File protection method and system utilizing class distribution and sequential memory storage - Patent 7222267

Abstract

To provide a method and system for protecting a file using class dispersion and sequential memory storage.SOLUTION: A file and method for protecting a file generates a plurality of class groups by distributing classes of an original executable file included in a package file; makes at least one of the plurality of class groups verify the integrity of the current class group and / or the class group that called the current class group while the plurality of class groups are stored in memory in any order at the time when the original executable file is requested to be executed; and thus can prevent a protection code from being bypassed to the executable file.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The following description relates to a file protection method and system utilizing class distribution and sequential memory storage. [Background technology]

[0002] Given a program (binary or source code), analyzing and understanding how that program operates is called "reverse engineering." Companies that sell finished products (binary files) hope that their products, which contain their company's technology, will not be easily reverse-engineered. Various techniques for obfuscating program code exist to make reverse engineering difficult. Examples include adding meaningless logic or code to the source code or encrypting or encoding data such as strings contained in the source code. Another example involves modifying the format of an executable file or assembly code to make it difficult to interpret code sections in the final executable file. Patent Document 1 (Patent Document 1) relates to an application code obfuscation device and method, and discloses applying obfuscation to applications running on a Java Virtual Machine by modifying the code structure that constitutes the application. In other words, the above-mentioned prior art discloses an example of obfuscation performed by modifying the assembly code of a built application.

[0003] In this case, in the prior art, classes to be protected within a package file (for example, Java classes of an APK (Android Application Package) in an Android OS (operating system) environment) are generated in the form of an executable file (for example, a dex file), at least a portion of the executable file (for example, the classes to be protected) is encrypted (or obfuscated) so that it cannot be recognized, and protection code that can restore and protect at least the encrypted portion is added and recorded. Thereafter, the protection code is executed when the executable file is executed, and at least a portion of the encrypted code of the executable file is restored and recorded in a temporary file, which is then stored in memory, thereby protecting the classes that existed within the package file.

[0004] However, because a protected executable file must exist in a restored state at any given time, there is a problem in that if the restored class is extracted and the exposed protection code is removed and then replaced, the protection code for the executable file can be easily circumvented and it can be made to operate only with the original class. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Korean Patent No. 10-1328012 Summary of the Invention [Problem to be solved by the invention]

[0006] Provided are a file protection method and system that can prevent circumvention of protection code for an executable file by distributing classes of an original executable file contained in a package file to generate a plurality of class groups, storing the plurality of class groups in memory in an arbitrary order at the time execution of the original executable file is requested, and having at least one of the plurality of class groups verify the integrity of the current class group and / or the class group that called the current class group. [Means for solving the problem]

[0007] A file protection method for a computer device including at least one processor is provided, the file protection method including: a step of extracting classes from an executable file of a package file by the at least one processor; a step of classifying the extracted classes into a plurality of class groups by the at least one processor; a step of adding a storage code to at least one first class group of the plurality of class groups such that the plurality of class groups are stored in memory in an arbitrary order when the package file is executed by the at least one processor; a step of adding an integrity code to at least one second class group of the plurality of class groups by the at least one processor, the integrity code being used to verify the integrity of the class group and at least one previous class group that called the class group by using the storage code; and a step of regenerating the package file by the at least one processor using the plurality of class groups to which the storage code and the integrity code have been added.

[0008] According to one aspect, the classifying step may be characterized by designating each of the extracted classes as a protected class or a non-protected class, and classifying the extracted classes into a class group of the protected classes and a class group of the non-protected classes.

[0009] According to another aspect, the classifying step may be characterized by further classifying the class groups of the protection classes into two or more class groups.

[0010] According to another aspect, the classifying step may be characterized by encrypting the protection class or a class group of the protection class.

[0011] According to another aspect, adding the storage code may be characterized by adding the storage code to a static initialization function of any class included in the first class group.

[0012] According to another aspect, the step of adding the integrity code may be characterized by adding to the second class group an integrity detection code that changes when the package file is regenerated, and an integrity verification code for determining whether the class group including the integrity detection code has been tampered with based on the change in the integrity detection code.

[0013] According to another aspect, the integrity detection code may be characterized by including at least one function of a function whose bytecode has been modified to terminate abnormally and a function whose bytecode has been modified to use a registry size that exceeds an available range, and including another class that is not actually called.

[0014] According to another aspect, the step of adding the integrity code may be characterized by controlling a computer device that installs and executes the package file to access integrity information for the second class group present in an external system, and adding an integrity verification code to the second class group to determine whether the corresponding second class group has been tampered with using the integrity information.

[0015] According to another aspect, the step of adding the integrity code may further include adding a protection code to the second class group.

[0016] According to another aspect, the step of adding the protection code may be characterized by adding code that performs at least one of an anti-disassembler operation, an anti-decompiler operation, and an anti-debugger operation to a protection class or any function or class included in a class group of the protection class as the protection code.

[0017] According to yet another aspect, the step of adding the integrity code may be characterized by adding a protection class including the integrity code and the protection code to the second class group.

[0018] Provided is a file protection method for a computer device including at least one processor, the file protection method including: a step of storing, by the at least one processor, a first class group among a plurality of class groups included in a package file in a memory; a step of restoring, by the at least one processor, an encrypted second class group among the plurality of class groups in the memory in accordance with the storage code included in the first class group; a step of specifying, by the at least one processor, executable file information related to the second class group restored in the memory so that it can be recognized by a class loader of a system included in the computer device in accordance with the storage code included in the first class group; a step of restoring, by the at least one processor, an encrypted third class group among the plurality of class groups in the memory in accordance with the storage code included in the restored second class group; and a step of specifying, by the at least one processor, the executable file information related to the third class group restored in the memory so that it can be recognized by a class loader of a system included in the computer device in accordance with the storage code included in the second class group.

[0019] A computer program is provided that causes a computer device to execute the method.

[0020] A computer-readable recording medium is provided, on which a program for causing a computer device to execute the method is recorded.

[0021] A computer apparatus is provided, comprising at least one processor implemented to execute computer-readable instructions, wherein the at least one processor extracts classes from an executable file of a package file, classifies the extracted classes into a plurality of class groups, adds storage code to at least a first class group of the plurality of class groups such that the plurality of class groups are stored in memory in an arbitrary order when the package file is executed, adds integrity code to at least a second class group of the plurality of class groups, the integrity code being used to verify the integrity of the class group itself and at least one previous class group that called the class group itself using the storage code, and regenerates the package file using the plurality of class groups to which the storage code and the integrity code have been added. [Effects of the Invention]

[0022] By distributing the classes of the original executable file contained in the package file to generate a plurality of class groups, and at the time when execution of the original executable file is requested, the plurality of class groups are stored in memory in any order, and at least one of the plurality of class groups verifies the integrity of the current class group and / or the class group that called the current class group, thereby preventing circumvention of the protection code for the executable file. [Brief explanation of the drawings]

[0023] [Figure 1] FIG. 1 illustrates an example of a network environment in accordance with an embodiment of the present invention. [Figure 2] FIG. 1 is a block diagram illustrating an example of a computing device according to an embodiment of the present invention. [Figure 3] 1 is a flow chart illustrating an example method for protecting files, in accordance with an embodiment of the present invention. [Figure 4] FIG. 10 illustrates an example process for regenerating a package file in accordance with an embodiment of the present invention. [Figure 5] 10 is a flowchart illustrating another example of a file protection method according to an embodiment of the present invention. [Figure 6] FIG. 10 is a diagram illustrating an example of a process for storing execution code in a memory in an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0024] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings.

[0025] A file protection system according to an embodiment of the present invention may be realized by at least one computer device, and a file protection method according to an embodiment of the present invention may be executed by at least one computer device included in the file protection system. A computer program according to an embodiment of the present invention may be installed and executed in the computer device, and the computer device may execute the file protection method according to an embodiment of the present invention under the control of the computer program being executed. The computer program may be recorded on a computer-readable recording medium in combination with the computer device to cause the computer device to execute the file protection method.

[0026] FIG. 1 is a diagram showing an example of a network environment in one embodiment of the present invention. The network environment in FIG. 1 shows an example including multiple electronic devices 110, 120, 130, and 140, multiple servers 150 and 160, and a network 170. FIG. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited to those shown in FIG. 1. Furthermore, the network environment in FIG. 1 is merely an example of an environment applicable to this embodiment, and environments applicable to this embodiment are not limited to the network environment in FIG. 1.

[0027] The electronic devices 110, 120, 130, and 140 may be fixed or mobile terminals implemented by computers. Examples of the electronic devices 110, 120, 130, and 140 include smartphones, mobile phones, navigation systems, personal computers (PCs), notebook PCs, digital broadcasting terminals, personal digital assistants (PDAs), portable multimedia players (PMPs), and tablets. While FIG. 1 illustrates a smartphone as an example of the electronic device 110, in embodiments of the present invention, the electronic device 110 may represent one of a variety of physical computer devices capable of communicating with the other electronic devices 120, 130, and 140 and / or the servers 150 and 160 via the network 170 using a substantially wireless or wired communication method.

[0028] The communication method is not limited, and may include not only communication methods using communication networks (for example, a mobile communication network, a wired Internet, a wireless Internet, and a broadcast network) that can be included in network 170, but also short-range wireless communication between devices. For example, network 170 may include any one or more of networks such as a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), and the Internet. Furthermore, network 170 may include any one or more of network topologies including, but not limited to, a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or hierarchical network, etc.

[0029] Each of the servers 150, 160 may be realized by one or more computer devices that communicate with multiple electronic devices 110, 120, 130, 140 via the network 170 to provide instructions, code, files, content, services, etc. For example, the server 150 may be a system that provides services (such as a file distribution service, a map service, a content provision service, a group call service (or an audio conference service), a messaging service, an email service, a social networking service, a translation service, a financial service, a payment service, a search service, etc.) to multiple electronic devices 110, 120, 130, 140 connected via the network 170.

[0030] 2 is a block diagram showing an example of a computer device according to an embodiment of the present invention. Each of the electronic devices 110, 120, 130, and 140 and each of the servers 150 and 160 described above may be realized by a computer device 200 shown in FIG.

[0031] As shown in FIG. 2 , such a computer device 200 may include a memory 210, a processor 220, a communication interface 230, and an input / output interface 240. The memory 210 is a computer-readable storage medium and may include random access memory (RAM), read-only memory (ROM), and a persistent mass storage device such as a disk drive. The persistent mass storage device such as a ROM or a disk drive may be included in the computer device 200 as a separate persistent storage device distinct from the memory 210. The memory 210 may also store an operating system and at least one program code. Such software components may be loaded into the memory 210 from a computer-readable storage medium separate from the memory 210. Such separate computer-readable storage medium may include a computer-readable storage medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, or a memory card. In another embodiment, the software components may be loaded into the memory 210 through a communication interface 230, which is not a computer-readable storage medium. For example, the software components may be loaded into the memory 210 of the computing device 200 based on a computer program installed by a file received over the network 170 .

[0032] Processor 220 may be configured to process computer program instructions by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to processor 220 by memory 210 or by communication interface 230. For example, processor 220 may be configured to execute instructions received according to program code stored in a storage device such as memory 210.

[0033] The communication module 230 may provide a function for the computer device 200 to communicate with other devices (e.g., the above-mentioned storage device) via the network 170. For example, requests, instructions, data, files, etc. generated by the processor 220 of the computer device 200 in accordance with program code stored in a storage device such as the memory 210 may be transmitted to other devices via the network 170 under the control of the communication interface 230. Conversely, signals, instructions, data, files, etc. from other devices may be received by the computer device 200 via the communication interface 230 of the computer device 200 via the network 170. The signals, instructions, data, etc. received via the communication module 230 may be transmitted to the processor 220 or the memory 210, and files, etc. may be recorded on a storage medium (e.g., the above-mentioned permanent storage device) that the computer device 200 may further include.

[0034] The input / output interface 240 may be a means for interfacing with the input / output device 250. For example, the input device may include a device such as a microphone, keyboard, or mouse, and the output device may include a device such as a display or speaker. As another example, the input / output interface 240 may be a means for interfacing with a device that integrates input and output functions into one, such as a touch screen. The input / output device 250 may be configured as a single device together with the computer device 200.

[0035] Also, in other embodiments, computing device 200 may include fewer or more components than those shown in Figure 2. However, most prior art components need not be explicitly shown in the figures. For example, computing device 200 may be implemented to include at least some of the input / output devices 250 described above, and may further include other components such as a transceiver, a database, etc.

[0036] FIG. 3 is a flowchart illustrating an example of a file protection method according to an embodiment of the present invention. The file protection method according to this embodiment may be performed by a computer device 200 that implements a system of a party (e.g., an application distributor) that intends to provide a package file to a user. In this case, a processor 220 of the computer device 200 may be implemented to execute control instructions provided by operating system code and at least one computer program code stored in a memory 210. Here, the processor 220 may control the computer device 200 to perform steps 310 to 350 included in the method of FIG. 3 according to the control instructions provided by the code stored in the computer device 200.

[0037] In step 310, the computing device 200 may extract classes from the executable file of the package file. In one embodiment, the package file may include an APK (Android Application Package) file in an Android OS (Operating System) environment, the executable file may include a dex file, and the classes may include, but are not limited to, Java classes.

[0038] In step 320, the computer device 200 may classify the extracted classes into multiple class groups. As an example, the computer device 200 may designate each extracted class as a protected class or a non-protected class and classify the extracted classes into a class group of protected classes and a class group of non-protected classes. Depending on the embodiment, the computer device 200 may further classify a class group of protected classes into two or more class groups. For example, the computer device 200 may separate inner classes within any protected class into a separate class group and / or separate anonymous classes within any protected class into a separate class group, thereby further classifying classes for the protected classes into two or more class groups. As another example, the computer device 200 may classify subordinate classes included in a specific package unit in any order. For example, when developing a package file, related classes may be bundled together in a specific package unit and related code may be maintained and developed together. In this case, distributing classes within a specific package unit can more securely protect related logic.

[0039] The class of executable files may be classified into one non-protected class group and one or more protected class groups, and the computer device 200 may encrypt the protected class or class group of protected classes.

[0040] In step 330, the computer device 200 may add storage code to at least one first class group of the plurality of class groups, such that the plurality of class groups are stored in memory in an arbitrary order when the package file is executed, where the first class group may be any of the remaining class groups excluding the class group that is stored last among the plurality of class groups.

[0041] On the other hand, the memory may be memory included in a physical device on which the package file is executed. The physical device may be the computer device 200 according to this embodiment, or may be another device on which the package file distributed by the computer device 200 is installed and executed.

[0042] In this case, the computer device 200 may arbitrarily set a storage order for the classified groups, and then add a storage code to the first class group so that, when the package file is executed, the groups are stored in memory in order according to the storage order. For example, when the package file is executed, an executable file including class group 1 of the unprotected class may be stored in memory first, and the next class group 2 may be stored in memory according to the storage code added to the stored class group 1. The next class group 2 may then store the next class group 3 in memory, and so on. The storage of class groups may be repeated in order until all class groups are stored in memory. The last class file does not need to include a storage code because there is no additional class file to store.

[0043] On the other hand, since the protected class or class group of the protected class is encrypted, the storage code may then include code for decrypting the encrypted class group and storing it in memory.

[0044] Additionally, the computer device 200 may add storage code to the static initialization function of any class included in the first class group.

[0045] In step 340, the computer device 200 may add, to at least one second class group of the plurality of class groups, an integrity code that verifies the integrity of the class group itself and at least one of the previous class groups that called the class group itself by the stored code. For example, to the above-mentioned class group 3, an integrity code that verifies the integrity of the class group 3 and at least one of the class group 2, which is the previous class group that called the class group 3, may be added.

[0046] In step 340, the computer device 200 may add to the second class group an integrity detection code that is modified when the package file is regenerated, and an integrity verification code for determining whether the class group including the integrity detection code has been tampered with based on the modification of the integrity detection code. Here, the integrity detection code may include at least one function of a function whose bytecode is modified to terminate abnormally and a function whose bytecode is modified to use a registry size that exceeds the available range, and may also include another class that is not actually called while the integrity is being corrected. If integrity is compromised, the integrity detection code may execute the above-mentioned class and terminate abnormally or use a registry size that exceeds the available range, thereby causing the code to malfunction. However, this is merely an example, and it goes without saying that the present invention can be extended to all types of bytecode modifications to prevent executable code from malfunctioning when integrity is compromised.

[0047] In one embodiment, the integrity verification code included in class group 3 may determine whether class group 2 and / or class group 3 have been tampered with based on the integrity detection code included in class group 2 and / or class group 3. In another embodiment, in step 340, the computer device 200 may control a computer device that installs and executes the package file to access integrity information for the second class group present in an external system, and add an integrity verification code to the second class group to determine whether the second class group has been tampered with using the integrity information. The computer device here may refer to a physical device that installs and executes the package file, unlike the computer device 200 of this embodiment.

[0048] Meanwhile, depending on the embodiment, the computer device 200 may further add protection code to the second class group. For example, the computer device 200 may add code that performs at least one of an anti-disassembler operation, an anti-decompiler operation, and an anti-debugger operation as protection code to any function or class included in the protection class or the class group of the protection class.

[0049] In this case, depending on the embodiment, the computer device 200 may add a protection class including the integrity code and the protection code to the second class group. In other words, the integrity verification code included in the integrity code and the above-mentioned protection code may be included in one protection class, and such protection class may be added to the second class group. Depending on the embodiment, the integrity verification code or a call code for calling the integrity verification code within the protection class may be added to any class. For example, the computer device 200 may add the integrity verification code or the call code for the integrity verification code to any non-protection class. As another example, the computer device 200 may add the integrity verification code or the call code for the integrity verification code to any class in each of the classified class groups or to any class in some of the classified class groups. In this case, the integrity verification code or the call code for the integrity verification code may be added to a static initialization function of the corresponding class.

[0050] The protection codes of the protection classes added to the second class group may be the same code for each protection class, may be different codes for at least two or more protection classes, or may be different codes for all protection classes.

[0051] In step 350, the computing device 200 may regenerate a package file using the plurality of class groups to which the storage code and integrity code have been added. The regenerated package file may be distributed to computing devices that install and execute the package file. When the package file is executed on each computing device, the class groups may be stored in the memory of the computing device in any order based on the storage code, and the integrity code is used to verify the integrity for the computing device itself and the called party, thereby preventing users from circumventing the protection code.

[0052] FIG. 4 illustrates an example of a process for regenerating a package file in an embodiment of the present invention. FIG. 4 illustrates an example in which multiple classes 420 are extracted from an executable file 411 included in a package file 410. The extracted multiple classes 420 may be classified into multiple class groups, and at least some of the class groups may be encrypted. Here, the encrypted class groups may be class groups of protected classes. FIG. 4 also illustrates an example in which each class group is composed of a separate executable file (executable file 1 (431), encrypted executable file 2 (432), and encrypted executable file 3 (433)). In the embodiment of FIG. 4, a protection code 1 (442) is added to each of executable file 1 (431), encrypted executable file 2 (432), and encrypted executable file 3 (433), and a storage code 1 (441) is added to executable file 1 (431), and a storage code 2 (443) is added to encrypted executable file 3 (433). In this embodiment, the protection code 1 (442) may include the protection code and the integrity code described with reference to FIG. 3. In this case, the storage order of the executable files may be executable file 1 (431), encrypted executable file 3 (433), and encrypted executable file 2 (432). For example, after executable file 1 (431) is stored in memory, executable file 1 (431) may restore executable file 3 (433) encrypted with storage code 1 (441) and store it in memory. Also, encrypted executable file 3 (433) may restore executable file 2 (432) encrypted with storage code 2 (442) and store it in memory.

[0053] 5 is a flowchart illustrating another example of a file protection method according to an embodiment of the present invention. The file protection method according to this embodiment may be performed by a computer device 200 that installs and executes a package file. In this case, the processor 220 of the computer device 200 may be configured to execute control instructions provided by operating system code and at least one computer program code stored in the memory 210. Here, the processor 220 may control the computer device 200 to perform steps 510 to 550 included in the method of FIG. 5 according to the control instructions provided by the code stored in the computer device 200.

[0054] In step 510, the computer device 200 may store a first class group of the plurality of class groups included in the package file in the memory 210. As an example, the class group of the non-protected classes may be stored in the memory 210 first.

[0055] In step 520, the computer device 200 may restore the encrypted second class group of the plurality of class groups on the memory 210 according to the storage code included in the first class group. For example, when the first class group is stored in the memory 210 and executed, thereby executing the storage code, the computer device 200 may restore and store the second class group on the memory 210 according to the storage code.

[0056] In step 530, the computer device 200 may specify executable file information for the second class group restored in memory according to the stored code included in the first class group so that a class loader of a system included in the computer device 200 can recognize it. In other words, the computer device 200 may specify executable file information for the second class group so that the class loader can recognize that the second class group stored in the memory 210 is an executable file.

[0057] In step 540, the computer device 200 may restore the encrypted third class group of the plurality of class groups to memory according to the storage code included in the restored second class group. For example, when the second class group is stored in the memory 210 and executed, thereby executing the storage code, the computer device 200 may restore and store the third class group to memory 210 according to the storage code.

[0058] In step 550, the computer device 200 may specify, according to the stored code included in the second class group, executable file information related to the third class group restored on the memory 210 so that a system class loader included in the computer device can recognize it.

[0059] In this manner, all class groups in the computing device 200 package file may be stored in memory 210 in any order.

[0060] In step 560, the computing device 200 may verify the integrity of at least one of the first class group, the second class group, and the third class group according to the integrity code included in at least one of the second class group and the third class group. For example, the second class group may include an integrity code for verifying the integrity of the first class group and / or the second class group, or the third class group may include an integrity code for verifying the integrity of the second class group and / or the third class group.

[0061] In this way, even if any user bypasses the protection code and obtains the restored class stored in memory, the restored class group verifies the integrity of itself and / or the class group that called it, so the user will not be able to bypass the protection code and execute the package file.

[0062] On the other hand, the encrypted file can be restored and stored as a temporary file, and then the restored temporary file can be stored in memory. Alternatively, the encrypted file can be restored and immediately stored in memory using a function provided by the operating system.

[0063] FIG. 6 is a diagram illustrating an example of a process for storing executable code in memory in an embodiment of the present invention. FIG. 6 illustrates a process for storing executable files (executable file 1 (431), encrypted executable file 2 (432), and encrypted executable file 3 (433)) in memory 610 when executing the protected package file 430, as described with reference to FIG. 4. First, after executable file 1 (431) is stored in memory 610, executable file 1 (431) may be protected by protection code 1 (442), and executable file 3 (433) encrypted by storage code 1 (441) may be restored and stored in memory 610. At this time, encrypted executable file 3 (433) may be protected by protection code 1 (442), and executable file 2 (432) encrypted by storage code 2 (443) may be restored and stored in memory 610. Encrypted executable file 2 (432) may also be protected by protection code 1 (442). As described above, even if any user bypasses the protection code and obtains the restored class stored in memory, the restored class group verifies the integrity of itself and / or the class group that called it, so the user will not be able to bypass the protection code and execute the package file.

[0064] Thus, according to an embodiment of the present invention, the classes of the original executable file contained in the package file are distributed to generate multiple class groups, and the multiple class groups are stored in memory in any order at the time execution of the original executable file is requested, and at least one of the multiple class groups verifies the integrity of the current class group and / or the class group that called the current class group, thereby preventing circumvention of the protection code for the executable file.

[0065] The above-described systems or devices may be realized using hardware components or a combination of hardware and software components. For example, the devices and components described in the embodiments may be realized using one or more general-purpose or special-purpose computers, such as a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the OS. The processing device may also access, store, manipulate, process, and generate data in response to the execution of software. For ease of understanding, a single processing device may be described. However, those skilled in the art will understand that a processing device may include multiple processing elements and / or multiple types of processing elements. For example, a processing device may include multiple processors or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0066] Software may include computer programs, codes, instructions, or a combination of one or more of these, and may configure a processing device to operate as desired or may independently or collectively instruct the processing device. The software and / or data may be embodied in any type of machine, component, physical device, virtual device, computer storage medium, or device to be interpreted by the processing device or to provide instructions or data to the processing device. The software may be distributed and stored and executed in a distributed manner across computer systems connected by a network. The software and data may be stored on one or more computer-readable recording media.

[0067] Methods according to embodiments may be implemented in the form of program instructions executable by various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The medium may continuously store a computer-executable program or temporarily store it for execution or download. Furthermore, the medium may be a variety of recording or storage means, including a single or multiple hardware devices, and is not limited to media directly connected to a computer system but may also be distributed over a network. Examples of media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; ROM, RAM, flash memory, and the like, configured to store program instructions. Other examples of media include recording media or storage media managed by application stores, other software distribution sites, servers, and the like. Examples of program instructions include not only machine language code, such as that generated by a compiler, but also high-level language code executed by a computer using an interpreter or the like.

[0068] Although the embodiments have been described above based on limited examples and drawings, those skilled in the art will appreciate that various modifications and variations may be made from the above description. For example, the described techniques may be performed in an order different from that described, and / or the described system, structure, device, circuit, or other element may be coupled or combined in a manner different from that described, or may be substituted or replaced by other elements or equivalents, and still achieve suitable results.

[0069] Therefore, different embodiments that are equivalent to the claims are within the scope of the appended claims. [Explanation of symbols]

[0070] 410:Package file 420: Class 430: Protected package file

Claims

1. 1. A method for protecting files in a computer device including at least one processor, comprising: extracting classes from executable files in a package file by the at least one processor; said at least one processor classifying said extracted classes into a plurality of class groups; adding storage code to at least a first class group of the plurality of class groups by the at least one processor such that the plurality of class groups are stored in memory in an arbitrary order upon execution of the package file; adding, by the at least one processor, to at least one second class group of the plurality of class groups, an integrity code that verifies the integrity of the second class group and at least one of a previous class group that invoked the second class group with the stored code; and and regenerating the package file using the plurality of class groups to which the storage code and the integrity code have been added by the at least one processor. file protection methods, including:

2. The classifying step comprises:

2. The file protection method of claim 1, further comprising the steps of: designating each of the extracted classes as a protected class or a non-protected class; and classifying the extracted classes into a class group of the protected classes and a class group of the non-protected classes.

3. The classifying step comprises:

3. The file protection method according to claim 2, wherein the class group of the protection classes is further classified into two or more class groups.

4. The classifying step comprises:

4. The file protection method according to claim 2, wherein the protection class or a class group of the protection class is encrypted.

5. The step of adding the storage code comprises:

5. The file protection method according to claim 1, wherein the stored code is added to a static initialization function of any class included in the first class group.

6. The step of adding the integrity code comprises: The file protection method of any one of claims 1 to 5, characterized in that an integrity detection code that changes when the package file is regenerated and an integrity verification code for determining whether the class group including the integrity detection code has been tampered with based on the change in the integrity detection code are added to the second class group.

7. The file protection method of claim 6, wherein the integrity detection code includes at least one function of a function whose bytecode has been modified to terminate abnormally and a function whose bytecode has been modified to use a registry size that exceeds an available range, and includes another class that is not actually called.

8. The step of adding the integrity code comprises: The file protection method according to any one of claims 1 to 5, characterized in that a computer device that installs and executes a package file is controlled to access integrity information for the second class group present in an external system, and an integrity verification code is added to the second class group using the integrity information to determine whether the corresponding second class group has been tampered with.

9. The step of adding the integrity code comprises: adding further protection codes to said second class group; A file protection method according to any one of claims 1 to 8, characterized in that:

10. The classifying step comprises: designating each of the extracted classes as a protected class or a non-protected class, and classifying the extracted classes into a class group of the protected classes and a class group of the non-protected classes; The step of adding the integrity code comprises: adding a further protection code to the second class group; The step of adding the protection code comprises:

2. The file protection method of claim 1, wherein code that performs at least one of an anti-disassembler operation, an anti-decompiler operation, and an anti-debugger operation is added as the protection code to a protection class or any function or class included in a class group of the protection class.

11. The step of adding the integrity code comprises:

10. The file protection method according to claim 9, wherein a protection class including said integrity code and said protection code is added to said second class group.

12. 1. A method for protecting files in a computer device including at least one processor, comprising: storing, by the at least one processor, in a memory, a first class group of a plurality of class groups included in a package file; a step of restoring, by the at least one processor, an encrypted second class group among the plurality of class groups on a memory according to a stored code included in the first class group; a step of specifying, by the at least one processor, executable file information relating to the second class group restored on the memory in accordance with stored code included in the first class group so that it can be recognized by a class loader of a system included in the computer device; a step of restoring, by the at least one processor, an encrypted third class group of the plurality of class groups on a memory according to a stored code included in the restored second class group; a step in which the at least one processor specifies executable file information relating to the third class group restored on the memory in accordance with the stored code included in the second class group so that the executable file information can be recognized by a class loader of a system included in the computer device; file protection methods, including:

13. verifying, by the at least one processor, the integrity of at least one of the first class group, the second class group, and the third class group according to an integrity code included in at least one of the second class group and the third class group; The file protection method of claim 12, further comprising:

14. A computer program causing a computer device to carry out the method according to any one of claims 1 to 13.

15. A computer-readable recording medium having recorded thereon a computer program for causing a computer device to execute the method according to any one of claims 1 to 13.

16. At least one processor implemented to execute computer-readable instructions Including, the at least one processor: Extract the classes from the executable file in the package file, classifying the extracted classes into a plurality of class groups; adding storage code to at least a first class group of the plurality of class groups such that the plurality of class groups are stored in memory in an arbitrary order upon execution of the package file; adding to at least one second class group of the plurality of class groups an integrity code that verifies the integrity of the second class group and at least one previous class group that invoked the second class group with the stored code; regenerating the package file using the plurality of class groups to which the storage code and the integrity code have been added; A computer device comprising:

Images