KR20210039629A - System and method for anti-ransomware application for server - Google Patents

Abstract

Provided is a system for a server to block a ransomware attack, including: a backup storage device, which is a separate storage device that is physically independent from the server, has a purpose for backing up stored data in the server, and includes a communication interface that enables communication connection with the server; and a service agent installed in the server to mediate communication with the backup storage device. According to an embodiment of the present invention, while the backup storage device is storage-mounted in the server, when there is a lock command for backup data that is backed up in the backup storage device after data backup of the stored data in the server to the backup storage device is processed, the backup storage device locks the backup data according to the lock command, so that the locked backup data is provided only in an unmodifiable read-only mode.

Description

Server ransomware attack blocking method and system {SYSTEM AND METHOD FOR ANTI-RANSOMWARE APPLICATION FOR SERVER}

The present invention relates to a server ransomware attack blocking method and system.

As ransomware distributed by hackers is increasingly diversified, users' data is increasingly threatened. In general, ransomware refers to an attack technique that requests money after encrypting data stored in a user's terminal or stored in a connected network storage so that the user cannot access it. Recently, ransomware itself does not only encrypt data stored in the PC, but also encrypts the entire PC, or even requests ransom money by encrypting the entire disk mounted on the PC. In addition, there is an attack that encrypts not only the PC but also the entire data on the server at once, so a fundamental alternative is needed.

Currently, the only realistic way to prevent ransomware is backup, but because the backup storage can also be encrypted by ransomware, it is required to separate the backup storage from the network or store it separately in offline media after backup.

However, organizations and companies that have been damaged by ransomware are often insignificant to have the necessary personnel and equipment to efficiently operate backups as described above. Therefore, there is a need for a way to safely manage the backed up data from ransomware in an inexpensive way without a separate management manpower.

The present invention is to provide a server ransomware attack blocking method and system capable of safely managing data stored in a server and backed up data from ransomware in an inexpensive and convenient method without a separate server management manpower.

According to an aspect of the present invention, as a server system for blocking ransomware attacks,

A storage device for backup, which is a separate storage device that is physically independent from the server and has a purpose for backing up data stored in the server, and includes a communication interface for enabling communication connection with the server; And a service agent installed in the server to mediate communication with the backup storage device,

In a state in which the backup storage device is storage-mounted on the server, after data backup to the backup storage device for the storage data in the server is processed, there is a lock command for the backup data that has been backed up to the backup storage device. Occation,

The backup storage device is provided with a ransomware attack blocking system in which the backup data is locked according to the locking command so that the locked backup data is provided only in a read-only mode that cannot be modified.

In one embodiment, the data backup to the backup storage device,

Only when a backup command for storage data in the server is made, the service agent transfers the backup command received to the server to the backup storage device, and the backup storage device transfers the storage data according to the received backup command. It can be handled by backing up.

In one embodiment, the backup storage device,

When the data modification command received to the server is transmitted from the service agent, it is checked whether the target data of the data modification command is related to the locked backup data, and is a data modification command related to the locked backup data. If it is confirmed that the data modification order can be rejected.

In one embodiment, the backup storage device,

When the target data of the data modification command is the locked backup data, data related to the corresponding backup data received from the other storage device even when the locked backup data is storage mounted on a storage device different from the server You can reject the modification command and process the backup data to be provided only in read-only mode.

In one embodiment, the backup storage device,

Including a hardware switch or a software switch for releasing the lock processing state set in the backup data,

Even when the unlock command for the locked backup data is transmitted through the service agent, when the change to the unlock state is not made through the operation change of the hardware switch or the software switch, the unlock command Can be rejected.

In one embodiment, the backup storage device,

When switching to the unlocked state is made through the hardware switch or the software switch, the read-only mode for the backup data according to the lock processing state is released, and the backup data can be converted into a state in which data can be modified. have.

In one embodiment, the conversion to the unlocked state may be selected from one of a batch release method performed on all of the data backed up in the backup storage device and a selection release method performed only on the requested backup data.

According to the method and system for blocking ransomware attacks for servers according to an embodiment of the present invention, it is possible to safely protect data stored in the server and backed up data from ransomware in an inexpensive and convenient method without a separate server management manpower. .

1 is a diagram illustrating a process in which a storage device for backup is mounted on a server in a server system for blocking ransomware attacks according to an embodiment of the present invention.
2 is a diagram illustrating a process in which a storage device for backup performs data backup and lock processing in a server system for blocking ransomware attacks according to an embodiment of the present invention.
3 is a diagram illustrating a process of unlocking a backup storage device in a server system for blocking ransomware attacks according to an embodiment of the present invention.

Since the present invention can apply various transformations and have various embodiments, specific embodiments are illustrated in the drawings and will be described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it should be understood to include all conversions, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that a detailed description of a related known technology may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description of the present specification are merely identification symbols for distinguishing one component from other components.

In addition, throughout the specification, when one component is referred to as "connected" or "connected" to another component, the one component may be directly connected or directly connected to the other component, but specially It should be understood that as long as there is no opposite substrate, it may be connected or may be connected via another component in the middle. In addition, throughout the specification, when a certain part "includes" a certain component, it means that other components may be further included rather than excluding other components unless specifically stated to the contrary. In addition, terms such as "unit" and "module" described in the specification mean a unit that processes at least one function or operation, which means that it can be implemented as one or more hardware or software, or a combination of hardware and software. .

Hereinafter, before describing the embodiments of the present invention with reference to the accompanying drawings, in order to help understanding the present invention, the difference between the method of the present invention and other methods will be described as follows.

Among the conventional prior art, there is a method of implementing "program-based read-only storage", which determines whether or not it is an authorized program according to the file protection policy, and allows the file to be modified if it is an authorized program. Otherwise, it operates only in read-only mode. It is a technology that makes it possible. In this program-based read-only storage implementation method, commands and responses are basically performed in file units, so files are provided as read-only files in file units. However, this program-based read-only storage implementation method has the following vulnerabilities.

For example, in the case of the Linux operating system, if the administrator account is stolen, all commands or traffic transmitted to the backup server can be viewed by the hacker. Therefore, the hacker must observe the commands transmitted to the backup server. If a replay attack is performed by stealing the fingerprint value of the authorized program (i.e., making the hacking program the same as the authorized program name, transferring the stolen fingerprint value to the backup server and disguised as a normal program), It has a vulnerability that makes the security method of the above technology ineffective.

On the other hand, according to the present invention, even if an administrator account is stolen as described above, it is possible to block a ransomware attack by a hacker. This will be clearly understood from the descriptions of the present invention to be described later.

Another way is to implement "read-only storage based on file creation time". This is a method in accordance with Korean Patent Application No. 10-2018-0029490 filed by the company, and is based on providing a file only for read-only use, but only when a new file needs to be created, based on the time when the file is requested to be created. This is a technology that allows the creation of a corresponding file within a predetermined time (ie, a file creation valid time range), and this also operates in a file unit as a basic unit.

However, even in the case of the read-only storage implementation method based on the file creation time described above, the following security vulnerabilities appear in some cases. In other words, a file with a small size (capacity) uploaded during the file creation process is not a problem, but in the case of a backup of a large file, the file creation valid time range must be lengthened. If there is, it can increase your chances of being exposed to external attacks during that time. For example, in the case of backup, in order to increase the storage efficiency, the backup is not performed in units of one file, but is backed up as a single file in Tar or ZIP format.If the file size is too large, the file modification time should be given long enough. Because it does.

In order to improve the above-described problems, an embodiment of the present invention proposes a "command-based read-only storage" implementation method. This command-based read-only storage implementation method is executed by a backup command, a lock command, and an unlock command. In this case, the backup/lock/unlock can be operated not only by file but also by folder. have. Therefore, even if there is a request to modify a specific file, if the folder holding the file (extending to the folder's parent folder) is locked according to the path of the file, the request to modify the file is rejected. .

These backup/lock/unlock commands can use the command structure according to the following commands when using the Linux operating system.

Backup command example

User>mount 192.10.1.1 localhost\backup

(Mkdir \backup\websource_backup_20190805)

Copy/Backup'\websource''\backup\websource_backup_20190805'

Lock command example

freeze \backup\websource_backup_20190805

Example of unlock command

Melt \backup\websource_backup_20190805 (OTP 201023)

As described above, in the case of the unlock command, authentication using a one-time password (OTP) may be additionally requested.

As described above, according to the method of the present invention, the backed up data can be changed to a read-only mode by locking all files and folders under a specific folder with a very simple console command.

According to the command-based read-only storage implementation method according to an embodiment of the present invention, when a file is requested from a generally mounted drive, a folder path storing the file is also included in the request. If the modification request is restricted based on the standard, very efficient security management becomes possible, and if the security management is performed on a folder basis, unnecessary metadata management for each individual file (in the case of the read-only storage implementation method based on the creation time described above, the current In the case of the difference in request time and the above-described program-based read-only storage implementation method, there is an advantage of being able to omit the attribute information of the corresponding program, fingerprint value, etc.).

Hereinafter, embodiments of the present invention will be sequentially described with reference to FIGS. 1 to 3.

The server system for blocking ransomware attacks according to an embodiment of the present invention is a separate storage device that is physically independent from the server and has a purpose for backing up data stored in the server, and enables communication access with the server. A storage device for backup including a communication interface (see "Mega Storage" in FIGS. 1 to 3, the same hereinafter); And a service agent installed in the server to mediate communication with the backup storage device (see "Mega connector" in FIGS. 1 to 3, the same hereinafter).

In the server system for blocking ransomware attacks of the present invention, the backup storage device provides the same environment as a network and a general storage capable of being directly connected. In other words,

It provides mount/unmount like general storage connected by NAS, DAS, SAN, etc., and provides I/O of the operating system as it is, so that various backup utilities and tools such as rsync do not have any problem in operation.

In addition, the service agent may be run at the service level of the operating system in its installation step, or may be installed so that it can be run at any location by registering a program execution environment path of the operating system.

According to an embodiment of the present invention, in a state in which the backup storage device is storage-mounted on the server, after data backup to the backup storage device for data stored in the server is processed, the backup storage device is backed up. When there is a lock command for the processed backup data, the backup storage device locks the backup data according to the lock command so that the locked backup data is provided in a read-only mode that cannot be modified. Will be described in detail below.

According to an embodiment of the present invention, data backup to the storage device for backup is performed only when a backup command for data stored in the server is issued, and the service agent sends the backup command received to the server to the backup storage device. Transfer to the device, the storage device for backup may be processed by backing up the storage data according to the received backup command. Hereinafter, this will be described with reference to FIG. 1. Here, FIG. 1 is a diagram illustrating a process in which a storage device for backup is mounted on a server in a server system for blocking ransomware attacks according to an embodiment of the present invention.

1, a storage device for backup (Mega Storage) refers to a device or server device with a built-in physical storage device and a Hybrid WORM program, and a service agent (Mega Connector) is installed on the customer service server to provide storage for backup. It is a module that communicates with a device (Mega Storage).

In order for a user to back up data on the company's service server, the backup storage device (Mega Storage) must be mounted on the company's service server. The user's mount request is received and processed by the service agent (Mega Connector), and various I/Os of the operating system related to the storage mount are processed by the service agent (Mega Connector) through the storage device for backup (Mega Storage). After that, it is processed by returning the result to the operating system.

The example of FIG. 1 shows an example in which a storage device for backup (Mega Storage) is mounted as a new folder called backup under a folder called /media.

In addition, FIG. 2 is a diagram illustrating a process in which a storage device for backup performs data backup and lock processing.

In an embodiment of the present invention, the backup storage device, when a data modification command received to the server is transmitted from the service agent, checks whether target data of the data modification command is related to the locked backup data, When it is confirmed that the data modification command related to the locked backup data is determined, the data modification command is rejected.

Referring to FIG. 2, after a user backs up the data of /websource to /media/backup/websource/20180101 (refer to (a) of FIG. 2), lock (this is provided by the service agent (Mega Connector)) Upon request, the backup storage device (Mega Storage) locks the folder, so that it operates in read-only mode only (refer to (b) and (c) of FIG. 2).

At this time, the /media/backup/websource/20180101 folder can be created with a command such as mkdir in the case of a Linux operating system.

In addition, information on the locked folders is stored in a nonvolatile memory (database, etc.) of a backup storage device (Mega Storage), so that data can be retained even when power supply to the backup storage device (Mega Storage) is stopped.

After that, all data modification requests (for example, write file, modify file, move file, delete file, etc.) for /media/backup/websource/20180101 are rejected by a user or a random processor including ransomware. do.

In addition, according to another embodiment, when the target data of the data modification command is the locked backup data, the locked backup data is storage mounted on a storage device different from the server. Even in this case, a data modification command for the corresponding backup data received from the other storage device may be rejected and the corresponding backup data may be processed so that it is provided only in a read-only mode.

In other words, the information of the locked folders is set to the storage reference path of the backup storage device (Mega Storage) (/websource/20180101 in the example of FIG. 1), and the backup storage device (Mega Storage) has a different path (eg. For example, even if it is mounted on /media/data), /media/data/websource/20180101 can still be implemented to be accessible only as read-only.

3 is a diagram illustrating a process of unlocking a backup storage device.

In an embodiment of the present invention, the backup storage device includes a hardware switch (eg, a lock setting and release hardware button provided in the backup storage device) or a software switch for releasing the lock processing state set in the backup data. It may include. Accordingly, even when the unlock command for the locked backup data is transmitted through the service agent, when the hardware switch or the software switch is not switched to the unlocked state, the The lock release command can be rejected (see (d) of FIG. 3).

Accordingly, the backup storage device, when switching to the unlocked state is made through the hardware switch or the software switch, releases the read-only mode for the backup data according to the lock processing state to store the backup data as data. The conversion process can be performed in a state in which modification is possible (see FIGS.

In this case, the conversion to the unlocked state may be selected from a batch release method performed on all of the data backed up in the backup storage device and a selection release method performed only on the requested backup data.

As described above, in the present invention, a folder that has been locked once and files and folders below it can be accessed only as read-only access, and may be implemented such that arbitrary unlocking by a user is impossible. However, as the number of locked folders increases, the writeable area of the backup storage device (Mega Storage) continues to decrease. Therefore, it is necessary to have a function to unlock the storage so that the storage can be reused. In the backup storage device (Mega Storage) of the present invention, an operation of turning off a hardware switch (the protect switch) or a software switch The unlock is handled. As described above, while the protect switch is off, it is possible to unlock a specific folder or unlock the entire backup storage device (Mega Storage). Of course, in addition to the on/off method of the hardware switch and the software switch, an on/off (ie, lock and unlock) method using an OTP (one time password) can also be applied.

In relation to the above-described locking and unlocking methods, various methods may further exist as follows. Hereinafter, various embodiments of this will be described.

According to an embodiment of the present invention, the lock processing of the storage device for backup is executed only when a preset lock command (ex. a lock command using the freeze command) is manually input (i.e., changes to read-only). It can be done, but it can also be automatically executed according to a predetermined condition. For example, if the file event coming from the client program installed in the user terminal to the network drive is a file/folder creation event (ex.create event), the file/folder creation event (ex.create event) is allowed to be created, and then the file/folder close event (ex.close). When an event) comes in, a method of automatically executing lock processing for the file/folder may be applied.

Here, as a C function that generates an I/O event that closes a file handle, the following two C functions can be used representatively when using Windows OS.

int fclose(FILE *stream)

BOOL CloseHandle(HANDLE hObject)

Also, here, as the C function that generates the I/O event that closes the file handle, the following C function can be used as a representative when using Linux / Unix OS.

int close(int fd)

When the program calls the API that closes the file handle as above, an I/O event that closes the file handle occurs, and this event is delivered to the file system. In this case, Windows can detect this I/O by Callback File System (File System Driver), and Linux can detect this I/O through FUSE.

Also, when a specific application ends with the File Handle open, the File Handles that are forcibly opened by the OS are generally closed, and the same event I/O occurs at this time as well.

The functions described above are those used in the C language, and there are separate functions for closing file handles for each language. All of these functions generate an event that closes the file handle with the file system.

Also, in the above, a method of making data stored in a backup storage device read-only or releasing read-only in a folder unit through on/off selection using a hardware switch, etc. has been mainly described. A method of automatically changing to a read-only mode by detecting a termination event may be adopted, but a method in which the disk initialization is not operated even when an initialization command for the corresponding disk is issued may be applied when the hardware switch is turned on.

Although the above has been described with reference to the embodiments of the present invention, those of ordinary skill in the relevant technical field variously modify the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. And it will be easily understood that it can be changed.

Claims (7)

As a server system for blocking ransomware attacks,
A storage device for backup, which is a separate storage device that is physically independent from the server and has a purpose for backing up data stored in the server, and includes a communication interface for enabling communication connection with the server; And a service agent installed in the server to mediate communication with the backup storage device,
In a state in which the backup storage device is storage-mounted on the server, after data backup to the backup storage device for the storage data in the server is processed, there is a lock command for the backup data that has been backed up to the backup storage device. Occation,
The backup storage device locks the corresponding backup data according to the lock command to process the locked backup data to be provided only in a read-only mode that cannot be modified.
The method of claim 1,
Data backup to the backup storage device,
Only when a backup command for storage data in the server is made, the service agent transfers the backup command received to the server to the backup storage device, and the backup storage device transfers the storage data according to the received backup command. Ransomware attack blocking system, characterized in that processed by backing up.
The method of claim 1,
The backup storage device,
When the data modification command received to the server is transmitted from the service agent, it is checked whether the target data of the data modification command is related to the locked backup data, and is a data modification command related to the locked backup data. Ransomware attack blocking system that rejects the data modification command if it is found to be.
The method of claim 3,
The backup storage device,
When the target data of the data modification command is the locked backup data, data related to the corresponding backup data received from the other storage device even when the locked backup data is storage mounted on a storage device different from the server A ransomware attack blocking system that rejects modification commands and processes that backup data is provided only in read-only mode.
The method of claim 1,
The backup storage device,
Including a hardware switch or a software switch for releasing the lock processing state set in the backup data,
Even when the unlock command for the locked backup data is transmitted through the service agent, when the change to the unlock state is not made through the operation change of the hardware switch or the software switch, the unlock command Deny processing, ransomware attack blocking system.
The method of claim 5,
The backup storage device,
When switching to the unlocked state is made through the hardware switch or the software switch, releasing a read-only mode for the backup data according to the lock processing state, and converting the backup data into a data modification state, Ransomware attack blocking system.
The method of claim 6,
The conversion to the unlocked state is characterized in that any one of a batch release method performed on all of the data backed up in the backup storage device and a selection release method performed only on the requested backup data can be selected. system.

Images