KR101906484B1 - Method for application security and system for executing the method - Google Patents

Abstract

An application security method and a system for performing the same are disclosed. The application security system according to the exemplary embodiment downloads a security-critical application in which the static-security-related file and the dynamic security-related file are loaded, transmits a verification request for the security-critical application, Receiving a verification request from a client device, a client device transmitting a security file request for the dynamic security-related file according to a corresponding verification result related information, performing verification of an unsecured application, And a management server that receives the secure file request from the client device and transmits the encrypted dynamic security-related file to the client device.

Description

METHOD FOR APPLICATION SECURITY AND SYSTEM FOR EXECUTING THE METHOD,

Embodiments of the invention relate to security technology.

In recent years, as the use of smart phones has soared, applications using applications installed on smart phones have increased. For example, financial transactions or settlements are increasingly performed using applications installed in a smart phone. However, there is a problem that an application for performing a financial transaction or settlement can be hijacked by a third party who has an illegal purpose.

Korean Patent Publication No. 10-2012-0100549 (2012.12.12)

An embodiment of the present invention is to provide an application security method capable of enhancing security according to application use and a system for performing the method.

The application security system according to an exemplary embodiment of the present invention downloads a security-critical application on which the static security-related file and a dynamic security-related file are loaded, transmits a verification request for the security-critical application, A client device for transmitting a security file request for the dynamic security related file according to verification result related information corresponding to the verification request; A verification server for receiving the verification request from the client device, performing verification of the unsecured application, and transmitting the verification result related information to the client device; And a management server receiving the secure file request from the client device and transmitting the encrypted dynamic security-related file to the client device.

The verification request may include identification information of the unsecured application and unique identification information of the client apparatus.

Wherein the verification server compares the identification information of the unsecured application included in the verification request with the identification information of the previously stored unsecured application and verifies the identification information based on the identification information of the client device, Generating a key value, and transmitting the verification result-related information including the verification result and the encryption-related key value to the client apparatus.

The verification server may generate an encryption-related key value based on management unique information in which unique identification information of the client apparatus and predetermined dummy management information are combined when an abnormal symptom occurs.

The verification server may determine that the abnormal symptom occurs when the total number of verification failures in accordance with the verification request of each client for a predetermined time exceeds a predetermined first number.

The verification server may determine that the abnormal symptom occurs when the verification failure according to the verification request exceeds the second predetermined number of times.

The secure file request may include unique identification information of the client device, the encryption related key value, and operating system related information of the client device.

The management server extracts a dynamic security related file corresponding to the operating system related information of the client device and encrypts the extracted dynamic security related file using the encryption related key value, And transmit the encryption-related key value to the client device.

The secure file request may include at least one of the unique identification information of the client device, the encryption related key value generated based on the unique identification information of the client device, and the operating system related information of the client device.

The application security system further includes a block chain for receiving the unique identification information and the encryption-related key value of each client device from the management server, and for matching unique identification information of each client device with the corresponding encryption-related key value can do.

Wherein the management server transmits unique identification information of the client device included in the security file request to the block chain, and the block chain extracts an encryption-related key value matched with the unique identification information of the client device, Wherein the management server extracts a dynamic security-related file corresponding to the operating system-related information of the client device, and transmits the extracted dynamic security-related file to the management server using an encryption-related key value received from the block chain And may transmit the encrypted dynamic security association file and the encryption related key value to the client device.

Wherein the client device decrypts the encrypted dynamic security-related file based on the encryption-related key value, wherein the dynamic security-related file includes a part of the dynamic security-related files in accordance with the remaining capacity of the memory of the client device And may include instructions for loading into memory.

Wherein the static security related file includes: a command for transmitting the verification request to the verification server when the security-critical application is executed; And terminating the security-critical application when verification of the security-less application fails as a result of the verification-result-related information check.

A method for securing an application according to an embodiment disclosed is a method performed in a computing device having one or more processors and a memory for storing one or more programs executed by the one or more processors, Downloading a security-critical application on which the static security-related file is installed, among the dynamic security-related files; Transmitting a verification request for the unsecured application; Receiving a verification result related information corresponding to the verification request, and transmitting a security file request for the dynamic security related file according to the verification result related information; Receiving an encrypted dynamic security-related file and an encryption-related key value corresponding to the secure file request; And decrypting the encrypted security-related file using the encryption-related key value.

The verification request may include identification information of the unsecured application and unique identification information of the client apparatus.

The verification result related information is generated based on the verification result of the verification by comparing the identification information of the unsecured application included in the verification request with the identification information of the previously stored unsecured application and based on the unique identification information of the client apparatus Encryption-related key values may be included.

The secure file request may include unique identification information of the client device, the encryption related key value, and operating system related information of the client device.

The dynamic security related file includes: a command for confirming a remaining capacity of the memory of the client apparatus; Comparing the remaining capacity of the memory with the capacity of the dynamic security association file; And loading some of the dynamic security related files into the memory according to the comparison result.

Wherein the static security-related file includes: a command for transmitting the verification request when the security-critical application is executed; And terminating the security-critical application when verification of the security-less application fails as a result of the verification-result-related information check.

An application security method according to another disclosed embodiment is a method performed in a computing device having one or more processors and a memory storing one or more programs executed by the one or more processors, Receiving a verification request for a security-critical application on which the static security-related file is installed among the related file and the dynamic security-related file; Performing verification by comparing identification information of an unsecured application included in the verification request with identification information of a previously stored unsecured application; And generating verification-related information corresponding to the verification request and transmitting the verification-related information to the client device, wherein the verification request includes identification information of the unsecured application and unique identification information of the client device, The generating of the verification result related information may include generating an encryption related key value based on the unique identification information of the client apparatus according to a result of the verification.

The generating of the encryption-related key value may be performed by hashing the unique identification information of the client apparatus when the result of the verification is a verification success.

The step of generating the encryption-related key value may include: determining whether an abnormal symptom is present based on log information according to a verification request of each client apparatus; And generating an encryption-related key value based on the management unique information in which the unique identification information of the client apparatus and predetermined dummy management information are combined when the anomaly occurs.

A method of securing an application according to another disclosed embodiment is a method performed in a computing device having one or more processors and a memory storing one or more programs executed by the one or more processors, And receiving a security file request for the dynamic security-related file from a client device that has downloaded the security-related application on which the static security-related file is installed, from among the dynamic security-related files; Extracting unique identification information of the client device included in the secure file request; Transmitting the unique identification information of the extracted client device to a block chain; Receiving an encryption-related key value from the block chain that matches the unique identification information of the client device; And encrypting the dynamic security-related file with the received encryption-related key value, and transmitting the encrypted dynamic security-related file and the encryption-related key value to the client device.

Wherein the secure file request includes unique identification information of the client device and operating system related information of the client device and wherein the step of transmitting the encrypted dynamic security related file to the client device comprises: Extracting a dynamic security-related file corresponding to the information; And encrypting the extracted dynamic security-related file with the received encryption-related key value.

According to the embodiment of the present invention, the security exposure of the application installed in the client device can be minimized by distributing the security-less application to the client device and transmitting the encrypted security-related file each time the security-less application is executed, It is possible to prevent a security-related file of an application from being hijacked or stolen by a malicious third party.

Further, the verification server verifies the security-less application and transmits the encryption-related key value to the client device, thereby confirming integrity of whether the application is falsified or tampered. In addition, by generating the encryption-related key value based on the unique identification information of the client device, encryption and decryption can be performed differently for each client device, thereby enhancing the security of application use.

In addition, by distributing the security-critical application to the client device, the size of the application distributed to the client device can be minimized. Even when the security-related file is changed or updated, there is no need to download the application again. Security-related files can be automatically received and executed.

1 is a block diagram of a configuration of an application security system according to an embodiment of the present invention;
FIG. 2 is a flowchart illustrating a process of verifying whether a user forged or falsified in an application security method according to an embodiment of the present invention.
3 is a flowchart illustrating a process of receiving a dynamic security-related file in an application security method according to an embodiment of the present invention.
4 is a block diagram illustrating and illustrating a computing environment including a computing device suitable for use in the exemplary embodiments.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, this is merely an example and the present invention is not limited thereto.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification. The terms used in the detailed description are intended only to describe embodiments of the invention and should in no way be limiting. Unless specifically stated otherwise, the singular forms of the expressions include plural forms of meanings. In this description, the expressions "comprising" or "comprising" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, Should not be construed to preclude the presence or possibility of other features, numbers, steps, operations, elements, portions or combinations thereof.

In the following description, terms such as " transmission ", "transmission "," transmission ", "reception ", and the like, of a signal or information refer not only to the direct transmission of signals or information from one component to another But also through other components. In particular, "transmitting" or "transmitting" a signal or information to an element is indicative of the final destination of the signal or information and not a direct destination. This is the same for "reception" of a signal or information. Also, in this specification, the fact that two or more pieces of data or information are "related" means that when one piece of data (or information) is acquired, at least a part of the other data (or information) can be obtained based thereon.

1 is a block diagram of an application security system according to an embodiment of the present invention.

Referring to FIG. 1, an application security system 100 may include a client device 102, a verification server 104, a management server 106, and a block chain 108. Here, the client device 102 is communicably connected to the verification server 104 and the management server 106 via a communication network. In addition, the management server 106 is communicatively coupled to the block chain 108 via a communications network. In some embodiments, the communication network may be an Internet, one or more local area networks, a wire area networks, a cellular network, a mobile network, other types of networks, .

The client device 102 is a communications device used by a user and examples of the client device 102 include various types of wired and wireless capable of being connected to a server computing device 104, 106, such as a cell phone, smart phone, tablet, wearable device, And a communication device.

The client device 102 may be downloaded by a user from a server computing device (e.g., verification server 104 or management server 106 or other server computing device not shown in FIG. 1). The downloaded application may be stored in a computer readable storage medium of the client device 102. The application includes a predetermined set of instructions executable by the processor of the client device 102. The instructions of the application, when executed by the processor of the client device 102, may cause the processor to perform operations according to exemplary embodiments. The computer-readable storage medium includes components of the operating system for executing a set of instructions, such as the application, on the client device 102. For example, such an operating system could be Apple's iOS or Google's Android.

The application downloaded by the client device 102 may be an application for performing a job requiring security such as financial transaction (account transfer, payment, etc.) on-line. For example, the downloaded application may be an application for Internet banking or the like. However, some of the security related files may be omitted (that is, only some security related files are included) in the downloaded application. That is, the downloaded application may be for carrying out a task requiring security on-line, but may be a state in which a part of the security-related file is omitted and the security-related work can not be performed normally or completely. Hereinafter, the downloaded application may be referred to as an unsecured application.

In an exemplary embodiment, the security-related files may include static security-related files and dynamic security-related files. An unsecured application may only include static security related files and not dynamic security related files. Here, the static security-related file may be a file for basic security of the security-less application. The static security related files may be, for example, for performing user authentication, access control, anti-debugging, and source obfuscation functions. User authentication may mean performing user authentication through password, biometric authentication, authorized authentication, pin number, etc. when executing a security-less application. The access control may mean to terminate the unsecured application if the result of the verification request described below is a verification failure. Dynamic security-related files may be files for additional security of non-security applications. Dynamic security related files may include, for example, keyboard security, routing detection, and anti-virus programs. In the embodiment of the present invention, a static security-related file means a security-related file installed in a security-less application, a dynamic security-related file means a security-related file that is not loaded in a security- .

Thus, since the client device 102 downloads an application (security-critical application) in which a security-related file is partially omitted (that is, a dynamic security-related file is omitted), the dynamic- Lt; / RTI >

Specifically, when the non-secured application is executed by the user, the client device 102 may transmit a verification request for the unsecured application to the verification server 104. [ The verification request may include identification information of the unsecured application (for example, the ID of the unsecured application and the hash value of the unsecured application). In addition, the verification request may further include management specific information for generating a cryptographic key value unique to the client device (102). In an exemplary embodiment, the management specific information may be unique identification information of the client device 102. [

Here, the unique identification information of the client device 102 may vary depending on the operating system of the client device 102. [ For example, when the operating system of the client device 102 is an Android, the unique identification information of the client device 102 includes a Universally Unique Identifier (UUID), an International Mobile Equipment Identifier (IMEI) The device unique value of the client device 102. In another example, when the operating system of the client device 102 is iOS, the unique identification information of the client device 102 may be a Universally Unique Identifier (UUID). The unique identification information of the client device 102 may be included in the verification request that is initially transmitted.

The client device 102 may receive verification result related information for the verification request from the verification server 104. [ The verification result related information may include a verification result of the verification request, a verification time, and an encryption-related key value. Here, the encryption-related key value may be a value obtained by hashing the unique identification information of the client device 102 (i.e., a hash value). The encryption-related key value may be included only if the verification result is a verification success.

The client device 102 can confirm the verification result related information and terminate the security missing application if the verification result is a verification failure. At this time, the client device 102 may notify the user that the security-critical application is terminated. The client device 102 may perform this operation based on static security related files included in the non-secure application. That is, the static security-related file may include an instruction to terminate the security-critical application if the verification fails.

In this manner, verification of the insecure application is performed, and when the verification fails, the insecure application (i.e., security) is firstly guaranteed by terminating the insecure application. That is, it is possible to verify the integrity of the downloaded application by verifying whether the downloaded application is falsified or altered and then executing it.

On the other hand, if the received verification result is a verification success, the client device 102 can transmit a security file request to the management server 106. Here, the secure file request may include the unique identification information of the client device 102 and the encryption-related key value. That is, when the client device 102 transmits the security file request to the management server 106, the client device 102 may include the encryption-related key value received from the verification server 104 in the security file request. The client device 102 may delete the encryption related key value after sending it to the management server 106. [ Here, the encryption-related key value may be included when the security file request is first transmitted. In addition, the security file request may further include information related to the operating system of the client device 102. [ Here, the operating system related information may include operating system type information and operating system version information.

The client device 102 may receive encrypted dynamic security related files and encryption related key values from the management server 106. The client device 102 may decrypt the dynamic security-related file encrypted with the encryption-related key value, then load the dynamic security-related file into the computer-readable storage medium, and execute the dynamic security-related file. The client device 102 may delete the dynamic security related file after executing the dynamic security related file. Here, the dynamic security-related file is deleted while being loaded in the computer-readable storage medium (i.e., memory), so that the dynamic security-related file can be prevented from being decompiled. In this case, unless the memory of the client device 102 itself is hacked, the dynamic security-related file can not be leaked to a third party.

On the other hand, the dynamic security-related file checks the remaining capacity of the memory of the client device 102 and, if the remaining capacity of the memory can not load all dynamic security-related files, loading only a part of the dynamic security- Lt; / RTI > Dynamic security related files can load some dynamic security related files into memory according to a predetermined priority among dynamic security related files based on the remaining capacity of memory. For example, if a dynamic security-related file includes a vaccine program, a virtual keyboard program, etc., a vaccine program that should always be operated rather than a virtual keyboard program used only during key input can be loaded into the memory first.

The client device 102 receives the encryption-related key value while verifying the application through the verification server 104 at the first execution of the unsecured application, transmits the security file request to the management server 106, ) And the encryption-related key value. In addition, the client device 102 may receive the encrypted dynamic security-related file and the decryption key from the management server 106, and may decrypt the encrypted dynamic security-related file using the decryption key. Thereafter, each time the client device 102 executes an unsecured application to perform a financial transaction or settlement online, it performs verification via the verification server 104 and sends a dynamic security file request to the management server 106 Lt; / RTI > Then, the management server 106 extracts the encryption-related key value matched with the unique identification information of the client device 102 included in the security file request, encrypts the dynamic security-related file, Key to the client device 102.

The verification server 104 may be responsible for verifying unsecured applications distributed to each client device 102. Specifically, the verification server 104 can confirm whether or not the unsecured application has been falsified or altered. The verification server 104 may store identification information of an unsecured application (for example, the ID of the unsecured application and the hash value of the unsecured application, etc.) before the secured unsaved application of the predetermined version is distributed.

The verification server 104 may receive a verification request from each client device 102 that has executed the unsecured applications. The verification server 104 can verify whether the identification information of the unsecured application included in the verification request matches the identification information of the previously stored unsecured application.

Specifically, the verification server 104 determines whether the identification information of the unsecured application included in the verification request (for example, the ID of the unsecured application and the hash value of the unsecured application) matches the identification information of the unsecured application , It can be judged that the verification is successful (that is, it is judged that the unsecured application is not falsified or tampered). If the identification information of the non-secured application included in the verification request does not match with the identification information of the previously stored unsecured application, the verification server 104 determines that the verification fails (that is, the corresponding non-secured application is falsified or tampered )can do.

The verification server 104 may generate the verification result related information in response to the verification request of the client device 102 and may transmit the generated verification result related information to the client device 102. [ The verification result related information may include a verification result of the verification request (i.e., verification success or verification failure), a verification time, and an encryption-related key value.

When the verification request includes management specific information (for example, unique identification information of the client device 102), the verification server 104 hashes the unique identification information of the client device 102, The hash value of the unique identification information of the device 102 can be set as the encryption-related key value. Here, the encryption-related key value may be an encryption key value for encrypting the security-related file in the management server 106 and a decryption key value for decrypting the security-related file encrypted in the client device 102. At this time, the encryption key value and the decryption key value may be the same. The verification server 104 can transmit the encryption-related key value to the verification result related information only when the verification result is successful.

Meanwhile, when the anomaly indication is determined, the verification server 104 may hash the management specific information added with the predetermined dummy management information in the unique identification information of the client device 102, and then set the management specific information as an encryption related key value. At this time, the management specific information may be the dummy management information added to the front end or the rear end of the unique identification information of the client device 102.

That is, the verification server 104 normally generates the encryption-related key value by using the unique identification information of the client device 102 as the management unique information, and when determining the anomalous indications, the unique identification information of the client device 102, The encryption-related key value can be generated using the management specific information in which the set dummy management information is combined.

The verification server 104 can manage the log information according to the verification request for each client device 102. [ The log information may include the time of receiving the verification request, the verification result, and the information transmission time related to the verification result. The verification server 104 can determine whether an abnormal symptom is present based on the log information according to the verification request. For example, the verification server 104 may determine that an abnormal symptom occurs when the total number of verification failures in accordance with the verification requests of the clients for a predetermined time exceeds a predetermined first number. In addition, the verification server 104 may determine that an abnormal symptom occurs when a verification failure in response to the verification request occurs to a predetermined client device 102 in excess of the second predetermined number of times. Here, the first number of times and the second number of times may be appropriately set in consideration of the number of service subscribers.

Thus, by changing the rule for generating an encryption-related key value when an anomaly occurs, it is possible to prevent the encryption-related key value from being exposed to a malicious third party.

The management server 106 may receive a secure file request from the client device 102. The management server 106 can check whether the client device 102 that transmitted the security file request is a registered device and register the client device 102 in the block chain 108 if the device is not registered . Specifically, the management server 106 extracts the unique identification information of the client device 102 in the secure file request, and transmits the unique identification information of the extracted client device 102 to the block chain 108 so that the corresponding client device 102 ) Can be inquired. If the client device 102 is not registered, the management server 106 may transmit the encryption-related key value contained in the security file request to the block chain 108 so that the client device 102 is registered . At this time, the block chain 108 may register unique identification information of the client device 102 with the encryption-related key value.

The management server 106 may also send dynamic security related files to the client device 102 based on operating system related information of the client device 102 included in the secure file request. The management server 106 can store dynamic security related files according to the operating system version for each operating system type. The management server 106 may extract the dynamic security related file corresponding to the operating system related information of the client device 102 and then encrypt the extracted dynamic security related file with the encryption related key value included in the security file request. The encrypted dynamic security-related file may then be transmitted to the client device 102 along with the encryption-related key value. Here, since the encryption-related key value is generated based on the unique identification information of the client device 102, the dynamic security-related file is encrypted and decrypted differently for each client device 102.

On the other hand, when the management server 106 is a device in which the client device 102 that transmitted the security file request is registered, the management server 106 acquires the unique identification information of the client device 102 from the block chain 108 It is possible to receive the encryption-related key value. The management server 106 may extract the dynamic security related file corresponding to the operating system related information of the client device 102 and then encrypt the extracted dynamic security related file with the encryption related key value received from the block chain 108 . The encrypted dynamic security-related file may then be transmitted to the client device 102 along with the encryption-related key value. In this manner, the management server 106 checks whether the client device 102 that has transmitted the security file request has been registered in advance, and determines whether the client device 102 is dynamic by using the encryption-related key value that matches the unique identification information of the client device 102 By encrypting the security-related file, the security of the application (i.e., security) can be secondarily guaranteed.

The block chain 108 may manage the encryption-related key value for each client device 102. The block chain 108 may register the client device 102 with the block chain 108. Specifically, when receiving the unique identification information of the client device 102 from the management server 106, the block chain 108 can confirm whether or not the corresponding client device 102 is registered based on the unique identification information. If the client device 102 is an unregistered device, the block chain 108 receives the encryption-related key value from the management server 106 and matches the unique identification information of the client device 102 with the encryption- So that the client device 102 can be registered.

That is, the client device 102 may include the encryption-related key value in addition to the unique identification information of the client device 102 in the security file request in the initial security file request. Here, the block chain 108 registers the verified client device 102 because the client device 102 receives and transmits the encryption-related key value only when verification is successful at the verification server 104.

On the other hand, when the client device 102 is a registered device, the block chain 108 extracts an encryption-related key value matched with the unique identification information of the corresponding client device 102, (106).

The block chain 108 may include an API server 108a and a plurality of distributed nodes 108b. An API (Application Program Interface) server 108a can provide an interface between the management server 106 and the block chain 108. [ The API server 108a can receive the unique identification information of the client device 102 from the management server 106 and confirm whether or not the corresponding client device 102 is registered. In addition, the API server 108a may store the unique identification information of the predetermined client device 102 and the encryption-related key value in a plurality of distribution nodes 108b. In addition, the API server 108a can extract the encryption-related key value matching the unique identification information of the client device 102 from the plurality of distribution nodes 108b and transmit it to the management server 106. [

The plurality of distributed nodes 108b may store the unique identification information and the encryption-related key value for each client device 102 by matching. The plurality of distributed nodes 108b may store the unique identification information and the encryption-related key value for each client device 102 based on the block-chain technology. In this case, the integrity of the encryption-related key value can be ensured, and the encryption-related key value can be prevented from being hacked or stolen.

According to the embodiment of the present invention, security-poor applications are distributed to the client device 102 and the encrypted dynamic security-related files are transmitted each time the security-critical applications are executed. Thus, Can be minimized and the security-related files of the application can be prevented from being hijacked or stolen by a malicious third party.

In addition, the verification server 104 performs verification of an insecure application, and transmits the encryption-related key value to the client device 102, thereby confirming integrity of whether the corresponding application is falsified or altered . In addition, by generating the encryption-related key value based on the unique identification information of the client device 102, encryption and decryption can be performed differently for each client device 102, .

In addition, by distributing the security-critical application to the client device 102, it is possible to minimize the size of the application distributed to the client device 102, and even when the dynamic security-related file is changed or updated, When the application is executed, updated dynamic security related files are automatically received and executed.

However, the present invention is not limited to this. The management server 106 may store the unique identification information for each client device 102 in the client device 102, The unique identification information may be matched with the encryption-related key value and stored.

In addition, although the security-related application includes static security-related files and does not include dynamic security-related files, it may be that static security-related files and dynamic security-related files are not loaded. That is, the security-related application may not mount the security-related file itself. In this case, the client device 102 can receive the encrypted static security-related file and the encrypted dynamic security-related file from the management server 106, decrypt and execute the file.

FIG. 2 is a flowchart illustrating a process of verifying whether a forgery or falsification has occurred in an application security method according to an embodiment of the present invention. In the illustrated flow chart, the method is described as being divided into a plurality of steps, but at least some of the steps may be performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, One or more steps may be added and performed.

Referring to FIG. 2, the client device 102 downloads a security-critical application (S 101). Security application is intended to perform security-related tasks such as financial transactions or payments online. However, only security-related files are included, and dynamic security-related files are omitted. It may be in a non-existent state. In an exemplary embodiment, the client device 102 may download an unsecured application from a server computing device, such as the verification server 104 or the management server 106, or the like.

Next, the client device 102 transmits a verification request related to the unsecured application to the verification server 104 (S103). The client device 102 may send a verification request to the verification server 104 when an unsecured application is executed by the user. When the unsecured application is first executed in the client device 102, the client device 102 transmits a verification request including the identification information of the unsecured application and the unique identification information of the client device 102 to the verification server 104 .

Next, the verification server 104 compares the identification information of the unsecured application included in the verification request with the identification information of the previously stored unsecured application to perform verification (S 105).

If the identification information of the security-critical application included in the verification request coincides with the identification information of the previously-stored security-less application as a result of the execution of step S 105, the verification server 104 transmits the unique ID of the client device 102 included in the verification request And generates an encryption-related key value based on the identification information (S 107). For example, the verification server 104 may generate an encryption-related key value by hashing the unique identification information of the client device 102.

Next, the verification server 104 transmits the verification result related information to the client device 102 (S 109). The verification result related information may include a verification result value corresponding to the verification request, a verification time, and an encryption-related key value. If the identification information of the security-critical application included in the verification request does not match the identification information of the previously-stored security-less application as a result of the execution of step S 105, the verification server 104 stores the encryption-related key value in the verification- . In addition, the verification server 104 can manage the log information according to the verification request of the client device 102.

3 is a flowchart illustrating a process of receiving a dynamic security-related file in an application security method according to an exemplary embodiment of the present invention. In the illustrated flow chart, the method is described as being divided into a plurality of steps, but at least some of the steps may be performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, One or more steps may be added and performed.

Referring to FIG. 3, when the verification result of the unsecured application is successful, the client device 102 transmits a security file request to the management server 106 (S 201). The secure file request may include unique identification information of the client device 102, encryption related key value, and operating system related information of the client device 102. On the other hand, if the verification result of the insecure application is a verification failure, the client device 102 can terminate the insecure insecure application.

Next, the management server 106 extracts the unique identification information of the client device 102 included in the security file request, and then transmits the unique identification information of the extracted client device 102 to the block chain 108 (S 203 ).

Next, the block chain 108 sends a corresponding encryption key value to the client device 102 if there is an encryption-related key value that matches the unique identification information of the client device 102 (i.e., if the client device 102 is registered) And transmits it to the management server 106 (S 205). On the other hand, if there is no encryption-related key value matching the unique identification information of the client device 102 (that is, if the corresponding client device 102 is not registered), the block chain 108 is transferred from the management server 106 Related key value, and registers the corresponding client device 102 by matching the unique identification information of the client device 102 with the encryption-related key value.

Next, the management server 106 extracts a dynamic security-related file corresponding to the operating system-related information of the client device 102 included in the security file request (S 207). That is, the management server 106 can extract dynamic security-related files corresponding to the operating system type and the operating system version of the client device 102.

Next, the management server 106 encrypts the extracted dynamic security-related file using the encryption-related key value received from the block chain 108 (S 209), and transmits the encrypted dynamic security-related file and the encryption-related key value , Decryption key value) to the client device 102 (S211).

Next, the client device 102 decrypts the encrypted dynamic security-related file using the received decryption key (S 213). Then, the decrypted dynamic security-related file is loaded into the memory, and the dynamic security-related file is executed and deleted (S 215).

4 is a block diagram illustrating and illustrating a computing environment 10 that includes a computing device suitable for use in the exemplary embodiments. In the illustrated embodiment, each of the components may have different functions and capabilities than those described below, and may include additional components in addition to those described below.

The illustrated computing environment 10 includes a computing device 12. In one embodiment, computing device 12 may be a client device (e.g., client device 102). The computing device 12 may also be a server computing device (e.g., verification server 104 or management server 106).

The computing device 12 includes at least one processor 14, a computer readable storage medium 16, The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiment discussed above. For example, processor 14 may execute one or more programs stored on computer readable storage medium 16. The one or more programs may include one or more computer-executable instructions, which when executed by the processor 14 cause the computing device 12 to perform operations in accordance with the illustrative embodiment .

The computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. The program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, the computer-readable storage medium 16 may be any type of storage medium such as a memory (volatile memory such as random access memory, non-volatile memory, or any suitable combination thereof), one or more magnetic disk storage devices, Memory devices, or any other form of storage medium that can be accessed by the computing device 12 and store the desired information, or any suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12, including processor 14, computer readable storage medium 16.

The computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide an interface for one or more input / output devices 24. The input / output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input / output device 24 may be connected to other components of the computing device 12 via the input / output interface 22. The exemplary input and output device 24 may be any type of device, such as a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touch pad or touch screen), a voice or sound input device, An input device, and / or an output device such as a display device, a printer, a speaker, and / or a network card. The exemplary input and output device 24 may be included within the computing device 12 as a component of the computing device 12 and may be coupled to the computing device 12 as a separate device distinct from the computing device 12 It is possible.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, . Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by equivalents to the appended claims, as well as the appended claims.

100: Application Security System
102: Client device
104: verification server
106: management server
108: Block Chain
108a: API server
108b: Distributed node

Claims (24)

Wherein the secure security application is downloaded from a static security related file and a dynamic security related file and transmits a verification request for the non secure application, A client device for sending a secure file request for dynamic security related files;
A verification server for receiving the verification request from the client device, performing verification of the unsecured application, and transmitting the verification result related information to the client device; And
And a management server that receives the secure file request from the client device and transmits the encrypted dynamic security-related file to the client device,
Wherein the client device receives the encrypted dynamic related file and the encryption related key value from the management server and decrypts the encrypted dynamic security related file based on the encryption related key value,
Wherein the dynamic security related file is configured to check the remaining capacity of the memory of the client device and to update the dynamic security related files according to a predetermined priority among the dynamic security related files when the remaining capacity of the memory can not load all of the dynamic security related files. And loading some dynamic security related files into the memory.
The method according to claim 1,
The verification request includes:
An identification information of the security-critical application, and unique identification information of the client apparatus.
The method of claim 2,
Wherein the verification server comprises:
A verification unit configured to compare the identification information of the unsecured application included in the verification request with the identification information of the previously stored unsecured application and to generate an encryption related key value based on the unique identification information of the client apparatus according to the verification result And transmits verification result related information including the verification result and the encryption related key value to the client device.
The method of claim 3,
Wherein the verification server comprises:
And generates an encryption-related key value based on management unique information in which unique identification information of the client apparatus and predetermined dummy management information are combined when an abnormal symptom occurs.
The method of claim 4,
Wherein the verification server comprises:
And determines that the abnormal symptom occurs when a total number of verification failures according to a verification request of each client for a predetermined time exceeds a predetermined first number.
The method of claim 4,
Wherein the verification server comprises:
And determines that the abnormal symptom occurs when a verification failure based on the verification request for the client device exceeds a second predetermined number of times.
The method of claim 3,
Wherein the secure file request comprises:
The unique identification information of the client device, the encryption related key value, and operating system related information of the client device.
The method of claim 7,
The management server includes:
Extracts a dynamic security-related file corresponding to the operating system-related information of the client device, encrypts the extracted dynamic security-related file using the encryption-related key value, and encrypts the encrypted dynamic security- To the client device.
The method according to claim 1,
Wherein the secure file request comprises:
And at least one of the unique identification information of the client device, the encryption-related key value generated based on the unique identification information of the client device, and the operating system-related information of the client device.
The method of claim 9,
The application security system comprises:
Further comprising a block chain for receiving the unique identification information and the encryption-related key value of each client device from the management server, and for matching and storing the unique identification information of each client device with the corresponding encryption-related key value.
The method of claim 10,
The management server includes:
Transmitting unique identification information of the client apparatus included in the secure file request to the block chain,
Wherein the block chain extracts an encryption-related key value matched with the unique identification information of the client apparatus and transmits the encryption-related key value to the management server,
The management server extracts a dynamic security related file corresponding to the operating system related information of the client device and encrypts the extracted dynamic security related file using an encryption related key value received from the block chain, Dynamic security related file and the encryption related key value to the client device.
delete The method according to claim 1,
The static security-
Transmitting the verification request to the verification server when the security-critical application is executed; And
And terminating the security-critical application when verification of the security-less application fails as a result of checking the verification result-related information.
One or more processors, and
A method performed in a client device having a memory for storing one or more programs executed by the one or more processors,
Downloading a security-critical application on which the static security-related file is mounted, among the static security-related file and the dynamic security-related file;
Transmitting a verification request for the unsecured application;
Receiving a verification result related information corresponding to the verification request, and transmitting a security file request for the dynamic security related file according to the verification result related information;
Receiving an encrypted dynamic security-related file and an encryption-related key value corresponding to the secure file request; And
And decrypting the encrypted dynamic security-related file using the encryption-related key value,
Wherein the step of decrypting comprises:
Checking the remaining capacity of the memory of the client device; And
Loading the dynamic security related files into the memory according to a predetermined priority among the dynamic security related files when the remaining capacity of the memory can not load all of the dynamic security related files, Security method.
15. The method of claim 14,
The verification request includes:
An identification information of the security-critical application, and unique identification information of the client device.
16. The method of claim 15,
The verification result related information may include,
A verification result obtained by comparing the identification information of the unsecured application included in the verification request with the identification information of the previously stored unsecured application and an encryption related key value generated based on the unique identification information of the client device , Application security method.
18. The method of claim 16,
Wherein the secure file request comprises:
The unique identification information of the client device, the encryption related key value, and operating system related information of the client device.
delete 15. The method of claim 14,
The static security-
An instruction for transmitting the verification request when the security-critical application is executed; And
And terminating the unsecured application when verification of the unsecured application fails as a result of the verification result related information.
One or more processors, and
A method performed in a computing device having a memory storing one or more programs executed by the one or more processors,
Receiving, from the client apparatus, a verification request for a security-related file containing the static security-related file and the dynamic security-related file;
Performing verification by comparing identification information of an unsecured application included in the verification request with identification information of a previously stored unsecured application; And
Generating verification-result-related information corresponding to the verification request and transmitting the information to the client device,
Wherein the verification request includes identification information of the unsecured application and unique identification information of the client apparatus,
The step of generating the verification result related information includes:
And generating an encryption-related key value based on the unique identification information of the client apparatus according to a result of the verification,
The client device decrypts the dynamic security-related file encrypted based on the encryption-related key value,
Wherein the dynamic security related file is configured to check the remaining capacity of the memory of the client device and to update the dynamic security related files according to a predetermined priority among the dynamic security related files when the remaining capacity of the memory can not load all of the dynamic security related files. And loading some dynamic security related files into the memory.
The method of claim 20,
The step of generating the encryption-related key value comprises:
And generates a hash of the unique identification information of the client apparatus when the result of the verification is a verification success.
The method of claim 20,
The step of generating the encryption-related key value comprises:
Determining whether an abnormal symptom is present based on log information according to a verification request of each client device; And
And generating an encryption-related key value based on the management unique information in which the unique identification information of the client apparatus and the predetermined dummy management information are combined when the abnormal symptom occurs.
One or more processors, and
A method performed in a computing device having a memory storing one or more programs executed by the one or more processors,
Receiving a security file request for the dynamic security-related file from a client device that has downloaded the security-related file containing the static security-related file and the static security-related file and the dynamic security-related file;
Extracting unique identification information of the client device included in the secure file request;
Transmitting the unique identification information of the extracted client device to a block chain;
Receiving an encryption-related key value from the block chain that matches the unique identification information of the client device; And
Encrypting the dynamic security-related file with the received encryption-related key value, and transmitting the encrypted dynamic security-related file and the encryption-related key value to the client device,
Wherein the client device decrypts the encrypted dynamic security related file based on the encryption related key value,
Wherein the dynamic security related file is configured to check the remaining capacity of the memory of the client device and to update the dynamic security related files according to a predetermined priority among the dynamic security related files when the remaining capacity of the memory can not load all of the dynamic security related files. And loading some dynamic security related files into the memory.
24. The method of claim 23,
Wherein the secure file request comprises:
The unique identification information of the client apparatus and the operating system related information of the client apparatus,
Wherein the transmitting the encrypted dynamic security-related file to the client device comprises:
Extracting a dynamic security related file corresponding to the operating system related information of the client device; And
Encrypting the extracted dynamic security-related file with the received encryption-related key value.

Images