JP2024175588A - Computer program, program protection device, and program protection method - Google Patents

Abstract

To provide a computer program, a program protection device, and a program protection method that can prevent a debugger attachment by an illegal program.SOLUTION: A computer program causes a computer to execute processing of: starting a first monitoring process by a protected program; starting a second monitoring process by the protected program or the first monitoring process; and monitoring an operation of the first monitoring process by the second monitoring process.SELECTED DRAWING: Figure 2

Description

The present invention relates to a computer program, a program protection device, and a program protection method.

A malicious attacker can inject a malicious program into a computer and, by performing an action called attachment, change the contents of the memory information of a process running under a protected program, or dump memory information. Such a malicious program can, for example, extract data from memory to create pirated copies or leak useful information.

Patent document 1 discloses a method for preventing unauthorized access to a program by halting execution of the protected program when a routine detects a debugger attachment from an attacker.

Japanese Patent Application Publication No. 11-175336

However, because an attacker has the authority to stop or terminate processes, stopping or terminating a process that detects a debugger attachment can allow a malicious program to perform a debugger attachment and change the contents of the memory information of a process running under the protected program, or dump the memory information.

The present invention has been made in consideration of the above circumstances, and aims to provide a computer program, a program protection device, and a program protection method that can prevent a malicious program from attaching a debugger.

The present application includes multiple means for solving the above problems, and as one example, a computer program causes a computer to execute the following processing: a first monitoring process is started in a protected program, a second monitoring process is started in the protected program or the first monitoring process, and the second monitoring process monitors the operation of the first monitoring process.

This invention makes it possible to prevent debugger attachment by malicious programs.

1 is a diagram illustrating an example of a configuration of a program protection device according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a software configuration of the program protection device. FIG. 13 illustrates an example of an attachment by a first monitoring process. FIG. 11 illustrates a first example of the operation of a second monitoring process. FIG. 11 is a diagram showing a first example of an attack pattern by an attacker. FIG. 13 is a diagram showing a second example of an attack pattern by an attacker. FIG. 11 illustrates a second example of the operation of the second monitoring process. FIG. 13 is a diagram showing a third example of an attack pattern by an attacker. FIG. 11 is a diagram illustrating an example of a processing procedure performed by the program protection device.

The following describes an embodiment of the present invention. FIG. 1 is a diagram showing an example of the configuration of a program protection device 50 of this embodiment. The program protection device 50 includes a control unit 51 that controls the entire device, a communication unit 52, a display unit 53, an operation unit 54, a memory 55, a storage unit 56, and a recording medium reading unit 57. The program protection device 50 can be configured, for example, as a personal computer (PC), a workstation (WS), a gaming device, a tablet terminal, or the like.

The control unit 51 is configured by incorporating a required number of CPUs (Central Processing Units), MPUs (Micro-Processing Units), GPUs (Graphics Processing Units), etc. The control unit 51 may also be configured by combining DSPs (Digital Signal Processors), FPGAs (Field-Programmable Gate Arrays), etc.

The communication unit 52 includes a communication module and has a communication function with an external device (not shown).

The display unit 53 can be configured with a liquid crystal display or an organic EL display. Note that instead of the display unit 53, an external display device may be connected to the program protection device 50.

The operation unit 54 is composed of, for example, a keyboard, a mouse, a touchpad, or a touch panel, and can accept operations on the information displayed on the display unit 53.

The memory 55 can be composed of semiconductor memory such as SRAM (Static Random Access Memory), DRAM (Dynamic Random Access Memory), ROM (Read Only Memory), and flash memory.

The storage unit 56 can be configured, for example, with a hard disk or semiconductor memory, and can store the application 10 as a computer program (program product), an OS (operating system) 60, and required information. The OS 60 includes, for example, Windows, MacOS, Linux (all of which are registered trademarks), etc.

The computer program (application) 10 and the OS 60 are deployed in memory 55 and executed by the control unit 51. The control unit 51 can execute the processing defined by the computer program 10 (specifically, the processing of the protected program 20, the first monitoring process 30, and the second monitoring process 40, which will be described later). Here, the application 10 collectively refers to the execution programs of the protected program 20, the first monitoring process 30, and the second monitoring process 40. In other words, the processing by the control unit 51 is also the processing by the protected program 20, the first monitoring process 30, and the second monitoring process 40.

The computer program 10 may be downloaded from an external device via the communication unit 52 and stored in the storage unit 56. Alternatively, the computer program 10 recorded on a recording medium (e.g., an optically readable disk storage medium such as a CD-ROM) 571 may be read by the recording medium reading unit 57 and stored in the storage unit 56. The computer program 10 may be deployed to be executed on a single computer, or on multiple computers located at one site, or distributed across multiple sites and interconnected by a communications network.

Figure 2 is a diagram showing an example of the software configuration of the program protection device 50. As shown in Figure 2, within the program protection device 50, an application 10 is executed under the control of an OS 60. The application 10 incorporates the execution programs of a protected program 20, a first monitoring process, and a second monitoring process 40. The protected program 20 corresponds to the main body of the application, and includes its own startup processing module and application execution module. Processing between the protected program 20, the first monitoring process 30, and the second monitoring process 40 is performed using functions provided by the OS 60.

When the application 10 is started, the protected program 20 is started, and the protected program 20 starts the first monitoring process 30 as its child process. The protected program 20 also starts the second monitoring process 40 as its child process. The first monitoring process 30 may also start the second monitoring process 40 as its child process.

The first monitoring process 30 performs an attach to the protected program 20, which is the parent process.

Figure 3 is a diagram showing an example of attachment by the first monitoring process 30. The first monitoring process 30 can check the behavior of the protection target program 20 during execution by attaching to the protection target program 20. Attachment can be performed, for example, by using a system call called ptrace. When the first monitoring process 30 outputs a memory information request to the protection target program 20, the protection target program 20 outputs the memory information to the first monitoring process 30. Signals (signals) are exchanged between the protection target program 20 and the first monitoring process 30 via the OS 60. Specifically, after attachment, the first monitoring process 30 receives a control signal issued from the OS 60 to the protection target program 20, and the first monitoring process 30 can observe the control signal to the protection target program 20 by the control signal, and can control the operation of the protection target program 20 by retransmitting the signal to the protection target program 20 via the OS 60. When the first monitoring process 30 is attached to the protected program 20, other processes (including malicious programs) cannot be attached to the protected program 20. This is because the number of processes that can be attached is limited to one.

The protected program 20 launches the first monitoring process 30, and the protected program 20 or the first monitoring process 30 launches the second monitoring process 40. The process can be launched, for example, by using a system call called fork. The second monitoring process 40 monitors the operation of the first monitoring process 30. The second monitoring process 40 may also monitor the operation of the protected program 20. The operation of the first monitoring process 30 or the protected program 20 can be monitored using the functions of the second monitoring process 40 itself or the functions of the OS 60.

Figure 4 is a diagram showing a first example of the operation of the second monitoring process 40. The first monitoring process 30 can check the behavior of the protected program 20 while it is running by attaching to the protected program 20. The second monitoring process 40 monitors the operation of the first monitoring process 30. The second monitoring process 40 may also monitor the operation of the protected program 20. The monitoring performed by the second monitoring process 40 can be performed, for example, by analyzing a process management file of the OS 60 and observing the operating state and attachment state of the process.

Figure 5 shows a first example of an attack pattern by an attacker. The first monitoring process 30 is currently attached to the running protected program 20. In this case, even if the attacker attempts to attach to the running protected program 20, the protected program 20 is already attached by another process (the first monitoring process 30), so the attacker cannot attach to the protected program. This makes it possible to protect the protected program from unauthorized access and prevent data from being illegally extracted from memory.

Figure 6 is a diagram showing a second example of an attack pattern by an attacker. As shown in Figure 6A, the protected program 20 is attached to the first monitoring process 30, and the attacker cannot attach to the protected program 20. Therefore, the attacker attempts to terminate the first monitoring process attached to the protected program 20. However, since the second monitoring process 40 monitors the operation of the first monitoring process 30, it can detect the termination of the first monitoring process 30. As shown in Figure 6B, the second monitoring process 40, having detected the termination of the first monitoring process 30, terminates the operation of the protected program 20.

As described above, when the second monitoring process 40 detects an abnormality (e.g., an unauthorized pause or termination) in the first monitoring process 30, the control unit 51 causes the second monitoring process 40 to terminate the operation of the protected program 20. In addition, when the second monitoring process 40 detects an abnormality (e.g., an unauthorized pause or termination) in the protected program 20, the control unit 51 may cause the second monitoring process 40 to terminate the operation of the protected program 20.

This allows the second monitoring process 40 to detect attacks on the first monitoring process 30 and the protected program 20, and as a result, the protected program 20 can be protected from unauthorized access. Even if an attacker attempts to attach to the protected program 20, the protected program 20 has terminated, so the attacker cannot attach to the protected program 20 (see FIG. 6B). This protects the protected program 20 from unauthorized access and prevents data from being illegally extracted from memory.

Figure 7 shows a second example of the operation of the second monitoring process 40. The second monitoring process 40 periodically or irregularly generates another process (a new process) that executes the same operations as itself, and terminates the current process. This allows the second monitoring process 40 to prevent itself from being identified as a target of attacks such as suspension or termination.

In the example of Figure 7, while the second monitoring process 40 (process ID = 01) is executing an operation, a new process, the second monitoring process 40 (process ID = 10), which performs the same operation as the second monitoring process 40 itself is generated, and the currently executing second monitoring process 40 (process ID = 01) is terminated.

Next, while the second monitoring process 40 (process ID = 10) is executing, a new process, a second monitoring process 40 (process ID = 22) that performs the same operation as the second monitoring process 40 itself, is generated, and the currently executing second monitoring process 40 (process ID = 10) is terminated.

Similarly, while the second monitoring process 40 (process ID = 22) is executing an operation, a new process, a second monitoring process 40, that performs the same operation as itself is generated, and the currently executing second monitoring process 40 (process ID = 22) is terminated. Thereafter, the same processing is repeated. Note that the example process ID is provided merely to conveniently indicate that the process IDs are different, and the IDs themselves are not limited to numbers.

As described above, the control unit 51 causes the second monitoring process 40 to start a second monitoring process 40 having a different process ID. In addition, when the control unit 51 starts a new second monitoring process 40, it terminates the most recent, oldest second monitoring process 40.

Figures 8A and 8B show a third example of an attack pattern by an attacker. Assume that the first monitoring process 30 is attached to the protected program 20. The second monitoring process (process ID = 01) 40 is monitoring the operation of the first monitoring process 30. The attacker attempts to identify the process ID of the second monitoring process 40 in order to stop or terminate the second monitoring process (process ID = 01) 40. The second monitoring process (process ID = 01) 40 generates a new second monitoring process (process ID = 02) 40 that performs the same operation as itself.

The newly created second monitoring process (process ID = 02) 40 monitors the operation of the first monitoring process 30. The most recent old second monitoring process (process ID = 01) 40 terminates itself. The above-mentioned process generation change (creating a new process and terminating the old process) can be performed at a time interval shorter (preferably sufficiently shorter) than the process ID identification operation by an attacker. Because an attacker can only identify the process ID = 01 of the old second monitoring process 40 that has already terminated, he cannot intervene to stop or terminate the newly created second monitoring process (process ID = 02).

As described above, according to this embodiment, an attacker cannot know information (process ID) that identifies the second monitoring process 40 while it is running, making it difficult to launch attacks such as stopping or terminating the second monitoring process 40.

Figure 9 is a diagram showing an example of a processing procedure by the program protection device 50. The subjects of the processing in Figure 9 are the protected program 20, the first monitoring process 30, and the second monitoring process 40, but these subjects may be collectively referred to as the control unit 51. The protected program 20 is started (S11), and the protected program 20 starts the first monitoring process 30 as its own child process (S12). The first monitoring process 30 attaches to the protected program 20 (S13). When performing the attachment, the first monitoring process 30 obtains the process ID of the protected program 20.

The protected program 20 starts the second monitoring process 40 as its own child process (S14). The second monitoring process 40 acquires the process ID of the first monitoring process 30 and monitors the operation of the first monitoring process 30 (S15). Note that the second monitoring process 40 may be caused to acquire the process ID of the protected program 20 and monitor the operation of the protected program 20.

The second monitoring process 40 determines whether it has detected an abnormality (such as a pause or termination) in the first monitoring process 30 (S16), and if it detects an abnormality (YES in S16), it terminates the protected program 20 (S17) and ends the process.

If no abnormality is detected (NO in S16), the second monitoring process 40 determines whether or not an action to identify the process ID of the second monitoring process 40 has been taken (S18). Here, it is assumed that the action to identify the process ID of the second monitoring process 40 has been taken by an attacker. The determination of whether or not an action to identify the process ID has been taken can use a function of the second monitoring process 40 itself or a function provided by the OS 60. If an action to identify the process ID has been taken (YES in S18), the second monitoring process 40 generates a new second monitoring process 40 having a new process ID (S19), terminates the old second monitoring process 40 (S20), and performs the processing of step S21 described below.

If there is no action to identify the process ID (NO in S18), the second monitoring process 40 determines whether to end the processing (S21), and if the processing is not to be ended (NO in S21), the processing continues from step S15 onwards. If the processing is to be ended (YES in S21), the processing of the protected program 20, the first monitoring process 30 and the second monitoring process 40 is ended.

As described above, according to this embodiment, a new second monitoring process 40 is generated to monitor the operation of the protected program 20 and the first monitoring process 30. If the second monitoring process 40 detects unauthorized intervention such as pausing or terminating the protected program 20 and the first monitoring process 30, it terminates the protected program 20. This makes it possible to prevent data from being extracted from memory through unauthorized access to the memory.

In addition, the second monitoring process 40 creates another process that performs the same operations as itself and terminates the currently running process, which prevents the process ID of the second monitoring process 40 itself from being identified, making it more difficult to attack the second monitoring process 40.

(Addendum 1) The computer program causes the computer to execute the following processing: start a first monitoring process in the protected program, start a second monitoring process in the protected program or the first monitoring process, and cause the second monitoring process to monitor the operation of the first monitoring process.

(Supplementary Note 2) The computer program in Supplementary Note 1 causes the computer to execute a process that attaches the first monitoring process to the protected program.

(Supplementary Note 3) In the computer program of Supplementary Note 1 or Supplementary Note 2, when the second monitoring process detects an abnormality in the first monitoring process, the computer executes a process to cause the second monitoring process to terminate the operation of the protected program.

(Appendix 4) In any one of appendices 1 to 3, the computer program causes the computer to execute a process that causes the second monitoring process to start a second monitoring process having a different process ID.

(Appendix 5) In appendix 4, the computer program causes the computer to execute a process that terminates the most recent, oldest second monitoring process when a new second monitoring process is started.

(Additional Note 6) The program protection device includes a control unit, which causes the protected program to start a first monitoring process, causes the protected program or the first monitoring process to start a second monitoring process, and causes the second monitoring process to monitor the operation of the first monitoring process.

(Appendix 7) The program protection method has a program to be protected start a first monitoring process, has the program to be protected or the first monitoring process start a second monitoring process, and has the second monitoring process monitor the operation of the first monitoring process.

The matters described in each embodiment can be combined with each other. In addition, the independent claims and dependent claims described in the claims can be combined with each other in any and all combinations regardless of the citation format. Furthermore, the claims use a format in which a claim cites two or more other claims (multi-claim format), but this is not limited to this. They may also be written in a format in which multiple claims cite at least one other claim (multi-multi-claim).

REFERENCE SIGNS LIST 10 Application 20 Program to be protected 30 First monitoring process 40 Second monitoring process 50 Program protection device 51 Control unit 52 Communication unit 53 Display unit 54 Operation unit 55 Memory 56 Storage unit 57 Recording medium reading unit 571 Recording medium 60 OS

Claims (7)

causing the protected program to launch a first monitoring process;
causing the protected program or the first monitoring process to launch a second monitoring process;
causing the second monitoring process to monitor the operation of the first monitoring process;
A computer program that causes a computer to carry out processing. Attaching the first monitoring process to the protected program;
2. A computer program product according to claim 1, which causes a computer to carry out a process. when the second monitoring process detects an abnormality in the first monitoring process, causing the second monitoring process to terminate the operation of the protected program;
2. A computer program product according to claim 1, which causes a computer to carry out a process. causing the second monitoring process to launch a second monitoring process having a different process ID;
A computer program product according to any one of claims 1 to 3, which causes a computer to carry out a process. When a new second monitoring process is started, the most recent old second monitoring process is terminated.
5. A computer program product according to claim 4, which causes a computer to carry out a process. A control unit is provided,
The control unit is
causing the protected program to launch a first monitoring process;
causing the protected program or the first monitoring process to launch a second monitoring process;
causing the second monitoring process to monitor the operation of the first monitoring process;
Program protection device. causing the protected program to launch a first monitoring process;
causing the protected program or the first monitoring process to launch a second monitoring process;
causing the second monitoring process to monitor the operation of the first monitoring process;
Program protection method.

Images