KR101226615B1 - A Device For Software Obfuscation And A System For Software Security Treatment - Google Patents

Abstract

The present invention relates to a software security system. A software security system according to the present invention comprises: at least one developer computer on which source coding is performed; Receives the original file after source coding and machine language translation is completed and performs code obfuscation, and cannot be accessed by unauthorized third parties. An obfuscation device for breaking the obfuscation program stored in the disc and formatting the hard disc; Collecting the source-coded files from each developer computer is input to the obfuscation device, characterized in that it comprises a security management server for receiving the obfuscated file from the obfuscation device

Description

A device for software obfuscation and a system for software security treatment

The present invention relates to a software security processing system, and more particularly, has an autonomous security function and an obfuscation device that operates in a network as a device independent of a developer's computer and a system configuration including the same to provide enhanced software security. It is about a software security processing system.

Hackers actively use technology called reverse engineering to search for vulnerabilities and find vulnerabilities by directly analyzing the original file, that is, the Windows executable, without source code.

In some cases, when a vulnerability of a program is analyzed, a hacker may modify the binary code of an executable program to change the control flow of the executable program so that the executable program operates as intended.

For example, if a hacker finds a password comparison code of an Internet banking certificate as reverse engineering and modifies the corresponding routine to skip the comparison part, the certificate certificate loses its meaning and reboots to prevent public PC security and illegal software installation. Security features are lost if the system administrator finds and skips a mode password checking routine that resets the hardware.

In response to such hackers' reverse engineering of software analysis, security experts are applying code obfuscation technology that makes it difficult to find the source code of an executable program.

FIG. 1A is a schematic diagram illustrating before and after conventional software code obfuscation, and FIG. 1B shows each step of a software security method for performing conventional software obfuscation.

In the conventional software code obfuscation, the original code of the executable file is decompiled in the machine language (step 1), encrypted for each code block (step 2), and the entire code is again encrypted ( Step 3). Translate the encrypted file back into machine language (step 4), obfuscate the decryption executable file that decrypts the password (step 5), and bring the encrypted original file together with the obfuscated decryption executable file to the service recipient. Deploy offline (step 6).

In addition, as shown in FIG. 2, after installing the obfuscation program CD for each developer computer 10 and operating the obfuscation system to perform obfuscation and testing, the obfuscation file is transmitted to the distribution server 20. The obfuscation program itself was distributed widely through the CD.

However, the conventional software security method of the above configuration has the following problems.

Due to the wide distribution of obfuscation program CD, the obfuscation algorithm by hackers has been almost analyzed, and since the original code is not obfuscated, only the original code is encrypted. There is a problem in that the encrypted file (that is, files including the original file are provided by default when the service is provided) can be easily obtained through online and offline. In this case, when a program for decryption is obtained, the original file is provided to the malicious third party as it is. In particular, the wide distribution of obfuscation programs has led to significant distribution of deobfuscation programs on the Internet by malicious third parties.

An object of the present invention is to provide an obfuscation device having a self-security function and operating as a device independent from a developer's computer on a network, and a software security processing system providing enhanced software security including the same.

Software obfuscation apparatus according to the present invention for achieving the above object, the obfuscation means for receiving a file complete with source coding and machine language translation via a network and performing code obfuscation; Program security means for preventing unauthorized third party access to the internal file system in which the obfuscation means is embedded; Device security means for breaking the obfuscation program stored in the hard disk and formatting the hard disk when the hard disk containing the program constituting the obfuscation means is detached and executed in another device; A file for accessing a computer having access authority through a network to receive an object to be obfuscated to be provided to the obfuscation means, and to provide an obfuscated file from the obfuscation means to a computer authorized to receive through the network. It is configured to include a transmitting and receiving means characterized in that it operates as an independent device in the network.

In the initial setting of the obfuscation device, it is possible to further select and set a combination of a method, a type, and a number of obfuscation performed in the obfuscation device.

The obfuscation apparatus is characterized by additionally performing highly virtualized obfuscation process by code virtualization and special codes for a specific part of the machine language marked by the developer in the developer computer.

A software security processing system according to the present invention for achieving the above object comprises: at least one developer computer on which source coding is performed; Receives the original file after source coding and machine language translation is completed and performs code obfuscation, and cannot be accessed by unauthorized third parties.If the hard disk containing the obfuscation program is detached and executed on another device, the hard disk is executed. An obfuscation device for breaking the obfuscation program stored in the disc and formatting the hard disc; Collecting the source-coded files from each developer computer is input to the obfuscation device, characterized in that it comprises a security management server for receiving the obfuscated files in the obfuscation device.

A software security processing system according to the present invention for achieving the above object comprises: at least one developer computer on which source coding is performed; A security management server for collecting a source coded file from each developer computer; Receives the original file of source coding from the security management server and performs code obfuscation and returns, unauthorized third party cannot access, removes the hard disk containing the obfuscation program and executes it on another device An obfuscating device for breaking the obfuscation program stored in the hard disk and formatting the hard disk; Receiving the obfuscated file from the obfuscation device, characterized in that it comprises a testing server that is tested for the obfuscated file.

Software security processing system according to the present invention for achieving the above object comprises at least one developer computer for performing source coding; When the source files are completed from source code and machine language translation from each developer's computer, the code is obfuscated, unauthorized third parties cannot access, and if the hard disk containing the obfuscation program is removed and executed on another device An obfuscating device for breaking the obfuscation program stored in the hard disk and formatting the hard disk; A testing server that receives the obfuscated file from the obfuscating device and performs testing on the obfuscated file; The testing server is characterized in that it comprises a distribution server for distributing the tested software to the client.

The obfuscation device is characterized in that provided in the internal network of the network.

The present invention is provided with an obfuscation device that maintains its own security according to the above configuration, so that access to the obfuscation program of an unauthorized third party is not possible, and the obfuscation is completed by the obfuscation device. The file and obfuscation device itself can prevent hacking attempts by preventing the hacker's pre-attack internal system analysis and source code analysis, thereby making it possible to maintain enhanced software security.

1A is a schematic diagram illustrating states before and after obfuscation in general source code obfuscation.
1B is a flow diagram illustrating a conventional code obfuscation process.
2 is a schematic diagram illustrating a conventional obfuscation system.
3A is a schematic diagram illustrating a configuration of a preferred embodiment of the software security processing system of one embodiment of the present invention.
Figure 3b is a schematic diagram illustrating each process of security processing by the software security processing system of an embodiment of the present invention.
4 is a schematic diagram illustrating a configuration of a preferred embodiment of the software security processing system of one embodiment of the present invention.
5 is a schematic diagram illustrating a configuration of a preferred embodiment of the software security processing system of one embodiment of the present invention.
6 is a schematic diagram illustrating a configuration of an obfuscation apparatus of an embodiment of the present invention.
Figure 7a is a schematic diagram illustrating a state before and after obfuscation by code virtualization by the obfuscation apparatus of the embodiment of the present invention.
Figure 7b is a schematic diagram illustrating the state before and after obfuscation by code virtualization by the obfuscation apparatus of the embodiment of the present invention.
8 is a flowchart illustrating an operation state of the device security means of the obfuscation device of the embodiment of the present invention.

Hereinafter, a configuration of a preferred embodiment of a software obfuscation apparatus and a software security processing system according to the present invention having the above configuration will be described in detail with reference to the accompanying drawings.

In FIG. 3A, a software security processing system according to an embodiment of the present invention includes a developer computer 110 on which source coding is performed, an obfuscation device 120 performing code obfuscation, and source coding from each developer computer 110. The security management server 130 collects the completed file and inputs it to the obfuscation device 120 and receives the obfuscated file from the obfuscation device 120, and receives the obfuscated file and the obfuscated file is completed. The testing server 160 for which the testing is performed, and the distribution server 180 for distributing the tested software to the client is configured.

The developer computer 110 of the present embodiment performs the source coding, and converts it to machine language and transmits it to the security management server 130. At this time, if the relevant program is 32Bit executable file such as EXE, DLL, OCX, BPL, etc., mark the important part that should not be exposed to the outside in machine language, that is, the part requiring high obfuscation, and transmit it to the security management server (Fig. 7a and 7b).

In this case, the marking is performed by a method and means discernible in the obfuscation apparatus 120, and it is possible to set such that the type and degree of obfuscation can be differentiated according to the method and means of marking. This can be.

In the present embodiment, the developer computer 110, the security management server 130, the obfuscation device 120, the testing server 160, and the distribution server 180 may transmit and receive files by TCP / IP protocol socket communication. For example, the socket is accessible to the obfuscation device 120 only by the DLL file provided by the security system of the present embodiment, and the security management server 130 and the obfuscation device 120 are used only for the obfuscation target file and the obfuscation file. The system setting of the obfuscation device 120 is made such that only exchange is possible and the other purpose access to the obfuscation device 120 in the network is not possible.

The security management server 130 according to the embodiment of the present invention is connected to a plurality of developer computers 110 in a network, receives a file that has been source coded and machine-translated, inputs it to the obfuscation device 120, and the obfuscation file is completed. Received from the obfuscation device 120, by inputting the returned file to the testing server 160 can be tested for normal operation.

 In addition, the security management server 130 receives the file obfuscated and tested from the testing server 160, and transmits to the distribution server 180, the file that needs to be modified / supplemented returns to the developer computer (110).

As shown in FIG. 4, in another embodiment of the present invention, the obfuscated file testing returned from the obfuscation device 120 may be configured to be directly performed by the security management server 130. 130 may be configured to directly transmit the obfuscated and tested files to the distribution server 180.

In addition, as shown in FIG. 5, in another embodiment of the present invention, the developer computer 110 and the obfuscation device 120 are connected by socket communication on a network, and source coding and The obfuscation target file in which the machine language translation and marking is performed is delivered to the obfuscation device 120 by a dll file provided by the system, and the obfuscation device 120 transmits the obfuscation-completed file to the developer computer 110 or the testing server. By passing to the 160, the testing is made and may be based on the configuration that is passed back to the distribution server (180).

Security management server 130 and obfuscation device 120 of the embodiment of the present invention is preferably located in the internal network that can be secured.

The obfuscating device 120 socket of this embodiment communicates with the security management server 130, the testing server 160, or the developer computer 110 through a DLL file provided by the security system and receives or obfuscates a file to be obfuscated. Send the complete file.

In FIG. 6, the obfuscation apparatus 120 according to the present embodiment includes a main processor 121, a storage device 125 storing self-security means 122, and an obfuscation program 123, an obfuscation target file, and obfuscation. Database 126 for storing the completed files, communication means 127 for socket communication with the security management server, data input and output means 128 and display means 129 for modifying or updating the obfuscation program do.

Self-securing means 122 of the present embodiment is a program security means (122a) for pre-blocking unauthorized third party access to the internal file system built in the obfuscation device 120, and the hard-coded obfuscation program The device security means 122b for breaking the file system including the obfuscation program stored in the hard disk and formatting the hard disk when the disk is removed and executed on another device.

Since the program security means 122a of the obfuscation device 120 of the present embodiment can access the obfuscation device 120 only by a password generated by a high security algorithm, the obfuscation device other than the obfuscation device manager ( No operation for the operation 120 may be performed. When accessing the file system by reverse engineering or the like, the obfuscation device 120 may deny the service and perform an operation such as rebooting the system or deleting the file system in some cases. have.

On the other hand, in the embodiment of the present invention, the device security means 122b is the CPU of the existing obfuscation device when the storage device of the obfuscation device 120 (the hard disk is taken out and operated in the third device) by physical decomposition. Since the device is identified by the unique number of the component hardware including the network card and the developer's unique algorithm and security table, it is impossible to operate the hard disk in a third device other than the original device.

For example, when hardware is operated as shown in FIG. 8, a key value of the system is first generated from a unique number of hardware such as a CPU unique number and a network card of the operating system. The service can be started only in the same cases compared with the key value of the installed software security processing system program installation (steps 60 to 63).

In addition, it stores the authority group data value (Admin Group Data Value) and the authority user data value (Admin User Data Value) corresponding to the corresponding key value, and monitors the change of the authority group or the information on user authority. If a mismatch occurs with the stored value, the system intrusion response system is driven (steps 64 to 80). For example, the service may be terminated, all file systems of the hard disk may be deleted, and the system may be rebooted. In addition, before the file system is deleted, the file system is destroyed to prevent restoration of the file system, thereby preventing access to the security algorithm and the obfuscation program of the hard disk by an unauthorized third party in advance (steps 81 to 81). Step 83).

The obfuscation device 120 of the present embodiment is provided with obfuscation means for obfuscating machine code, and the obfuscation means of this embodiment has an original code tracking disturbance function and an anti-debugging function for the obfuscated executable file. And an obfuscation program for adding an antipatch function, an encryption function, and the like, which are implemented by obfuscation in case of improper access such as reverse engineering of a third party to a file that has been obfuscated by the obfuscation program. Functions proactively prevent third-party system decryption, thus maintaining enhanced software security.

For example, in the present embodiment, the original code tracking interruption function includes an API wrapper function, an API address hiding, an IAT table destruction, and a flow modification function.

In this embodiment, the API wrapper function means inserting various dummy codes into the normal API code to make analysis and tracking through the debugger difficult. Hiding the API address means that if the debugger points to the Widow API in memory, it can be replaced with a string to facilitate code analysis, so the debugger changes the address so that it doesn't recognize the address at all.

Destroying the IAT table means that the disassembler can't find the window API by destroying the IAT table that the disassembler references to find the window API so that backtracking through disassembly is not possible. Flow modification means to modify the flow of simple code by changing the flow of execution code to make code analysis difficult.

In the present embodiment, the anti-debugging function is a debugger detection function for detecting and blocking the operation of various debugger tools to block software analysis through a debugger, a monitoring tool detection function for blocking software analysis through a monitoring tool, and a virtual environment. It includes a virtual environment detection function that detects and blocks the act of copying the software and then running and analyzing it.

The anti-patch function of the present embodiment modifies various files constituting the software product to check whether the file is modified or not to bypass the security function of the product, and checks the code by hacking the memory of the executed software. It includes a memory variant that detects behavior changes to the execution structure.

The encryption function of the present embodiment refers to an encryption function that encrypts a code area of software to block backtracking through disassembly in advance, and includes various algorithms such as AES and ARIA, and allows a user to select a desired algorithm. It is configured to be.

On the other hand, the obfuscation apparatus of the present embodiment is equipped with a variety of existing techniques of software obfuscation, for example, obfuscation such as partition obfuscation, data obfuscation, aggregate obfuscation, control obfuscation, so as to insert a dummy code, generate a variable code, Obfuscate executables by transforming control flows, virtualizing code, and so on.

In addition, the obfuscation apparatus 120 according to the present embodiment further performs a highly virtualized obfuscation process by code virtualization and a unique special code for a specific part of the machine code marked by the developer in the developer computer.

For example, as illustrated in FIGS. 7A and 7B, the machine language portion of the area marked by the developer converts the instructions into instructions composed of special codes unique to the device or company, and configures a virtual CPU capable of interpreting them. In some cases, it is configured by multiple virtual CPUs so that the program cannot be decoded before the hacker analyzes the special meaning of the special code and virtual CPU. Therefore, it is very difficult for the hacker to analyze the system and prevent attack by hackers. You can block in advance.

Meanwhile, in a preferred embodiment of the present invention, the obfuscation programs embedded in the obfuscation device 120 are the same obfuscation as implemented in the executable file obfuscated by the obfuscation program in response to unauthorized access by an unauthorized third party. It is possible to be obfuscated by the digestion techniques and functions.

The following describes the operation of the preferred embodiment of the software security processing system according to the present invention having the configuration as described above.

In the case of the present embodiment, the obfuscation device 120 itself is installed in the internal network of the network, and access to the obfuscation device 120 is possible only by an ID and a password protected by a high security algorithm. Except for the obfuscation device administrator (security company's administrator), which is the highest authority, no access and manipulation to the file system stored in the obfuscation device storage means 125 is possible, so that random distribution of the obfuscation program itself is impossible.

On the other hand, when the hard disk, which is a storage device in which the obfuscation program is stored, etc. is detached from the obfuscation device 120 and executed in another device, the hard disk operation itself does not become a self-destructive function for the hard disk file system. Therefore, it is possible to block the exposure of the obfuscation algorithm to the malicious person in advance because it is almost impossible to bypass the obfuscation program.

In addition, since the executable file obfuscated by the obfuscation device 120 of the present embodiment is obfuscated the original file itself, even if reverse engineering is successfully performed, the file itself is not the original file, but the file itself is modified. In any case, the original file provided to the on-line service is not provided to the third party as it is, and the important part of the file is subjected to advanced obfuscation by code virtualization, so that the executable file is recognized as a broken state. Playback is almost impossible.

Therefore, the original code for providing on-line service is difficult to secure to the third party, and even if it is reverse engineering, it is difficult to reproduce the original. It becomes possible to disable it.

The scope of the present invention is not limited to the above embodiments, but is determined by the matters described in the claims, and it is obvious that the present invention includes various modifications and adaptations made by those skilled in the art in the claims and equivalents.

110 ....... Developer Computer 120 ........ Obstacle
122 ............ Self security measures 122a ....... Program security measures
122b ........ device security measures 123 ........ obfuscation programs
125 ....... Storage Device 130 ........ Security Management Server
160 ......... Testing Server 180 ........ Deployment Server

Claims (7)

Obfuscation means for receiving a file from which source coding and machine language translation is completed through a network, and performing code obfuscation;
Program security means for preventing unauthorized third party access to the internal file system in which the obfuscation means is embedded;
Device security means for breaking the obfuscation program stored in the hard disk and formatting the hard disk when the hard disk containing the program constituting the obfuscation means is detached and executed in another device;
A file for accessing a computer having access authority through a network to receive only an object to be obfuscated to be provided to the obfuscation means, and to provide only the obfuscated file from the obfuscation means to a computer authorized to receive through the network. Software obfuscation device comprising a transmitting and receiving means, operating as an independent device in the network.
The software obfuscation device according to claim 1, wherein a combination of a method, a type, and a number of times of obfuscation performed by the obfuscation device can be further selected and set when the obfuscation device is initially set.
The method of claim 1, wherein the obfuscation device,
A software obfuscation apparatus further comprising a highly virtualized process of code virtualization and special code for a specific part of a machine code marked by a developer on a developer computer.
At least one developer computer on which source coding is performed;
Receives the original file after source coding and machine language translation is completed and performs code obfuscation, and cannot be accessed by unauthorized third parties.If the hard disk containing the obfuscation program is detached and executed on another device, the hard disk is executed. An obfuscation device for breaking the obfuscation program stored in the disc and formatting the hard disc;
And a security management server that collects source coded files from each developer computer and inputs them to the obfuscation device, and receives the obfuscated file from the obfuscation device.
At least one developer computer on which source coding is performed;
A security management server for collecting a source coded file from each developer computer;
Receives the original file of source coding from the security management server and performs code obfuscation and returns, unauthorized third party cannot access, removes the hard disk containing the obfuscation program and executes it on another device An obfuscating device for breaking the obfuscation program stored in the hard disk and formatting the hard disk;
And a testing server configured to receive the obfuscated file from the obfuscating device and to test the obfuscated file.
At least one developer computer for performing source coding;
When the source files are completed from source code and machine language translation from each developer's computer, the code is obfuscated, unauthorized third parties cannot access, and if the hard disk containing the obfuscation program is removed and executed on another device An obfuscating device for breaking the obfuscation program stored in the hard disk and formatting the hard disk;
A testing server that receives the obfuscated file from the obfuscating device and performs testing on the obfuscated file;
And a distribution server for distributing the tested software to the client by the testing server.
The software security processing system according to any one of claims 4 to 6, wherein the obfuscation device is provided in an internal network of the network.

Images