KR101042794B1 - System-on-chip and asic based malware detecting apparatus in mobile device - Google Patents

Abstract

The present invention relates to a technology for detecting malicious code introduced into a mobile terminal, which is composed of custom-based semiconductor (ASIC) -based hardware on a system-on-chip. The present invention is a hardware-based to perform a packet filtering operation for the packet received from the outside through the media access control unit according to the setting of the firewall setting unit on the system-on-chip memory, or to store in the application memory, or to deliver to the anti-malware engine With a firewall; Hardware-based to detect malicious code by performing pattern matching between the code pattern in the file received from the firewall or the file received through the input / output interface unit and the pattern of malicious code registered in the malware signature database on the system-on-chip memory in the system-on-chip With an anti-malware engine; A system-on-chip memory configured to provide setting contents of the firewall and include the malware signature database; A system-based chip configured to control a switching operation so that the file filtered by the firewall is directly transmitted to an application memory or an anti-malware engine, and to control a cycle for detecting malware of the anti-malware engine. Is achieved.

Mobile Devices, Anti-Malware, System-on-Chip, Firewalls, Anti-Malware Engines

Description

System-on-Chip and Custom Semiconductor-based Malware Detection Device in Mobile Terminals

The present invention relates to a technology for detecting malicious code applied to a mobile terminal, and in particular, by building a firewall and anti-malware engine with ASIC-based hardware on a system-on-chip in consideration of the improvement of resources and performance of the mobile terminal, The present invention relates to a system-on-chip and custom-semiconductor based malicious code detection device for detecting malicious code introduced into a mobile terminal.

Recently, with the widespread use of smart phones, personal digital assistants (PDAs), and WiBro terminals, these portable terminals are becoming a necessity for modern life. Many people use mobile devices to talk about each other, exchange information, and exchange business-critical information through voice and data communication.

However, as the hardware functions of the mobile terminal are expanded and advanced, the applications executed in the mobile terminal are diversified and complicated, so that the malicious code that has previously attacked the computer is likely to cause serious damage to the mobile terminal. In particular, due to the proliferation of wireless mobile Internet services such as WiBro, in addition to malicious codes that attack vulnerabilities of existing computer applications, the weaknesses of applications and services for mobile terminals such as Bluetooth and MMS (Multimedia Messaging System) Mobile malware has been introduced to attack.

Examples of the mobile malicious code include a thymophonica worm, an I-mode malicious code, a short message service (SMS), a virus operating in a palm OS, and a virus (Phage, Vapor, Liberty).

These malicious codes not only cause malfunction of the mobile terminal but also cause serious damage such as deleting data or leaking user's personal information. Therefore, there is a demand for measures to effectively protect the mobile terminal from various malicious codes.

Anti-Malware (Anti-Malware) solutions applied to conventional mobile terminals are based on software, and the basic operation thereof is as follows. The software-based antivirus program basically includes an anti-malware engine and a signature matching unit, and has a structure in which a virus signature database is periodically updated.

In such a structure, when anti-virus software scans files, the anti-virus software finds a match with signatures existing in the database, and checks for virus infection or detects abnormal files. In addition, a firewall applied to a conventional portable terminal blocks all network access input from the outside or a network connection with a specific external external program according to policy setting.

As described above, anti-malware solutions applied to conventional mobile terminals are built as software and used as mobile devices. However, since mobile devices are relatively limited in resources such as central processing unit and battery, it is inconvenient for a user to perform other tasks besides malware detection due to performance degradation when using the existing model. Will suffer.

In addition, when using a software-based antivirus solution applied to a conventional portable terminal, there is a difficulty in monitoring all packets due to performance degradation when monitoring packets received through a network.

Accordingly, an object of the present invention is to solve the performance degradation of a software-based antivirus solution, and to overcome the limitations of a software-based cooperative malware signature (malware signature) database. It is to provide a device that detects malicious code flowing into a mobile terminal by configuring a firewall and anti-malware based on ASIC) and changing the virus signature database to be locally reflected.

The present invention for achieving the above object,

A hardware-based firewall for performing a packet filtering operation on packets received from the outside through the media access control unit according to the setting contents of the firewall setting unit on the system-on-chip memory, and storing the packet in an application memory or forwarding the packet to an anti-malware engine;

Hardware-based to detect malicious code by performing pattern matching between the code pattern in the file received from the firewall or the file received through the input / output interface unit and the pattern of malicious code registered in the malware signature database on the system-on-chip memory in the system-on-chip With an anti-malware engine;

A system-on-chip memory which provides setting contents of the firewall and supports a file decoding function for file format recognition in the anti-malware engine;

And a hardware-based controller that controls the switching operation so that the file filtered by the firewall is directly transferred to an application memory or to an anti-malware engine, and controls a malware detection cycle of the anti-malware engine. It is characterized by the configuration.

Preferably, the mobile device application unit interacting with the system on a chip is built in the application memory to update the vaccine version, and is connected to the mobile device application unit for adopting the corresponding connection method according to the network used on the server side It works in conjunction.

The present invention is composed of ASIC-based hardware on the system-on-chip to detect malicious code flowing into the mobile terminal, thereby improving virus scanning and matching performance. Accordingly, there is an effect that can perform an antivirus service at the same time while performing other tasks on the mobile device.

In addition, all packets can be monitored through a hardware-configured firewall, which keeps the mobile device more secure from mobile viruses.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing an embodiment of a system-on-chip and custom-semiconductor based malware detection device in a mobile terminal according to the present invention. As shown therein, a media access control (MAC) 10 is shown. And an input / output interface 20, a system on chip 30, an application memory 40, and an OTA module 50.

The system on chip 30 includes a firewall 31, an anti-malware engine 32, a memory 33 for the system on chip 33, and a controller 34, which are implemented as an ASIC-based hardware. .

The firewall 31 is composed of a receiver 31A, a packet identification unit 31B, a packet filtering unit 31C, and a transmitter 31D.

The system-on-chip memory 33 includes a firewall setting unit 33A, a malware signature database 33B, and an anti-malware module unit 33C.

The system-on-chip 30 is mounted on the main PCB of the portable terminal, and the mobile device application unit is built on the peripheral medium access control unit 10, the input / output interface unit 20, and the application memory 40. It operates in conjunction with 40A and the OTA module 50. The system-on-chip 30 is operated in an autonomous monitoring mode that is preprogrammed with a normal working state rule of the input / output data flow, and a mode for disabling the input and output channels when the current state exceeds the normal state rule. .

The medium access control unit 10 is part of the data connection layer of the OSI basic reference model, and is a layer specific to a local area network (LAN) that exists on a property in which multiple nodes share the same medium. Packets received from the outside through communication (wireless communication) are transmitted to the system on chip 30 through the medium access control unit 10.

The packets transmitted to the system on chip 30 through the media access control unit 10 are stored in the application memory 40 as they are through the firewall 31 or are transmitted to the anti-malware engine 32. The application memory 40 includes an operating system (OS) and various programs used in a mobile device.

In the firewall 31, the receiving unit 31A receives the packets received through the medium access control unit 10 and transmits the received packets to the packet identification unit 31B. At this time, the packet identification unit 31B classifies the input packets and outputs them to the packet filtering unit 31C. The packet filtering unit 31C performs filtering, such as 'allow' and 'drop', on the input packet according to the setting contents of the firewall setting unit 33A of the system-on-chip memory 33. The filtered packets are stored in the application memory 40 as they are or transmitted to the anti-malware engine 32.

The input / output interface unit 20 includes an input / output chip, a card, a Bluetooth module, and the like. The input / output interface unit 20 transmits files to be used in the mobile device application unit 40A to the anti-malware engine 32.

The anti-malware engine 32 performs a malware detection operation on the packet filtered file output from the packet filtering unit 31C and a file newly input from the input / output interface unit 20. The malware signature database 33B is built on the system-on-chip memory 33 in the system-on-chip 30, and the anti-malware engine 32 is registered in the malware signature database 33B to detect malware. A pattern matching operation is performed between the pattern of and the code pattern in the file input to the path.

As described above, the malware signature database 33B is not built on the application memory 40, but on the system on chip memory 33 in the system on chip 30, thereby simplifying the installation process and operation. Installation time is reduced.

The anti-malware module unit 33C supports additional functions for detecting malware in the system on chip 30. For example, the function of cleaning up the database after a certain period of time in the malware signature database, parallel processing of malware detection, and periodic setting function.

The malware signature database 33B and the anti-malware module unit 33C may be manually or preset by the OTA module 50 when a firewall code or code of the anti-malware engine 32 is changed or modified through a network. Automatically updated at intervals. The malware signature database 33B is automatically updated through the path for each mobile device.

The controller 34 switches the file output from the packet filtering unit 31C to the anti-malware engine 32 to perform a malicious code detection operation or to be output to and stored in the application memory 40 as it is. In controlling the operation and detecting the malware, the controller performs the control to be performed at an appropriate period or time point in consideration of battery power consumption.

2 shows the structure of the application unit 40A for mobile devices operating in conjunction with the system-on-chip 30. As shown in FIG. 2, the application module 41 and the database information unit 42 are largely formed. .

The application module 41 includes a version sync module 41A, an update module 41B, a center connection module 41C, and a tag generation module 41D. The database information section 42 is composed of a center URL information section 42A and a device information section 42B.

The version synchronization module 41A compares the vaccine version of the server with the vaccine version of the mobile terminal at predetermined intervals and, if they are different, operates the update module 41B so that the vaccine version of the mobile terminal is updated to the latest version of the server. In addition, the version synchronization module 41A operates the update module 41B to update the vaccine version of the mobile terminal even in a situation where the malware signature database on the server side needs to be updated.

As such, the security policy is effective only when the vaccine version is updated frequently based on the vulnerabilities that occur constantly.

When the various connection methods are given to the user, the center connection module 41C prioritizes the connection method and adopts the connection method according to the network used on the server side. For example, if WiFi is available, select a mobile carrier to connect via WiFi instead of accessing the center URL. In this case, the center URL information unit 42A is used to connect the mobile terminal with the network of the server side through the medium access control unit 10 through the adopted connection method (eg, wireless LAN (eg, WiFi), mobile communication company). .

The tag generation module 41D generates a tag for each operating system (OS) on the malware signature database 33B, and the generated tag is stored in the malware signature database 33B.

In addition, the tag generation module 41D performs a tagging operation on which local information and which version information the corresponding database is when the malware signature database 33B is updated. The version information and local information are stored and managed in the tag generation module 41D.

The device information unit 42B maintains information required by the device.

Although the preferred embodiment of the present invention has been described in detail above, the scope of the present invention is not limited thereto, and may be implemented in various embodiments based on the basic concept of the present invention defined in the following claims. Such embodiments are also within the scope of the present invention.

1 is a block diagram of a system-on-chip and custom semiconductor-based malware detection device in a mobile terminal according to the present invention.

FIG. 2 is a detailed block diagram of an application unit for a mobile device in FIG. 1. FIG.

*** Description of the symbols for the main parts of the drawings ***

10: medium access control unit 20: input and output interface unit

30: system on chip 31: firewall

31A: Receiving unit 31B: Packet identification unit

31C: packet filtering unit 31D: transmitting unit

32 Anti-Malware Engine 33: Memory for System-on-Chip

33A: Firewall Settings 33B: Malware Signature Database

33C: anti-malware module 34: controller

40: application memory 40A: mobile application unit

41: Application Module 41A: Version Synchronization Module

41B: Update module 41C: Center connection module

41D: tag generation module 42: database information unit

42A: center URL information section 42B: device information section

42C: Malware Signature Database

50: OTA Module

Claims (9)

A firewall for classifying and filtering packets received from the outside, a system-on-chip memory that stores packets output from the firewall, or includes configuration information and a malware signature database of the firewall, and received from the firewall An anti-malware engine that detects malicious code based on the malware signature database for a file or a file input from an input / output interface unit, delivering the filtered file from the firewall to the anti-malware engine, and the malicious of the anti-malware engine A system on chip including a controller for controlling the code detection period; And It operates in conjunction with the system on a chip, and stores the data related to the application, malicious in the mobile terminal comprising a memory for the application including a tag generation module for generating a tag for each operating system on the malware signature database Code detection device. The method of claim 1, The system-on-chip memory A firewall setting unit storing setting values for packet filtering of the firewall; A malware signature database that stores patterns of malware to detect malware, And an anti-malware module unit configured to store parallel processing or periodic setting function information of the malware detection of the anti-malware engine. The method of claim 2, The malware signature database and the anti-malware module unit is updated through an OTA module when a firewall code or the code of the anti-malware engine is changed through a network. The method of claim 1, The system on chip is a malware detection device in a mobile terminal, characterized in that the custom semiconductor. The method of claim 1, The firewall, A receiving unit which receives the packets received through the medium access control unit and delivers them to the packet identification unit; A packet identification unit for classifying and outputting the input packets; Device for detecting malicious code in a mobile terminal, characterized in that it comprises a packet filtering unit for filtering the input packet according to the setting content. The method of claim 1, The application memory further includes an application module for comparing the vaccine version of the server and the vaccine version of the mobile terminal at predetermined intervals and, if they are different, operate the update module to update the vaccine version of the mobile terminal to the latest version of the server. Malware detection apparatus for a mobile terminal, characterized in that. The method of claim 6, And the application memory includes a database information unit for storing data of the mobile device and maintaining information required by the mobile device. The method of claim 7, wherein The database information unit, A center URL information unit for connecting the mobile terminal with the network at the server side through a media access control unit by an adopted access method; Device for detecting malware in a mobile terminal, characterized in that it comprises a device information unit for holding the information required by the mobile device. delete

Images