KR101343613B1 - Apparatus and method for controlling file flow using thread in kernal mode, and program storing medium for executing the method - Google Patents

Abstract

The present invention relates to a device and a method for controlling a file flow using a thread in kernel mode. When a file I / O occurs in various applications such as a specific Internet site, webmail, email, web hard, or messenger, the thread start address in kernel mode. It relates to a technique for controlling the file flow by using the collected. The flow of files by analyzing the thread address collector and the thread start address collected by the thread address collector when the target application process performs the user's file I / O related operations. By including a file flow control unit for controlling the file flow can be effectively controlled in a variety of applications, such as a specific Internet site, webmail, email, web hard, messenger, without being dependent on a specific application.

Description

Apparatus, method and program recording medium for controlling file flow using threads in kernel mode {APPARATUS AND METHOD FOR CONTROLLING FILE FLOW USING THREAD IN KERNAL MODE, AND PROGRAM STORING MEDIUM FOR EXECUTING THE METHOD}

When file I / O occurs in a target application, it relates to a technique for controlling file flow using a thread start address in kernel mode.

Recently, as a computer of an individual user becomes larger and at the same time, the processing speed is improved, various important documents such as the company's trade secret data and data containing personal information are stored and stored in the computer. In addition, with the development of Internet communication technology, general users exchange files with other users through various applications such as email and messenger. Therefore, various important documents stored in the computer are exposed to the risk of being leaked to the outside by general users through such applications.

In general, when users send and receive attachments through the mail server, the packet is collected and analyzed through the router or switch hub, which is the end of the attachment, and then the attachment is monitored or gateways such as firewalls are used. Blocks the transmission of incoming or outgoing attachments by blocking the URL (Uniform Resource Locator), IP (Internet Protocol) and port of the transmission or reception packet and blocking the Internet access. However, in the general gateway, the information leakage prevention method has a problem that depends on various applications such as messenger or webmail, or sites to be blocked, and transmits a file by communicating in an unprotected area using a portable computer. In this case, even if the leak prevention system is installed on the user computer, there was a problem that can not prevent the transmission of the file. Republic of Korea Patent Publication No. 10-2010-0048231, Republic of Korea Patent Registration No. 10-0999977 discloses a technique for preventing information leakage through e-mail and the like.

This is to provide a method to effectively control the file flow occurring in various applications such as a specific Internet site, webmail, email, webhard, and messenger without using a thread start address in kernel mode in a specific application.

This is to provide a method for effectively preventing the leakage of personal information or confidential information by file transfer by controlling file flow occurring in various applications.

According to an aspect, an apparatus for controlling file flow using a thread in kernel mode may include: a thread address collector and a thread address collector configured to collect a start address of a thread generated when a user performs a file input / output operation in a target application process; It includes a file flow control unit for controlling the flow of the file by analyzing the start address of the thread (thread) collected by the unit.

According to an additional aspect, the file flow controller may determine whether a thread is generated by performing a file input / output operation by a user in a target application based on a start address of a thread collected by a thread address collector, and a thread. As a result of the determination of the address analyzer, the thread may include a file blocking unit that blocks input and output of a target file when a file input / output operation is performed by a user.

According to an additional aspect, the file flow controller may further include a blocking target determining unit determining whether the file is a blocking file when the thread is determined to be generated by a user by performing a file input / output operation by the thread address analyzer. have.

In this case, the blocking target determining unit may search whether the content of the file includes personal information and determine that the blocking target file is included in the case where the personal information is included.

According to another aspect, the method may further include a thread database that stores thread information generated when a file input / output operation is performed by a user for each target application process, and the thread address analyzer may correspond to the collected thread start address information. If the thread information exists in the thread database, it may be determined that the file input / output operation is performed by the user.

In this case, the thread information may include a connection relationship between a dynamic link library (Dynamic Linked Library, DLL) corresponding to the thread start address information for each target application process.

According to an aspect of the present invention, a method of controlling file flow using a thread in kernel mode includes collecting a starting address of a thread generated when a user performs a file input / output related operation in a target application process, and collecting the thread. Controlling the flow of the file by analyzing the starting address

According to a further aspect, the controlling of the file flow may include analyzing a starting address of a collected thread to determine whether the thread is generated by performing a file input / output operation by a user in a target application and determining a result of the thread starting address. If the thread determines that the file input / output operation has been performed by the user, the thread may block input / output of the file.

According to an additional aspect, the blocking of the file input / output may include determining whether the file is a blocking target file when it is determined that the thread is generated by performing a file input / output operation by the user.

According to an additional aspect, the step of determining whether the file to be blocked may search whether the personal information exists in the file and determine that the file to be blocked when the personal information exists.

According to another aspect, the thread start address analysis step may determine that the file input / output operation is performed by the user when the thread information corresponding to the collected thread start address information exists in the thread database.

According to an aspect, a computer-readable recording medium having recorded thereon a program may include a program for executing a method of controlling file flow using a thread in kernel mode as described above.

By using the thread start address in kernel mode, you can effectively control the file flow that occurs in various applications such as Internet sites, webmail, email, webhard, and messengers without being tied to a specific application.

By effectively controlling the file flow generated in various applications, it is possible to prevent the leakage of personal or confidential information by file transfer.

1 is a block diagram of an apparatus for controlling file flow using a thread in kernel mode, according to an exemplary embodiment.
FIG. 2 is a detailed block diagram of a file flow control apparatus according to the embodiment of FIG. 1.
3 is a flowchart of a method of controlling file flow using a thread in kernel mode, according to an exemplary embodiment.
4 is a detailed flowchart of a file flow control step according to the embodiment of FIG. 3.

The details of other embodiments are included in the detailed description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Hereinafter, an apparatus, a method for controlling file flow using a thread in kernel mode according to embodiments of the present invention, and a recording medium including a program for executing the method will be described in detail with reference to the drawings.

1 is a block diagram of an apparatus for controlling file flow using a thread in kernel mode, according to an exemplary embodiment. As shown in FIG. 1, an apparatus 200 for controlling file flow using a thread in kernel mode includes a thread address collector 210 and a file flow controller 220. The thread address collector 210 collects a start address of a thread when a target application is executed and a file I / O operation is performed by a user and a thread for performing file I / O related operation is generated by the target application process. do.

Process is a term used in various fields to mean process or process. In the computer field, it is used to mean 'running program.' It is known that it was first used by researchers at the Bell Telephone Research Institute, which designed the Multics (multiplexed information and computing service) system in the mid-1960s. It can mean a program or part of it, and it can also be used to manipulate or process data input or output. There is a higher layer called the parent process and a lower layer called the child process. The parent process is started by a program or command, and the child process is created by the parent process. One parent process manages multiple child processes. Multitasking is what makes multiple child processes appear to be processed simultaneously on a single CPU (see Naver Encyclopedia).

A thread is a unit of flow that runs within any program, especially within a process. Typically, a program has one thread, but depending on the program environment, more than one thread can run at the same time. This method of execution is called multithreading.

The target application 100 is executed in various information processing devices such as a mobile terminal (for example, smart phone), computer (for example, PC) and the like. File input / output such as a specific Internet site, e-mail, webmail, messenger, web hard, P2P, etc. Should be construed as referring to anything that causes a file (for example, a file is attached and sent to the outside).

When a target application 100 such as an internet site (eg, a bulletin board file attachment), an email, a webmail, a messenger, a web hard drive, or a P2P is executed to generate a file input / output (I / O), the execution process of the target application 100 is executed. File I / O related thread is created. The thread address collecting unit 210 collects thread information generated by the target application 100 process at a specific point in time. For example, at some point in time, an address such as 0x77D903E7 generated by the target application 100 may be collected.

The file flow controller 220 analyzes the thread addresses collected by the thread address collector 210 to control the flow of file input / output generated in the target application. Controlling the file flow is to analyze the thread address information generated when the file I / O operation is performed in the target application. ), Or to prevent the target file from being transferred or downloaded in a normal form, such as terminating the file I / O process of the target application, or tampering with the contents of the target file (e.g. deleting personal information). It should be interpreted as meaning all actions.

FIG. 2 is a detailed block diagram of a file flow control apparatus according to the embodiment of FIG. 1. Hereinafter, the file flow control apparatus 200 according to the present embodiment will be described in detail with reference to FIG. 2. According to an additional aspect of the present embodiment, the file flow controller 220 may include a thread address analyzer 221. The thread address analyzer 221 determines whether a file input / output operation is generated by the user in the target application 100 based on the thread address information collected by the thread address collector 210.

When the target application 100 is executed, the application 100 executes various tasks by itself, and users perform various operations such as file attachment, mail transmission, chatting by messenger, and file attachment in a bulletin board in the application 100. Sometimes. As described above, when various operations are performed in the target application 100 by the user's operation or internally, threads for executing the task are created.

Meanwhile, according to an additional aspect of the present embodiment, the file flow control apparatus 200 may further include a thread database 230. The thread database 230 stores information on threads generated when a file input / output operation is performed by a user for each target application process. The thread database 230 may store target application information (eg, ID or name), thread start address information, file input / output type (eg, upload, download, etc.). For example, if the start address information of a thread generated when a file attach (upload) operation is performed by a user in a specific messenger program is generated as 0x77D903E7, the thread database 230 may include specific messenger program information and thread start address information ( 0x77D903E7), file upload, and the like may be stored.

Meanwhile, the thread information may include a connection relationship between a dynamic link library (DLL) corresponding to thread start address information for each target application process. In other words, if the DLL to be executed when a file attach (upload) operation is performed in a specific application is ieframe.dll, and the starting address of the generated thread is equal to 0x77D903E7, the connection relationship will be set as ieframe.dll / + 0x6d86fcdb / 0x77D903E7. Can be represented. As such, by displaying the connection relationship between the thread start address information and the corresponding DLL information, it is possible to easily understand that the file input / output operation is performed by the user in the target application.

When the thread information corresponding to the collected thread start address information exists in the thread database 230, the thread address analyzer 221 may determine that the file input / output operation is performed by the user.

According to an additional aspect of the present embodiment, the file flow control unit 220 may further include a file blocking unit 223. The file blocking unit 223 may block the input / output of the file when it is determined that the thread is generated by performing a file input / output operation by the user as a result of the determination by the thread address analyzer 221. As described above, the method of controlling file flow is not limited to blocking file input and output, and means all operations of preventing a target file from being input / output (eg, uploading or downloading a file) in a normal form by a user in the target application. Should be interpreted as

Meanwhile, according to an additional aspect, the file flow controller 220 may further include a blocking target determination unit 222. The blocking object determining unit 222 determines whether the file is an object to be blocked when the function call information analysis unit 221 determines that the file input / output function information is generated by the file input / output operation by the user. In this case, the blocking target determination unit 222 may search whether the contents of the file include personal information and determine that the blocking target file is included in the case where the personal information is included. However, the present invention is not limited thereto, and whether the target file is a blocking target may be set based on various criteria. For example, according to another embodiment, the company's policy may be set to block uploading of all files in order to prevent information leakage from inside or outside the company, or the files containing personal information by searching the contents of the target file. In addition, a file classified as a confidential document, a file exceeding a predetermined capacity, or the like may be set to not be transmitted to the outside. Alternatively, all files downloaded from the outside, or music, video files, files exceeding a predetermined capacity, etc., which are not related to the company's work, may be set to not be downloaded.

To this end, the file flow control apparatus 200 according to an additional aspect of the present embodiment may further include a blocking target file database (not shown). The blocking target file database (not shown) may store various kinds of information for storing a blocking policy of various files. The blocking target determining unit 222 may use the blocking target file information stored in the blocking target file database (not shown). It may be determined whether the target file is a blocking target file.

3 is a flowchart of a method of controlling file flow using a thread in kernel mode, according to an exemplary embodiment. In the kernel mode, a method of controlling file flow by using a thread may include: First, when a target application is executed (step 100) and a file input / output occurs in the target application (step 200), when a user executes a file input / output related operation in the target application process. The start address of the created thread is collected (step 300). The target application 100 is executed in various information processing devices such as a mobile terminal (for example, smart phone), computer (for example, PC) and the like. File input / output such as a specific Internet site, e-mail, webmail, messenger, web hard, P2P, etc. (E.g. a file is attached and sent to the outside).

When the target application 100 is executed to generate file input / output (I / O), a thread for performing a corresponding operation is generated. The thread address collector 210 collects start address information of the generated thread.

Next, the starting address of the thread collected by the thread address collecting step 300 is analyzed to control the file flow (step 400). In this case, controlling the file flow may be performed by analyzing a thread that is generated when file input / output occurs in the target application 100, and depending on the result, input / output of the target file (for example, transmission by attaching the file to the outside or downloading the file transmitted from the outside). Etc.), or to prevent the target file from being transferred externally or downloaded in a normal form, such as terminating the file I / O process of the target application or altering the contents of the target file (e.g. deleting personal information). Means any action.

4 is a detailed flowchart of a file flow control step according to the embodiment of FIG. 3. Referring to FIG. 4, the step 400 of controlling the file flow will be described in more detail. First, when the thread address collector 210 collects a start address of a thread generated by the target application 100 in the function call information extraction step 300, the thread address analyzer 221 analyzes the collected function information. (Step 410). More specifically, the thread address analyzer 221 compares the thread information generated by the user when the file input / output operation is performed in the target application 100 stored in the thread database 230, and the collected thread information is stored by the user. It is determined whether the file input / output operation has been performed (step 420).

Applications 100, such as Internet sites, various messenger programs, e-mail programs, perform various tasks on their own. In addition, when the user performs various operations such as sending mail, chatting with a messenger, and attaching a file in the application 100, a thread for performing the corresponding operation is created. If the collected thread information matches the thread information generated when users generate file input / output (eg, file attachment, file download, etc.) in the target application 100, it may be understood that the collected thread information is a file input / output operation performed by the user.

That is, since the thread database 230 stores thread information generated when a file input / output operation is performed by a user for each application, when the collected thread information matches the thread information stored in the thread database 230, the target application. You can see if the user performs file I / O.

If, as a result of determination, the thread information generated by performing file input / output (eg, file upload, download, etc.) by the user in the target application 100 (step 430), input / output of the target file is blocked (step 440). As described above, the method for controlling the file flow is not limited to blocking file input and output, and all operations for preventing input and output (eg, file upload and download) in a normal form by the user in the target application 100 by the user. It should be interpreted as meaning.

In step 440 of blocking input / output of the target file, it is first determined whether the file input / output target file by the user is a blocking target file (step 441), and then, if the target file is a blocking target file, input / output of the target file is performed. It may be blocked (step 442). In one embodiment, the contents of the file may be searched for whether personal information is included, and if the personal information is included, the corresponding file may be determined as a file to be blocked. However, the present invention is not limited thereto, and whether the target file is blocked may be set based on various criteria. For example, the company's policy can be set to block uploading and downloading of all files to prevent information leakage from inside and outside the company, and search for the contents of the target file as files containing confidential information or confidential documents. According to the classified file, a file exceeding a predetermined capacity, and the like, it may be set so as not to be transmitted to the outside. Alternatively, all files downloaded from the outside, music, video files, files exceeding a predetermined capacity, etc., which are not related to the company's business may not be downloaded.

Meanwhile, according to another exemplary embodiment, the file flow control method according to the exemplary embodiments of FIGS. 3 and 4 may be implemented as a program to operate in a kernel mode and recorded in a computer-readable recording medium. Examples of computer-readable recording media include ROM, RAM, CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, portable storage devices such as USB and SD cards, and carrier waves (e.g., transmission over the Internet). And the like, but are not limited thereto. In addition, the computer may include all information processing devices such as a PC and a mobile terminal.

The program included in the recording medium according to the present embodiment is executed in kernel mode and can execute a method of controlling file flow using a thread. That is, when file input / output occurs in the target application process when the target application is executed, a function of collecting thread information (eg, starting address information) generated to perform the file input / output operation may be performed.

In addition, the collected thread information may be analyzed to control the file flow. At this time, controlling the file flow means analyzing the information of the thread that is generated when the file I / O occurs in the target application, and depending on the result, input / output of the target file (for example, transfer by attaching the file to the outside or downloading the file transmitted from the outside). ), Or to prevent the target file from being transferred or downloaded in a normal form, such as terminating the file I / O process of the target application, or tampering with the contents of the target file (e.g. deleting personal information). It means everything.

The function of controlling the file flow first collects thread information (eg, thread start address information) generated as a file input / output operation is performed in the target application 100 and analyzes the collected thread information. In particular, a function of determining whether the collected thread information is function information generated by performing a file input / output operation by a user in the target application may be performed. Meanwhile, the program performs file input / output operation by the users in the target application 100 by comparing the collected thread information with the thread information generated when the file input / output is performed by the users for each target application process stored in the thread database 230. It may be determined whether this has been performed.

If, as a result of determination, the thread information generated by file input / output (eg, file upload, download, etc.) is performed by the user in the target application 100, the function may block the input / output of the target file. The function of blocking input / output of a target file may first determine whether a file input / output target file by a user is a blocking target file, and then block input / output of the target file if the target file is a blocking target file. As an example, the contents of the file may be searched for whether the personal information is included, and if the personal information is included, the corresponding file may be determined as the blocking target file. However, the present invention is not limited thereto, and whether the target file is blocked may be set based on various criteria. For example, in another embodiment, the company's policy may be set to block uploading and downloading of all files in order to prevent information leakage from inside and outside the company, and search for the contents of the target file to include personal information. The data may be classified according to a file classified as a confidential document, a file exceeding a predetermined capacity, and the like so as not to be transmitted to the outside. Alternatively, all files downloaded from the outside, music, video files, files exceeding a predetermined capacity, etc., which are not related to the company's business may not be downloaded.

It will be understood by those skilled in the art that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. The scope of the present invention is defined by the appended claims rather than the foregoing detailed description, and all changes or modifications derived from the meaning and scope of the claims and the equivalents thereof are included in the scope of the present invention Should be interpreted.

200: file flow control device 210: thread address collection unit
220: file flow control unit 221: thread address analysis unit
222: blocking object determination unit 223: file blocking unit
230: thread database

Claims (12)

A thread address collector for collecting a start address of a thread generated when a user performs a file input / output related operation in a target application process; And
And a file flow controller configured to control a flow of the file by analyzing a start address of a thread collected by the thread address collector. 2. The method of claim 1, wherein the file flow control unit,
A thread address analysis unit determining whether the thread is generated by a file input / output operation performed by a user in a target application based on a start address of a thread collected by the thread address collector; And
And a file blocking unit for blocking input and output of the file if the thread is generated by a user by performing a file input / output operation by the user as a result of the determination of the thread address analysis unit. The method of claim 2, wherein the file flow control unit,
When the thread is determined by the user to perform a file input and output operation by the thread address analysis unit is determined that the block to determine whether the file is a file to block; using a thread in the kernel mode further comprising: Device that controls file flow. The method of claim 3, wherein the blocking object determination unit,
Device for controlling the file flow using a thread in the kernel mode, characterized in that by searching whether the content of the file contains personal information and determines that the file to be blocked if the personal information is included. 3. The method of claim 2,
And a thread database storing thread information generated when a file input / output operation is performed by a user for each target application process.
The thread address analysis unit,
When the thread information corresponding to the collected thread start address information exists in the thread database, the file flow is controlled by using a thread in the kernel mode, in which it is determined that a file input / output operation is performed by a user. Device. The method of claim 5, wherein the thread information,
Device for controlling file flow using a thread in kernel mode, characterized in that it comprises a connection relationship of the dynamic link library (DLL) corresponding to the thread start address information for each process by the target application. Collecting a start address of a thread generated when a user performs a file input / output related operation in a target application process; And
And controlling the flow of the file by analyzing a start address of the collected thread. The method of claim 7, wherein controlling the file flow,
Analyzing a starting address of the collected thread to determine whether the thread is generated by performing a file input / output operation by a user in a target application; And
Blocking the input / output of the file when it is determined that the thread is generated by performing a file input / output operation by a user; and controlling a file flow using a thread in a kernel mode. The method of claim 8, wherein the blocking of the file input / output is performed.
And determining whether the file is a file to be blocked when the thread is determined to be generated by a file input / output operation by a user. 2. The method of claim 9, wherein the determining of the blocking target file comprises:
The method of controlling file flow using a thread in a kernel mode, characterized in that searching for whether personal information exists in the file and determining that the personal information exists is a blocking target file. The method of claim 8, wherein the thread start address resolution step comprises:
If the thread information corresponding to the collected thread start address information exists in a thread database, the method for controlling file flow using a thread in a kernel mode characterized in that it is determined that a file input / output operation is performed by a user. . A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 7 to 11.

Images