KR100674632B1 - Mobile Code Authentication Schemes that Permit Overlapping of Execution and Downloading - Google Patents

Abstract

 The present invention relates to a method for authenticating a code of a received application or data in a system for receiving, installing, updating, and executing a mobile / wireless application or data (data) from an application server via wireless.

The present invention is to provide an efficient code authentication method that can be performed by transmitting the application divided into a plurality of code chunks (pieces) when transmitting to the mobile, and immediately verify the plurality of code chunks that are divided and transmitted from the mobile device to be downloaded immediately. It is based on the hash chain technique and the authentication tree technique, respectively, and when the code snippet is downloaded, it can be immediately verified for forgery by checking the forgery. It is characterized by that it can be done.

Wireless Communications, Authentication, Security, Mobile Applications, Mobile Code, Ubiquitous Computing Security

Description

Mobile Code Authentication Schemes that Permit Overlapping of Execution and Downloading}

1 is a block diagram showing the execution of the mobile terminal device code authentication method of the present invention.

2 is a view showing an example of an authentication tree generated in the present invention.

3 is a diagram showing an authentication tree generation algorithm in the present invention.

(references)

[1] Chandra Krintz, Brad Calder, Urs H ㆆ lzle, Reducing Transfer Delay Using Java Class File Splitting and Prefetching, In Proceedings of the 1999 ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languates, and Applications, pp. 276-291, 1999.

[2] Emin G. Sirer, Arthur J. Gregory, and Brian N. Bershad, A Practical Approach for Improving Startup Latency in Java Applications, In Workshop on Compiler Support for System Software, pp. 47-55, 1999.

[3] Chandra Krintz, Brad Calder, Han Bok Lee, and Benjamin G. Zorn, Overlapping Execution with Transfer Using Non-Strict Execution for Mobile Programs, In Proceedings of the 8th International Conference on Architectural Support for Programming Languages and Operating Systems, pp . 159-169, 1998.

[4] Dennis Lee, Jean-Loup Baer, Brian Bershad, and Tom Anderson, Reducing Startup Latency in Web and Desktop Applications, In Proceedings of the 3rd USENIX Windows NT Symposium, pp. 165-174, 1999.

[5] Tsutomu Gamou, A Working-Set Approach to Reduce the Download-Execution Time of Mobile Programs, In Proceedings of the 22nd International Conference on Distributed Computing Systems, 2002, pp. 239-248, 2002.

[6] Gray McGraw and Ed Felten, Securing Java: Getting Down to Business with Mobile Code, John Wiley & Sons, Inc., 1999.

[7] Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone, Handbook of Applied Cryptography, CRC Press, 1997.

[8] Ralph C. Merkle, A Certified Digital Signature, In CRYPTO'89, pages 218-238, 1989.

The present invention relates to a method for authenticating a code of a received application or data in a system for receiving, installing, updating, and executing a mobile / wireless application or data (data) from an application server via wireless.

Because wireless networks have low bandwidth and frequently experience transmission errors and losses, the execution of the code after it is completely transmitted requires a lot of delay.

Therefore, in order to reduce the delay time, the method of starting execution with some code received before the code is completed has been studied in various ways. [Refs. 1,2,3,4,5] For example, a Java applet is a class. Download and run the code separately [Ref. 1].

On the other hand, security is most important for the widespread use of commercial mobile code download services.

In one example, the code provider and the user would like to prevent any hacker from changing the downloaded code or inserting a virus, and the user would like to confirm that the downloaded code was written by the code provider. To this end, a code authentication scheme has been proposed that verifies the code by verifying the signature of the code provider against the downloaded code.

In general, Microsoft's Authenticode and Sun's Java code signing techniques, which are mainly applied to Active-X, are widely used [Ref. 6].

However, when applying the code authentication technique in a concurrent download and execution environment, the mobile device cannot verify the digital signature until all code chunks (fragments) have been downloaded, and because it is not safe to run unvalidated code, You will not be able to perform the practice together.

The present invention is to provide an efficient code authentication method that can be performed by transmitting the application divided into a plurality of code chunks (pieces) when transmitting to the mobile, and immediately verify the multiple code chunks that are divided and transmitted from the mobile device to perform the download. That is, the purpose of the present invention is to propose a code authentication method that enables verification of each chunk of code before downloading the entire code, and to check whether the chunk is forged / modified during verification.

The present invention is based on the hash chain technique and the authentication tree technique, respectively, and when a code snippet is downloaded, it can immediately verify whether a forgery is performed by performing a verification task, and perform a download and authentication and execution by performing a code snippet after the inspection. Characterized in that it can be parallel.

In other words, the present invention is based on the hash chaining scheme and authentication trees scheme for the two cases where the order of chunk transmission is fixed in advance and determined during the execution of the program. Code authentication scheme is proposed.

The present invention provides a process of dividing an application into multiple chunks, generating authentication information for the generated chunks, and information to be transmitted from each chunk piece and the authentication information for the chunks. Generating a transmission code of an application provider server, the method comprising generating and transmitting the generated information to a mobile terminal;

 As soon as the chunk and the authentication information provided from the application provider are downloaded, the program code authentication process of the mobile terminal device includes verifying the chunk and performing the verified chunk.

Code authentication is very important when downloading and performing application code on a mobile device.

In order to reduce the execution time delay of the mobile code, the present invention usually starts with some code received before the entire code is downloaded.

In the present invention having the above-described features, two methods that can be authenticated while starting execution with some codes are provided for two cases in which the order of code chunks to be transmitted is predetermined and two cases dynamically determined during program execution. .

The order of code chunks varies from program to program, and in the case of a relatively simple program, the execution path of the program is constant, so it may be determined in advance, and the program producer of the application providing server may set the program in advance. One). However, in the case of relatively complex programs, code chunks are determined dynamically according to user input and given environment, and the mobile device then requests on-demand code chunks to be executed (case 2). ).

The present invention for these two cases will be described in detail with reference to the embodiments shown in the accompanying drawings.

(A). When the order of code chunks is determined in advance

Assuming that the mobile code M consists of n code chunks M ₀ , M ₁ , ..., M _n-1 , the order of transmitting the code chunks is M ₀ , M ₁ , ..., M _n-1 Assume that it is predetermined.

Where AP: Application Provider (Application Provider)

        MH: Mobile Host

        h (x): one-way hash function (Ref. 7)

Sig _A (M): A signature value obtained by signer A digitally signing data M. The digital signature value is a value obtained by decrypting Sig _A (M) using M's public key in mobile device (MH) and M. If this matches, M is successfully verified.

        C || D: Concatenates data C and D

First, the AP server generates H _n having an arbitrary value.

Then, using the random value H _n , generate the following information for the code chunks M ₀ , M ₁ , ..., M _n-1 : H _i = h (H _{i + 1} || M _i ) (0 ≦ i ≦ n−1).

Application provider server (AP) is sent as the next information including After generating the signature Sig _AP (H ₀₎ to H _0, the generated digital signature value Sig _AP (H ₀₎ to the mobile device (MH) sequence.

(Sig _AP (H ₀ ), H ₀ ), (M ₀ , H ₁ ), (M ₁ , H ₂ ), ..., (M _n-1 , H _n ) _.

Meanwhile, The mobile device (MH) is verified for the H ₀ H ₀ as compared to decoding the _(AP Sig (H _0), H ₀₎ transmitted by using the received public key of the application provider (AP). Then, MH receives (M ₀ , H ₁ ) and calculates H ' ₀ = h (H ₁ || M ₀ ) using a hash function, and compares the calculated H' ₀ with H ' _{0. 1} , M ₀ is verified,

If H ' ₀ = H ₀ , H ₁ , M ₀ is verified.

When the verification is completed, the mobile device MH stores the verified data M ₀ in the secondary memory.

The mobile device MH repeats the information M ₁ , H ₂ ,..., And M _n-1 , H _n that have received this process, and stores the verified data in the memory.

That is, for (1≤i≤n-1), the mobile device MH receives (M _i , H _{i + 1} ) and calculates H ′ _i = h (H _{i + 1} || M _i ) check the _'i = H _i and stores, M _i Having examined the M _i.

(B). The order in which the chunks are sent is determined during execution.

(B1). Authentication Tree

 First, before describing the code chunk authentication method in the case where the transmission order of the code chunks is determined during execution, the authentication tree [Ref. 8] used in such a case will be described first.

(d≥0) 중 임의의 M_i (0≤i<2^d)를 보내고 검증자는 받은 데이터를 검증하려고 한다고 가정한다. There is a signer S and a verifier V, and the signer S gives the verifier V the data M ₀ , M ₁ , ...,

Suppose any M _{i of} ( ^d ≧ 0) (0 ≦ i <2 ^d ) and the verifier wants to verify the received data.

에 대해 인증 트리를 구성한 후, 검증자(V)에게 임의의 M_i와 인증 부가 정보 (다음의 데이터 전송 부분에서 설명)를 보내며, 검증자(V)는 이를 이용하여 M_i를 검증할 수 있다. For this purpose, the signer (S) is M ₀ , M ₁ , ...,

After constructing the authentication tree for, the verifier V sends arbitrary M _i and authentication side information (described in the following data transmission section), and the verifier V can use this to verify M _i . .

Authentication information generation: The authentication tree is a modified full binary tree, and as shown in FIG. 2, data M _i (0 ≦ i <2 ^d ) corresponds to each leaf node.

Each node e in the authentication tree has one value E associated with it.

If e is a leaf _{node, e ii (e 0-0) (} e 1~1) (e 2~2) represented by (e _3~3) and its associated value E _i~i = h (M _i) Set to.

If e is an internal node, it is represented by e k to k _' (k <k'), and the child nodes are e _{k1 to k1 '} and e _{k2 to k2'} (k _{1 ≤} k ₁ '<k _{2 ≤} k ₂ '). ), Set k = k ₁ and k '= k ₂ '.

Further, the value associated with e _k to _{k '} is E _{k to k'} = h (E _{k1 to k1 '} || E _{k2 to k2'} ),

For example, the leaf nodes e _0-1 and e _0-0 with respect to the internal nodes e _0-1 are E ₀ -1 = h (E _{0 -0} || E _1-1 ).

We call Siblings (e, e ') the set of values associated with all sibling nodes of each node in the path from node e to ancestor node e', for example Siblings (e _1-1 , e in FIG. _{0 to 3)} = a {E _0~0, E _2~3}.

 The method of generating the authentication tree is shown in Algorithm 1 as shown in FIG.

)에 대하여 서명자는 검증자에게 전자서명정보와 i에 대하여 경로상에 있는 각 노드의 모드 형제노드와 연관된 값의 집합 정보를 포함하는 (M_i, Sig_S(E_0∼

), Siblings(e_i∼i, e_0∼

))을 전송한다. Data transfer: any i (0≤i≤

For signer, the signer contains the digital signature information and the set of values associated with the mode sibling node of each node in the path for _i (M _i , Sig _S (E _{0 ~)}

), Siblings (e _{i to i,} e _{0 to}

Send)).

M _i is data to be received and verified by the verifier, and the rest is authentication additional information required for verification.

)을 검증해야하며 다음과 같은 절차를 따른다. Data Verification: a signature value for the value associated with the root node after obtaining the values associated with each node on the path from the leaf nodes to verify the _i~i e M _i by using the authentication information added to the root node Sig _S (E _0-

), And follow the procedure below.

)={E₁, E₂, E₃, ..., E_k, ..., E_d}로 나타낼 수 있으며, E_k는 앞에서 언급한 경로 상에 있는 노드 중, 레벨 k (1≤k≤d)에 있는 노드의 형제 노드에 연관된 값이다. First, Siblings (e _i, e _{0 to}

) = {E ₁ , E ₂ , E ₃ , ..., E _k , ..., E _d }, where E _k is the level k (1≤k among the nodes on the path mentioned above). Is the value associated with the sibling node of the node at &lt; = d).

First, the verifier (V) obtains the value _{E 'i~i = h (M i} ) associated with the leaf node e _i~i in the level of the path d.

The value associated with the internal node at level k-1 among the nodes on the path can be obtained by using E _k and the value associated with the node at level k among the nodes on the path. Get all the values associated with each node in the table.

)을 복호한 값과 루트 노드와 연관된 값인 E'_0∼

이 일치하면 E'_0∼

이 성공적으로 검증된 것이며 일방향 해쉬 함수의 성질에 따라 E'_0∼

를 계산할 때 사용한 모든 값들이 검증된 것이고, 따라서 M_i가 성공적으로 검증된 것이다.Thereafter, using the public key of the signer S, Sig _S (E _{0 to} E).

) And the value associated with the root node, E ' _{0 to}

If this matches, E ' _{0 to}

It will have been successfully validated by the nature of the one-way hash function E _'0~

All the values used to calculate are verified, and therefore M _i is successfully verified.

Referring to the example of Figure 2 as follows.

Figure 2 shows an authentication tree consisting of 4 (= 2 ² ) leaf nodes.

The data are M ₀ , M ₁ , M ₂ and M ₃ , and the values associated with the leaf nodes are E _0-0 = h (M ₀ ), E _1-1 = h (M ₁ ), E _2-2 = h (M ₂ ) and E _{3 to 3} = h (M ₃ ).

Further, the value associated with the internal node _{E 0~1 = h (E 0~0 ||} E 1~1), E 2~3 = h (E 2~2 || E 3~3), and E _{0~ 3} = h (E _0-1 || E _2-3 ).

The authentication side information necessary for verifying the M ₂ is Sig _S (E _0~3) and _{Siblings (e 2~2, e 0~3)} = {E 3~3, E 0~1}, verifying the M ₂ Here's how.

First, the value E ' _{2 to 2} = h (M ₂ ) associated with the leaf nodes e _{2 to 2} of the data M ₂ is calculated and then E' _{2 to 3} = h (E ' ₂ to ₂ ) using E ₃ to ₃ . || E _3-3 ) is calculated.

E ' _{0 ~ 3} = h (E _{0 ~ 1} || E' _{2 ~ 3} ) can be made with E _{0 ~ 1} and E ' _{2 ~ 3} , and Sig _S (E _{0 ~ 3} ) is decrypted with public key. Verify M ₂ by confirming that the value and E ' ₀ to ₃ are equal.

(B2). Mobile Code Authentication Method Using Authentication Tree Method

로 구성되어 있다고 가정하고, 코드 청크를 전송하는 순서는 다운로드시 모바일 장치(MH)에 의해 동적으로 결정된다고 가정한다.First, mobile code M has n (= 2 ^d ) code chunks of the same size M ₀ , M ₁ , ...,

Assume that the order of transmitting code chunks is dynamically determined by the mobile device (MH) at the time of download.

 The mobile code authentication method for such a case operates by the following process.

에 대해 앞서 설명한 바와 같은 방법으로 인증 트리 A를 생성한다. First, the provider server (AP) is responsible for the code chunks M ₀ , M ₁ , ...,

Generate an authentication tree A in the same manner as described above.

)을 생성한다. Thereafter, the application provider server (AP) signs the value E _0-2 d- ₁ associated with the root node of the generated authentication tree A, thereby digital signature information Sig _AP (E _0-).

)

), Sig_AP(E_0∼

))을 전송한다. Each time the mobile device (MH) requests the ^{_{M i (0≤i <2 d)}} , application provider server (AP) is a _{(M i, Siblings (e i~i} , e 0~

), Sig _AP (E _0-

Send)).

After that, the mobile device MH can verify M _i in the same manner as described above.

This method uses the authentication tree technique as it is, so it is safe and simple. However, each signature chunk is sent with one signature value and log n hash values.

), Sig_AP(E_0∼

)을 이용하여 M_i (0≤i<2^d)를 검증하면, 트리 내 M_i에 대응하는 잎 노드 e_i∼i 에 연관된 값 E_i∼i는 물론 e_i∼i의 모든 조상 노드들에 연관된 값들도 모두 검증될 뿐만 아니라, Siblings(e_i∼i, e_0∼

)들도 모두 검증된다는 장점도 있다.On the other hand, Siblings (e _{i to i} , e _{0 to}

), Sig _AP (E _0-

) To all ancestor nodes of M _i (0≤i leaf node associated with the e value _{i~i i~i} E, as well as e _i~i corresponding to <2 ^d), in the tree M _i when verifying using Not only the associated values are verified, but Siblings (e _{i to i} , e _{0 to}

) Also has the advantage of being verified.

Next, we propose an improved code authentication method using this property.

(B3). Another embodiment of a mobile code authentication method using an authentication tree technique.

에 앞서 설명한 바와 같은 방법으로 인증 트리 A를 생성한다.(S-1) First, the application provider server (AP) is responsible for the code chunks M ₀ , M ₁ , ...,

Authentication tree A is generated in the same manner as described above. (S-1)

를 서명하여 Sig_AP(E_0∼

)을 생성한다.(S-2) Subsequently, the application server (AP) determines a value E ₀ to associated with the root node of the generated authentication tree A.

Sign Sig _AP (E _0∼

(S-2)

The application server and the mobile device (AP / MH) set Authenticated, which is a set of verified values, to {} (S-3).

The mobile device (MH) requests the chunk M _i to the AP (S-4).

까지의 경로 상에 있는 각 노드에 대하여, 연관된 값이 집합 Authenticated에 있는 노드를 찾는다. (S-5)Application provider server (AP) is the root node e _0~ from the leaf node associated with the e _i~i M _i

For each node on the path up to, find the node whose associated value is in the set Authenticated. (S-5)

If present, the node with the highest level is called e _{k -k '} , and the application provider AP transmits (M _i , Siblings (e _i-i , e _{k- k'} )). If not present, k = 0, k '= 2 ^d −1, and the application provider (AP) is (M _i , Siblings (e _{i to i} , e _{k to k'} ), Sig _AP (E _{k to k '} )), And the MH / AP adds the values E _k to _k' obtained by decoding the Sig _AP (E _k to _{k '} ) with the AP's public key to the set Authenticated (S-6).

Siblings (e i to _i , e _{k to k '} ) = {E _d , E _d-1 , ..., E _j , ..., E _t } (d≥j≥t) _j is a value associated with the sibling node of the node in level j among the nodes in the path of the leaf nodes e i- _i to ancestor nodes e _{k-k '} .

First, the mobile device (MH) obtains the value _{E 'i~i = h (M i} ) associated with the leaf node e _i~i in the level of the path d. (S-7)

The value associated with the internal node at level j-1 among the nodes on the path can be obtained by using E _j and the value associated with the node at level j among the nodes on the path. Get all the values associated with each node in the table. (S-8)

The mobile device MH then obtains E '_k-k' . If this value is equal to the already validated E _{k to k '} in the Authenticated set, then E' _{k to k '} is successfully validated and used to calculate E' _k to _{k '} depending on the nature of the one-way hash function. The values have been verified and M _i has been successfully verified (S-9).

The application server and the mobile device (AP / MH) add Siblings (e _{i to i} , e _k to _{k '} ), which are validated values, to the Authenticated set, and from e _{i to i} to e _k to _k' . Add the values associated with each node in the path (S-10).

After adding the values associated with each node as in the step (S-10), the operations of (S-4) to (S-10) are repeated.

로 구성된다. For example, suppose n = 4. Mobile code M has four code chunks M ₀ , M ₁ , ...,

It consists of.

를 서명하여 Sig_AP(E_0∼

)을 생성한다. Authenticated={}이다. First, the application server generates an authentication tree A (see FIG. 2), and then, the value E ₀ to the root node of the authentication tree A is generated.

Sign Sig _AP (E _0∼

) Authenticated = {}.

When the mobile device (MH) requests M ₂ , the application server (AP) is (M ₂ , Siblings (e _2-2 , e _0-3 ) = {E _3-3 , E _0-1 }, Sig _AP ( E _0-3 )) to verify M ₂ . Authenticated = {E _3-3, E _0-1, E ' _2-2, E' _2-3, E ' _0-3 }.

When thereafter the mobile device (MH) to request the M _0, the application provider server (AP) is a node in this, the associated values of the nodes on the path to the root node from e _0~0 corresponding to ₀ M e ₀ Authenticated _-1 can be found.

The application provider server (AP) transmits (M ₀ , Siblings (e _0-0 , e _0-1 ) = {E _1-1 }).

After generating the mobile device (MH) is configured to receive this _{E '0~0 = h (M 0} ), E' 0~1 = h (E '0~0 || E 1~1), the value is Authenticated Verify M ₀ by checking E _{0 to 1 in} .

According to the present invention, when the application is divided into multiple code chunks and transmitted, the mobile device can immediately verify the downloaded code chunks and perform them, so that the execution start delay and execution delay time of the program can be greatly reduced. Can be.

Claims (6)

delete delete  The process of dividing an application into multiple chunks, generating authentication information for the generated chunks, and generating and sending information from each chunk piece and the authentication information for that chunk. A process of generating a transmission code of an application provider server including transmitting the collected information to a mobile terminal device;  In the mobile terminal device code authentication method comprising the step of verifying the chunk and performing the verified chunk, as soon as the chunk and authentication information provided from the application provider is downloaded, Generating authentication information for the generated chunk includes generating an authentication tree for each code chunk, and generating electronic signature information by signing a value associated with a root node of the generated authentication tree. Done, In the process of transmitting the generated information to the mobile terminal device, it is determined whether there is a request for program data M _i to be transmitted from the mobile terminal device, and if there is a request of the program data M _i of the mobile terminal device, To transmit the data M _i and the authentication additional information, In the process of verifying the chunk of the mobile terminal, the value associated with each node in the path from the corresponding data (M _i ) leaf node to the root node is obtained by using the authentication additional information transmitted from the application providing server. Obtaining and verifying a signature value with respect to a value associated with a root node. 4. The method of claim 3, wherein the code information transmitted from the application providing server to the mobile terminal device comprises data (M _i ) (0 ≦ _i ≦ 2 ^d −1), Digital signature information (Sig _S (E _{0 ~)}

)) And set information (Siblings (e _{i to i,} e _{0 to) of the} values associated with the mode sibling nodes of each node on the path from the leaf node to the root node with respect to the data M _i .

A method for authenticating a mobile terminal device code allowing parallel download and execution, characterized in that it comprises a)).  The process of dividing an application into multiple chunks, generating authentication information for the generated chunks, and generating and sending information from each chunk piece and the authentication information for that chunk. A process of generating a transmission code of an application provider server including transmitting the collected information to a mobile terminal device;  In the mobile terminal device code authentication method comprising the step of verifying the chunk and performing the verified chunk, as soon as the chunk and authentication information provided from the application provider is downloaded, The process of generating authentication information for the generated chunks includes: generating an authentication tree for each code chunk, generating electronic signature information by signing a value associated with a root node of the generated authentication tree, and verifying Setting up a set of authorized values, Authenticated, In the process of transmitting the generated information to the mobile terminal device, there is a process of determining whether there is a request for program data M _i to be transmitted from the mobile terminal device, and there is a request for program data M _i of the mobile terminal device. In the case of each node on the path from the leaf node associated with the corresponding data M _i to the root node, the process of finding a node in the set Authenticated set of associated values set in the above process, and in the set Authenticated set of associated values set If the node search result is present in the set, the electronic signature information is not included. If not, the electronic signature information is included in the information to be transmitted and the data M _i is transmitted to the mobile terminal device. In the case of including and transmitting, the value obtained by decrypting the digital signature information with the public key of the application server. Including adding to the set Authenticated, Verification of the chunk of the mobile terminal apparatus may include setting Authenticated, which is a set of verified values, requesting data M _i , and using authentication additional information transmitted from an application providing server. and the data (M _i) the leaf node from the step to obtain the value associated with each node, and, by searching the calculated value in the Authenticated set to find whether there is the same verification value data (M _i) on the route to the root node, And verifying and adding the associated values in each node in the path from the leaf node associated with the verified data (M _i ) to the root node to the Authenticated set. Mobile terminal device code authentication method that allows parallelism. 6. The method of claim 5, wherein the code information transmitted from the application providing server to the mobile terminal device is data (M _i ) (0 ≦ _i ≦ 2 ^d −1), Digital signature information Sig _S (E _{0 to}

) And the set information (Siblings (e _{i to i,} e _{0 to} ) of the values associated with all sibling nodes of each node in the path with respect to the data M _i .

A method for authenticating a mobile terminal device code allowing parallel download and execution, characterized in that it comprises a)).

Images