KR101260759B1 - Apparatus and method for controlling access to native library - Google Patents

Abstract

PURPOSE: A native library access control apparatus and a method thereof are provided to prevent unauthorized use of a native library without permission using an unauthorized application, thereby protecting intellectual properties of the native library. CONSTITUTION: A native library access control apparatus includes a calling unit(200), an update unit(202), an access control policy(204), an access control unit(208), and a native library module(210). The calling unit which is a software module for calling a native library(206) calls a corresponding native library requested for loading from an application in case the application operates and loads the native library. The update unit updates the access control policy about the native library. The access control unit authenticates the application by loading the access control policy in case the native library is called and blocks the native library requested. The access control unit authenticates the application which loads the native library by being firstly called at the time of loading the native library. [Reference numerals] (200) Calling unit; (202) Update unit; (204) Access control policy(white list); (208) Access control unit; (210) Native library module

Description

Native library access control device and method {APPARATUS AND METHOD FOR CONTROLLING ACCESS TO NATIVE LIBRARY}

The present invention relates to a method for protection of application source code, and in particular, at the time of execution of an application configured to have a native library, the native library is loaded by a class loader. By authenticating the application that is currently requesting to load the native library, the control will ensure that the native library is loaded only for applications that have been successfully authenticated, thereby preventing unauthorized use of the native library by third-party applications built upon arbitrary acquisition of the native library. A native library access control device and method for preventing this are disclosed.

Recently, with the development of mobile communication technology as well as wired and wireless Internet, mobile phones having various functions such as wireless Internet function as well as telephone call function have been widely used. In particular, smart phones, which are recently spreading, can install various functions such as multimedia playback functions, and users are using smart phones for various purposes.

In general, a smart phone combines the advantages of a mobile phone and a personal digital assistant (PDA), and is implemented by integrating data communication functions such as schedule management, fax transmission, and Internet access. In general, a smart phone is equipped with a wireless communication module such as Wi-Fi, and can transmit and receive data through the Internet network. Also, it is possible to search for information on the Internet and to send and receive picture information such as directions by using an electronic pen on the liquid crystal display. .

Such smart phones and portable terminals such as tablet PCs have their own operating systems such as IOS and Android, for example, and development of applications executable by the operating systems is being actively performed.

On the other hand, most of the above applications in the Android environment are implemented in JAVA code.

At this time, the output of JAVA is generated as byte code to be executed in a JAVA virtual machine (JVM). Although there is an advantage of JAVA that can be executed on a multiplatform, these byte codes are reverse engineered with easy decompile. Very vulnerable to reverse engineering There are also many tools for reverse engineering. Therefore, if any Android application (APK) is uploaded and distributed, the person who downloaded the application decompresses the APK file, decompiles the DEX file, which is an Android executable file, obtains the source code, and then uses the third application. In the case of redevelopment, it is very difficult to protect the intellectual property (IP) of the first developed product.

To this end, conventionally, a method for preventing leakage of source code of an application implemented by JAVA. First, since decompilation of JAVA code cannot be avoided, code obfuscation is performed so that it is difficult to understand the source code even when decompiled. . However, this technique makes the source code difficult to understand, and it does not fundamentally prevent the acquisition of JAVA code.

Second, JAVA decomposes JAVA's decompilation issues into native code by implementing sensitive code such as important executable code of the application as a Native Library module and interworking with JAVA. However, if the native library is implemented, JAVA's decompilation issue is alleviated, but if the native library is used as a whole, there is a problem in that a clone application can be easily created by using a native library used by an arbitrary third party.

1 illustrates a concept of creating a duplicate application through the exploitation of a conventional native library.

Referring to FIG. 1, for example, when a main executable code of an application 100 of a specific company is manufactured to work with a native library 102, a third party may use a native library 102 through reverse engineering or the like. After arbitrary acquisition, it is possible to easily duplicate the application 150 by compressing it into a new APK file, in which case it was difficult to protect the intellectual property of the native library of the original user.

(Patent Literature)

Korean Patent Laid-Open No. 10-2008-0099247 (November 12, 2008) discloses at least one computer readable medium and a system in which a data structure is stored.

Therefore, when the application configured to have a native library is executed, the present invention authenticates the application that has requested the load of the current native library at the time when the native library is loaded by the class loader, and is only native to the successful application. By controlling a library to be loaded, a native library access control apparatus and method for preventing unauthorized use of a native library by a third party application produced by acquiring a native library is provided.

The present invention as described above is a native library access control device, comprising: an updater for updating an access control policy for a native library, and when the native library load request from an application is updated, the access control policy is updated, and A caller for calling a native library and an access to load the access control policy when the native library is called to authenticate the application, and to block the call of the native library requested to be loaded from the application if the authentication fails. It includes a control unit.

In addition, the access control unit is characterized in that the first call at the time when the native library is loaded, characterized in that for authenticating the application that loaded the native library.

The access controller may decode the access control policy when the native library is called to extract a whitelist for allowing access to the native library, and if the information of the application is not in the whitelist, Characterized in that it is determined that the authentication failed.

The access controller may load the native library and connect the application to the application when authentication of the application succeeds.

The access control unit may receive a call of the native library from the caller through a JNI (java native interface).

In addition, the native library is located at the native level of the JVM (java virtual machine) is characterized in that it is loaded by the application.

The access control policy may be encrypted and loaded into the access control unit.

In addition, the white list is characterized in that it contains authentication information that is allowed to load the native library.

The authentication information may include one or more of a signature value, a package name, a file name, a file size, or a hash value of the application.

In addition, the application is characterized in that it is implemented in JAVA code.

The present invention also provides a native library access control method, comprising: receiving a native library load request from an application, updating the access control policy for the native library upon receiving the load request, and then calling the native library And authenticating the application by loading the access control policy when the native library is called, and blocking the call of the native library requested to be loaded from the application when the authentication fails.

In addition, authenticating the application may include loading and decrypting the access control policy when the native library is called, and extracting a whitelist from which the access control policy is allowed to access from the decrypted access control policy. And checking whether the information of the application exists in the whitelist and performing authentication.

The performing of the authentication may include determining that the authentication of the application has failed when the information of the application is not in the white list.

The method may further include loading the native library requested to be loaded from the application when the authentication of the application succeeds.

In addition, the native library is located at the native level of the JVM, characterized in that the loading by the application through the JNI interface.

In addition, the access control policy is characterized in that after being updated from the update unit of the application level, is encrypted and loaded.

In addition, the whitelist is characterized in that it contains information of the application that is allowed to load the native library.

The authentication information may include one or more of a signature value, a package name, a file name, a file size, or a hash value of the application.

In the present invention, in access control of a native library, when an application configured to have a native library is executed, the present invention authenticates an application that has requested to load the current native library at the time when the native library is loaded by a class loader. By controlling the native library to be loaded only for the successful application, there is an advantage of protecting the intellectual property of the native library by preventing unauthorized use of the native library by a third-party application produced by acquiring the native library.

1 is a conceptual diagram of creating a cloned application by using a conventional native library;
2 is a detailed block diagram of a native library access control apparatus according to an embodiment of the present invention;
3 is an operation control flowchart for native library access control according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the present invention. In the following description of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowchart may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created.

These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram.

Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

FIG. 2 illustrates a detailed block diagram of a native library access control apparatus according to an exemplary embodiment of the present invention. The caller 200, the updater 202, the access control policy 204, and the access controller 208, native library module 210, and the like.

Hereinafter, an operation of each component of the native library access control apparatus of the present invention will be described in detail with reference to FIG. 2.

First, there may be a request for execution from a user for any application whose important executable code is composed of a native library among a plurality of applications installed in a portable terminal such as a smartphone. When the application is driven according to the above execution request, the application loads the native library 206 for interworking with the native library 206 where the native level is located.

When the application is driven to load the native library 206 as a software module calling the native library 206, the calling unit 200 calls the corresponding native library 206 requested to be loaded from the application.

In this case, for example, the application may be implemented with JAVA code. When the application is implemented with JAVA code, the native library module 210, which is executable code of an application existing on Native, may be loaded through JNI (JAVA Native Interface). Can be. That is, the native library module 210 is a software module that stores the important executable code of the application. When the application is implemented with JAVA code, the native library module 210 works with JAVA of the application through JNI to alleviate the decompile issue for the application. You can.

In addition, the caller 200 may first update the updater 202 before loading the corresponding native library module 210 existing at the native level in order to protect the native library 206 in which important executable code of the application is stored. By controlling, the access control policy for the native library 206 is updated, and when the update of the access control policy is completed, the native library 206 existing in the native level is called.

The updater 202 updates an access control policy having information on a signature value or a package name of an application that can access the native library 206 under the control of the caller 200. Done. At this time, the information included in the access control policy, that is, the signature value, package name, etc. of the application that can be used as the authentication means is a simple embodiment timely, in addition to the hash (CRC, SHA, MD5, etc. to check integrity) Various information such as file name and file size can be used, including the hash value. Hereinafter, in the embodiment of the present invention, the signature value or package name of the application is described as an example of information that can be used as the authentication information, but the present invention is not limited thereto.

In addition, such an access control policy may include, for example, white list information about the signature value or package name of an application that is allowed to access the native library 206, and such an access control policy may be secured. May be encrypted and transmitted to the access control unit 208 of the native library 206.

The call to the native library 206 from the caller 200 as described above is transmitted to the access control unit 208 existing in the native library 206.

The access control unit 208 is a software module that performs access control on the native library module 210 that stores important executable code of an application. When the native library 206 is loaded from the caller 200 as described above, Called first to perform authentication against the application that requested to load the native library 206.

That is, when the native library 206 is called, the access controller 208 loads and decrypts the updated access control policy 204 in the updater, and decodes the access control policy 204 for the native library 206 from the decrypted access control policy 204. The whitelist including the authentication information of the application to which the access is allowed is extracted to perform authentication on the application that has requested to load the native library 206.

In this case, the authentication information of the application may be, for example, a signature value or a package name of the application, and the signature value or package name may be a signature value of the original author who originally created the native library 206 and a package name for the application. Can be.

In performing authentication for the above application, the access control unit 200 extracts the signature value and package name of the application calling the native library 206, and then checks whether the extracted signature value or package name exists on the whitelist. If the check exists in the white list, the application is normally operated by normally calling the native library module 210 configured to interwork with the corresponding application.

However, when the signature value and the package name of the application calling the native library 206 do not exist on the whitelist, the access control unit 208 controls the native library module 210 configured to interoperate with the application not to be called. Unauthorized use of the native library module 210 by abnormal applications can be prevented.

3 illustrates an operation control flow for controlling access to a native library in a native library access control apparatus according to an embodiment of the present invention. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 2 and 3.

First, there may be a request for execution from a user for any application whose important executable code is composed of the native library 206 among a plurality of applications installed in a portable terminal such as a smartphone.

When the application is driven according to the execution request for the application as described above (S300), the application is native through the calling unit 200 when the application is composed of the native library 206 important to prevent decompilation of the application. A request is made to load the library 206 (S302).

In this case, for example, the application may be implemented with JAVA code. When the application is implemented with JAVA code, the native library module 210, which is executable code of an application existing on Native, may be loaded through JNI (JAVA Native Interface). Can be.

That is, the native library module 210 is a software module that stores important executable code of an application. When the application is implemented with JAVA code, the native library module 210 may mitigate the decompilation issue for the application by interworking with the JAVA of the application through JNI.

As described above, when there is a load request from the application to the native library 206, the calling unit 200, in order to protect the native library 206 that stores the important executable code of the application, the corresponding native present in the Native level Before loading the library module 210, the update unit 202 is first controlled so that the access control policy 204 for the native library 206 is updated. Accordingly, the updater 202 updates the access control policy 204 having information on the signature value or package name of the application that can access the native library 206 (S304). At this time, the information included in the access control policy, that is, the signature value, package name, etc. of the application that can be used as the authentication means is a simple embodiment timely, in addition to the hash (CRC, SHA, MD5, etc. to check integrity) Various information such as file name and file size can be used, including the hash value. Hereinafter, in the embodiment of the present invention, the signature value or package name of the application is described as an example of information that can be used as the authentication information, but the present invention is not limited thereto.

In addition, such an access control policy 204 may include, for example, white list information about the signature value or package name of an application that is allowed to access the native library 206, such access control. The policy 204 may be encrypted for security and sent to the access control 208 of the native library 206.

When the update on the access control policy 204 is completed as described above, the calling unit 200 calls the native library 206 existing in the native level (S306).

At this time, the call of the native library 206 as described above is transmitted to the access control unit 208 that controls the access of the native library module 210 that stores the important executable code of the application, the access control unit 208 It is called first when the native library 206 is loaded to perform authentication for the application that requested to load the native library 206.

That is, when the native library 206 is called, the access controller 208 loads and decrypts the updated access control policy 204 in the updater 202, and allows access to the native library from the decrypted access control policy. The white list including the authentication information of the application is extracted (S308).

In this case, the authentication information of the application may be, for example, a signature value or a package name of the application, and the signature value or package name may be a signature value of the original author who originally created the native library 206 and a package name for the application. Can be. That is, for example, when the native library 206 as described above is an engine module of an application produced by a specific company, the signature value may be a unique signature value of the corresponding company, and the application package name may be, for example, "kakao talk". And so on. Therefore, if an application using a different package name loads a vendor-generated native library, the package name is wrong, so that calls to the native library can be controlled.

Subsequently, the access control unit 208 extracts application information such as a signature value and a package name of the application calling the native library 206 (S310), and then checks whether the extracted signature value or package name exists on the whitelist. In step S312, authentication is performed as to whether the application is permitted access.

At this time, if the signature value and the package name of the application calling the native library 206 are not present on the whitelist, the access control unit 208 determines that the application is not a normal application and the native library module 210 Controlling not to be called (S314) to prevent unauthorized use of the native library module 210 by the abnormal application.

However, when the signature value and the package name of the application calling the native library 206 exist on the whitelist, the access control unit 208 determines that the application is a normal application and calls the native library module 210 to determine the application. By allowing the application to work with the application (S316).

As described above, in access control to a native library, when an application configured to have a native library is executed, the application that has requested to load the current native library at the time when the native library is loaded by a class loader is selected. By ensuring that native libraries are loaded only for applications that have been authenticated and certified, the intellectual property of the native libraries can be protected by preventing unauthorized use of the native libraries by third-party applications produced by acquiring the native libraries.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention should not be limited by the described embodiments but should be defined by the appended claims.

200: caller 202: updater
204: Access Control Policy 206: Native Library
208: access control unit 210: native library module

Claims (18)

delete An updater for updating the access control policy for the native library,
A caller which calls the native library after updating the access control policy when the native library load request is made from an application;
When the native library is called, the access control policy is loaded to authenticate the application, and if the authentication fails, and includes an access control unit for blocking the call of the native library requested to be loaded from the application,
The access control unit is a native library access control device, characterized in that to authenticate the application that is called first when the native library is loaded to load the native library.
An updater for updating the access control policy for the native library,
A caller which calls the native library after updating the access control policy when the native library load request is made from an application;
When the native library is called, the access control policy is loaded to authenticate the application, and if the authentication fails, and includes an access control unit for blocking the call of the native library requested to be loaded from the application,
When the native library is called, the access controller decrypts the access control policy to extract a whitelist that allows access to the native library, and authenticates the application when information of the application is not in the whitelist. Native library access control device characterized in that it determines to fail.
An updater for updating the access control policy for the native library,
A caller which calls the native library after updating the access control policy when the native library load request is made from an application;
When the native library is called, the access control policy is loaded to authenticate the application, and if the authentication fails, and includes an access control unit for blocking the call of the native library requested to be loaded from the application,
And the access control unit loads the native library and connects the application to the application when authentication of the application is successful.
An updater for updating the access control policy for the native library,
A caller which calls the native library after updating the access control policy when the native library load request is made from an application;
When the native library is called, the access control policy is loaded to authenticate the application, and if the authentication fails, and includes an access control unit for blocking the call of the native library requested to be loaded from the application,
And the access control unit receives a call of the native library from the caller through a Java native interface (JNI). An updater for updating the access control policy for the native library,
A caller which calls the native library after updating the access control policy when the native library load request is made from an application;
When the native library is called, the access control policy is loaded to authenticate the application, and if the authentication fails, and includes an access control unit for blocking the call of the native library requested to be loaded from the application,
And the native library is located at a native level of a Java virtual machine and loaded by the application.
An updater for updating the access control policy for the native library,
A caller which calls the native library after updating the access control policy when the native library load request is made from an application;
When the native library is called, the access control policy is loaded to authenticate the application, and if the authentication fails, and includes an access control unit for blocking the call of the native library requested to be loaded from the application,
And the access control policy is encrypted and loaded into the access control unit.
The method of claim 3, wherein
The white list is
The native library access control device, characterized in that it comprises authentication information that is allowed to load the native library.
The method of claim 8,
The authentication information,
And at least one of a signature value, a package name, a file name, a file size, and a hash value of the application.
The method of claim 2,
The application,
Native library access control device, characterized in that implemented in JAVA code.
delete Receiving a native library load request from an application at a caller of the native library access controller;
Calling the native library after updating the access control policy for the native library upon receiving the load request from the caller;
Authenticating the application by loading the access control policy in an access control unit of the native library access control device when the native library is called;
Blocking the call of the native library requested to be loaded from the application in the access controller when the authentication fails,
The step of authenticating the application,
Loading and decoding the access control policy in the access controller when the native library is called;
Extracting, from the decoded access control policy, the white list allowing access to the native library;
Performing authentication by checking whether the information of the application exists in the white list in the access control unit;
Native library access control method comprising a.
13. The method of claim 12,
The step of performing the authentication includes:
And if the information of the application is not in the white list, the access controller determines that authentication of the application has failed.
Receiving a native library load request from an application at a caller of the native library access controller;
Calling the native library after updating the access control policy for the native library upon receiving the load request from the caller;
Authenticating the application by loading the access control policy in an access control unit of the native library access control device when the native library is called;
Blocking the call of the native library requested to be loaded from the application in the access controller when the authentication fails,
And loading the native library requested to be loaded from the application in the access control unit when the authentication of the application is successful.
Receiving a native library load request from an application at a caller of the native library access controller;
Calling the native library after updating the access control policy for the native library upon receiving the load request from the caller;
Authenticating the application by loading the access control policy in an access control unit of the native library access control device when the native library is called;
Blocking the call of the native library requested to be loaded from the application in the access controller when the authentication fails,
The native library is,
Located at the native level of the JVM, the native library access control method characterized in that it is loaded by the application through a JNI interface.
Receiving a native library load request from an application at a caller of the native library access controller;
Calling the native library after updating the access control policy for the native library upon receiving the load request from the caller;
Authenticating the application by loading the access control policy in an access control unit of the native library access control device when the native library is called;
Blocking the call of the native library requested to be loaded from the application in the access controller when the authentication fails,
The access control policy,
Native library access control method, characterized in that after being updated from the update unit of the application level, encrypted and loaded.
13. The method of claim 12,
The white list,
Native library access control method comprising the authentication information is allowed to load the native library.
The method of claim 17,
The authentication information,
And at least one of a signature value, a package name, a file name, a file size, and a hash value of the application.

Images