KR101907847B1 - Apparatus, method for encryption using dependency integrity check of androids and other similar systems - Google Patents

Abstract

The present invention relates to an apparatus and a method for encryption using dependency relationship type forgery integrity check in androids and other similar systems, and an application encrypted by the same. To this end, the apparatus comprises: a main code extracting module extracting a main executable code or a main character string to be encrypted in an executable code part of an input specific application; an encryption module encrypting the extracted main execution code or main character string to generate an encryption code, and storing the generated encryption code in a security module of the specific application; a reference code insertion module deleting the extracted main execution code or the main character string, and generating and inserting a reference code for referencing the deleted main execution code or the encryption code stored in the security module at the position of the key string; and a security module encryption module encrypting the security module based on data of the executable code part of the specific application modified by the reference code insertion module. According to the present invention, security can be maintained.

Description

[0001] APPARATUS, METHOD FOR ENCRYPTION USING DEPENDENCY INTEGRITY CHECK OF ANDROIDS AND OTHER SIMILAR SYSTEMS [0002]

The present invention relates to an apparatus and method for cryptographic processing using dependency-based forgery integrity check of Android and other similar systems, in connection with application integrity, and an application encrypted thereby.

With the recent rapid increase in the number of mobile devices, security boundaries are shifting from existing networks or devices to applications. In the past, when there were not many desktops or mobile devices, mainframe-centric computing moved to interconnections over the network. Therefore, at that time, it was easy to define the security boundary by router, firewall related security policy, and so on. However, as the number of desktop personal clients has increased explosively, security boundaries have been extended to reside on devices through user access and authentication policies or hardware. Since then, with the rapid increase in the number of mobile devices in recent years, the global app economy is spurring innovation at the application layer, and as each application deeply penetrates the user's life, important information is stored in mobile applications , Security boundaries have been moved to applications to maintain the integrity of hacking and cracking.

Especially after 2011, malicious codes such as Droid-Dream, DroidKungFu, and Ginermaster were circulated. After reverse engineering, the normal Android app was repackaged and distributed with malicious codes. Thus, Android applications are the main target of malware authors for the following reasons.

Android applications are easy to reverse-engineer because DEX code can be mapped 1: 1 with Javabyte code, so malicious code insertion and repackaging using app forgery is easy. In addition, it is easy to distribute malicious applications because it is possible to install the Android application package file (APK file) on the mobile device since the third party market is activated in addition to Google's official market Play Store.

FIG. 1 shows a process of creating an APK file. As shown in Fig. 1, the * .dex file is a file converted into a bytecode * .class file so that it can be recognized by dalvik, which is an Android virtual machine (VM). Conversely, if you extract * .class files by decompiling * .dex files into dabby bytecode, you can also decompile them with the java code of the Android application. When you run the developed APK file to start the installation of the application, the APK file is unzipped and the APK is saved as the Package name in / data / app, for example. * .dex The dumbic byte code is stored in, for example, / data / dalvik-cache. Other files such as lib are stored in, for example, / data / data / Package names. The actual executable file * .dex works in the Dalvik virtual machine.

2 shows the structure of the APK file. As shown in FIG. 2, the APK file is similar to a Java standard jar file that contains executable program code and resources. Generally, the AndroidManifest.xml file included in the APK file is an XML file containing meta information such as application information and access authority information. The classes.dex file is a Java bytecode information to be loaded and executed by the Dalvik virtual machine , And the res directory consists of files that define layout, strings, and so on. The lib directory contains compiled native libraries such as .so, and the assets directory can contain additional files that the application needs, and these files can be processed by the android.content.res.AssetManager class.

Korean Patent Publication No. 10-2017-0089859, Methods and Devices for Providing Verification of Application Integrity, Thomson Licensing Korean Patent Publication No. 10-2017-0088858, Methods and Devices for Providing Application Integrity Verification, Thomson Licensing

Previously, in order to solve the problem, after encrypting the dex file for running the Android application, the encryption method was provided by decrypting the encrypted dex file during execution. However, this has not been easy to prevent the decompilation of the running Android application in order to increase the size of the application market and at the same time, to exploit the forgery of the application which is greatly performed. In order to prevent decompilation of the Android application, There is a problem that the dex file can not be executed properly.

That is, the existing data integrity verification uses the hash value based integrity verification method calculated using the hash algorithm. However, if the attacker can find out the existing hash value through a separate process of calculating and verifying the existing hash value, there is a possibility that the attacker can easily bypass it. In addition, if only the hash value for detecting forgery and falsification is modified, forgery detection can be bypassed. Therefore, it has been required to develop a research project on various methods to solve this problem. Java (Dex), which has been used for the same security problem, has a problem that it is very easy to analyze. Therefore, the production of binary modules for integrity verification is continuously increasing in the mobile security market.

Previously, a module containing an integrity verification function could be bypassed by simply patching or deleting the code through a binary load using a method such as LoadLibrary.

Due to the nature of Android environment, it is impossible to prevent decompilation by enabling Java code analysis through decompile. Dex files can be decompiled to convert Dex files into jar files to check the source code of APK files, and malicious behavior on mobile apps is possible through source code analysis and tampering. Therefore, if you protect your Dex files by encrypting them in an existing way, you can easily check the source code of your mobile app by decompiling the Dex file by patching and deleting the decryption code. Therefore, in order to protect Dex files, it is necessary to improve the difficulty of Java (DEX) analysis and the integrity verification technology that can prevent the bypass of the security system should have a clear difference from the existing methods. Although Dex encryption and integrity verification technology has been researched and commercialized in the current market, it is not able to play the role of security technology because it can be analyzed and bypassed.

Therefore, it is an object of the present invention to prevent the integrity from being released through the calculation and verification of hash value, and to protect the Dex file from the hacking of an attacker by making it harder than the existing method, And a cryptographic processing apparatus using the dependency forgery integrity check of the system, a method and an application encrypted by the method.

Hereinafter, specific means for achieving the object of the present invention will be described.

An object of the present invention is to provide a key code extraction module for extracting a main execution code or a main character string to be encrypted in an executable code part of a specific application input; An encryption module for encrypting the extracted main execution code or the main string to generate an encryption code, and storing the generated encryption code in the security module of the specific application; A reference code insertion module which deletes the extracted main execution code or the main string and generates and inserts a reference code for referring to the deleted main execution code or the position of the main string, ; And a security module encryption module for encrypting the security module based on data of the executable code portion of the specific application modified by the reference code inserting module, wherein the dependency between the security module and the executable code portion And outputting the encrypted specific application which can be checked by forgery integrity check, by using the dependency-type forgery integrity check.

Another object of the present invention is to provide a memory module for storing program codes in which an encryption processing method is performed; And a processing module for executing the program code, wherein the program code includes a main code extracting step for extracting a main execution code or a main character string to be encrypted in an executable code part of the input specific application; An encryption step of encrypting the extracted main execution code or the main string to generate an encryption code, and storing the generated encryption code in a security module of the specific application; A reference code inserting step of deleting the extracted main execution code or the main string and generating and inserting a reference code for referring to the deleted main execution code or the position of the main string to the encryption code stored in the security module ; And a security module encrypting step of encrypting the security module based on the data of the executable code part of the specific application modified by the reference code inserting step, wherein the dependency between the security module and the executable code part And outputting the encrypted specific application which can be checked by forgery integrity check, by using the dependency-type forgery integrity check.

Another object of the present invention is to provide a main code extraction module for extracting a main execution code or a main character string to be encrypted in an executable code part of a specific application inputted; An encrypting step of encrypting the main executable code or the extracted key string to generate an encrypted code, and storing the generated encrypted code in the security module of the specific application; The reference code inserting module deletes the extracted main execution code or the main string and generates a reference code for referencing the deleted main execution code or the position of the main string to the encryption code stored in the security module A reference code insertion step of inserting; And a security module encrypting step of encrypting the security module based on data of the executable code part of the specific application modified by the reference code inserting module, And outputting the encrypted specific application capable of forgery integrity check based on a dependency of a possible code part, by using a dependency-type forgery integrity check.

It is another object of the present invention to provide a method of encrypting and decrypting an encrypted application code in an application stored on a recording medium which can be encrypted by a cryptographic processing method and which can be executed by a computer, Application code in which a reference code is stored instead; And a security module that includes the main executable code or the encryption code that encrypts the main string, and is encrypted based on the data of the application code, wherein the security module and the application code depend on the forgery integrity check Which is stored in a recording medium that can be executed by a computer.

As described above, the present invention has the following effects.

First, according to an embodiment of the present invention, it is necessary to solve the problem of analyzing and modifying both areas by improving the dependency between Java (DEX) and a binary type security module. Therefore, This helps maintain security.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate preferred embodiments of the invention and, together with the description, And shall not be interpreted.
1 shows a process of creating an APK file,
2 shows the structure of the APK file,
FIG. 3 illustrates an encryption processing apparatus 100 using a dependency forgery integrity check according to an embodiment of the present invention,
FIG. 4 is a flowchart illustrating a method of processing encryption using a dependency-based forgery integrity check according to an embodiment of the present invention; FIG.
5 is an illustration of a system in which an application encrypted by the method of processing an encryption using a dependency forgery integrity check according to an embodiment of the present invention is implemented,
Figure 6 is an illustration of an encrypted application structure in accordance with one embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following detailed description of the operation principle of the preferred embodiment of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may unnecessarily obscure the subject matter of the present invention.

The same reference numerals are used for portions having similar functions and functions throughout the drawings. In the specification, when a specific portion is connected to another portion, it includes not only a direct connection but also a case where the other portion is indirectly connected with another element in between. In addition, the inclusion of a specific constituent element does not exclude other constituent elements unless specifically stated otherwise, but may include other constituent elements.

Cryptographic processing device using dependency forgery integrity check of Android and other similar systems

With respect to an encryption processing apparatus using dependency forgery integrity check, FIG. 3 shows an encryption processing apparatus 100 using a dependency-based forgery integrity check according to an embodiment of the present invention. 3, the encryption processing apparatus 100 using the dependency forgery integrity check according to an embodiment of the present invention includes a main code extraction module 110, an encryption module 120, a reference code insertion module 130, and a security module encryption module 140. The main code extracting module 110, the encrypting module 120, the reference code inserting module 130, and the security module encrypting module 140 according to an embodiment of the present invention can be configured in a server of a principal performing encryption services have.

The main code extracting module 110 is a structure for extracting a main executable code or a main character string to be encrypted from an executable code part (for example, a DEX file) of an application when a specific application APK file is input. The executable code to be encrypted in the main code extraction module 110, that is, the executable code to be encrypted and the executable code to be the non-encryption target are arbitrarily set by the administrator of the computer program for carrying out the present invention, Can be selected. According to an embodiment of the present invention, the main code selected to be extracted by the main code extraction module 110 can be selected based on the importance degree determined by the previously stored importance determination model.

The encryption module 120 is a configuration for encrypting the main executable code or the main string extracted from the executable code part of the application by the main code extraction module 110 to generate an encryption code and storing it in the security module of the library. When the main code extraction module 110 extracts the execution code to be encrypted, the execution code extracted by the encryption module 120 is encrypted. At this time, the encryption may be performed using various encryption algorithms, for example, an encryption scheme based on a common key (Secret Key). For example, the encryption code may be stored in a .so file, which is a security module stored in the library.

The reference code inserting module 130 deletes the main execution code or the main character string extracted from the executable code part of the application by the main code extracting module 110 and refers to the corresponding encryption code stored in the security module at the corresponding position And generates a reference code. For example, if you store the main executable code in the DEX file in the .so file, which is a security module, you can delete the corresponding executable code in the DEX file and reference the corresponding code in the .so file It is inserted at the location of the main executable code.

The security module encryption module 140 is based on the data of the executable code portion of the application generated by the main code extraction module 110 and the reference code insertion module 130 ) This is a configuration for encrypting the security module. For example, the security module encryption module 140 may convert the DEX file into which the main execution code is deleted and the reference code is inserted, and encrypt the security module based on the Hash value. The application encrypted by the security module encryption module 140 (APK file of the encrypted application) can be output. According to an embodiment of the present invention, since the security module is encrypted by using a Hash value of at least a part of executable code (e.g., a DEX file) as a key, Key) can be used. In the past, there has been a problem that the hash value is exposed by checking the integrity through comparing the hash value previously stored. However, according to the embodiment of the present invention, the key value is generated dynamically, . If the hash value is changed as a result of the integrity being broken, the encryption can not be normally released and the infringement can be grasped.

As a result, according to one embodiment of the present invention, an effect that an encrypted application capable of forgery integrity check is output is generated by the dependency between the security module and the executable code unit.

A security module according to an embodiment of the present invention can generate a normal app including an encryption code and a resource for normal execution of an application, encrypts the security module with a data base of Java (Dex) You can increase your dependency on the app. According to an embodiment of the present invention, it is possible to increase the dependency of Java (DEX) with low security and security modules and apps based on the technical features of the security module as described above, thereby bypassing security functions such as system performance improvement and integrity verification . When an attacker attempts to forge or modify a Dex file of an app according to an embodiment of the present invention, the Dex file is used as a value necessary for the security module to operate. Therefore, when one of the security modules is modulated The structure is changed and the normal application can not be executed. Also, if forex modification of the Dex file is performed through forgery integrity check and Dex file encryption, the application execution is stopped as soon as the security module is tampered with due to the app dependency.

Also, during the creation of the security module-containing app according to an embodiment of the present invention, a technique of inserting and modifying a reference code in a process of building a security module and obfuscating Java (DEX) and analyzing difficulty in a Gradle Plugin (Including the ability to remove existing data) to enable high code obfuscation. New code can be generated each time to create Java (DEX) and a highly dependable security module (binary).

Previously, the security module compares the hash value of the executable code such as the DEX file of the application with the original value held by the security module, and checks the forgery and falsification. In the conventional method, when the original value is modulated, even if the DEX file is modulated, it is impossible to check the forgery or falsification and the normal execution becomes possible. However, according to the embodiment of the present invention, since the DEX file and the security module are configured to have an interdependency relationship, the above problem is solved.

When the encrypted application is executed by the encryption processing apparatus using the dependency forgery integrity check according to an embodiment of the present invention, the application is executed in the following steps.

(1) Load encrypted security module from library

(2) decrypting the security module using at least a part of the Hash value of the application executable code (for example, DEX file)

(3) The decrypted security module decrypts the encrypted executable code (for example, a DEX file)

(4) execute the execution code of the application, and execute the application normal execution including the main code stored in the security module through the reference code

Therefore, if the DEX file is modulated, there is a problem in decrypting the security module, and if the security module of the library is modulated, there is a problem in execution of the application, and forgery and falsification can be prevented.

According to an embodiment of the present invention, the security module encryption module modifies the Android runtime based on the encrypted security module, and when the specific application is executed, the decryption of the encrypted code such as the DEX file is executed on the Android runtime Is performed. According to an embodiment of the present invention, when the Android runtime is modified based on the encrypted security module to decrypt the encrypted execution code on the Android runtime, when the security module is to be tampered, The effect of the modulation of the security module becomes more difficult.

How to handle encryption using dependency forgery integrity check of Android and other similar systems

FIG. 4 is a flowchart illustrating an encryption processing method using a dependency forgery integrity check according to an embodiment of the present invention, in connection with a cryptographic processing method using dependency forgery integrity check. 4, the encryption processing method using the dependency forgery integrity check according to an exemplary embodiment of the present invention includes a main code extraction step S10, an encryption step S20, a reference code insertion step S30, And a security module encryption step (S40).

The main code extracting step S10 is a step for extracting a main execution code or a main character string to be encrypted from an executable code part (for example, a DEX file) of the application when a specific application APK file is inputted.

The encrypting step S20 is a step for encrypting the main executable code or the main string extracted from the executable code part of the application by the main code extracting step S10 to generate an encrypted code and storing it in the security module of the library.

In the reference code inserting step (S30), the main execution code or main character string extracted from the executable code part of the application is deleted by the main code extracting step (S10), and the corresponding code stored in the security module is referred to A reference code is generated and inserted.

The security module encryption step S40 is a step of encrypting the security module based on the data of the executable code part of the application generated by the main code extraction step S10 and the reference code insertion step S30.

As a result, according to one embodiment of the present invention, an effect that an encrypted application capable of forgery integrity check is output is generated by the dependency between the security module and the executable code unit.

When the encrypted application is executed by the encryption processing method using the dependency-based forgery-and-integrity check according to an embodiment of the present invention, the application is executed in the following steps.

(1) Load encrypted security module from library

(2) decrypting the security module using at least a part of the Hash value of the application executable code (for example, DEX file)

(3) The decrypted security module decrypts the encrypted executable code (for example, a DEX file)

(4) execute the execution code of the application, and execute the application normal execution including the main code stored in the security module through the reference code

Therefore, if the DEX file is modulated, there is a problem in decrypting the security module, and if the security module of the library is modulated, there is a problem in execution of the application, and forgery and falsification can be prevented.

According to an embodiment of the present invention, the security module encryption module modifies the Android runtime based on the encrypted security module, and when the specific application is executed, the decryption of the encrypted code such as the DEX file is executed on the Android runtime Is performed. According to an embodiment of the present invention, when the Android runtime is modified based on the encrypted security module to decrypt the encrypted execution code on the Android runtime, when the security module is to be tampered, The effect of the modulation of the security module becomes more difficult.

Applications encrypted by the encryption processing method using dependency forgery integrity check of Android and other similar systems

With respect to the application encrypted by the encryption processing method using the dependency forgery integrity check according to an embodiment of the present invention, FIG. 5 is a flowchart illustrating an encryption processing method using the dependency forgery integrity check according to an embodiment of the present invention Figure 5 is an illustration of a system in which an encrypted application is implemented. As shown in FIG. 5, a system 1 in which an encrypted application is implemented includes a client 10 and an application provider (application store) The client 10 may be any suitable type of device running on the Android OS, such as a smartphone or tablet, which includes at least one hardware processing unit ("processor") 11, memory 12, A user interface 13 for interacting with the user, and a communication interface 14 for communicating with the network 30, such as the application provider 20 via the Internet. Those of ordinary skill in the art will appreciate that the illustrated device is highly simplified for clarity reasons and further that the actual devices include features such as power supplies, and persistent storage. The application provider 20 includes a processor 21 and stores at least one encrypted application APK file 22 that can be downloaded by the client 10. The APK file includes an APK Certificate.

Figure 6 is an illustration of an encrypted application structure in accordance with one embodiment of the present invention. The encrypted application APK file 22 includes an APK certificate 201 signed by the signing entity, application code 202 (pre-installation DEX and post-installation ODEX or ELF files), at least a key used to sign the APK certificate And a signing certificate including a signature verification key 203 when signed with a different key than the security module 210. [

The security module 210 may be encrypted with the Hash value of the application code 202 and configured in an interdependent relationship. Therefore, when an attacker attempts to forge or modify a Dex file of an app according to an embodiment of the present invention, the Dex file is used as a single Hash value required for the security module to operate, The structure is changed, and the effect that the normal application can not be executed occurs. Also, if forex modification of the Dex file is performed through forgery integrity check and Dex file encryption, the application execution is stopped as soon as the security module is tampered with due to the app dependency.

As described above, those skilled in the art will appreciate that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. It is therefore to be understood that the above-described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the present invention is defined by the appended claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention.

The features and advantages described herein are not all inclusive, and in particular, many additional features and advantages will be apparent to those skilled in the art in view of the drawings, specification, and claims. Moreover, it should be noted that the language used herein is primarily chosen for readability and for purposes of teaching, and may not be selected to delineate or limit the subject matter of the invention.

The foregoing description of embodiments of the invention has been presented for purposes of illustration. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Those skilled in the art will appreciate that many modifications and variations are possible in light of the above teachings.

The scope of the invention is, therefore, not to be limited by the Detailed Description, but is to be defined by the claims of any application based thereon. Accordingly, the disclosure of embodiments of the invention is illustrative and not restrictive of the scope of the invention, which is set forth in the following claims.

1: System
10: Client
11: Processor
12: Memory
13: UI
14: I / O
21: Processor
22: Encrypted application APK file
20: Application provider
30: Network
100: encryption processing device using dependency relational forgery integrity check
110: Major code extraction module
120: Encryption module
130: Reference code insertion module
140: Security module encryption module
22: Encrypted application APK file
201: APK certificate
202: Application code
203: Signature verification key
204: Library
210: Security module

Claims (2)

A main code extracting module for extracting a main code which is a code to be encrypted in an executable code part of an input specific application;
An encryption module for encrypting the extracted main code to generate an encryption code, and storing the generated encryption code in a security module of the specific application;
A reference code inserting module for deleting the extracted main code and generating and inserting a reference code for referring to the encrypted code stored in the security module at a position of the deleted main code; And
A security module encrypting module encrypting the security module with at least a part of the entire code of the executable code part of the specific application modified by the reference code inserting module as a key;
/ RTI >
Outputting the encrypted specific application capable of forgery integrity check according to a dependency between the security module and the executable code unit,
Wherein the security module encryption module modifies the Android runtime based on the encrypted security module,
The decryption of the encrypted code is performed on the Android runtime when the specific application is executed.
An encryption processing device using dependency forgery integrity check.
A main code extracting module for extracting a main code to be encrypted in an executable code part of the input specific application;
An encrypting step of encrypting the extracted main code to generate an encrypted code, and storing the generated encrypted code in a security module of the specific application;
A reference code insertion module deletes the extracted main code and generates and inserts a reference code for referring to the encrypted code stored in the security module at a position of the deleted main code; And
The security module encrypting module encrypts the security module with at least a part of the entire code of the executable code portion of the specific application modified by the reference code inserting module as a key;
/ RTI >
Outputting the encrypted specific application capable of forgery integrity check according to a dependency between the security module and the executable code unit,
Wherein the security module encryption module modifies the Android runtime based on the encrypted security module,
The decryption of the encrypted code is performed on the Android runtime when the specific application is executed.
An encryption processing method using dependency - based forgery integrity check.

Images