KR101784312B1 - A apparatus and method of providing security to cloud data to prevent unauthorized access - Google Patents

Abstract

A method of providing an electronic device and its security is provided. The method for providing security of the electronic device includes: checking a client's environment to receive a cloud service from the cloud, determining at least one of an address size and a range of the virtual memory to acquire a cloud service to execute a cloud process, To determine and store the process state of the cloud process in response to the execution of the cloud process, to monitor the cloud process to access the cloud process in the cloud, and to protect the cloud service from unauthorized access. This allows the user to protect cloud data from unauthorized access.

Description

TECHNICAL FIELD [0001] The present invention relates to an electronic device that provides security to cloud data in order to prevent unauthorized access, and a method of providing security thereof.

The present invention relates to a cloud computing related field, and more particularly, to a cloud computing related field capable of providing a security function while providing a cloud service.

Recently, cloud-based computing is rapidly becoming widely used and various services are being provided. Examples of such services include IPTV services, virtual web stores, media outlets, e-stores, internet shops, web shops and other online sites, But is not limited thereto. Traditionally, cloud-based architectures have used resources hosted by cloud service providers. Examples of such resources include, but are not limited to, at least one processor, an operating system, a display device, at least one storage device, and the like. Resources are connected together to form a virtual machine.

The user requests the virtual machine from the cloud service provider to acquire the service. The user may also request the virtual machine to perform at least one intended task. The virtual machine is controlled by a central server in the cloud to provide resources for performing at least one intended task requested by the user. The cloud-based architecture also includes some virtual machines that can be scaled by request. In addition, the virtual machines included in the cloud-based architecture are connected to users using IP (Internet Protocol) networks. However, data security is an important issue to prevent unauthorized access, such as hacking data from the cloud.

The conventional method provides security at the central server side. This approach provides various approaches for providing security functions to prevent unauthorized access at the central server side. This approach can include network filter security, virtual machine security, operating system security, file security, file resource management security, endpoint security, virtual account security, process security and application security. The central server can control one access or various approaches to provide security functions. However, this approach provides a security function when the application or service containing the data is delivered to the user's electronic device (e.g., personal computer, TV, mobile phone, etc.). That is, when delivering an application, the user provides the application to other clients, whether intended or not. In particular, this method does not monitor unauthenticated access when an application is delivered.

In addition, other security features (e.g., anti-virus, firewalls, etc.) can also provide data to unauthorized users. This security feature can be applied to provide a security function when a user follows a security license provided by a cloud service provider to prevent unauthorized access.

As an example, the first user may be accessed by a cloud application provided by a cloud service provider. However, the second user can be accessed simultaneously with the cloud application by executing at least one process. In such a scenario, the second user may perform unauthenticated access to the cloud application. In this case, the first user may not be able to recognize the unauthorized access performed by the second user. In other cases, the first user may intentionally share the cloud application with the second user. In both cases, however, the cloud service provider may lose money by losing revenue. In addition, unauthorized access can pose a threat to the cloud business.

Accordingly, there is a need for an efficient method and apparatus for monitoring and preventing unauthorized access of a cloud service.

It is an object of the present invention to provide an electronic apparatus and method for providing security to cloud data in order to prevent unauthorized access.

A method of providing security to cloud data to prevent unauthorized access, in accordance with an embodiment of the present invention, identifies the environment of the client to provide a cloud service obtained from the cloud. And, the method includes determining at least one of an address size and an address range of the virtual memory, wherein the virtual memory is used by the client to execute the cloud process to obtain the cloud service. And, this method includes storing the process state of the cloud process in response to execution of the cloud process of the virtual memory, wherein the process state can be stored in the cloud client management system database associated with the client. In addition, this method includes monitoring the cloud process to ensure that access to the cloud process is ensured in the cloud to deliver the cloud service to the client. And, this method includes protecting the cloud service from unauthorized access.

An apparatus for providing security to cloud data to prevent unauthorized access, according to an embodiment of the present invention, includes a communication interface for performing communication. And, the apparatus includes a memory for storing instructions. The device also verifies the environment of the client to provide a cloud service and determines at least one of an address size and an address range of the virtual memory, wherein the virtual memory is configured such that the client executes the cloud process to obtain the cloud service And stores the process state of the cloud process in response to the execution of the cloud process of virtual memory, monitors the cloud process for access to the cloud process in the cloud to deliver the cloud service to the client, Lt; RTI ID = 0.0 > a < / RTI > cloud service.

According to another aspect of the present invention, there is provided a method of providing security for an electronic device, comprising: checking an environment of a client to receive a cloud service from the cloud; Determining at least one of an address size and a range of virtual memory to obtain the cloud service, and executing a cloud process; Determining and storing a process state of the cloud process in response to execution of the cloud process in the virtual memory; Monitoring the cloud process for the cloud process to access the cloud; And protecting the cloud service from unauthorized access as a result of the monitoring.

Determining a plurality of processes executing in an environment of the client; Monitoring each of the plurality of processes to deliver the cloud service to the client, wherein each of the plurality of processes accesses the cloud; And blocking at least one process among the plurality of processes from which access to the cloud is denied.

In addition, the method may further include storing system-specific information and software-specific information for monitoring a plurality of cloud processes.

In addition, the method may further include updating the system unique information and the software unique information in real time.

The monitoring may further include: determining whether access to the cloud process is unauthenticated access; And determining the type of unauthorized access if it is determined that the unauthorized access is to be performed, the protecting step comprising: blocking the unauthorized access; And reporting information about the unauthorized access to the cloud.

And, the type of unauthorized access may include access made by another user that is not allowed to access and share in violation of terms and conditions by the user.

The method may further include updating the security function based on the information about the unauthorized access when the information about the unauthorized access is reported.

Stopping monitoring of a plurality of processes in real time; And resuming monitoring of the stopped plurality of processes in real time.

According to another aspect of the present invention, there is provided an electronic device including: a communication unit for communicating with an external cloud; A storage unit; And a cloud process control unit for checking the environment of the client in order to receive a cloud service from the cloud and executing at least one of an address size and a range of the virtual memory to obtain the cloud service to execute the cloud process, Determining a process state of the cloud process in response to the execution and storing the process state in the storage unit, monitoring the cloud process to access the cloud process in the cloud, and monitoring the cloud process from unauthenticated access, And a processor that protects the processor.

The processor is further configured to determine a plurality of processes running in the environment of the client and to monitor the plurality of processes so that each of the plurality of processes accesses the cloud to deliver the cloud service to the client , And may block at least one process among the plurality of processes that the access to the cloud is denied.

In addition, the storage unit may store system-specific information and software-specific information for monitoring a plurality of cloud processes.

The processor may update the system unique information and the software unique information in real time.

The processor may also determine whether the access of the cloud process is an unauthenticated access, determine the type of unauthenticated access if the access of the cloud processor is determined to be unauthenticated access, And to control the communication interface to report information about the unauthorized access to the cloud.

And, the type of unauthorized access may include access made by another user that is not allowed to access and share in violation of terms and conditions by the user.

In addition, when the information about the unauthorized access is reported, the cloud service provider can update the security function based on the information about the unauthorized access.

The processor can stop monitoring of a plurality of processes in real time and resume monitoring of the stopped plurality of processes in real time.

1 is a block diagram of a cloud environment, in accordance with one embodiment of the present invention;
2 is a block diagram of an electronic device that provides security to cloud data to prevent unauthorized access, in accordance with an embodiment of the present invention,
3 is a flow diagram illustrating a method for providing security to cloud data to prevent unauthorized access, in accordance with an embodiment of the present invention;
4A and 4B are flowcharts illustrating a method of delivering a cloud service to a user according to an embodiment of the present invention;
5A to 5D are flowcharts illustrating a method of monitoring a cloud process in order to guarantee access to a cloud process in a cloud before providing a cloud service to a user according to an embodiment of the present invention.
6A and 6B are flowcharts illustrating a method of providing security of cloud data according to an embodiment of the present invention,
7A-7D are flowcharts illustrating a method for monitoring and protecting a cloud application from unauthorized access, in accordance with an embodiment of the invention.

Hereinafter, the present invention will be described in more detail with reference to the drawings. In particular, a specific embodiment for providing a method and apparatus for providing security to cloud data to prevent unauthorized access will be described.

Figure 1 is a block diagram of a cloud environment 100, in accordance with an embodiment of the present invention. The cloud environment 100 includes various electronic devices such as a digital TV 105a, a computer 105b, a mobile device 105c, a PDA 105d, and a laptop 105e. The electronic devices may obtain various cloud services from the cloud 110.

Examples of cloud services may include IPTV services, various cloud applications, computing services, virtual web stores, media outlets, e-stores, internet shops, web-shops, and other online sites provided by the cloud 110 , But is not limited thereto. A user of the electronic device may subscribe to a cloud service provider to obtain a cloud service. A user of an electronic device subscribed to a cloud service provider may be referred to as a client. A user can create a request to obtain a cloud service. Once the request is generated by the user, the cloud service provider initiates the process in response to the request. The processing includes preparation of the virtual machine. During the prepare operation, the virtual machine is assigned to the user. At least one cloud process associated with the cloud service requested by the user is executed in the virtual machine to provide the cloud service to the user.

According to one embodiment, the electronic device is operable to provide a security function on the user side. The security features can be provided prior to providing the cloud service to the user. The security feature can protect the user from performing unauthorized access to the cloud. In addition, the security feature allows a cloud service provider to monitor unauthenticated access to the cloud by violation of users, terms and conditions associated with the cloud service. In addition, the security feature allows the cloud service provider to provide feedback to the user when the user violates terms or conditions or when the user performs unauthenticated access to the cloud.

For example, a TV channel service provider provides a plurality of TV channels to a user. However, the TV channels provided may be limited. In addition, the TV channel service provider can not provide foreign channels (e.g., German channels, etc.) that the user wants to watch. In this case, the user can use the IPTV service to acquire the foreign channel together with the TV channel from the cloud. The cloud service provider enables the user to provide the IPTV service from the cloud 110 provided. Cloud service providers provide licenses with terms and conditions for accessing IPTV services. Further, the security function provided according to an embodiment of the present invention can prevent the user from violating the license. In addition, security features can help prevent users from breaching security, and can also prevent hacking IPTV services to share the cloud with other users in an unauthorized manner.

According to an embodiment of the present invention, the electronic device operates so as to confirm the environment of the user. The environment is identified to determine the capabilities of the cloud service. The determination of the function may include determining the status of the cloud service, determining the type of unauthenticated access (e.g., access by another user to connect directly to the cloud service), and determining a term or condition violation by the user But the present invention is not limited thereto.

The address size and address range of the memory (e.g., virtual memory, flash memory, random access memory (RAM), etc.) are determined during the user's environment check. In one example, the memory may include a Video Random Access Memory (VRAM). Memory is used to run various cloud processes to support cloud services. In addition, the status of the cloud service is determined and stored. As an example, the number of cloud services in the active state is determined. The state of the cloud services is stored in a database, such as a cloud client management system database. At this time, each user is associated with the cloud client management system database. In addition, the database includes a list of processes running in the environment of the authenticated user for accessing the cloud 110. [ The database may be updated in real time to add the process to the list of authorized processes to access the cloud 110. [

In addition, the electronic device may monitor the list of processes to prevent unauthorized access to the client. In an embodiment of the present invention, the list of processes authorized to access the cloud 110 may be identified by checking the violation of the terms and conditions provided to the cloud service (e.g., that other users are dedicated to the cloud data) Can be monitored.

In an embodiment of the invention, when unauthenticated access is attempted to the processor to the cloud 110, the processes contained in the list of processes are blocked. In addition, processes that violate terms and conditions may not be able to access the cloud 110.

An electronic device including various configurations for protecting cloud data from unauthorized access will be described in detail with reference to FIG.

2 is a block diagram of an electronic device that provides security to cloud data to prevent unauthorized access, in accordance with an embodiment of the present invention. 2, the electronic device includes a bus 205, a processor 210, a memory 215, a ROM 220, a storage unit 225, a display 230, an input device 235, a cursor control (240), and a communication interface (245).

The electronic device includes a bus 205 or other communication mechanism for sending and receiving information, and a process 210 coupled to the bus 205 for processing information. The electronic device includes a memory 215, such as RAM or other dynamic storage device, coupled to the bus 205 for storing information or instructions executed by the process 210. The memory 215 may be used by the processor 210 to temporarily change while instructions are being executed or to store other intermediate information. The electronic device may also include read only memory (ROM) or other static storage device coupled to the bus 205 for storing static information and instructions for the process. The storage unit 225 (e.g., a magnetic disk or optical disk) is authenticated to access the cloud 110 and may be coupled to a bus 205 (e.g., a hard disk or optical disk) to store various information, such as information related to various processors ).

The electronic device is connected to the display 230 (e.g., a cathode ray tube (CRT), a liquid crystal display (LCD), etc.) via a bus 205 to display the cloud content requested by the user. To send and receive information and command selections to process 210, an input device 235, including numeric keys, character keys, and other keys, is coupled to bus 205. A cursor controller 240, such as a mouse, trackball, or cursor navigation key, is provided to transmit and receive direction information and selected commands to the process 210 and to control the movement of the cursor displayed on the display 230. [

The various embodiments relate to the use of an electronic device for implementing the techniques described below. In one embodiment, the technique is performed by the electronic device in response to the processor 210 executing an instruction contained in the memory 215. These instructions may be read into memory 215 from another machine-readable medium such as storage unit 225. [ Execution of instructions contained in memory 215 causes process 210 to perform the process steps described below.

In one embodiment, the processor 210 includes at least one processing unit for performing at least one function of the processor 210. The processing unit may be implemented as a hardware circuit for performing a specific function or a combination of software instructions.

As used below, the term "machine-readable media" refers to a medium that enables data to be provided to a machine for performing a specific function. In an embodiment implemented using electronic devices, various machine-readable media may provide instructions to the processor 210 being executed. Machine-readable media can be implemented as volatile or nonvolatile wetting media. The volatile storage medium includes a memory 215 such as dynamic memory or the like. The non-volatile storage medium includes a storage unit 225 such as an optical disk or a magnetic disk. All of these media are tangible so that commands can be sent to the media, which can be detected by a physical mechanism, so that the commands can be read to the machine.

Typical forms of machine-readable media include, but are not limited to, a floppy disk, a flexible disk, a hard disk, a magnetic tape, or other magnetic medium, CD-ROM, A ROM, a PROM, an EPROM, a FLASH-EPROM, another memory chip or a cartridge, etc. having a pattern of punches, punchcards, paper tapes, or holes have.

In another embodiment, the machine-readable media may be a transmission medium including an optical axis cable using wires including the bus 205, a copper wire or an optical fiber cable, and the like. Transmission media may be in the form of acoustic or optical waves that may be generated during radio wave and infrared data communication. Examples of machine-readable media include, but are not limited to, carrier waves or other media But is not limited thereto. For example, the command may be first transmitted by the magnetic disk of the remote computer. The remote computer can load commands from the dynamic memory and send commands over the telephone line using the modem. A modem connected to the electronic device receives an instruction via a telephone line and uses an infrared communication unit to convert the data into an infrared signal. The infrared sensing section receives the data transmitted by the infrared signal and the appropriate circuitry can place the data on the bus 205. [ The bus 205 transfers data to the memory 215 so that the processor 210 can execute the instruction. The instructions received by the memory 215 may be optionally stored in the storage unit 225 either before or after being executed by the processor 210. [ All of these media are tangible so that commands can be sent to the media, which can be detected by a physical mechanism, so that the commands can be read to the machine.

The electronic device also includes a communication interface 245 connected to the bus 205. The communication interface 245 is coupled to the cloud 110 to provide bi-directional data communication. For example, communication interface 245 may be an integrated services digital network (ISDN) card or a modem that provides a data communication connection to a corresponding type of telephone line. As another example, the communication interface 245 may be a local area network (LAN) card capable of providing a data communication connection to a compatible LAN. In this implementation, the communication interface 245 can send and receive electrical signals, electromagnetic signals, or optical signals that carry digital data streams representing various types of information.

The process 210 of the electronic device may be operable to identify the environment of the client to provide cloud services from the cloud 110. Process 210 may be operable to determine the address size and address range of the virtual memory. Virtual memory can be used by a user to run a cloud processor to obtain cloud services. In addition, the processor 210 may be operable to store the process state of the cloud process in response to execution of the cloud processor of the virtual memory. In one embodiment, the processor 210 may include a cloud client management system database for storing process state. In addition, the cloud client management system database included in the processor 210 may store a list of authorized processes to access the cloud 110. In addition, the processor 210 may monitor the cloud processor as to whether the cloud processor is accessible to the cloud to deliver the cloud service to the client. In addition, the processor 210 may be operable to protect the cloud service from unauthorized access.

In one embodiment, the processor 210 may be operable to determine various process executions on a user's electronic transfer. In addition, the processor 210 may be operable to monitor the processor as to whether or not each processor is accessible to the cloud 110. [ In addition, the processor 210 may block or block at least one processor in the cloud 110 from which access is denied among the various processors. In addition, the processor 210 may suspend or resume monitoring of the processor in real time.

In one embodiment, the processor 210 may be part of a standalone operating system, a cloud operating system, or a browser (e.g., firefox, internet explorer, chrome, etc.). Processor 210, which provides security for cloud data, is provided by a cloud service provider and can be delivered as a cloud service obtained from cloud 110. [

Hereinafter, a security providing method of cloud data for preventing unauthorized access will be described with reference to FIG.

3 is a flowchart for explaining a security providing method of cloud data for preventing unauthorized access according to an embodiment of the present invention. The method starts at step 305. In step 310, the environment of the client is checked to provide a cloud service. An example of a cloud service includes, but is not limited to, an IPTV service, a mail service, a computation service, a storage service, and the like. An example of an environment includes, but is not limited to, a browser, a cloud operating system associated with a user, and the like. In addition, the status of the cloud service is confirmed. The environment is identified to provide security features of the cloud data while the user is accessing the cloud 110.

In step 315, the address size and address range of the memory (e.g., virtual memory, flash memory, RAM, etc.) are determined. The memory is used to run the cloud process so that the client can acquire the cloud service. In one example, the address range and address size of the VRAM are determined. In one embodiment, metadata supporting the cloud service may also be determined. Memory and metadata are used to identify the client to protect cloud services from unauthorized access. In addition, memory and metadata are used to confirm malicious user access to cloud services in an unauthenticated manner. Various mechanisms, such as the calling graph mechanism and the access control mechanism, are used to identify malicious users,

In step 320, the process state of the cloud process is stored in response to execution of the cloud process of the memory. In one embodiment, the cloud process may be in an active state. Here, the activation state of the cloud process is judged and stored. In another embodiment, the cloud process may be in an inactive state. Here, the inactive state of the cloud process is also determined and stored.

The process state is stored in the cloud client management system database associated with the client. Here, each user is associated with a corresponding cloud client management system database to store the corresponding process state. In one embodiment, the cloud client management system database stores a list of authorized processes to access the cloud 110 that drives the client's electronic device. If at least one process included in the process list calls a cloud service, then at least one process is monitored to determine whether the processor is authorized to access the cloud 110. [ The process is also monitored to determine whether the processor violated the terms and conditions provided by the cloud service provider to access the cloud service.

In step 325, the cloud process is monitored for access to the cloud process to the cloud to deliver the cloud service to the client. For example, a client may run a remote shared application to allow other users to share the cloud service. In this case, the client violates the terms and conditions. Here, the cloud process is monitored to confirm activation of the remote shared application, and the remote shared application is blocked such that no other user can access the cloud service. The cloud process is monitored in real time to prevent unauthorized access to the cloud 110. In addition, the cloud process is monitored to determine violations of terms and conditions.

In step 330, the cloud service is protected from unauthorized access by other users. Protection is performed by blocking at least one process that is attempted to perform an unauthorized access to the cloud 110. [ The cloud service is also protected by notifying the cloud service provider of violations of terms and conditions by the client. In addition, in step 330, feedback is provided to the cloud service provider including various cloud services used by the client. The feedback also includes violations of terms and conditions by the client.

In one embodiment, the client is capable of at least one new process. In this case, before accessing the cloud 110, the new process is monitored to determine whether the new process is authorized to access the cloud. During monitoring, the process of blocking access to the cloud during the new process is blocked.

In one embodiment, system specific information and soft specific information associated with the client are stored. System specific and software specific information is used to monitor the various processes and is used to prevent the cloud 110 from performing unauthorized access to at least one process. System specific and software specific information is also stored in the cloud client management system database. System-specific and software-specific information is updated in real time before being stored in the cloud client management system database. In addition, at least one modification to the system-specific information and the software-specific information is updated in real time and stored in the cloud client management system database.

In one embodiment, monitoring of the cloud process is paused and resumed in real time. In addition, the above-described method defines the level of the security function in accordance with the requirements specified in the client. The level of the security function may be defined by a license or the like provided to the client.

In one embodiment, when an unauthorized intrusion into the address space is identified, it is reported by the cloud service provider to prevent unauthorized access to the cloud 110.

In one embodiment, the method determines whether the VRAM driver associated with the cloud process complies with a defined security function prior to accessing the cloud 110. The method ends in step 335.

4A and 4B are flowcharts illustrating a method for delivering a cloud service to a user according to an embodiment of the present invention. The method starts in step 405.

In step 410, a request for the cloud service is received from the user. An example of a cloud service includes, but is not limited to, an IPTV service, a mail service, a computing service, a storage service, and the like. The request may be performed by the user's electronic device.

In step 415, the request is parsed to obtain system specific information. The request is also analyzed to obtain software specific information. Various parsing techniques are used to parse the request. System-specific information and software-specific information are used to determine various processes that are authorized to access the cloud 110. In addition, system specific information and software specific information are used to determine the processes that are required to be blocked for accessing the cloud 110. [

In step 420, the mode of the service included in the request is confirmed. An example of a mode of service includes, but is not limited to, a cloud IPTV service, a data maniluation service, a main service, a computing service, and the like. The mode of the service is determined to process the request.

In step 425, a virtual machine is prepared based on the mode of the service identified in step 420. Virtual machines are used to run at least one process to deliver cloud services to users.

In step 430, the license is prepared to monitor the cloud service. The license includes terms and conditions for a list of authorized processes for accessing the cloud 110. [ The license prevents unauthorized access to at least one process where access to the cloud 110 is prevented.

In step 435, it is determined whether a new license is required. If it is determined that a new license is required, the method proceeds to step 440. However, if it is determined that a new license is not needed, the method proceeds to step 450. A new license is required if the user runs a new process.

In step 440, the new license is prepared to monitor the cloud service. The new process is monitored to determine whether or not the new process is authorized to access the cloud 110. The new license is prepared based on the access of the new process to the cloud 110.

In step 445, a new license is sent to the user. In one example, if a new process is authorized to access the cloud 110, the new license is updated so that the new license can be added to the list of authorized processes to access the cloud 110.

In step 450, the system unique information is updated. The system specific information is updated to determine a list of authorized processes for accessing the cloud 110 and a list of processes for which access to the cloud 110 is prevented.

In step 445, the cloud service is delivered to the user. The method then ends at step 460.

5A to 5D are flowcharts illustrating a method of monitoring a cloud process in order to guarantee accessibility of a cloud process to a cloud before delivering a cloud service to a user according to an embodiment of the present invention.

The method begins at step 502. In step 504, a request for the cloud service is received from the user. As an example, the request may include an IPTV service.

In step 506, the security function may be configured to monitor the cloud service. The configuration includes determining an address size and address range of a memory (e.g., virtual memory, flash memory, RAM) used to execute a cloud process for delivering a cloud service to a user. The configuration also includes determining a process state of the cloud process in response to the execution of the cloud process of virtual memory.

In step 508, the system-specific information and the software-specific information are collected. Examples of system specific information and software specific information include various processes executed on a user's electronic device, address ranges associated with each of the various processes, maps, VRAM driver details, user specific information, and at least one user initial process But is not limited thereto. System specific and software specific information is used to monitor the various processes and is used to block at least one process that performs unauthenticated access to the cloud 110. [ The system-specific information and software-specific information includes a list of processes associated with an authenticated user for accessing the cloud 110. In addition, in step 508, the system unique information and software information are stored.

In step 510, various processes that require monitoring are identified. The various processes may be running on the user's electronic device. Various processes requiring monitoring are stored in the storage device.

In step 514, various processes are monitored. The monitoring includes verifying whether the various processes are authorized to access the cloud 110. Monitoring includes identifying at least one process in which access to the cloud 110 is prevented. Monitoring may be performed by comparing the list of authorized process identifiers to the cloud 110 with a process identifier associated with each of the various processes.

In step 516, it is determined whether unauthenticated access has been performed to the storage device. If so, the method continues to step 518. Otherwise, the method continues to step 520.

In step 518, information related to various processes is extracted. The information is used to determine whether the various processes are allowed to access the cloud 110.

In step 520, it is determined whether unauthenticated access has been performed to the cloud application providing the cloud service. If so, the method continues to step 522. Otherwise, the method continues to step 544.

In step 522, the type of unauthenticated access is determined. An example of a type of unauthorized access may include, but is not limited to, access violations of duration and condition by a user, unauthenticated access by another user such as a hacker, and the like.

In step 524, it is determined whether or not the cloud content is shared by the user. Cloud content includes cloud services such as video included in cloud TV. If it is determined that the cloud content is shared, the method proceeds to step 526. Otherwise, the method continues to step 534.

In step 526, it is determined whether the license of the user is allowed to share cloud content with other users. The license is provided by the cloud service provider. If it is determined to be allowed to share with other users, the method continues to method 532. Otherwise, the method continues to step 528. [

In step 528, the cloud content is blocked to prevent sharing. Cloud content is blocked because it prevents the user's license from sharing cloud content with other users. Blocks of cloud content also assure users from violating licenses.

In step 530, feedback is sent to the user. Feedback informs the user of the violation of the license. Feedback also informs the user about the disruption of cloud content.

In step 532, the cloud content is dedicated so that it can be shared. The sharing of cloud content is possible because the user's license allows sharing. A license may specify the number of users allowed to access the cloud client to prevent unauthorized unauthorized access.

In step 534, it is determined whether an access that has not been authenticated by another user, such as a hacker, has been performed. If so, the method continues to step 536. Otherwise, the method continues to step 540.

In step 536, the cloud content is blocked to prevent unauthorized access. At least one algorithm is used to allow cloud content to be blocked from unauthenticated access.

In step 538, the user is informed of unauthenticated access performed by another user. The notification is performed so that the user can recognize the unauthorized access. The notification also allows the user to take preventive measures to prevent unauthorized access.

In step 540, the cloud service provider is updated for unauthenticated access performed by another user.

In step 542, the security function is updated to prevent unauthorized access. The security features are updated by the cloud service provider.

In step 544, the cloud service is delivered to the user. The method ends at step 546. [

6A and 6B are flowcharts illustrating a method for providing security of cloud data according to an embodiment of the present invention. The method starts in step 605.

In step 610, the user's cloud service is activated on the user side. Activation includes preparing the terms and conditions by the cloud service provider so that they can access the cloud < RTI ID = 0.0 > 110. < / RTI >

In step 615, a security function for the VRAM associated with the cloud service is provided. As an example, the security function for the VRAM is performed by checking the process ID of the VRAM. If the process ID of the VRAM is included in the list of authorized processes to access the cloud 110, the cloud service can be accessed by the user.

In step 620, backtrace security is enabled. Backtrace security allows users to have a comprehensive and diverse collection of security-related tools such as port scanners, password crackers, and more.

In step 625, the address space associated with the user's cloud service is protected. The address space is used to execute processes for providing cloud services to the user. Protection is provided by monitoring unauthorized access to the cloud 110. [ Protection is also provided by not violating terms and conditions offered by the cloud service provider so that the user can access the cloud.

In step 630, a request for the cloud service is received from the user. A user may send a request using an accessible electronic device in the cloud 110. [

In step 635, it is determined whether unauthenticated access to the cloud 110 has been performed by the user. Examples of unauthenticated access include, but are not limited to, user sharing of cloud services with other users, remote user hacking contents included in cloud services, unauthenticated content included in VRAM, It is not. Unauthorized access is determined by identifying a process identifier (ID) associated with the various processes that are authorized to access the cloud 110. If unauthorized access is performed by the user, the method continues to step 640. [ Otherwise, the method continues to step 650.

In step 640, the type of unauthenticated access is determined. An example of unauthenticated access may include, but is not limited to, unauthorized access performed by another user, such as a breach of terms and conditions by the user, hackers, and the like.

In step 645, an action for unauthenticated access is taken. An example of an action may include, but is not limited to, blocking a cloud process that violates terms and conditions, or informing a user about unauthorized access performed by another user. The action includes storing a cloud process that performs unauthenticated access to prevent subsequent analysis. The method ends at step 650.

7A-7D are flowcharts illustrating a method for monitoring and protecting a cloud application from unauthorized access, in accordance with an embodiment of the present invention. The method starts in step 702.

In step 704, a request to provide a cloud service is granted to the user. The request may be approved for the user to subscribe to the cloud service provider to access the cloud 110. [ The cloud application is executed to deliver the cloud service to the user.

In step 706, the VRAM driver is updated to support the security function. The VRAM driver can access the VRAM that stores cloud contents to provide cloud service.

In step 708, the system-specific information, the software-specific information, and the metadata associated with the user are transmitted to the VRAM driver. Also, the process ID associated with each of the at least one process is also transferred to the VRAM driver. At least one of the processors may be running on the user's electronic device.

In step 710, at least one of the processors is identified to determine the admissibility of at least one process as to whether or not the VRAM is accessible. The VRAM driver creates a list of at least one processes that are required to be executed to deliver the cloud service to the user. The admissibility of at least one process for accessing the VRAM is determined by comparing the process ID of each process with the list of process IDs authorized to access the cloud 110. The list of process IDs authorized to access the cloud 110 may be stored in a database associated with the user.

In step 712, the status associated with the cloud application for delivering the cloud service to the user is checked.

In step 714, it is determined whether the state associated with the cloud application is activated. If activated, the method continues to step 716. Otherwise, the method continues to step 726. [

In step 716, it is determined whether a window associated with the cloud application is hidden on the user's electronic device. If the window is hidden, the method continues to step 718. Otherwise, the method continues to step 722. [

In step 718, it is determined whether an unauthenticated access has been performed to the cloud application. If unauthenticated access has been performed, the method continues to step 720. [ Otherwise, the method continues to step 742. [ At least one process running on the user's electronic device may perform unauthenticated access to the cloud application. Unauthorized access may include calling a read function on the VRAM by at least one process running on the user's electronic device. Unauthorized access may also include invoking a write function on the VRAM by at least one process running on the user's electronic device.

In step 720, a process for performing unauthenticated access to the cloud application is identified. In addition, in step 720, the process is blocked from accessing the cloud application.

In step 722, the cloud service is delivered to the user, and the method ends in step 724.

In step 726, it is determined whether at least one cloud service is available. The determination is made when the state associated with the cloud application is inactive or when the window associated with the cloud application is not hidden on the user's electronic device. If at least one cloud service is available, the method continues to step 728. [ Otherwise, the method continues to step 740. Examples of at least one cloud service include, but are not limited to, a mail service, a computing service, and the like.

In step 728, it is determined whether the state associated with the cloud application is active. If the state associated with the cloud application is active, the method returns to step 718; otherwise, it continues to step 730.

In step 730, the cloud service is delivered to the user, and the method ends in step 740.

In step 742, it is determined whether at least one process running on the user's electronic device is allowed to access the cloud application. If at least one of the processes is allowed to access the cloud application, the method continues to step 744. [ Otherwise, the method continues to step 748. Determining whether at least one process running on a user's electronic device is allowed to access the cloud application is performed if no unauthenticated access is found in the cloud application.

In step 744, at least one processor is allowed to access the cloud service.

In step 746, the cloud service is delivered to the user, and the method ends in step 750.

At step 748, at least one process is blocked from accessing the cloud service because at least one of the processes is not allowed to access the cloud application, and the method ends at step 750.

Various embodiments of the present invention as described above enable protection of cloud data on the client side. Also, by providing a security function on the client side, the cloud content can be protected from unauthorized access before providing the cloud service to the user. At this time, the client, the cloud service provider, and the third participant are guaranteed secure access to the cloud contents. In addition, it is possible to prevent cloud data from being shared with other users in a manner not authenticated by the above-described method. In addition, the above-described method allows the cloud service provider to protect the content reproduction of the third party.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be construed as limiting the scope of the invention as defined by the appended claims. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

110: Cloud 105: Electronic device
205: bus 210: processor
215: memory 220: ROM
225: storage unit 230: display
235: input device 240: cursor controller
245: Communication interface

Claims (16)

A method for providing security of an electronic device,
Requesting a cloud service to at least one cloud server;
Determining at least one of an address size and a range of a virtual memory of the electronic device used for executing a cloud process associated with the cloud service, and executing the cloud process in the virtual memory area;
Collecting process list information associated with a user authorized to access the cloud service;
Monitoring the cloud process associated with the cloud service accessing the at least one cloud server based on the process list information; And
And preventing unauthorized access of the cloud process to the at least one cloud server, in accordance with a result of the monitoring. The method according to claim 1,
Determining a plurality of processes being executed in the electronic device;
Monitoring the plurality of processes accessing the at least one cloud server and communicating the cloud service to the electronic device; And
And blocking at least one process that is denied access to the at least one cloud server among the plurality of processes. The method according to claim 1,
Storing system-specific information and software-specific information for monitoring a plurality of cloud processes. The method of claim 3,
And updating the system unique information and the software unique information in real time. The method according to claim 1,
Wherein the monitoring comprises:
Determining whether access to the cloud process is unauthenticated access; And
Determining the type of unauthorized access if it is determined to be unauthenticated access,
The method of claim 1,
Blocking the unauthorized access; And
And reporting information about the unauthorized access to the at least one cloud server. 6. The method of claim 5,
The type of unauthenticated access may include,
And access made by another user not allowed to access and share in violation of terms and conditions by the user. 6. The method of claim 5,
If the information about the unauthorized access is reported, updating the security function based on the information about the unauthorized access by the cloud service provider. The method according to claim 1,
Stop monitoring of a plurality of processes in real time; And
And resuming monitoring of the stopped plurality of processes in real time. In an electronic device,
A communication unit for communicating with at least one external cloud server;
A storage unit; And
Determining at least one of an address size and a range of a virtual memory of the electronic device used to execute a cloud process associated with the cloud service, and requesting the at least one external cloud server to execute the cloud process, Related process list information for accessing the at least one external cloud server and for monitoring the cloud process associated with the cloud service accessing the at least one external cloud server based on the process list information, And to prevent unauthorized access of the cloud process to the at least one external cloud server in accordance with a result of the monitoring. 10. The method of claim 9,
The processor
Monitor a plurality of processes running in the electronic device, monitor the plurality of processes accessing the at least one external cloud server and communicating the cloud service to the electronic device, and wherein the at least one The at least one process being denied access to the external cloud server of the external cloud server. 10. The method of claim 9,
Wherein,
And stores system-specific information and software-specific information for monitoring a plurality of cloud processes. 12. The method of claim 11,
The processor comprising:
And updates the system-specific information and the software-specific information in real time. 10. The method of claim 9,
The processor comprising:
Determining whether the access of the cloud process is an unauthenticated access, determining if the access of the cloud process is an unauthenticated access, the type of unauthenticated access,
Wherein the control unit controls the communication unit to block the unauthorized access and to report information about the unauthorized access to the at least one external cloud server. 14. The method of claim 13,
The type of unauthenticated access may include,
And access made by another user that is not allowed to access and share in violation of terms and conditions by the user. 14. The method of claim 13,
And when the information about the unauthorized access is reported, the cloud service provider updates the security function based on the information about the unauthorized access. 10. The method of claim 9,
The processor comprising:
Stop monitoring of a plurality of processes in real time, and resume monitoring of the stopped plurality of processes in real time.

Images