KR102483848B1 - Apparatus and method for strengthening login - Google Patents

Abstract

A login enhancement device and method according to a preferred embodiment of the present invention performs a login operation by applying a login enhancement technique, thereby protecting sensitive information from crawling without affecting the user's login convenience, In the case where the log-in reinforcement operation according to the present invention is applied, it is difficult to manufacture a crawling tool, and thus, it is possible to give up manufacturing a crawling tool.

Description

Apparatus and method for strengthening login}

The present invention relates to an apparatus and method for enhancing login, and more particularly, to an apparatus and method for performing a log-in operation of a website.

Websites suffer from intrusion by crawling. Damages include data leakage, infringement of sensitive information, server failure, and increase in server operating costs.

Conventional methods for responding to crawling use IP (Internet Protocol) blocking using WAF (Web Application Firewall), threshold blocking, Google's reCaptcha, and the like. However, the IP blocking method using WAF has a problem of being easily bypassed, and reCaptcha is expensive and difficult to apply for a long period of time until it is effective in actual service.

In addition, there is also a method using a secondary authentication tool such as OTP (One Time Password), but this has a disadvantage of reducing user convenience.

Therefore, it is necessary to develop a login technique that can prevent infringement by crawling while maintaining user convenience.

An object of the present invention is to provide a login reinforcement device and method for performing a login operation by applying a login reinforcement technique in order to protect sensitive information from crawling without affecting the user's login convenience. there is

Other non-specified objects of the present invention may be additionally considered within the scope that can be easily inferred from the following detailed description and effects thereof.

In order to achieve the above object, the login reinforcement device according to a preferred embodiment of the present invention generates a private key and a public key based on a preset public key encryption algorithm when a login web page is requested from a web browser installed in a user terminal. and an information providing unit providing the login web page and the public key to the web browser; and when a login information packet in which the value of the login item of the login web page is encrypted using the public key is received from the web browser, the value of the login item is decrypted using the private key, and the decrypted and a login performer performing a login operation based on the value of the login item.

Here, the front-end code corresponding to the login web page is obfuscated by a JavaScript code that encrypts the value of the login item based on the public key encryption algorithm. It may be obfuscated by the technique.

Here, in the front-end code, encryption related information preset for the public key encryption algorithm may be deleted.

Here, the encryption-related information may be at least one of a file path, a file name, a comment, and a debugging code.

Here, in the login information packet, a value for the login item may be recorded in a preset variable unrelated to a variable of the login item, and a preset dummy value may be recorded in a variable of the login item. there is.

Here, the public key encryption algorithm may be a Rivest Shamir Adleman (RSA) algorithm.

Here, the login item may include an ID item and a password item.

In order to achieve the above object, a login enhancement method according to a preferred embodiment of the present invention generates a private key and a public key based on a preset public key encryption algorithm when a login web page is requested from a web browser installed in a user terminal. doing; providing the login web page and the public key to the web browser; decrypting the value of the login item using the private key when a login information packet in which the value of the login item of the login web page is encrypted using the public key is received from the web browser; and performing a login operation based on the value of the decrypted login item.

Here, the front-end code corresponding to the login web page is obfuscated by a JavaScript code that encrypts the value of the login item based on the public key encryption algorithm. It may be obfuscated by the technique.

Here, in the front-end code, encryption related information preset for the public key encryption algorithm may be deleted.

Here, in the login information packet, a value for the login item may be recorded in a preset variable unrelated to a variable of the login item, and a preset dummy value may be recorded in a variable of the login item. there is.

A computer program according to a preferred embodiment of the present invention for achieving the above technical problem is stored in a computer-readable recording medium and executes any one of the above login reinforcement methods on a computer.

According to the login reinforcement device and method according to a preferred embodiment of the present invention, by performing a login operation by applying the login reinforcement technique, sensitive information can be protected from crawling without affecting the user's login convenience. .

In addition, when the log-in reinforcement operation according to the present invention is applied, it is difficult to manufacture a crawling tool, and it is possible to give up manufacturing a crawling tool.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a block diagram for explaining a login enhancement device according to a preferred embodiment of the present invention.
FIG. 2 is a block diagram for explaining the configuration of the login reinforcement device shown in FIG. 1 .
3 is a diagram for explaining an example of encryption of a value for a login item according to a preferred embodiment of the present invention.
4 is a diagram for explaining an example of a process of obtaining a public key and a private key according to a preferred embodiment of the present invention.
5 is a diagram for explaining an example of obfuscation of JavaScript code according to a preferred embodiment of the present invention.
6 is a diagram for explaining an example of encryption-related information according to a preferred embodiment of the present invention.
7 is a diagram for explaining an example of a login information packet according to a preferred embodiment of the present invention.
8 is a diagram for explaining the performance of a login reinforcement operation according to a preferred embodiment of the present invention.
9 is a diagram for explaining the difficulty of manufacturing a crawling tool when a log-in reinforcement operation according to a preferred embodiment of the present invention is applied.
10 is a flowchart illustrating a login reinforcement method according to a preferred embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them, will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms, only the present embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to completely inform the person who has the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

In this specification, terms such as "first" and "second" are used to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element.

In this specification, identification codes (eg, a, b, c, etc.) for each step are used for convenience of explanation, and identification codes do not describe the order of each step, and each step is clearly Unless a specific order is specified, it may occur in a different order from the specified order. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

In this specification, expressions such as "has", "may have", "includes" or "may include" indicate the existence of a corresponding feature (eg, numerical value, function, operation, or component such as a part). indicated, and does not preclude the presence of additional features.

In addition, the term '~unit' described in this specification means software or a hardware component such as a field-programmable gate array (FPGA) or ASIC, and '~unit' performs certain roles. However, '~ part' is not limited to software or hardware. '~bu' may be configured to be in an addressable storage medium and may be configured to reproduce one or more processors. Therefore, as an example, '~unit' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and procedures. , subroutines, segments of program code, drivers, firmware, microcode, circuitry, data structures and variables. Functions provided within components and '~units' may be combined into smaller numbers of components and '~units' or further separated into additional components and '~units'.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of a login enhancement device and method according to the present invention will be described in detail with reference to the accompanying drawings.

First, referring to FIG. 1, a login enhancement device according to a preferred embodiment of the present invention will be described.

1 is a block diagram for explaining a login enhancement device according to a preferred embodiment of the present invention.

Referring to FIG. 1 , a login enhancement device 100 according to a preferred embodiment of the present invention is connected to a user terminal 200 through a communication network 300 .

The login enhancement device 100 performs an operation related to login of a website according to a request of the user terminal 200 . In particular, the login reinforcement device 100 according to the present invention performs a login operation by applying a login reinforcement technique to protect sensitive information from crawling without affecting the user's login convenience. When the log-in reinforcement operation according to the present invention is applied, it is difficult to manufacture a crawling tool, and thus, it is possible to give up manufacturing a crawling tool.

Here, the sensitive information refers to various types of information that can be checked after logging in.

The user terminal 200 may access the login reinforcement device 100 through the installed web browser 210 to send and receive data necessary for a login operation.

Here, the user terminal 200 includes not only a desktop computer, but also a notebook computer, a workstation, a palmtop computer, an ultra mobile personal computer (UMPC), a tablet PC, a personal digital assistant (PDA), a web pad, It may be made of a terminal equipped with a memory means and equipped with a microprocessor, such as a smart phone, a mobile phone, etc., and having an arithmetic capability.

The communication network 300 may include a telephone network as well as a data communication network including a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), and the Internet. It can be wired or wireless, and it does not matter which communication method is used.

On the other hand, although the login reinforcement device 100 is shown in FIG. 1 as an independent device, the present invention is not limited thereto and according to an embodiment, the login reinforcement device 100 according to the present invention provides a web service including a login operation. Is installed in a web server (not shown) that provides a web server to perform a login reinforcement operation according to the present invention, or the login reinforcement device 100 according to the present invention is implemented as an independent device and connected to the web server , The login enhancement device 100 may be implemented to perform only a login operation among web services provided through a web server.

Then, with reference to FIG. 2, a login enhancement device according to a preferred embodiment of the present invention will be described in more detail.

FIG. 2 is a block diagram for explaining the configuration of the login reinforcement device shown in FIG. 1 .

Referring to FIG. 2 , the login reinforcement device 100 may include an information provider 110 and a login performer 130 .

When the information providing unit 110 receives a request for a login web page from the web browser 210 installed in the user terminal 200, it generates a private key and a public key based on a preset public key encryption algorithm.

Here, the public key encryption algorithm refers to a Rivest Shamir Adleman (RSA) algorithm or the like.

And, the information provider 100 provides the login web page and the public key to the web browser 210 . Then, the web browser 210 stores the public key and displays a login web page. Thereafter, when information is entered into the login item of the login web page by the user and login is requested, the web browser 210 encrypts the value of the login item using the public key, and sends the login information packet to the login enhancement device ( 100) will be provided.

Here, the login item may include an ID item, a password item, and the like.

And, in the login information packet, the value of the login item of the login web page is encrypted using a public key. At this time, only values for login items among information recorded in the login information packet may be encrypted using a public key.

At this time, the front-end code corresponding to the login web page is obfuscated by an obfuscation technique in which the JavaScript code that encrypts the value of the login item based on the public key encryption algorithm is set in advance. may be upset Here, the preset obfuscation technique refers to an obfuscation technique having a high decoding difficulty, such as an obfuscation technique in which a decoding tool is not disclosed or a decoding difficulty is guaranteed.

Also, in the front-end code, encryption-related information previously set for a public key encryption algorithm may be deleted. Here, the encryption-related information refers to information from which the type of the public key encryption algorithm can be inferred, and may be at least one of a file path, a file name, a comment, and a debugging code.

In addition, in the login information packet, a value for a login item may be recorded in a preset variable unrelated to a variable of the login item, and a preset dummy value may be recorded in a variable of the login item. For example, when a login item consists of an ID item and a password item, dummy values that have nothing to do with the values for the actual login item are recorded in the "ID" variable and the "PW" variable in the login information packet, and The value (encrypted value) is written to the "DATA" variable, which has nothing to do with the "ID" variable, and the value for the actual password entry (the encrypted value) is written to the "INFORMATION" variable, which has nothing to do with the "PW" variable. may have been recorded. At this time, the dummy value may be composed of a value encrypted using a public key.

When the login information packet is received from the web browser 210, the login performer 130 decrypts the value of the login item using a private key.

Then, the login performer 130 performs a login operation based on the value of the decrypted login item. That is, the login performer 130 may compare the value of the decrypted login item with pre-stored user login information to determine whether to accept the login.

Next, an example of a login reinforcement operation according to a preferred embodiment of the present invention will be described with reference to FIGS. 3 to 7 .

3 is a diagram for explaining an example of encryption of a value for a login item according to a preferred embodiment of the present invention, and FIG. 4 is a diagram for explaining an example of a process for obtaining a public key and a private key according to a preferred embodiment of the present invention. It is a drawing for

Among the login reinforcement techniques according to the present invention, the first technique applies public key encryption algorithm-based encryption. The first technique uses a public key encryption algorithm to encrypt an ID value and a password value input through a login web page when a "login" button is pressed. When the "login" button is pressed, as shown in FIG. 3, the transmitted login information packet is transmitted with an encrypted value written in the "pw" variable and the "ID" variable, rather than the value inferred by the user ID and password, respectively do.

This is the value obtained after performing encryption based on the public key encryption algorithm, and the value changes each time the login web page is called. For example, as shown in FIG. 4 , public key and private key generation may be implemented using a Java security module. That is, the public key and the private key can be obtained through "keyPair.getPublic();" and "keyPair.getPrivate();". The web front page plays the role of receiving and delivering the contents requested by the web browser to the back-end server. At this time, whenever the web browser calls the web front page, of course, the back-end server calls the code to provide the information requested by the web front page, and each time "keyPair.getPublic();" and "keyPair.getPrivate( );" is called, so the public and private keys change each time.

Therefore, in order to automate this login, crawl tool creators have asked questions such as "What is this value?", "Is this an encrypted value?", "What encrypted value?" You should be able to answer questions.

If you answer all of them, you can build a crawling tool. If you know that it is a public key cryptographic algorithm, you will find the public key. The public key encryption algorithm is divided into a public key and a private key to perform encryption and decryption. Since the public key is a key provided to anyone, analyzing the front-end code or the flow of login information packets reveals the public key will be able to find

In this way, since the public key can be found if the public key encryption algorithm is known, the present invention can apply an additional login reinforcement technique described below to make it difficult to infer the public key encryption algorithm.

5 is a diagram for explaining an example of obfuscation of JavaScript code according to a preferred embodiment of the present invention.

Among the login reinforcement techniques according to the present invention, the second technique is a JavaScript code obfuscation technique. The actual public key encryption algorithm-based encryption process is performed by the JavaScript code in the front-end code. By analyzing this JavaScript code, you can analyze which public key encryption algorithm is being used.

Accordingly, the present invention applies obfuscation of JavaScript code to make it difficult for crawlers to analyze JavaScript code.

Here, obfuscation techniques that are easily decrypted (obfuscation techniques using the XOR technique, dean.edwards.name/packer created by dean edwards researcher, and obfuscation techniques using open obfuscation techniques such as beautifier.io ) are of great significance. does not exist. There is a keyword that can be inferred from the obfuscation technique, so if it is easily decrypted with an open decryption tool based on this keyword, it becomes meaningless. Therefore, the present invention is an obfuscation technique with a high difficulty of decoding (http://jasob.com/, http://javascript-source.com/, https://jscrambler.com/ where decryption tools such as As shown in FIG. 5, the JavaScript code may be obfuscated using an obfuscation technique with guaranteed difficulty.

6 is a diagram for explaining an example of encryption-related information according to a preferred embodiment of the present invention.

The third technique among login reinforcement techniques according to the present invention is a technique for deleting encryption-related information. Information that is widely used in analysis is the file path, file name, comment, and debugging code written for debugging purposes exposed on the front-end code.

Even if it is difficult to implement a login information packet that transmits an ID value and a password value by performing encryption based on a public key encryption algorithm, as shown in FIG. Anyone can infer that "RSA algorithm" is used among public key encryption algorithms. Therefore, the present invention deletes comments on the code.

In addition, since the public key encryption algorithm can be inferred using the file path "js/auth/rsa/" (that is, the front resource file name) (ERI_2 in FIG. 6), the present invention also deletes the file path.

In addition, if an error occurs in the "else (exception handling) part" for debugging purposes, if an alert called "Invalid RSA public key" is generated (ERI_5 in Fig. 6), this part is also created by the crawling tool producer If an error occurs during analysis, since RSA encryption can be inferred, the present invention also deletes the debugging code. For example, use a repository such as git to store the code before deploying it to the service. Repositories such as git provide a search function. If you search using a keyword (e.g., RSA, etc.) directly or indirectly related to a public key encryption algorithm, codes with the keyword inserted are listed, and the public key encryption algorithm Debugging code that can be inferred can be deleted.

7 is a diagram for explaining an example of a login information packet according to a preferred embodiment of the present invention.

A fourth technique among login reinforcement techniques according to the present invention is a technique for hiding variable names in a login information packet. That is, if there is an "ID" variable and a "pw" variable, it is naturally determined that the user ID value and password value transmitted from the login web page are transmitted to these variables.

However, in the present invention, actual ID and password values are transmitted through variables that do not seem to be related thereto, and encrypted dummy values are transmitted to the "ID" variable and the "pw" variable. That is, as shown in FIG. 7, dummy values (DM_V1 and DM_V2 in FIG. 7) are put into the "pw" and "ID" variables, respectively, and real ID values and passwords are respectively put into the "Value1" and "Value2" variables. Values (ID_V and PW_V in FIG. 7) can be entered. Accordingly, it is not possible to determine where the actual ID value and password value are recorded using only the login information packet.

Next, the performance of the login reinforcement operation according to the preferred embodiment of the present invention will be described with reference to FIGS. 8 and 9 .

8 is a diagram for explaining the performance of a login reinforcement operation according to a preferred embodiment of the present invention, and FIG. it is a drawing

As shown in FIG. 8 , the login reinforcement operation according to the present invention can protect sensitive information from crawling without affecting the user's login convenience.

In addition, as shown in FIG. 9, in order to create a crawling tool for the system to which the login reinforcement operation according to the present invention is applied, several processes (whether the login web page can be analyzed -> whether the login information packet can be analyzed -> deobfuscation Whether it is possible -> whether it is possible to determine the encryption method -> whether it is possible to check the public key -> whether it is possible to check the variables in the login information packet -> whether it is possible to implement programming) Because of this, you can give up on making crawl tools.

In other words, the present invention lowers the return on investment (ROI) required when creating a crawling tool that requires log-in automation for invasion of sensitive information, thereby giving up crawling tool production.

Next, a login reinforcement method according to a preferred embodiment of the present invention will be described with reference to FIG. 10 .

10 is a flowchart illustrating a login reinforcement method according to a preferred embodiment of the present invention.

Referring to FIG. 10 , when the user terminal 200 requests a login web page (S110), the login reinforcement device 100 generates a private key and a public key based on a preset public key encryption algorithm (S120).

Here, the public key encryption algorithm refers to an RSA algorithm or the like.

Then, the login reinforcement device 100 provides the login web page and the public key to the user terminal 200 (S130).

Then, the user terminal 200 stores the public key and displays a login web page (S140).

Thereafter, when information is input to the login item of the login web page by the user and login is requested (S150), the user terminal 200 encrypts the value of the login item using the public key (S160).

Here, the login item may include an ID item, a password item, and the like.

Then, the user terminal 200 provides the login information packet to the login enhancement device 100 (S170).

Here, in the login information packet, a value for a login item of a login web page is encrypted using a public key.

At this time, the front-end code corresponding to the login web page may have the JavaScript code that encrypts the value of the login item based on the public key encryption algorithm and is obfuscated by a pre-set obfuscation technique. can Here, the preset obfuscation technique refers to an obfuscation technique having a high decoding difficulty, such as an obfuscation technique in which a decoding tool is not disclosed or a decoding difficulty is guaranteed.

Also, in the front-end code, encryption-related information previously set for a public key encryption algorithm may be deleted. Here, the encryption-related information refers to information from which the type of the public key encryption algorithm can be inferred, and may be at least one of a file path, a file name, a comment, and a debugging code.

In addition, in the login information packet, a value for a login item may be recorded in a preset variable unrelated to a variable of the login item, and a preset dummy value may be recorded in a variable of the login item.

Then, the login reinforcement device 100 decrypts the value of the login item using the private key (S180).

Then, the login reinforcement device 100 performs a login operation based on the value of the decrypted login item (S190).

That is, the login reinforcement device 100 may compare the value of the decrypted login item with pre-stored user login information to determine whether to accept the login.

Even though all components constituting the embodiments of the present invention described above are described as being combined or operated as one, the present invention is not necessarily limited to these embodiments. That is, within the scope of the object of the present invention, all of the components may be selectively combined with one or more to operate. In addition, although all of the components may be implemented as a single independent piece of hardware, some or all of the components are selectively combined to perform some or all of the combined functions in one or a plurality of pieces of hardware. It may be implemented as a computer program having. In addition, such a computer program can implement an embodiment of the present invention by being stored in a computer readable recording medium such as a USB memory, a CD disk, a flash memory, etc., and read and executed by a computer. A recording medium of a computer program may include a magnetic recording medium, an optical recording medium, and the like.

The above description is merely an example of the technical idea of the present invention, and those skilled in the art can make various modifications, changes, and substitutions without departing from the essential characteristics of the present invention. will be. Therefore, the embodiments disclosed in the present invention and the accompanying drawings are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments and the accompanying drawings. . The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

100: login hardening device,
110: information provision unit,
130: login execution unit,
200: user terminal,
210: web browser,
300: communication network

Claims (12)

An information provider for generating a private key and a public key based on a preset public key encryption algorithm when a login web page is requested from a web browser installed in a user terminal, and providing the login web page and the public key to the web browser. ; and
When a login information packet in which the value of the login item of the login web page is encrypted using the public key is received from the web browser, the value of the login item is decrypted using the private key, and the decrypted A login performer performing a login operation based on the value of the login item; including,
The front-end code corresponding to the login web page is an obfuscation technique in which a JavaScript code that encrypts the value of the login item based on the public key encryption algorithm is set in advance. obfuscated,
In the front-end code, encryption related information preset for the public key encryption algorithm is deleted,
The encryption-related information includes a file path, file name, comments, and debugging code.
Login Enhancer. delete delete delete In paragraph 1,
The login information packet,
The value of the login item is recorded in a preset variable unrelated to the variable of the login item, and a preset dummy value is recorded in the variable of the login item.
Login Enhancer. In paragraph 1,
The public key encryption algorithm,
RSA (Rivest Shamir Adleman) algorithm,
Login Enhancer. In paragraph 1,
The login item is
Including ID items and password items,
Login Enhancer. generating a private key and a public key based on a preset public key encryption algorithm when a login web page is requested from a web browser installed in a user terminal;
providing the login web page and the public key to the web browser;
decrypting the value of the login item using the private key when a login information packet in which the value of the login item of the login web page is encrypted using the public key is received from the web browser; and
performing a login operation based on the value of the decrypted login item; including,
The front-end code corresponding to the login web page is an obfuscation technique in which a JavaScript code that encrypts the value of the login item based on the public key encryption algorithm is set in advance. obfuscated,
In the front-end code, encryption related information preset for the public key encryption algorithm is deleted,
The encryption-related information includes a file path, file name, comments, and debugging code.
How to harden your login. delete delete In paragraph 8,
The login information packet,
The value of the login item is recorded in a preset variable unrelated to the variable of the login item, and a preset dummy value is recorded in the variable of the login item.
How to harden your login. A computer program stored in a computer-readable recording medium in order to execute the login reinforcement method according to any one of claims 8 or 11 on a computer.

Images