Computing apparatus and method for executing policies based on a file list in a sandbox environment

Abstract

A computing device and method for executing a policy based on a file list are disclosed, which can receive and interpret policy information by utilizing a function to query a list of files allowed in a sandbox. According to one aspect, the computing device comprises a processor and a memory that stores instructions executed by the processor. The memory stores instructions of a sandbox application running in a sandbox environment, instructions of a hooking module loaded and operating inside the sandbox application, and instructions of a security agent operating outside the sandbox. The security agent encodes original policy data into a string and creates a policy delivery file having the encoded string as a filename within a policy folder of a file system. The hooking module performs a file list query for the policy folder of the file system to collect the filename of the policy delivery file and restores the original policy data based on the collected filename.

Description

Technology Field

[0001] The present invention relates to security control technology for applications, and more specifically, to a computing device and method for executing policies based on a file list in a sandbox environment. Background Technology

[0002] Generally, in order to perform security such as behavior control, output control, and media control of user terminals in enterprise environments, application programs must continuously receive security policies from external security modules (or policy agents). Existing policy delivery methods have a structure in which, when an external security module generates a configuration file containing structured policy data such as JSON or XML, the application program either directly reads the contents of the configuration file or receives the policy through inter-process communication (IPC) such as shared memory, named pipes, or sockets.

[0003] Recently, to prevent malware infection and unauthorized modification of system files, major applications such as Adobe Acrobat, Google Chrome, and Microsoft Edge have adopted a structure in which they run in an isolated security environment called a sandbox. Applications running in a sandbox environment operate with strictly limited permissions granted at the executable file level, and for system security, the path for data exchange with external processes is fundamentally blocked.

[0004] Therefore, in a sandbox environment, directly reading the contents of policy files outside the executable or communicating with external processes is considered a serious threat by the sandbox security model and is strictly blocked. In other words, since sandbox permissions are vested in the executable file itself, applications cannot access the policy sharing structure; consequently, a critical limitation exists in that applications in a sandbox environment can only perform the function of applying existing policies and cannot receive new policies or update them.

[0005] Due to these constraints, problems are emerging where new policies cannot be synchronized within applications in the sandbox environment whenever a policy changes, leading to security gaps or a significant increase in the complexity of policy management. Therefore, there is an urgent need for a new level of technical solution that can rapidly and flawlessly deliver and synchronize external policy data to applications within the sandbox environment without compromising the robust security constraint model required by the sandbox environment. The problem to be solved

[0006] The present invention is proposed to solve the aforementioned problems and aims to provide a computing device and method for executing a policy based on a file list, which can receive and interpret policy information by utilizing a function to look up a list of files allowed in a sandbox. means of solving the problem

[0007] According to one aspect, a computing device comprising a processor and a memory for storing instructions executed by said processor, wherein the memory stores instructions of a sandbox application running in a sandbox environment, instructions of a hooking module loaded and operating inside said sandbox application, and instructions of a security agent operating outside said sandbox, said security agent encodes original policy data into a string and creates a policy delivery file having said encoded string as a filename in a policy folder of a file system, and said hooking module performs a file list lookup for said policy folder of the file system to collect the filename of said policy delivery file and restores said original policy data based on said collected filename.

[0008] The security agent divides the encoded string into pre-set lengths and creates a plurality of policy delivery files having filenames that include each divided string and sequence number information, and the hooking module can restore the original policy data by sorting and combining the divided strings based on the sequence number information included in the filenames of the plurality of policy delivery files collected through the file list lookup.

[0009] The security agent creates a policy update notification file having an identification filename to notify of a policy update within the policy folder, changes the identification filename when the policy is changed, and the hooking module can restore the original policy data by collecting the filename of the policy delivery file when it detects a change in the identification filename of the policy update notification file through a lookup of the file list.

[0010] The above policy delivery file may have an empty or meaningless interior filled with data, and the original policy data may be included only in the filename itself.

[0011] A method for executing a policy based on a file list in a sandbox environment, performed by a computing device according to another aspect, comprises: encoding original policy data into a string outside the sandbox environment; creating a policy delivery file having the encoded string as a filename within a policy folder of a file system outside the sandbox environment; collecting the filename of the policy delivery file by performing a file list lookup for the policy folder of the file system inside the sandbox environment; and restoring the original policy data based on the collected filename inside the sandbox environment.

[0012] The generating step involves dividing the encoded string into pre-set lengths and generating a plurality of policy transmission files having filenames that include each divided string and sequence number information, and the restoring step involves sorting and combining the divided strings based on the sequence number information included in the filenames of the plurality of policy transmission files collected through the file list lookup to restore the original policy data.

[0013] The above method further includes the step of creating a policy update notification file having an identification filename to notify of a policy update within the policy folder outside the sandbox environment; and the step of changing the identification filename of the policy update notification file when the policy is changed, wherein the collecting step may be performed when the change of the identification filename of the policy update notification file is detected through the lookup of the file list.

[0014] The above policy delivery file may have an empty or meaningless interior filled with data, and the original policy data may be included only in the filename itself. Effects of the invention

[0015] This invention effectively transmits large volumes of policy data securely using only permitted permissions—file list lookup and filenames—without compromising the strict isolation security model of a sandbox environment. Through this, it completely bypasses sandbox restrictions and restores the original policy intact, without the need for IPC communication or file reading. Furthermore, it prevents security gaps by detecting policy updates in real-time and synchronizing immediately simply by renaming notification files. This structure can be applied universally to multiple heterogeneous sandboxes and general programs, maximizing consistency and scalability in policy management across enterprise security environments. Brief explanation of the drawing

[0016] FIG. 1 is a block diagram showing the overall software architecture of a computing device that executes a policy based on a file list in a sandbox environment according to one embodiment of the present invention. FIG. 2 is a diagram illustrating a security settings screen of an application that provides a sandbox environment to which an embodiment of the present invention is applied. FIG. 3 is a diagram illustrating an actual file list of policy delivery files generated according to an embodiment of the present invention and stored in a policy folder of a file system. FIG. 4 is a flowchart illustrating a method for a security agent according to an embodiment of the present invention to create a policy delivery file in a file system to deliver a policy to a sandbox environment. FIG. 5 is a flowchart illustrating a method in which a hooking module according to an embodiment of the present invention restores and applies policy data based on a file list in a sandbox environment. Specific details for implementing the invention

[0017] Hereinafter, embodiments disclosed in this specification will be described in detail with reference to the attached drawings. Identical or similar components regardless of drawing symbols will be assigned the same reference number, and redundant descriptions thereof will be omitted. The suffix "bu" used for components in the following description is assigned or used interchangeably solely for the ease of drafting the specification and does not have a distinct meaning or role in itself. Furthermore, in describing the embodiments disclosed in this specification, if it is determined that a detailed description of related prior art could obscure the essence of the embodiments disclosed in this specification, such detailed description will be omitted. Additionally, the attached drawings are intended only to facilitate understanding of the embodiments disclosed in this specification; the technical concept disclosed in this specification is not limited by the attached drawings, and it should be understood that they include all modifications, equivalents, and substitutions that fall within the spirit and technical scope of the present invention.

[0018] Terms including ordinal numbers, such as first, second, etc., may be used to describe various components, but said components are not limited by said terms. These terms are used solely for the purpose of distinguishing one component from another.

[0019] The singular expression includes the plural expression unless the context clearly indicates otherwise. In this application, terms such as "comprising" or "having" are intended to specify the existence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0020] For convenience of explanation in implementing the present invention, the components may be described in detail; however, these components may be implemented within a single device or module, or a single component may be divided and implemented across multiple devices or modules.

[0021] FIG. 1 is a block diagram showing the overall software architecture of a computing device that executes a policy based on a file list in a sandbox environment according to one embodiment of the present invention.

[0022] The computing device (100) is a terminal such as a user's PC. The computing device (100) may include memory, a memory controller, one or more processors (CPUs), peripheral interfaces, an input / output (I / O) subsystem, a display device, an input device, and a communication module. The memory may include high-speed random access memory and may also include one or more magnetic disk storage devices, non-volatile memory such as flash memory devices, or other non-volatile semiconductor memory devices.

[0023] Access to memory by other components, such as the processor and peripheral interfaces of the computing device (100), can be controlled by a memory controller. Referring to FIG. 1, the computing device (100) according to the present invention is configured to include a sandbox area (130) comprising a security agent (110), a file system (120), and a hooking module (132). Each layer and component can be implemented in software, hardware, or a combination thereof and operate organically with one another.

[0024] The security agent (110) operates in a user mode environment that is not subject to sandbox restrictions, like a general application, and is the entity that manages policies and generates policy data to be delivered inside the sandbox. The security agent (110) generates original policy data (e.g., JSON format) and stores it in a policy folder (121) of the file system (120). An example of a policy generation function is as follows.

[0025] MPolicy

[0026] MPolicyFMemory

[0027] The security agent (110) encodes the original policy data into a string (e.g., Base64), splits it into fixed lengths considering the maximum length of filenames allowed by the operating system, and then creates empty files in the file system (120) that have the split strings as filenames. An example of a string conversion function is as follows.

[0028] conv_Data2I64List

[0029] F64FPolicy

[0030] And the following is an example of a function that creates an empty file with a split string as the filename and cleans up existing empty files.

[0031] MSB_CreatePolicyFile

[0032] MSB_DeletePlicyToJsonMemory

[0033] The file system (120) is a data storage area provided on a physical or logical disk via the lower kernel layer of the operating system. The file system (120) is a storage area that can be commonly referenced by a security agent (110) not subject to sandbox restrictions and a sandbox application operating with strictly limited privileges, and is provided with a policy folder (121) inside. The policy folder (121) stores original policy data (121-1), a plurality of policy delivery files (121-3), and a policy update notification file (121-2).

[0034] The original policy data (121-1) is an original policy file generated by the security agent (110), and the multiple policy delivery files (121-3) are files accessed by the hooking module (132) derived from the original policy file by the security agent (110), and are files in which policy data is stored in the filename and the content is empty. The policy delivery files (121-3) exist on the file system (120) in the form of files with a file size of 0 or filled with meaningless dummy data, that is, in the form of empty files. Instead, information in which the original policy data is encoded into a secure string (e.g., Base64) is hidden within the filenames of these files. The strings created from the original policy data are divided into fixed lengths within the maximum filename length allowed by the operating system, and a sequence number (e.g., 001, 002, etc.) is assigned to the beginning of each divided string and assigned as the filename of each policy delivery file (121-3).

[0035] The policy update notification file (121-2) is a file that notifies of the update of policy data. The filename of the policy update notification file (121-2) is changed by the security agent (110) whenever the policy is updated. That is, whenever the policy is updated, the filename of the policy update notification file (121-2) is changed by the security agent (110) (e.g., firstfile ↔ secondfile), thereby notifying the hooking module (132) of the sandbox area (130) of the policy update.

[0036] The sandbox area (130) is an isolated security environment in which Inter-Process Communication (IPC) with external processes, access to shared memory, and direct reading and writing of external file contents are blocked to protect the operating system from malicious code. Sandbox applications (131) refer to processes such as Google Chrome (Chrome.exe), Microsoft Edge (MsEdge.exe), and Adobe Acrobat (Acrobat.exe) that run inside the sandbox area (130). These operate by being granted limited sandbox permissions on an executable file basis.

[0037] The hooking module (132) is an agent module that is loaded (e.g., via DLL injection) into the process of the sandbox application (131) and executes actual security policies such as output control, media control, and behavior control. Since the hooking module (132) also operates dependently on the sandbox application (131), it does not have the authority to read the contents of external policy files or communicate with the security agent (110). Therefore, the hooking module (132) receives data, particularly policy data, from an external system by utilizing only the file list lookup function for the only allowed directory, without violating the strict security model of the sandbox environment (130).

[0038] The hooking module (132) periodically queries the file list of the policy folder (121) located in the file system (120) or when a specific action of the sandbox application (131) occurs. The hooking module (132) detects whether the policy has been updated in real time by checking whether the filename (e.g., firstfile, secondfile, etc.) of the policy update notification file (121-2) existing in the policy folder (121) has changed through querying the file list.

[0039] When a policy update is detected, the hooking module (132) collects only the filenames of the policy delivery files (121-3) within the policy folder (121) and sorts them in order based on the sequence number information (e.g., 001, 002, etc.) assigned to the beginning of each filename. Then, the hooking module (132) extracts only the encoded string portions excluding the sequence numbers from the sorted filenames, combines them into a single continuous string, and then decodes (e.g., Base64 decoding) the original policy data (e.g., JSON format) in memory without any read access to the file contents and immediately applies it to the sandbox application (131).

[0040] FIG. 2 is a drawing illustrating a security settings screen of an application providing a sandbox environment to which an embodiment of the present invention is applied, and is a security settings screen of Adobe Acrobat.

[0041] Referring to FIG. 2, it can be seen that a general-purpose application (131), such as Adobe Acrobat, provides its own Sandbox protection (protected mode) function to protect the system from malware or hacking attacks. When the user enables protected mode in the settings (e.g., enable protected mode at startup), the application (e.g., Acrobat.exe) runs in a restricted privilege state (sandbox area) that is much more isolated than normal user mode.

[0042] As such, the process of an application (131) with sandbox mode enabled has its direct read / write permissions to the local file system (120) granted by the operating system, as well as its communication (IPC) permissions with external processes using named pipes, sockets, etc., severely restricted. In other words, the sandbox environment prevents external intrusion while strictly controlling data access from the inside to the outside.

[0043] Therefore, the hooking module (132) that is injected and operates inside the process of the above application (131) is also bound to be subject to this sandbox security policy, and the conventional method of receiving the policy by directly viewing the policy file (JSON) generated by the security agent (110) or by directly communicating with the security agent (110) is fundamentally blocked in an environment like FIG. 2.

[0044] As proposed in the present invention, it can be seen that only the method of utilizing a directory file list viewing function and a file name as a medium, which are the minimum permissions exceptionally allowed even in a sandbox environment (130), is a technical means to transmit external policy data internally under such strong security constraints.

[0045] FIG. 3 is a diagram illustrating an actual file list of policy delivery files generated according to an embodiment of the present invention and stored in a policy folder of a file system.

[0046] Referring to FIG. 3, it can be seen that within the policy folder (121) of the file system (120), there are multiple policy delivery files (121-3) generated by the security agent (110) and a policy update notification file (secondfile) (121-2) at the bottom.

[0047] The key feature to note in this file list is that, unlike the typical usage of file systems, the internal storage space (file contents) of these files is empty or filled with meaningless dummy data, and policy data is directly recorded only in the filenames themselves.

[0048] Looking at the structure of the filenames, index information, such as '0000', '0001', and '0002', is located at the beginning of each filename to strictly guarantee the assembly order of the data. Following the separator (e.g., '='), the actual string data (e.g., 'QnEvdi...', '2GlqyA...') is located, which is obtained by encoding the original JSON policy data using Base64 and splitting it to meet the operating system's maximum filename length limit specifications.

[0049] Additionally, 'secondfile' located at the bottom of the file list functions as the aforementioned policy update notification file (121-2). When the security agent (110) distributes a new policy, it deletes the existing files and creates new policy delivery files (121-3), and at the same time changes the name of this notification file (e.g., firstfile ↔ secondfile).

[0050] The hooking module (132) within the sandbox area (130) can collect policy data and check whether the policy is updated simply by viewing the file list in the directory as shown in FIG. 3, even if it has no permission to open the contents of the file. The hooking module (132) can extract only the encoded string parts based on the preceding sequence information from the collected filenames, sort and combine them in order, and then decode them again to reconstruct the original external policy data within the sandbox area (130).

[0051] FIG. 4 is a flowchart illustrating a method for a security agent according to an embodiment of the present invention to create a policy delivery file in a file system to deliver a policy to a sandbox environment. FIG. 4 is performed by a security agent (110) and, preferably, can be performed by at least one processor according to a program instruction of the security agent (110) stored in memory.

[0052] Referring to FIG. 4, in step S401, the security agent (110) generates original policy data (121-1) that defines policies (e.g., output control, media control, etc.) to be applied to the sandbox application (131). At this time, the original policy data may be a JSON file, etc., as previously described. The security agent (110) stores the original policy data (121-1) in the policy folder (121) of the file system (120).

[0053] In step S402, the security agent (110) encodes the generated original policy data (121-1) into a string that can be used as a filename. Since direct reading of file contents is blocked in the sandbox environment (130), it is desirable to encode the data into a string using an English and number-based Base64 encoding method that does not violate the naming rules of the file system (120).

[0054] In step S403, the security agent (110) divides the encoded string into pre-set fixed-length units, taking into account the maximum filename length allowed by the operating system (OS). Since there is a limit to the data capacity that can be contained in a single filename, this is a process of dividing the entire policy data into multiple pieces.

[0055] In step S404, the security agent (110) assigns a sequence number (Index, e.g., 0000, 0001, 0002, etc.) indicating the assembly order to the beginning of each split string so that the hooking module (132) inside the sandbox can subsequently parse and reassemble the original data in the correct order.

[0056] In step S405, the security agent (110) creates multiple policy delivery files (121-3) with physical or logical file contents filled with empty or meaningless data by setting the combination of the assigned sequence number and each divided string as a filename, and stores them in the policy folder (121).

[0057] By going through steps S401 to S405, the security agent (110) completes a unique data delivery system that can safely push large amounts of policy data into the sandbox solely through a directory of files, without direct communication (IPC) with the sandbox application (131) or external memory interference.

[0058] FIG. 5 is a flowchart illustrating a method for a hooking module according to an embodiment of the present invention to restore and apply policy data based on a file list in a sandbox environment. FIG. 5 is performed by a hooking module (132) and, preferably, can be performed by at least one processor according to a program instruction of the hooking module (132) stored in memory.

[0059] Referring to FIG. 5, in step S501, the hooking module (132) retrieves a list of policy delivery files (121-3) existing in the policy folder (121) of the file system (120) by utilizing the directory access rights that are uniquely allowed in the sandbox environment (130). At this time, the hooking module (132) does not read the internal data of the files, but collects only the filename string information of the files into memory through the file enumeration API provided by the operating system.

[0060] In step S502, the hooking module (132) checks the leading sequence number information indicating the assembly order of the data in each collected filename, extracts only the actual encoded string part excluding the sequence number and separator from each filename, and sorts them in ascending order based on the sequence number. This is an essential process to ensure the integrity of the original data, as the result of querying the file list of the operating system may not always guarantee the order.

[0061] In step S503, the hooking module (132) combines the extracted strings listed in order into one, reconstructing the complete encoded string before splitting in memory. In step S504, the hooking module (132) decodes the combined string using a preset method (e.g., Base64 decoding) to successfully restore the original policy data (e.g., JSON format) (121-1) in memory.

[0062] In step S505, the hooking module (132) parses the original policy data (121-1) restored to memory and converts it into an internal data structure, and then immediately applies it as an actual security policy (e.g., output control, clipboard control, file storage encryption, etc.) of the sandbox application (131) based on this.

[0063] Through steps S501 to S505, the hooking module (132) inside the sandbox can receive a large volume of updated policies in real time and synchronize them flawlessly without any direct communication with the external security agent (110) or access to file contents.

[0064] According to the embodiments of the present invention described above, it is possible to safely bypass sandbox security restrictions and deliver policies without defects. Instead of directly reading the contents of a file or performing inter-process communication (IPC), the file list lookup function commonly permitted in the sandbox environment (130) and the filename itself are utilized as a data delivery medium. Through this, large amounts of policy data can be safely pushed into the sandbox and perfectly restored to the original structure (JSON, etc.) without compromising the strong isolation security model of the sandbox at all.

[0065] In addition, real-time policy change detection and immediate synchronization without communication load are possible. By adopting a structure in which the security agent (110) changes the name of the notification file when the policy is updated, the hooking module (132) inside the sandbox can immediately recognize and synchronize policy updates simply by changing the directory list without receiving separate events or viewing the contents, thereby minimizing security gaps.

[0066] This invention provides flexible scalability to various security domains. Since the policy delivery mechanism of this invention is not limited to specific functions, it can be universally applied to a wide range of security functions required within a sandbox, such as print security, file encryption / decryption, clipboard control, and network access control, as well as executable file control, document export control, and storage media control. Consequently, it can play a pivotal role in establishing enterprise-wide integrated Data Loss Prevention (DLP) solutions and precise access control systems.

[0067] While this specification contains many features, such features should not be interpreted as limiting the scope of the invention or the claims. Additionally, features described in individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in a single embodiment herein may be individually implemented in various embodiments or appropriately combined and implemented.

[0068] Although operations are described in a specific order in the drawings, it should not be understood that such operations are performed in the specific order as illustrated, or in a series of consecutive sequences, or that all described operations are performed to obtain a desired result. Multitasking and parallel processing may be advantageous in certain environments. Furthermore, it should be understood that the distinction between various system components in the above-described embodiments does not require such distinction in all embodiments. The above-described program components and systems may generally be implemented as a package in a single software product or multiple software products.

[0069] The method of the present invention as described above can be implemented as a program and stored in a computer-readable form on a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.). Since this process can be easily carried out by a person skilled in the art to which the present invention belongs, it will not be described in further detail.

[0070] The present invention described above is not limited by the aforementioned embodiments and attached drawings, as various substitutions, modifications, and changes are possible within the scope of the technical concept of the present invention for those skilled in the art to which the present invention belongs. Explanation of the symbols

[0071] 110: Security Agent 120: File system 121: Policy Folder 121-1 : Original policy data 121-2: Policy Update Notification File 121-3: Policy Delivery File 130: Sandbox Area 131: Sandbox Application 132: Hooking Module

Claims

Claim 1 A computing device comprising a processor and a memory that stores instructions executed by said processor, wherein the memory stores instructions of a sandbox application executed in a sandbox environment, instructions of a hooking module loaded and operating inside said sandbox application, and instructions of a security agent operating outside said sandbox, said security agent encodes original policy data into a string and creates a policy delivery file having said encoded string as a filename in a policy folder of a file system, said hooking module performs a file list lookup for said policy folder of the file system to collect the filename of said policy delivery file and restores said original policy data based on said collected filename, said security agent creates a policy update notification file having an identification filename to notify of a policy update in said policy folder and changes said identification filename when the policy changes, said hooking module, when it detects a change in said identification filename of said policy update notification file through said file list lookup, collects the filename of said policy delivery file and performs the restoration of said original policy data. Claim 2 In claim 1, the security agent divides the encoded string into pre-set lengths and generates a plurality of policy delivery files having a string containing each divided string and sequence number information as a filename, and the hooking module restores the original policy data by sorting and combining the divided strings based on the sequence number information included in the filenames of the plurality of policy delivery files collected through the file list lookup. Claim 3 delete Claim 4 In paragraph 1, the policy transmission file is a computing device in which the interior of the file is empty or filled with meaningless data, and the original policy data is contained only in the filename itself. Claim 5 A method for executing a policy based on a file list in a sandbox environment, performed by a computing device, comprising: encoding original policy data into a string outside the sandbox environment; creating a policy delivery file having the encoded string as a filename within a policy folder of a file system outside the sandbox environment; collecting the filename of the policy delivery file by performing a file list lookup for the policy folder of the file system inside the sandbox environment; restoring the original policy data based on the collected filename inside the sandbox environment; creating a policy update notification file having an identification filename to notify of a policy update within the policy folder outside the sandbox environment; and changing the identification filename of the policy update notification file when the policy is changed, and performing the collecting step and the restoring step when the change of the identification filename of the policy update notification file is detected through the file list lookup. Claim 6 In claim 5, the step of creating the policy delivery file within the policy folder of the file system comprises dividing the encoded string into pre-set lengths and creating a plurality of the policy delivery files having a string containing each of the divided strings and sequence number information as a filename, and the step of restoring comprises restoring the original policy data by sorting and combining the divided strings based on the sequence number information included in the filenames of the plurality of policy delivery files collected through the file list lookup. Claim 7 delete Claim 8 In paragraph 5, the above policy delivery file is a method in which the interior of the file is filled with empty or meaningless data, and the original policy data is included only in the filename itself.

Images