KR101066375B1 - Mobile anti-malware service method based on cloud - Google Patents

Abstract

The present invention relates to a mobile anti-malware service method, comprising: checking the validity of a currently active VDB (Virus Database) location in a client, collecting client information, and transmitting the collected client information to a server; Checking, if there is no change in the locator, the server checking whether the update of the VDB location is necessary and if the update of the VDB location is necessary, the server updating the VDB location. . According to the present invention, at the time of updating the malware DB on the mobile device, minimal data traffic is transmitted and received, thereby preventing waste of communication resources.

Malware, Malware, Malicious Software, Resources, Mobile, Cloud, Applications.

Description

Mobile anti-malware service method based on cloud}

The present invention relates to a mobile anti-malware service method, and more particularly, to a mobile anti-malware service method for safely maintaining a mobile device from malware including malicious code and malicious software.

Malware is software that is specifically designed to harm or interfere with a system, such as viruses or Trojan horses, or code and malicious software that can endanger data, computers, or networks, or This word is derived from malicious code and refers to software developed to damage other systems. Recently, malware needs to be careful not to open attachments or download and install software, but simply clicking on a link or image on a popular search page can install unwanted software and hijack the system. do.

In general, a computer virus is a combination of instructions that modify a computer program or executable part and copy itself or its modifications to it to damage the computer's operation. It is a type of computer program that infiltrates data, destroys data, or destroys other programs. A virus works when you start your computer with an infected disk or when you run a specific program, which destroys data, interrupts your computer's operation, and replicates itself to infect other computers.

The path of infection of such a computer virus has a very diverse and complicated structure. The most common paths are illegal copying, computer communication, computer sharing, LAN or the Internet. Using pirated software diskettes or working on a computer that is shared by several people is more likely to cause a virus infection, and you will be infected with the diskette or program without your knowledge. If you use these infected diskettes or programs on your computer, The computer is also infected. Recently, as the use of computer communication increases, viruses spread rapidly when sending and receiving data.

On the other hand, due to the relationship between the operating system and the file system is less than the computer, and the importance of the data used is relatively low, the recognition and damage of the mobile virus to the wireless communication system is not yet large.

However, wireless terminals are now adopting the functions of computers and developing them into smartphones. As the wireless network of wireless terminals expands to comparable to the wireless Internet, the virus damages occurring in computers are expected to affect wireless networks of wireless terminals. The likelihood of reproduction is increasing.

In reality, damages to mobile viruses are appearing. As a specific example of mobile virus damages, in Japan's representative mobile phone Internet service, Japan's I-Mode, hundreds of mobile phones in Japan are threatened by police due to malware stored in software. There was an incident that caused the phone number to be called.

In addition, mobile viruses are expected to increase gradually as securities and bank transactions are possible using wireless terminals, and the explosive increase in users of wireless terminals is expected to have a greater impact than the damage of computer viruses. Security and safety have become one of the most important issues.

In an anti-malware system for anti-malware of such a mobile device, the entire malware DB is downloaded from a server in order to update a malware database (hereinafter referred to as 'DB') on a mobile device. By doing so, conventionally, a large amount of data traffic is transmitted and received between the server and the mobile device, resulting in waste of communication resources, and there is a problem in using a mobile application due to limited resources of the mobile device.

In addition, the mobile communication environment is also globalized and roaming services are introduced to countries around the world. There is a problem that conventional anti-malware systems cannot effectively cope with malware generated locally.

The present invention has been made to solve the above problems, to minimize the waste of communication resources by transmitting and receiving a minimum data traffic when updating the malware DB on the mobile device, it is possible to effectively use the limited resources of the mobile device The purpose is to provide a mobile anti-malware service method.

In addition, an object of the present invention is to provide a mobile anti-malware service method that can effectively respond to malware generated in each region of the world.

In order to achieve the above object, the present invention provides a VDB (Virus Database) master, which is a data structure including information about the number of location DBs and active locations, a version of a location DB, and blocks for managing the location DBs. A mobile anti-malware service method comprising: a VDB location, which is a data structure including the number of checksums of blocks, and a location determiner that manages VDB master information as an entity having logic to determine an active location. Checking the validity of the currently active VDB location, collecting and transmitting client information to the server, checking whether there is a change in the location determiner, and if there is no change in the location determiner, the server determines the VDB. Checking whether an update of the location is required and if an update of the VDB location is needed, the server And a step of updating the location VDB.

In the collecting and transmitting the client information to the server, the client information includes the checksum of the positioner, the execution environment of the client, the location ID of the currently active VDB location, the version ID of the VDB location, and the number of blocks of the VDB location. It may be.

If there is a change in the locator, the server sends the locator for the client to the client according to the client information received from the client and the client updates the locator received from the server. And executing the updated positioner.

In the transmitting of the positioner suitable for the execution environment of the client to the client, the positioner suitable for the execution environment of the client may be transmitted to the client according to the execution environment information of the client received from the client.

The updating of the location of the VDB in the server may include: checking whether the location DB of the client is required at the server; and checking whether the client has a block if the location DB of the client is required. If the client does not have a block, the server configures download information; if the client has a block, the server requests the client for information about the block, and the client information for the block from the server When receiving a request, collecting and transmitting information about the blocks of the client to the server, the server determines the operation to be performed for each block and configures the information necessary for the operation, the server is configured to the information Sending the message to the client, Performing an update operation for each block based on the information received from the server, and notifying the server of the operation result, and the server may include the step of recording the operation result.

The validating of the currently active VDB location in the client may include checking whether information of the currently active VDB location exists, and if the VDB location information exists, loading the VDB location and executing a loop by the number of blocks. Checking whether the loop is executed as many times as the number of blocks, and if the loop is not executed as many times as the number of blocks, checking whether the block checksum of the VDB position is equal to the md5 hash value of the actual block, If the block checksum of the VDB position and the md5 hash value of the actual block are not the same, removing the damaged block, if the loop is executed as many as the number of blocks, checking whether the VDB position information is changed, and if the VDB position information is changed The method may include updating the changed VDB location information.

The client may perform the update operation for each block based on the information received from the server, wherein the client performs a loop by the number of block information received from the server, and whether the loop is performed by the number of block information. In the checking step, if the loop is not performed as many as the block information, it is checked whether there is free space to store the result of the block change operation, and if there is no free space, the block is secured based on the block change information configured in the server. Changing the block, if there is free space, performing the block change operation based on the block change information configured in the server, and if looping is performed as many as the block information, checking the block change occurrence and updating the changed VDB location information. It may include.

Securing the storage space may be to secure the storage space according to a storage management policy.

The server determines a task to be performed for each block and configures the information necessary for the task, the server determines whether to perform the addition / removal / replacement / update operation for each block, and configures the information necessary for the task It may be.

The server determines whether to perform the addition / removal / replacement / update operation for each block, and to configure the information necessary for the operation, the server inquires block information corresponding to the location ID from the server DB and loops as many as the number of blocks. Performing the step of determining whether or not the loop is performed as many as the number of blocks, and if the loop is not performed as many as the number of blocks, checking whether the block ID exists in the client, and if the block ID does not exist in the client, providing additional information. Configuring and checking whether the block version ID and the client block version ID matched if the block ID exists in the client, and if the block version ID and the client block version ID do not match, If it is judged to be a replacement operation, the replacement operation information configuration is performed. Performing job information configuration, if the block version ID and the client block version ID match, checking whether the inquired block checksum and the client block checksum match, and the block checksum and the client block checksum match If not, performing replacement operation information configuration; if looping is performed as many as the number of blocks, checking whether the block ID exists in the inquiry result; and removing the operation information configuration because the block ID exists in the inquiry result. It may include the step.

The server may determine whether there is a change in the positioner by using checksum information of the positioner received from the client.

The server may check whether the update of the VDB location is necessary using the location ID of the VDB location, the version ID of the VDB location, and the number of blocks of the VDB location received from the client.

The server may request the client for information about a block, wherein the server requests the client for block information including a block ID, a block version ID, and a block checksum.

If the block version ID and the client block version ID do not match, determining whether to replace or update is determined as a replacement if the change to the client block version ID is equal to or greater than a reference value, otherwise, the operation is determined as an update. It may be.

According to the present invention, at the time of updating the malware DB on the mobile device, minimal data traffic is transmitted and received, thereby preventing waste of communication resources. That is, in the present invention, since the minimum data traffic required for the mobile device is transmitted through the cloud close to the region where the mobile device is located, unnecessary large amount of traffic can be prevented from being transmitted.

In addition, the present invention has the advantage that it is possible to effectively use the limited resources of the mobile device. That is, in the present invention, since optimized data is transmitted and received, there is an effect that an optimal DB can be constructed while using the minimum resources of the mobile device.

In addition, the present invention has the advantage of being able to effectively respond to malware occurring in each region of the world. That is, in the present invention, there is an effect that can immediately respond to malware generated in the world region.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used for the same reference numerals even though they are shown in different drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a block diagram showing a mobile anti-malware system according to an embodiment of the present invention.

Referring to FIG. 1, the mobile anti-malware system includes a mobile device 100, a plurality of cloud centers 200a, 200b, and 200c, and an internet network 300.

The plurality of cloud centers 200a, 200b, and 200c provide data required for anti-malware including a malware database (DB) through a cloud of a corresponding cloud center based on the region where the mobile device 100 is located. Transmit to the mobile device 100. 1 illustrates a cloud center 200a located in Korea, a cloud center 200b located in the United States, and a cloud center 200c located in Europe. For example, if the mobile device 100 is located in the United States, the cloud center 200b located in the United States transmits data necessary for the anti-malware to the mobile device 100.

The mobile device 100 downloads data necessary for anti-malware including a malware DB from the cloud centers 200a, 200b, and 200c to update the anti-malware application. The mobile device 100 may communicate with the internet network 300 through a plurality of repeaters 11 and 13.

The internet network 300 is connected to a plurality of cloud centers 200a, 200b and 200c and the mobile device 100. In FIG. 1, the internet network 300 is only one example of a wired and wireless communication network, and various wired and wireless communication networks may be used according to embodiments. For example, a mobile network such as WiFi may be used as the wired or wireless communication network.

Now, a detailed DB update process in the mobile device 100 and the cloud centers 200a, 200b, and 200c having the configuration as described above will be described in detail with reference to the accompanying drawings.

First, the terms to be used in the process description will be described before the detailed description.

'VDB master' is the data structure of information about the number of location DB and active location, and 'VDB location' is the data such as the version of location DB, the number of blocks managed and the checksum value of blocks. Structure, 'checksum' is md5 hash value and it is 32 byte string value, 'VDB manager' is an object responsible for virus database update, manages VDB location information, and 'locator' is activated. As an entity with logic to determine location, it manages VDB master information.

2 and 3 are flowcharts illustrating the entire mobile anti-malware process according to an embodiment of the present invention. In FIGS. 2 and 3, the mobile device 100 is on the client side, and the cloud centers 200a, 200b, 200c are on the server side.

2 is a flow chart briefly illustrating the mobile anti-malware process of the present invention, and FIG. 3 is a flow chart illustrating the mobile anti-malware process of the present invention in more detail.

Referring to Figure 2 describes the mobile anti-malware process of the present invention, the client checks the validity of the currently active VDB location (S301).

The client information is collected and transmitted to the server (S303). In one embodiment of the present invention, the client information may include the checksum of the location determiner, the execution environment of the client, the location ID of the currently active VDB location, the version ID of the VDB location, and the number of blocks of the VDB location.

The server checks whether there is a change in the positioner (S305). In an embodiment of the present invention, the server may check whether there is a change in the location determiner using the checksum information of the location determiner received from the client.

If there is a change in the positioner, the server transmits the positioner suitable for the execution environment of the client to the client according to the client information received from the client (S307). According to an embodiment of the present invention, according to the execution environment information of the client received from the client in step S307, it may be to transmit a locator suitable for the execution environment of the client to the client.

The client updates with the positioner received from the server (S309), and executes the updated positioner (S311). Then, the process returns to step S301 again.

If there is no change in the positioner, the server checks whether the update of the VDB location is necessary (S313). If the update of the VDB location is necessary, the server updates the VDB location (S315). In an embodiment of the present invention, the server may check whether the update of the VDB location is necessary by using the location ID of the VDB location, the version ID of the VDB location, and the number of blocks of the VDB location.

Referring to FIG. 3, the client checks the validity of the currently active VDB location (S401). The client information is collected and transmitted to the server (S403). Detailed description of the validity of the VDB location in the present invention will be described later.

The server checks whether there is a change in the positioner (S405). If there is a change in the positioner, the positioner suitable for the execution environment of the mobile device 100 is transmitted to the client (S407). The client then updates the positioner (S409) and executes the positioner (S411).

On the other hand, if there is no change in the positioner in the server, it is checked whether the inspection of the location DB of the client is necessary (S413). If it is not necessary to check the location DB of the client, information configuration is performed (S415), and if it is necessary to check the location DB of the client, it is checked whether there is a block in the client (S417). If there is no block in the client, download information configuration is performed (S421). If there is a block in the client, information about the client blocks is requested to the client (S419). The client side receiving the request collects information on the client blocks and transmits the information to the server (S423).

In operation S419, the server may request block information including a block ID, a block version ID, and a block checksum from the client.

Next, the server configures the determination of the addition / removal / replacement / update operation for each block and the information necessary for the operation (S425). Determination of necessary tasks in the server and a detailed description of necessary information configuration according to the corresponding tasks will be described later.

Next, the server transmits the configured information to the client (S427). The client updates block by block (S429) and notifies the server of the result of the operation (S431). In the present invention, a specific method of updating block by block in the client will be described later.

Next, the server records the operation result of the client (S433).

4 is a flowchart illustrating a validation process on a client side, i. E. A mobile device, according to an embodiment of the invention.

Referring to FIG. 4, it is checked whether the VDB location information of the current active location exists in the client (S501). If the current VDB location information does not exist, the process is terminated. If the current VDB location information exists, the VDB location is loaded and a loop is executed as many as the number of blocks (S503).

If the loop is performed as many as the number of blocks (S505), if the loop is not performed as many as the number of blocks, it is checked whether the block checksum of the VDB position and the md5 hash value of the actual block are the same (S507). If the block checksum of the VDB position and the md5 hash value of the actual block are the same, the flow returns to step S505, otherwise, after removing the damaged block (S509), the flow returns to step S505.

If the loop is performed as many blocks in step S505, it is checked whether the VDB location information has been changed (S511). If the VDB location information has been changed, the changed VDB location information is updated (S513).

5 is a flowchart illustrating a block-by-block update operation on a client side, that is, a mobile device, according to an embodiment of the present invention.

Referring to FIG. 5, a loop is performed by the number of block information received from a client (S601). Then, it is checked whether the loop is performed by the number of block information (S603). If the loop is not performed as many as the number of block information, it is checked whether there is free space for storing the block change work result (S605). If there is no free space, the storage space is secured by the storage management policy (S607). Then, the block is updated based on the block change information configured in the server to update the block to the latest version (S609).

If the loop is performed as many block information as in step S603, it is determined whether a block change occurs (S611). If there is a block change, the changed VDB location information is updated (S613).

6 is a flowchart illustrating an information organization process at a server side, i.e., a cloud center, according to an embodiment of the present invention.

Referring to FIG. 6, the server inquires block information corresponding to the location ID from the server DB (S701), and loops as many blocks (S703).

Next, it is checked whether the loop is performed as many as the number of blocks (S705). If the loop is not performed as many as the number of blocks, it is checked whether the block ID exists in the client (S707). If the block ID does not exist in the client, the additional information is configured and the process returns to step S705 (S709). If the block ID exists in the client, it is checked whether the inquired block version ID and the client block version ID match (S711).

If the block version ID and the client block version ID do not match, it is determined whether the replacement operation or the update operation (S713). If it is an update operation, the configuration of the update information is performed to return to step S705 (S715), and if it is a replacement operation, the replacement information configuration is performed to return to the step S705 (S717). In an embodiment of the present disclosure, step S713 may be determined as a replacement task if the item to change the client block version ID is greater than or equal to a preset reference value. Otherwise, the operation S713 may be determined as an update task.

If the block version ID and the client block version ID match in step S711, it is checked whether the inquired block checksum and client block checksum match (S719). If the inquired block checksum and the client block checksum do not match, the replacement operation information configuration is performed, and the flow returns to step S705 (S721).

On the other hand, if the loop is performed as many blocks in step S705, it is checked whether the block ID exists only in the client and also in the inquiry result (S723). If the block ID exists in the search result, the removal operation information configuration is performed (S725).

While the invention has been described using some preferred embodiments, these embodiments are illustrative and not restrictive. Those skilled in the art will appreciate that various changes and modifications can be made without departing from the spirit of the invention and the scope of the rights set forth in the appended claims.

1 is a block diagram showing a mobile anti-malware system according to an embodiment of the present invention.

2 and 3 are flowcharts illustrating the entire mobile anti-malware process according to an embodiment of the present invention.

4 is a flowchart illustrating a validity checking process in a client according to an embodiment of the present invention.

5 is a flowchart illustrating a block-by-block update operation in a client according to an embodiment of the present invention.

6 is a flowchart illustrating an information configuration process in a server according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100 mobile devices 200a, 200b, 200c cloud center

300 internet networks

Claims (14)

VDB master, which is a data structure that contains information about the number of location DBs that are held and active location, and a data structure that includes the version of the location DB, the number of blocks to be managed, and the checksum value of the blocks. A mobile anti-malware service method of a client comprising a VDB location and a location determiner that manages VDB master information as an entity having logic to determine an active location. Checking the validity of the currently active VDB location in the client, collecting the client information, and transmitting the collected client information to the server; Based on the received client information, the server checking whether there is a change in the positioner; If there is a change in the locator, the locator for the client's execution environment is transmitted to the client according to the received client information. If there is no change in the locator, the server checks whether the update of the VDB location is necessary. step; And And if the update of the VDB location is needed, the server updating the VDB location. The method of claim 1, In the collecting and transmitting the client information to the server, The client information includes a checksum of the positioner, the execution environment of the client, the location ID of the currently active VDB location, the version ID of the VDB location, and the number of blocks of the VDB location. The method of claim 2, And updating, by the client, the location determiner received from the server, and executing the updated location determiner. The method of claim 1, The transmitting of the location determiner suitable for the execution environment of the client to the client may include transmitting the location determiner suitable for the execution environment of the client to the client according to the execution environment information of the client received from the client. Malware service method. The method of claim 2, Updating the VDB location in the server, Checking whether the server needs to check the location DB of the client; If it is necessary to check the location DB of the client, checking whether the client has a block; If there is no block in the client, the server constructs download information; If the client has a block, the server requests the client for information about the block; When the client receives a request for information about a block from the server, collecting and transmitting information about blocks of the client to the server; Determining, by the server, a task to be performed for each block and configuring information necessary for the task; The server transmitting the configured information to the client; The client performing an update operation for each block based on the information received from the server, and notifying the server of the operation result; And The server comprises the step of recording the operation result of the mobile anti-malware service. The method of claim 2, Validating the currently active VDB location on the client, Checking whether information on the currently active VDB location exists, and if the VDB location information exists, loading the VDB location and executing a loop by the number of blocks; Checking whether the loop is executed by the number of blocks; If the loop is not executed as many times as the number of blocks, checking whether the block checksum of the VDB position and the md5 hash value of the actual block are the same; Removing the damaged block if the block checksum of the VDB position and the md5 hash value of the actual block are not the same; If the loop is executed as many as the number of blocks, checking whether the VDB location information is changed; And And if the VDB location information has been changed, updating the changed VDB location information. The method of claim 5, The client performing the update operation for each block based on the information received from the server, The client performing a loop by the number of block information received from the server; Checking whether the loop is performed by the number of block information; If the loop is not performed as many as the block information, it is checked whether there is free space to store the result of the block change operation. If there is free space, performing a block change operation based on the block change information configured in the server; And And if the loop is performed as many as the block information, checking whether a block change occurs and updating the changed VDB location information. The method of claim 7, wherein Securing the storage space is to secure the storage space according to a storage management policy. The method of claim 5, In the step of determining the work to be performed for each block and configuring the information necessary for the work, the server, The server determines whether to perform an add / remove / replace / update operation for each block, and configures information necessary for the operation. 10. The method of claim 9, The server determines whether to perform an add / remove / replace / update operation for each block, and configure information necessary for the operation. The server searching for block information corresponding to the location ID in the server DB and performing a loop as many as the number of blocks; Checking whether the loop is performed by the number of blocks; If the loop is not performed as many as the number of blocks, check whether the block ID exists in the client, and if the block ID does not exist in the client, configure additional information. Checking whether the IDs match; If the block version ID and the client block version ID do not match, determining whether the replacement operation or the update operation is performed, and performing replacement operation information configuration if the replacement operation is performed; If the block version ID and the client block version ID coincide with each other, checking whether the inquired block checksum and the client block checksum match; Performing replacement operation information configuration if the block checksum does not match the client's block checksum; Checking whether the block ID exists in an inquiry result when the number of blocks is looped; And And performing the removal operation information configuration because the block ID exists in the inquiry result. The method of claim 2, And the server checks whether there is a change in the location determiner using the checksum information of the location determiner received from the client. The method of claim 2, The server checks whether the update of the VDB location is necessary by using the location ID of the VDB location, the version ID of the VDB location, and the number of blocks of the VDB location received from the client. 5. The method of claim 4, The server requesting the client for information about the block includes: The server requests the client for block information including a block ID, a block version ID, and a block checksum. The method of claim 10, If the block version ID and the client block version ID do not match, it is determined whether the replacement operation or the update operation, The mobile anti-malware service method, characterized in that if the change to the client block version ID more than the reference value is determined as a replacement operation, otherwise it is determined as an update operation.

Images