KR101047659B1 - Cloud-based mobile anti-malware systems, cloud centers and mobile devices - Google Patents

Abstract

The present invention relates to a mobile anti-malware system, and the mobile anti-malware system of the present invention includes an anti-malware including a malware database through a cloud of a corresponding cloud center based on a region where a mobile device is located. A plurality of cloud centers for transmitting data necessary for the mobile device, a mobile device for downloading anti-malware data including a malware DB from the cloud center to update an anti-malware application, and the plurality of cloud centers and the mobile device It includes a wired and wireless network connected to the network. According to the present invention, at the time of updating the malware DB on the mobile device, minimal data traffic is transmitted and received, thereby preventing waste of communication resources.

Malware, Malware, Malicious Software, Resources, Mobile, Cloud, Applications.

Description

Cloud anti-malware system based on cloud, cloud center and mobile device}

The present invention relates to a mobile anti-malware system, and more particularly, to a mobile anti-malware system for securely maintaining a mobile device from malware including malicious code and malicious software.

Malware is software that is specifically designed to harm or interfere with a system, such as viruses or Trojan horses, or code and malicious software that can endanger data, computers, or networks, or This word is derived from malicious code and refers to software developed to damage other systems. Recently, malware needs to open an attachment or download and install the software. Just click on a link or image on a popular search page to install unwanted software, and the system can be hijacked. do.

In general, a computer virus is a combination of instructions that modify a computer program or executable part and copy itself or its modifications to it to damage the computer's operation. It is a type of computer program that infiltrates data, destroys data, or destroys other programs. A virus works when you start your computer with an infected disk or when you run a specific program, which destroys data, interrupts your computer's operation, and replicates itself to infect other computers.

The path of infection of such a computer virus has a very diverse and complicated structure. The most common paths are illegal copying, computer communication, computer sharing, LAN or the Internet. Using pirated software diskettes or working on a computer that is shared by several people is more likely to cause a virus infection, and you will be infected with the diskette or program without your knowledge. If you use these infected diskettes or programs on your computer, The computer is also infected. Recently, as the use of computer communication increases, viruses spread rapidly when sending and receiving data.

On the other hand, due to the relationship between the operating system and the file system is less than the computer, and the importance of the data used is relatively low, the recognition and damage of the mobile virus to the wireless communication system is not yet large.

However, wireless terminals are now adopting the functions of computers and are developing into smart phones, and as the wireless network of wireless terminals expands to comparable to the wireless Internet, the virus damage occurring in computers is reproduced in wireless networks of wireless terminals. It is likely to be.

In reality, damages to mobile viruses are appearing. As a specific example of mobile virus damages, in Japan's representative mobile phone Internet service, Japan's I-Mode, hundreds of mobile phones in Japan are threatened by police due to malware stored in software. There was an incident that caused the phone number to be called.

In addition, mobile viruses are expected to increase gradually as securities and bank transactions are possible using wireless terminals, and the explosive increase in users of wireless terminals is expected to have a greater impact than the damage of computer viruses. Security and safety have become one of the most important issues.

In an anti-malware system for anti-malware of such a mobile device, the entire malware DB is downloaded from a server in order to update a malware database (hereinafter referred to as 'DB') on a mobile device. By doing so, conventionally, a large amount of data traffic is transmitted and received between the server and the mobile device, resulting in waste of communication resources, and there is a problem in using a mobile application due to limited resources of the mobile device.

In addition, the mobile communication environment is also globalized and roaming services are introduced to countries around the world. In the conventional anti-malware system, there is a problem in that it cannot effectively cope with malware generated in each region.

The present invention has been made to solve the above problems, to minimize the waste of communication resources by transmitting and receiving a minimum data traffic when updating the malware DB on the mobile device, it is possible to effectively use the limited resources of the mobile device The purpose is to provide a mobile anti-malware system.

It is also an object of the present invention to provide a mobile anti-malware system that can effectively respond to malware generated in each region of the world.

The mobile anti-malware system of the present invention for achieving the above object is to provide data necessary for anti-malware including a malware database (DB) through the cloud of the cloud center based on the region where the mobile device is located. A plurality of cloud centers that transmit to the mobile device, a mobile device that downloads data required for anti-malware including a malware DB from the cloud center to update an anti-malware application, and is connected to the plurality of cloud centers and the mobile device Includes wired and wireless networks.

The cloud center includes an anti-malware update server for updating a malware database, an anti-malware update server for updating anti-malware, an anti-malware database for updating a malware signature database, and anti-malware software for storing a malware signature. It may include a malware version patch. The malware DB of the cloud center includes mobile virus information active in the region. Each DB of the cloud center may be divided by operating system of each mobile device.

The mobile device may include an anti-malware engine for driving anti-malware software, an application module including various applications required for anti-malware operation, and a DB module including various DBs of the mobile device.

The application module is a version sync module for matching the antivirus software version of the cloud center with the antivirus software version of the mobile device, and for updating the DB by downloading the minimum data from the corresponding cloud center based on the location. It may include a DB update module and a connection module for connecting to the wired or wireless communication network.

The version sink module may upgrade the vaccine software version of the mobile device to the vaccine software version of the cloud center when the vaccine software version of the cloud center and the vaccine software version of the mobile device are different.

The connection module may identify the network through which the cloud center is connected, and may be connected through the network.

The DB module may include a center URL information DB in which the URL information of the cloud center is stored, a device information DB in which information necessary for the mobile device is stored, and a malware signature DB including malware signature information.

The URL information of the cloud center stored in the center URL information DB may be used to select a connection method with the wired / wireless communication network in a mobile device.

According to the present invention, at the time of updating the malware DB on the mobile device, minimal data traffic is transmitted and received, thereby preventing waste of communication resources. That is, in the present invention, since the minimum data traffic required for the mobile device is transmitted through the cloud close to the region where the mobile device is located, unnecessary large amount of traffic can be prevented from being transmitted.

In addition, the present invention has the advantage to effectively use the limited resources of the mobile device. That is, in the present invention, since optimized data is transmitted and received, there is an effect that an optimal DB can be constructed while using the minimum resources of the mobile device.

In addition, the present invention has the advantage of being able to effectively respond to malware occurring in each region of the world. That is, in the present invention, there is an effect that can immediately respond to malware generated in the world region.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used for the same reference numerals even though they are shown in different drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a block diagram showing a mobile anti-malware system according to an embodiment of the present invention.

Referring to FIG. 1, the mobile anti-malware system includes a mobile device 100, a plurality of cloud centers 200a, 200b, and 200c, and an internet network 300.

The plurality of cloud centers 200a, 200b, and 200c provide data required for anti-malware including a malware database (DB) through a cloud of a corresponding cloud center based on the region where the mobile device 100 is located. Transmit to the mobile device 100. 1 illustrates a cloud center 200a located in Korea, a cloud center 200b located in the United States, and a cloud center 200c located in Europe. For example, if the mobile device 100 is located in the United States, the cloud center 200b located in the United States transmits data necessary for the anti-malware to the mobile device 100.

The mobile device 100 downloads data necessary for anti-malware including a malware DB from the cloud centers 200a, 200b, and 200c to update the anti-malware application. The mobile device 100 may communicate with the internet network 300 through a plurality of repeaters 11 and 13.

The internet network 300 is connected to a plurality of cloud centers 200a, 200b and 200c and the mobile device 100. In FIG. 1, the internet network 300 is only one example of a wired and wireless communication network, and various wired and wireless communication networks may be used according to embodiments. For example, a mobile network such as WiFi may be used as the wired or wireless communication network.

2 is a block diagram illustrating an internal configuration of a mobile device according to an embodiment of the present invention.

2, the mobile device 100 includes an anti-malware engine 110, an application module, and a DB module.

The anti-malware engine 110 is used to run anti-malware software.

The application module includes various applications required for anti-malware operation, and includes a version sync module 120, a DB update module 130, a connection module 140, and a tag generation module 150.

The version sink module 120 serves to match the antivirus software version of the cloud center 200 with the antivirus software version of the mobile device. In one embodiment of the present invention, the version sink module 120 is a vaccine device version of the cloud center 200, if the vaccine software version of the cloud center 200 and the vaccine software version of the mobile device 100 is different, the mobile device The antivirus software version of 100 may be upgraded.

The DB update module 130 updates the DB by downloading the minimum data from the cloud center 200 based on the location.

The connection module 140 is used for connection with the wired / wireless communication network 300. In an embodiment of the present invention, the connection module 140 may determine which network the cloud center 200 is connected to, and control the mobile device 100 to be connected through the corresponding network.

Whenever the tag generation module 150 downloads a malware DB related to the mobile device 100 locally, the tag generation module 150 generates a tag for checking information corresponding to the mobile device 100.

The DB module includes various DBs of the mobile device 100, and includes a center URL information DB 160, a device information DB 170, and a malware signature DB 180.

The center URL information DB 160 stores URL information of the cloud center 200. In one embodiment of the present invention, the URL information stored in the center URL information DB 160, the connection module 140 to grasp the connection network method of the cloud center 200, to connect the mobile device 100 to the corresponding network It can be used to

The device information DB 170 stores information necessary for the mobile device 100.

The malware signature DB 180 includes malware signature information.

3 is a block diagram showing an internal configuration of a cloud center according to an embodiment of the present invention.

Referring to FIG. 3, the cloud center 200 includes a malware DB update server 210, an anti-malware update server 220, and a center DB 230.

The malware DB update server 210 serves to update the malware DB.

The anti-malware update server 220 serves to update the anti-malware. In the present invention, the malware DB of the cloud center 200 includes mobile virus information active in the region.

The anti-malware version patch unit 232 serves to update the version of the anti-malware software.

The log unit 234 serves to generate and store a log record of the mobile device 100.

The malware signature DB 236 is responsible for storing the malware signature.

In one embodiment of the present invention, each DB of the cloud center 200 is preferably divided by the operating system of each mobile device.

While the invention has been described using some preferred embodiments, these embodiments are illustrative and not restrictive. Those skilled in the art will appreciate that various changes and modifications can be made without departing from the spirit of the invention and the scope of the rights set forth in the appended claims.

1 is a block diagram showing a mobile anti-malware system according to an embodiment of the present invention.

2 is a block diagram illustrating an internal configuration of a mobile device according to an embodiment of the present invention.

3 is a block diagram showing an internal configuration of a cloud center according to an embodiment of the present invention.

4 is a flowchart illustrating a mobile anti-malware overall process according to an embodiment of the present invention.

5 is a flowchart illustrating a validity checking process in a client according to an embodiment of the present invention.

6 is a flowchart illustrating a block-by-block update operation in a client according to an embodiment of the present invention.

7 is a flowchart illustrating an information configuration process in a server according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100 Mobile Devices 200 Cloud Centers

300 Internet Network 110 Anti Malware Engine

120 Version Sink Module 130 DB Update Module

140 connection module 150 tag generation module

160 Center URL Information DB 170 Device Information DB

180 Malware Signature DB 210 Malware DB Update Server

220 Anti-Malware Update Server 230 Center DB

232 Anti-malware version Patch section 234 Log section

236 Malware Signature DB

Claims (19)

A plurality of cloud centers which transmit data for anti-malware including a malware database (DB) to the mobile device through a cloud of a corresponding cloud center based on a region where a mobile device is located; A mobile device for downloading data required for anti-malware including a malware DB from the cloud center to update an anti-malware application; And A wired / wireless communication network connected to the plurality of cloud centers and the mobile device, Mobile anti-malware system, characterized in that the malware database of the cloud center includes mobile virus information active in the region. The method of claim 1, The cloud center, A malware DB update server for updating a malware DB; An anti-malware update server for updating anti-malware; A malware signature DB for storing a malware signature; And Mobile anti-malware system comprising an anti-malware version patch for updating the version of the anti-malware software. delete The method of claim 1, The mobile anti-malware system, characterized in that each DB of the cloud center is divided by the operating system of each mobile device. The method of claim 1, The mobile device, Anti-malware engine for running anti-malware software; An application module including various applications required for anti-malware operation; And Mobile anti-malware system comprising a DB module including a variety of DB of the mobile device. The method of claim 5, The application module, A version sync module for matching the antivirus software version of the cloud center with the antivirus software version of the mobile device; DB update module for updating the DB by downloading the minimum data from the cloud center based on the location; And Mobile anti-malware system comprising a connection module for connecting to the wired and wireless communication network. The method of claim 6, The version sync module may upgrade the antivirus software version of the mobile device to the antivirus software version of the cloud center when the antivirus software version of the cloud center is different from the antivirus software version of the mobile device. . The method of claim 6, The connection module is a mobile anti-malware system, characterized in that to check the network through which the cloud center is connected, to be connected through the network. The method of claim 5, The DB module, A center URL information DB in which URL information of the cloud center is stored; A device information DB in which information necessary for the mobile device is stored; And A mobile anti-malware system comprising a malware signature DB containing malware signature information. 10. The method of claim 9, The URL information of the cloud center stored in the center URL information DB is used to select a connection method with the wired / wireless communication network in a mobile device. In a cloud center including a cloud system, A malware DB update server for updating a malware DB; An anti-malware update server for updating anti-malware; A malware signature DB for storing a malware signature; And Includes an anti-malware version patch to update the version of anti-malware software, The malware DB is a cloud center, characterized in that it contains mobile virus information active in the region. delete The method of claim 11, Each DB of the cloud center is a cloud center, characterized in that divided by the operating system of each mobile device. Anti-malware engine for running anti-malware software; It includes a variety of applications for anti-malware operation, a version sync module for matching the antivirus software version of the cloud center with the antivirus software version of the mobile device, and downloads minimal data from the corresponding cloud center based on location. An application module including a DB update module for updating the DB and a connection module for connecting to a wired or wireless communication network; And A mobile device comprising a DB module including various DBs of the mobile device. delete The method of claim 14, And the version sync module upgrades the vaccine software version of the mobile device to the vaccine software version of the cloud center when the vaccine software version of the cloud center and the vaccine software version of the mobile device are different. The method of claim 14, The connection module checks which network the cloud center is connected to, and wherein the mobile device is connected via the network. The method of claim 14, The DB module, A center URL information DB in which URL information of the cloud center is stored; A device information DB in which information necessary for the mobile device is stored; And A mobile device comprising a malware signature DB containing malware signature information. The method of claim 18, The URL information of the cloud center stored in the center URL information DB is used to select a connection method with the wired / wireless communication network in the mobile device.

Images