System and method for security using one-time execution code

• US 9,830,434 B2
• Filed: 05/09/2008
• Issued: 11/28/2017
• Est. Priority Date: 05/09/2007
• Status: Active Grant

• Current Assignee: Wellbia.com Co. Ltd.
• Original Assignee: Wellbia.com Co. Ltd.
• Inventors: Jung, Young Suk
• Primary Examiner(s): Zee, Edward
• Application Number:
  US12/598,945
• Publication Number:
  US 20100146590A1
• Time in Patent Office: 3,490 Days
• Field of Search: 713184, 709221, 726 5, 726 23
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

The present invention relates to a security system, and more particularly, to a security system and method using a one-time execution code in an environment in which a client and a server are connected through a network. The server irregularly generates and transmits the one-time execution code to the client, and the client directly executes the one-time execution code on a memory area and transmits the execution result and deletes the one-time execution code on the memory area. Therefore, the server determines whether or not an error exists in the execution result and can prevent forgery and appropriation of the client by blocking the connection with the client.

Claims

1. A security client comprising a processor and a memory, the security client configured to use a one-time execution code in an environment in which a server and the security client establish a connection through a network, wherein the security client automatically receives, from the server, the one-time execution code without a user interaction,

wherein the received one-time execution code is included in a packet between the server and the security client, the packet being transmitted from the server to the security client,

wherein the one-time execution code is repeatedly generated as irregular by the server while the connection with the security client is maintained, for determining whether a client program is appropriate,

wherein the security client is configured to load the one-time execution code on a code container, the code container being pre-allocated in a part of the memory which is already occupied by the client program, and obtain an execution result of the loaded one-time execution code while executing the client program,

wherein the received one-time execution code is not generated as a file but directly loaded on the pre-allocated part of the memory which is already occupied by the client program,

wherein the security client transmits the execution result to the server, and deletes the one-time execution code from the code container after the transmitting of the execution result,

wherein the transmitted execution result is included in a packet between the server and the security client, the packet being transmitted from the security client to the server.

2. The security client of claim 1, wherein the code container is pre-allocated when the client program is started and loads the one-time execution code when the one-time execution code is received.

3. The security client of claim 1, wherein the one-time execution code is extracted by analyzing the packet transmitted from the server to the security client.

4. The security client of claim 1, wherein the execution result of the one-time execution code is associated with verifying the client program, not associated with verifying a user of the client program.

5. The security client of claim 1, wherein the execution result of the one-time execution code is obtained without a user interaction.

6. A security server configured to use a one-time execution code in an environment in which the server and a security client establish a connection through a network, the server comprising:

a processor and a memory;

a one-time execution code generator, implemented using the processor, configured to generate and transmit the one-time execution code for determining whether a client program is appropriate, the transmitted one-time execution code being included in a packet between the server and the client program, wherein the one-time execution code is not generated as a file but configured to be directly loaded on a pre-allocated part of a memory area which is already occupied by the client program running on the security client;

a result analyzer, implemented using the processor, configured to analyze an execution result of the loaded one-time execution code transmitted from the security client to determine whether or not an error occurs in the execution result, the execution result of the loaded one-time execution code being obtained by the security client while executing the client program, wherein the transmitted execution result being included in a packet between the server and the client program; and

a client connection controller, implemented using the processor, configured to block the connection with the security client when the result analyzer finds the error,

wherein the one-time execution code is repeatedly generated as irregular, and the one-time execution code is repeatedly transmitted to the security client without a user interaction, while the connection with the security client is maintained, and

wherein it is determined based on random value whether or not the one-time execution code is generated.

7. The security server of claim 6, wherein the one-time execution code generator calls a random function for determining whether or not the one-time execution code is generated, the random value being obtained by the random function, whereby the generating of the one-time execution code is randomly occurred.

8. The security server of claim 7, wherein the one-time execution code generator acquires the one-time execution code from a database set in advance or generates a new one-time execution code.

9. The security server of claim 6, wherein the result analyzer determines that an error occurs when the execution result of the one-time execution code is not received or the execution result of the one-time execution code has an error.

10. The security server of claim 6, wherein the execution result of the one-time execution code is associated with the client program, not associated with a user of the client program.

11. The security server of claim 6, wherein the execution result of the one-time execution code is obtained at the security client without a user interaction.

12. A security method, comprising:

receiving, from a server, a one-time execution code for determining whether a client program is appropriate without a user interaction,

wherein the received one-time execution code is included in a packet between a server program running on the server and a client program running on a security client, the packet being transmitted from the server to the security client through a connection established between the server and the security client on a network;

loading the received one-time execution code on a code container, the code container being pre-allocated in a part of a memory area which is already occupied by the client program, and wherein the received one-time execution code is not generated as a file but directly loaded on the pre-allocated part of the memory area which is already occupied by the client program;

wherein the one-time execution code is repeatedly generated as irregular by the server while the connection with the security client is maintained;

obtaining an execution result of the loaded one-time execution code while executing the client program and transmitting the execution result to the server, wherein the execution result of the one-time execution code is obtained without a user interaction,

wherein the transmitted execution result is included in a packet between the server program and the client program, the packet being transmitted from the server to the security client; and

deleting the loaded one time execution code from the code container after the execution result is transmitted to the server.

16. A non-transitory computer-readable recording medium having recorded thereon a program for performing the method of claim 12.

13. A security method, comprising:

generating a one-time execution code for determining whether a client program is appropriate and transmitting the one-time execution code to a security client connected through a connection established between a server and the security client on a network, the transmitted one-time execution code being included in a packet between the server and the client program, wherein the one-time execution code received by the security client is not generated as a file but directly loaded on a pre-allocated part of a memory area which is already occupied by the client program running on the security client,

receiving the execution result of the one-time execution code from the security client and analyzing the execution result, the transmitted execution result being included in a packet between the server and the client program; and

blocking the connection with the security client when the execution result indicates that the client program is inappropriate,

wherein the one-time execution code is repeatedly generated as irregular, and the one-time execution code is repeatedly transmitted to the security client without a user interaction, while the connection with the security client is maintained,

wherein it is determined based on random value whether or not the one-time execution code is generated, and

wherein the execution result of the one-time execution code is obtained at the security client while executing the client program and without a user interaction.

14. The security method of claim 13, wherein the generating the one-time execution code comprises:

calling a random function; and

acquiring and generating the one-time execution code by using a result of the called random function.

15. The security method of claim 14, wherein the one-time execution code is acquired form a database set in advance or a new one-time execution code is generated.