocked (S15). However, if the subject process has permission to use the API or if the target process is not protected (S14), the hooked API is allowed to be executed (S16).

As such, an API hooking routine for hooking certain API functions in the kernel area is required to protect the security process itself or other processes.

However, on 64-bit Windows operating systems (eg Vista), it has a patch guard feature, which makes it impossible to install API hooking routines. Therefore, there is a problem in that a 64-bit Windows operating system cannot implement a self-protection function of a security process using a conventional API hooking routine installation method.

In order to solve the above problems, the object of the present invention is to register an object registration callback function in the object manager so that the security process is called when the object is accessed. It is to provide a system and method for self-protection or other process protection.

The process protection system using the object manager according to the present invention for achieving the above object is an object manager for receiving all object operations by receiving an object access message, and when the object manager receives the object access message An object callback register for registering an object resist callback function to output a callback signal, an object access detection unit for receiving the callback signal from the object manager, a subject process, a target process, and a task type of the object access message from the callback signal; A filtering unit for extracting a data source, an analysis unit for analyzing a subject process, a target process, and a job type extracted from the filtering unit, and a result processing unit for returning the callback signal to the object manager according to an analysis result of the analysis unit; .

In addition, the process protection method using the object manager according to the present invention, the object callback registration step of registering an object resist callback function to output a callback signal upon receiving the object access message to the object manager receiving the object access message, and An object approach detection step of receiving the callback signal from an object manager; a filtering step of extracting a subject process, a target process, and a task type of the object access message from the callback signal; and a subject process and a target process extracted in the filtering step And an analysis step of analyzing a work type, and a result processing step of returning the callback signal to the object manager according to the analysis result of the analysis step.

As described above, according to the present invention, even in an environment in which patch guard is installed, such as a 64-bit Windows operating system, self-protection or other process protection of the security process can be implemented.

Hereinafter, a process protection system and method using an object manager according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The process protection method according to the invention is provided in the form of a program. Generally, a 'program' or a 'file' refers to a command set written in order to execute a computer, and a 'process' refers to a program running in the computer. In other words, the process protection program of the present invention is executed as a security process in a computer system. Executable code and data of this security process are loaded into the memory of the computer system. The memory also includes an ObjectManager (ObjectManager) that manages all operations (open, write, read, exit, etc.) targeting various objects (processes and threads).

2 is a block diagram illustrating a protection system for implementing a process protection method using the object manager of the present invention.

The process protection system of the present invention is implemented by the object manager 210 and the security process 220. The security process is created in the memory by executing the program of the process protection function according to the present invention on the computer system.

The security process 220 includes an object callback registration unit 221 for registering an object register callback function in the object manager 210 and an object access detection unit for receiving a callback signal from the object manager to detect an access to an arbitrary object ( 222, a filtering unit 223 extracting an access subject process, an access target process, and a task type from the callback signal, and analyzing the access subject process, an access target process, and a task type extracted by the filtering unit 223. An analysis unit 224 and a result processing unit 225 for returning the callback signal in accordance with the analysis results of the analysis unit 224.

The object manager 210 manages all tasks that access all objects (processes and threads) of the computer system. That is, in a 64-bit Windows operating system, if any first process opens any second process, writes data to the second process, reads data from the second process, or terminates the second process, An object access message for accessing the second process is delivered to this object manager 210. Therefore, this object access message includes the subject process (first process) information that generated this object access message, the type of work (read, write, open, end, etc.) to be performed by this object access message, and the The target process (second process) information to be included is included.

When the object access message is received by the object manager 210, the object callback registration unit 221 registers an object resist callback function for causing the object manager 210 to output a callback signal to the security process. This callback signal contains the information contained in the object access message (the subject process, the task type and the target process of the object access message).

The object access detecting unit 222 detects an object approach by receiving a callback signal from the object manager 210.

The filtering unit 223 extracts information on the subject process of the object access message, the target process of the object access message, and the operation type of the object access message from the callback signal.

The analysis unit 224 stores a criterion of whether to use the security and the permission of the task and the name of the process to be protected, and comprehensively analyzes the subject process, the target process and the task type extracted by the filtering unit 223. It determines whether the task type is a task that requires security, whether the subject process has permission to use the task, and whether the target process is protected.

The result processing unit 225 protects the target process by not returning a callback signal to the object manager when the job type is a job that requires security, the subject process does not have the right to use the corresponding task, and the target process is a protected target. On the other hand, the result processing unit 225 returns a callback signal to the object manager when the job type is a job that does not require security, the subject process has the corresponding work authority, or the target process is not protected, thereby responding to the object access message. Allow the work to be performed.

3 is an operation flowchart illustrating a process protection method using the object manager of the security process according to an embodiment of the present invention.

The security process registers an object registration callback function with the object manager (S31). This object registration callback function is a function that outputs a callback signal to the security process when an object access message is received. The callback signal includes the subject process, target process, and job type information of the object access message.

Thereafter, when the callback signal is input from the object manager (S32), the security process filters the subject process, the target process, and the job type information of the object access message from the callback signal (S33).

The security process analyzes whether the task type of the object access message is a task that requires security, whether the subject process of the object access message has permission to the task, and whether the target process of the object access message is protected. (S34). To this end, the security process stores the type of work that requires security, the criteria for judging whether to use the work, and the process name.

As a result of the analysis in step S34, if the task type of the object access message is a security-required task, the subject process does not have permission to the task, and the target process is a protected process (S35), the security process sends a callback signal to the object manager. By not returning, the object access message is not performed (S36).

On the other hand, if the analysis result of step S34 indicates that the task type of the object access message is not a security-required task, the subject process has permission to the task, or the target process is not a protected process (S35), the security process is an object manager. The object access message is performed by returning a callback signal to the user (S37).

The technical spirit of the present invention has been described above with reference to the accompanying drawings, but this is by way of example only for describing the best embodiment of the present invention and not for limiting the present invention. In addition, it is a matter of course that various modifications and variations are possible without departing from the scope of the technical idea of the present invention by anyone having ordinary skill in the art.

1 is a flowchart illustrating a process protection method according to the prior art;

2 is a block diagram showing a protection system for implementing a process protection method using the object manager of the present invention;

3 is an operation flowchart illustrating a process protection method using the object manager of the security process according to an embodiment of the present invention.

Claims (6)

An object manager that receives object access messages and manages all tasks that target objects; An object callback registration unit for registering an object resist callback function to cause the object manager to output a callback signal when the object access message is received; An object access detecting unit for receiving the callback signal from the object manager; A filtering unit which extracts a subject process, a target process, and a task type of the object access message from the callback signal; An analysis unit for analyzing a subject process, a target process, and a task type extracted by the filtering unit; And a result processing unit for returning the callback signal to the object manager according to the analysis result of the analysis unit. The method of claim 1, wherein the result processing unit returns the callback signal to the object manager if the job type is a job requiring security, and if the subject process does not have permission to use the job, and the target process is protected. Process protection system using an object manager, characterized in that not. The callback signal to the object manager according to claim 1, wherein the result processor is a task in which the task type does not require security, the subject process has permission to use the task, or the target process is not protected. Process protection system using the object manager, characterized in that for returning. An object callback registration step of registering an object resist callback function to output a callback signal upon receiving the object access message to an object manager receiving an object access message; An object approach detection step of receiving the callback signal from the object manager; A filtering step of extracting a subject process, a target process, and a task type of the object access message from the callback signal; An analysis step of analyzing the subject process, the target process, and the job type extracted in the filtering step; And a result processing step of returning the callback signal to the object manager according to the analysis result of the analysis step. 5. The method of claim 4, wherein the result processing step includes the callback signal to the object manager when the job type is a job requiring security, the subject process does not have permission to use the job, and the target process is protected. Process protection method using the object manager, characterized in that not returned. 5. The method of claim 4, wherein the processing of the result is performed when the job type is a job that does not require security, the subject process has permission to use the job, or the target process is not protected. Process protection method using an object manager, characterized in that for returning a signal.

Images