KR20130015236A - User terminal and service server for processing security of the user terminal - Google Patents

Abstract

PURPOSE: A user terminal and a service server device thereof are provided to protect a user terminal from problems by separating the operation of an application from controlled data. CONSTITUTION: An execution unit(105) executes an application by calling an API(Application Program Interface) which is necessary to execute the application. A routing verification unit(103) determines the routing of a terminal. When the routing of the terminal is determined, a management unit(107) restricts the call of the API. The routing verification unit installs a service demon for confirming the routing of the terminal. The service demon is automatically executed as a back ground type in the booting of the terminal. The service demon executes the script including information for confirming the routing of the terminal. [Reference numerals] (100) User terminal; (101) Communication unit; (103) Routing verification unit; (105) Execution unit; (107) API management unit

Description

USER TERMINAL AND SERVICE SERVER FOR PROCESSING SECURITY OF THE USER TERMINAL}

The present invention relates to a user terminal and a service server apparatus for performing terminal security.

With the recent smartphone activation, various applications can be installed and run on the smartphone. As a result, a number of important problems affecting a terminal error due to an application or system performance are occurring.

Conventionally, in order to check whether an application may cause a problem in a user terminal, the application should be installed once and executed in the user terminal and checked. Also, identifying risks from hidden code was difficult to find even when running the application. As a result, these applications are installed in the user terminal, causing a lot of problems, and there is a demand for a way to block them.

In addition, the smartphone users have the operator authority locked to the smartphone through the terminal routing, the user can adjust the terminal system at will. Therefore, operators are making various attempts to prevent this.

For example, in the case of a financial application, it is executed in a rooted terminal to check whether the terminal is rooted in the financial application itself in order to prevent the user information from being disclosed.

However, when the application checks whether the terminal is individually routed as described above, there is a problem of implementing a function for checking whether all applications are routed, and thus, the terminal does not completely prevent routing.

In addition, if the routing pattern changes, the ability to check whether the route should change must be changed, which in turn causes problems such as reinstalling the application itself.

Accordingly, the technical problem to be achieved by the present invention is to provide a user terminal and a service server apparatus that can limit the applications that can cause problems in advance, and performs terminal security to facilitate checking whether the terminal is rooted.

According to one aspect of the invention there is provided a user terminal. The terminal includes: an execution unit for executing an application and calling an application programming interface required to execute the application; Routing verification unit for determining whether the terminal routing; And a management unit that limits the call of the application programming interface of the execution unit when the routing verification unit determines that the terminal is rooted.

According to another feature of the invention there is provided a service server device. The apparatus may include a verification unit that analyzes code of an application for which a developer requests registration and determines whether there is a possibility of causing a problem in a user terminal in which the application is installed; And a registration unit for registering an application in which the verification unit determines that a problem may occur, and registering an application that does not have a problem. The registered application is distributed to a user terminal through a plurality of different distribution channels. do.

According to an embodiment of the present invention, it is possible to protect a user terminal by limiting an application which may cause a problem when registering an application in advance and determining whether the terminal is rooted in advance so that the application is not executed through the manipulated data. can do.

In addition, conventionally, in order to identify a problem-prone application, the application must be installed on the terminal once. However, in the embodiment of the present invention, the problem code may be confirmed in advance on the application code to restrict the registration of the corresponding application. You can exclude problematic applications before they are installed.

In addition, by managing a script for checking whether the terminal is rooted by the server for each type of terminal, and periodically updated, it is possible to solve the problem that was not able to cope when the routing pattern is changed in the past.

1 is a network configuration diagram according to an embodiment of the present invention.
2 is a block diagram showing a detailed configuration of a user terminal for performing terminal security according to an embodiment of the present invention.
3 is a block diagram showing a detailed configuration of a service server for performing terminal security according to an embodiment of the present invention.
4 is a flowchart illustrating an application registration process according to an embodiment of the present invention.
5 is a flowchart illustrating a routing verification process according to an embodiment of the present invention.
6 is a flowchart illustrating an application execution process according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

Also, the term "part" in the description means a unit for processing at least one function or operation, which may be implemented by hardware, software, or a combination of hardware and software.

Hereinafter, a user terminal and a service server apparatus for performing terminal security according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a network configuration according to an embodiment of the present invention.

Referring to FIG. 1, in the network configuration diagram, a user terminal 100 and a service server (or a service server device, hereinafter referred to as a “service server”) 200 are connected through a network 300.

Here, the user terminal 100 is a terminal for downloading, installing and executing an application, for example, may be a smartphone.

In addition, the service server 200 may be a server that not only processes registration of an application installed in the user terminal 100 but also distributes the application to the user terminal 100 through a unique distribution channel.

In this case, the user terminal 100 and the service server 200 perform terminal security.

The terminal security is to limit the applications that can cause problems in the application registration in advance, and to determine whether the terminal is rooted (Rooting) in advance so that the application is not executed through the manipulated data (data).

To this end, the present invention is implemented in two embodiments, one of which allows the user terminal side to block application execution in a terminal rooting state, and another embodiment of the terminal system before the application is distributed to the user terminal. It does not allow registration of applications that attempt to access it.

First, Figure 2 is a block diagram showing a detailed configuration of a user terminal for performing terminal security according to an embodiment of the present invention.

Referring to FIG. 2, the user terminal 100 includes a communication unit 101, a routing verifying unit 103, an execution unit 105, and an application programming interface (hereinafter, referred to as an “API”) managing unit 107. ).

The communication unit 101 is connected to the network 300 to transmit and receive data, and is connected to the service server 200.

The routing verification unit 103 executes a pre-installed routing service daemon at the time of booting. Here, the daemon is a program that is continuously executed to process periodic service requests, and refers to a program that runs in the background and performs various tasks.

At this time, the executed routing service daemon executes a script (scrypt) for checking whether the terminal is rooted. Here, the rooting means having the rights of the owner who has access to, modify, and control all the settings of the operating system and the system, and changes the various settings of the system.

In addition, a script is a set of instructions that are translated and executed by a program other than a computer processor or compiler, and are composed of short programs or instructions written in a language other than a programming language. These scripts are stored in the service daemon's memory and cannot be modified by the user.

The script is periodically updated, and the routing verification unit 103 periodically accesses the service server 200 through the communication unit 101 to download the script.

The script is determined to be a case where the terminal is rooted if the corresponding folder and file path is accessible, including a folder and file path accessible only to the root user. In addition, the script includes a shell command having a root user authority, and when such a shell command is normally executed, it is determined that the terminal is rooted.

Here, a shell command means a command interpreted by the shell, and a shell means a command interpreter of Linux. In other words, all commands used in Linux are interpreted by the shell and executed by searching for them.

The execution unit 105 executes an application and calls an API necessary for executing the application.

The API manager 107 manages a plurality of APIs executed in the user terminal 100, and returns an API requested by the execution unit 105 or processes an error.

In general, an application installed on a smartphone uses an API, which is a standardized library, for ease of programming and execution. These APIs are a set of more than 1000 functions that allow you to do things like create windows and open files when creating applications in the operating system or in languages like C, C ++, Pascal, and so on. An API has a language or message format that is used when an application communicates with a system program such as an operating system or database management system. The API is implemented by calling a function that provides a link to a specific subroutine for execution within an application. Thus, an API has several program modules or routines that must already exist or be linked in order to perform the work requested by the function call.

In this case, when the API is called from the execution unit 105, the API manager 107 checks whether the user terminal 100 is routed through the routing verification unit 103, and determines that the API is routed. Returns. On the other hand, if it is not rooted, the called API is returned to the execution unit 105.

Here, the API whose call is restricted depending on whether the terminal is routed may be an API provided by an operator, and may be, for example, a KAF (KT Application Framwork) API.

3 is a block diagram showing a detailed configuration of a service server for performing terminal security according to an embodiment of the present invention.

Referring to FIG. 3, the service server 200 includes a register 201, a verifier 205, an application register DB 203, a script transmitter 207, and a script DB 209.

The registration unit 201 performs a procedure for registering an application requested by a developer, and stores the application in the application registration DB 203 when registration is completed. Thereafter, the application stored in the application registration DB 203 is provided to the user terminal 100 through various distribution channels.

At this time, the registration unit 201 blocks the registration of an application that can access a restricted folder, call a restricted API, or execute a restricted command.

The verification unit 205 manages folder information of the terminal that should not be accessed by the application, APIs and commands that should not be used in the application. The verification unit 205 analyzes the application code in which the registration unit 201 is requested to register and determines whether the application is accessible to a restricted folder, calls a limited API, or executes a limited command, and determines the result of the registration unit 201. To provide.

The script DB 207 stores a script for checking whether a terminal is rooted for each terminal type (or model).

The script transmitter 209 transmits a script for checking whether the user terminal 100 is rooted at the request of the user terminal 100 periodically. At this time, the type of the user terminal 100 requesting the script is checked and the corresponding script is extracted from the script DB 207 and provided.

Based on the above description, the process of registering an application, verifying rooting, and executing an application will be described.

4 is a flowchart illustrating an application registration process according to an embodiment of the present invention, and illustrates an operation of the service server of FIG. 3.

Referring to FIG. 4, when the registration unit 201 of the service server 200 receives an application registration request from the developer (S101), the verification unit 205 of the service server 200 analyzes the application code (S103).

The verification unit 205 of the service server 200 determines whether the application requested for registration is accessible to the restricted folder according to the application code analysis (S105).

If not accessible, the verification unit 205 of the service server 200 determines whether the application requested to be registered calls a restricted API (S107).

If the limited API is not called, the verification unit 205 of the service server 200 determines whether to execute a limited command (S109).

If the limited command is not executed, the registration unit 201 of the service server 200 completes the registration of the application for which registration is requested (S111), and stores it in the application registration DB 203.

On the other hand, if it is determined that the restricted folder is accessible in step S105, the restricted API is called in step S107, or the restricted command is executed in step S109, the registration unit 201 of the service server 200 processes an application registration error ( S107).

Here, steps S105, S107, and S109 may be changed in order or performed simultaneously.

FIG. 5 is a flowchart illustrating a routing verification process according to an exemplary embodiment of the present invention, and illustrates an operation of the user terminal of FIG. 2.

Referring to FIG. 5, the root verifying unit 103 of the user terminal 100 installs a service daemon for checking whether a route is present (S201).

At this time, the service daemon executes a script (scrypt) to check the routing, the routing verification unit 103 of the user terminal 100 is periodically updated by downloading (S203, S205) such a script from the service server 200 (S207).

Subsequently, when the terminal booting step S209 is performed, the routing verification unit 103 of the user terminal 100 executes the service daemon (S211) and executes a script (scrypt) by the service daemon (S213).

When the script is executed, the routing verification unit 103 of the user terminal 100 determines whether the system folder is accessible (S215).

If it is not possible, it is determined whether a system command included in the script is executable (S217).

If not executable, the API execution permission set in the user terminal 100 is set (S219).

On the other hand, if it is determined that the system folder is accessible in step S215 or if the system command is executable in step S217, the user terminal 100 determines that it is rooted (S221) and sets the execution restriction of the API ( S223).

6 is a flowchart illustrating an application execution process according to an exemplary embodiment of the present invention, and illustrates an operation of the user terminal of FIG. 2.

Referring to FIG. 6, the execution unit 105 of the user terminal 100 executes an application (S301) and calls an API required for executing the application (S203).

Then, the API manager 107 of the user terminal 100 checks whether the user terminal 100 is routed through the routing verification unit 103 (S305). Checking whether the routing is managed by the routing verification unit 103 through the process of FIG.

At this time, if it is not determined as a routing terminal, the API management unit 107 of the user terminal 100 returns the normal API results to the execution unit 105 (S307).

On the other hand, if it is determined that the routing terminal, the API management unit 107 of the user terminal 100 returns an error due to routing to the execution unit 105 (S309).

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (10)

An execution unit which executes an application and calls an application programming interface required to execute the application;
Routing verification unit for determining whether the terminal routing; And
If the routing verification unit determines that the terminal is rooted, the management unit for limiting the call of the application programming interface of the execution unit
Lt; / RTI > The method of claim 1,
The routing verification unit,
Install a service daemon for checking whether the terminal is rooted,
The service daemon automatically runs in the background when the terminal is booted. The method of claim 2,
The service daemon,
And a user terminal executing the script when the service daemon is executed, including a script including information for checking whether the terminal is rooted. The method of claim 3,
The script is
Contains restricted folder information that should not be accessed by the application, limited application programming interface and limited commands that should not be used by the application,
The routing verification unit,
And determining the terminal routing by determining whether access to the restricted folder information, access to the restricted application programming interface is performed, and whether the restricted command is executed according to the execution of the script. 5. The method of claim 4,
The limited application programming interface,
User terminal that is an application programming interface provided by a specific operator. 6. The method according to any one of claims 3 to 5,
Further comprising a communication unit for connecting to the service server for transmitting the script over a network,
The routing verification unit,
User terminal for periodically updating the script by receiving a script from the service server through the communication unit. A verification unit for analyzing a code of an application that a developer requests registration to determine whether there is a possibility of causing a problem in a user terminal in which the application is to be installed; And
The registration of the application that the verification unit has determined that the problem is likely to be error processing, the application that is not likely to have a problem includes a registration unit for registration processing,
The application server of the registration process is distributed to the user terminal through a plurality of different distribution channels. The method of claim 7, wherein
Wherein the verifying unit comprises:
Manages folder information of a terminal whose access is restricted to an application, an application programming interface and a command whose use is restricted to an application, and analyzes the code of the application to determine access to the folder information of the restricted terminal, and the restricted application programming. Service server device for determining whether to use the interface and the command. The method of claim 7, wherein
Further comprising a transmitting unit for periodically transmitting a script for checking whether the routing to the user terminal,
The script is
A service server device including folder information of a terminal for which access is restricted to an application, information about an application programming interface and a command for which usage is restricted to an application. 10. The method of claim 9,
Further comprising a script DB for storing a script consisting of information for checking whether the corresponding terminal is routing for each type of terminal or model of the terminal,
Wherein the transmission unit comprises:
Checking the terminal type or the terminal model of the user terminal, selecting a script corresponding to the terminal type or the terminal model from the script DB, and transmitting the selected script to the user terminal.

Images