KR102201218B1 - Access control system and method to security engine of mobile terminal - Google Patents

Abstract

The present invention relates to an access control system and method of a security engine of a mobile terminal, wherein the access control system of a security engine of a mobile terminal comprising a basic operating system unit and a security engine unit executes a trust app installed in the basic operating system unit, In order to use the security function of the security engine unit, the app ID and user authentication information are transmitted to the security engine unit, and the security engine unit recognizes and trusts a trusted app based on the app ID and the user authentication information transmitted from the basic operating system unit. It authenticates whether the user running the app is the owner of the mobile terminal and allows access to the security engine unit.

Description

Access control system and method to security engine of mobile terminal

The present invention relates to a system and method for access control of a security engine of a mobile terminal, and in detail, an application (Application: hereinafter referred to as "app") ID is registered in a security engine in a basic operating system and accessed from the basic operating system to the security engine. In this regard, the present invention relates to an access control system and method of a security engine of a mobile terminal capable of enhancing the security of a mobile terminal by allowing an app installed on the mobile to access after authentication of the mobile terminal owner.

Mobile terminals are increasingly being used not only for Internet banking and financial services such as stocks, but also for tasks such as Smart Work due to Internet connection and convenience of portability.

As services through mobile terminals increase, PC-centered malicious codes are rapidly spreading to mobile terminals, and damages such as personal property damage as well as corporate information leakage are increasing.

Accordingly, mobile operating systems provide patches and upgrades that complement the announced security vulnerabilities, and mobile security applications are provided by separate security companies, but the hacking techniques that become increasingly intelligent are showing limitations.

The existing platform-level security technology reinforces the access control function within the basic operating system so that the operating system can distinguish between work and personal apps, and through virtualization technology and technology to control personal apps from accessing the data of business apps. It is related to controlling data sharing between each other by completely isolating operating systems of the same or the same level so that operating areas are different from each other, one for personal use and one for business use.

The technology that controls access to business data through access control at the operating system level is said to be performed at the operating system level, but there is a space where malicious codes must be protected at the same time, so there may always be a potential security vulnerability. If found, it is necessary to develop a patch that fixes the vulnerability.

In a structure having a separate operating area through virtualization technology, data leakage in the work area can be prevented through the security vulnerability of the personal area by separating the personal and work space, but the business area also has the same level of security as the personal area. Therefore, data may be leaked due to a security vulnerability in the business area rather than an intrusion from the personal area.

As a structure to fundamentally solve this problem, interest in a structure in which the area performing the security function is isolated from the basic operating system area is increasing, and various studies on this are in progress.

Accordingly, the present invention is to solve the above problem, and an object of the present invention is to register the app ID in the security engine in the basic operating system, and when accessing the security engine in the basic operating system, the app installed on the mobile and the mobile terminal owner It is to provide an app ID registration system and method of a mobile terminal that can enhance security of a mobile terminal by allowing access after performing authentication, and an access control system and method of a security engine of a mobile terminal.

As an access control system of a security engine of a mobile terminal for accessing the security engine of a mobile terminal according to an embodiment of the present invention to achieve the above object, app authentication and authentication through a verification process for downloaded apps If successful, a basic operating system unit that calculates the app ID of the downloaded app and a security engine unit that stores the app ID calculated and transmitted by the basic operating system unit, and the basic operating system unit verifies the downloaded app An app authentication module that performs app authentication through a process, an app storage module in which the app authenticated by the app authentication module is installed, and the app ID for the app authenticated by the app authentication module are calculated and transmitted to the security engine unit. A security engine application programming interface (API), wherein the app storage module transmits the app ID and user authentication information to the security engine unit to use the security function of the security engine unit, and the security engine unit Based on the app ID and the user authentication information transmitted from the unit, access to the security engine unit is allowed through authentication as to whether a trusted app is recognized and whether the user who ran the trusted app is the owner of the mobile terminal.

The security engine unit may include an access control policy DB (Database) for storing the app ID of a trusted app and an access control module for receiving the app ID transmitted from the basic operating system unit and storing it in the access control policy DB. .

The basic operating system unit may verify whether the downloaded app is an app distributed through a normal path or from a normal app store, or verify whether the downloaded app is forged or altered to perform app authentication.

Further, it further includes a hypervisor that isolates the basic operating system and the security engine and has a communication channel for communication between the basic operating system and the security engine.

Meanwhile, the basic operating system unit may verify whether the downloaded app is an app distributed through a normal path or from a normal app store, or verify whether the downloaded app is forged or altered to perform app authentication. The app ID stored in the access control policy DB may be stored by transmitting to the security engine after the security engine API calculates the app ID for an app authenticated as a trusted app by the app authentication module. The security engine API calculates the app ID only in response to a call within the basic operating system unit.

In order to achieve the above object, an App ID registration method of a mobile terminal for controlling access to a security engine of a mobile terminal according to an embodiment of the present invention is performed by accessing an app store through a mobile terminal consisting of a basic operating system and a security engine. Downloading an app, performing app authentication through a verification process for the downloaded app by the basic operating system, and if authentication is successful, the basic operating system calculates the app ID for the downloaded app, and uses the security engine. And storing, in the security engine, the app ID transmitted from the basic operating system.

In the performing of the app authentication, it is verified whether the downloaded app is an app distributed through a normal path or from a normal app store, or whether it is forged or altered to perform app authentication.

In this case, the verification may be performed through an electronic signature using a certificate or may be performed through authentication of the integrity information of the app file.

On the other hand, if authentication fails, the installation of the downloaded app can be stopped.

App ID calculation for the downloaded app may be performed using a one-way hash algorithm.

delete

delete

delete

delete

delete

The access control method of a security engine of a mobile terminal according to an embodiment of the present invention for achieving the above object includes the steps of executing an app installed in the mobile terminal and calling a security engine API, wherein the security engine API is Calculating the app ID of the calling app, and transmitting the calculated app ID to the access control module of the security engine to request permission to access the security engine, the access control module, the app ID transmitted from the security engine API Determining whether the app to access the security engine by using is a trusted app, the determination result, if the app to access the security engine is a trusted app, requesting user authentication information, and user authentication information input by the user Based on this, it includes determining whether the user who ran the app is the owner of the mobile terminal, and allowing access to the security engine when the user who ran the app is the owner of the mobile terminal.

In addition, when the app is terminated, the channel communication can be terminated and deactivated at the same time as the app is terminated.

In this case, calculating the app ID may be performed based on app information managed by the operating system.

Meanwhile, the determining whether the app is the trusted app may be determining whether the app ID transmitted from the security engine API is registered in the access control policy DB of the security engine.

In addition, if it is determined that the app is not trusted in the step of determining whether the app is trusted, access to the security engine is denied.

In the step of determining whether the mobile terminal is the owner, it is determined whether the user authentication information input by the user is preset in the access control policy DB of the security engine.

According to this embodiment of the present invention, in a terminal structure having a security engine isolated from a basic operating system directly provided to a user within a mobile terminal, when accessing the security engine from the basic operating system, the trusted app and the mobile terminal owner By passing through two-factor authentication based on authentication, the security of a mobile terminal having a security engine can be enhanced.

Therefore, by reinforcing the security of the mobile terminal, it is possible to increase the reliability of the apps operated in the mobile terminal, thereby reinforcing the safety of financial transactions such as internet banking and stocks. Smart work-type services such as companies and public institutions can also be activated. That is, it can be used to activate various services based on mobile terminals that require terminal reliability.

1 is a block diagram illustrating an access control system for an isolated security engine in a mobile terminal.
Figure 2 is a flow chart showing the process of installing and registering a trust app.
3 is a flow chart showing a security engine access control process when operating an app.

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, only these embodiments are intended to complete the disclosure of the present invention, and those skilled in the art to which the present invention belongs. It is provided to fully inform the person of the scope of the invention, and the invention is only defined by the scope of the claims. Meanwhile, terms used in the present specification are for describing exemplary embodiments and are not intended to limit the present invention. In this specification, the singular form also includes the plural form unless specifically stated in the phrase.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to elements of each drawing, it should be noted that the same elements have the same numerals as possible even if they are indicated on different drawings. In addition, in describing the present invention, when it is determined that a detailed description of a related known configuration or function may obscure the subject matter of the present invention, a detailed description thereof will be omitted.

In order to provide a security-enhanced use environment for an isolated security engine proposed against such a background, the present invention executes an app and an app to be executed when an app running in the basic operating system accesses the security area. Using a two-factor access control method that authenticates one user, we seek to find a way to enhance the security of mobile terminals together with an isolated security engine.

1 is a block diagram illustrating an access control system for an isolated security engine in a mobile terminal.

Referring to FIG. 1, the mobile terminal has a binary structure in which the basic operating system 10 and the security engine 20 are isolated, and the basic operating system 10 and the security engine 20 are in a hypervisor 30. Physically isolated by

The basic operating system 10 is, for example, an Android operating system, which is basically provided to a user in a mobile terminal, and the security engine 20 provides a security function.

The basic operating system 10 includes an app authentication module 11, an app storage unit 12, and a security engine API (Application Programming Interface) 13 to use the isolated security engine 20.

The app authentication module 11 may be included in a module that installs an app in the basic operating system or may be provided as a separate module, and it is installed through an app store that distributes the app to be installed and an authentication process before installing the app on a mobile terminal. Plays the role of checking whether the app being used is a normal app.

After the authentication process is completed, the app is installed on the mobile terminal as a trusted app ("trusted app"), stored in the app storage unit 12, and the access control module 22 is accessed through the security engine API 13. After that, it is registered as a trusted app in the access control policy DB (21).

On the other hand, an app that fails the authentication process can be installed on the mobile terminal as a general app, so that the isolated security engine cannot be used.

The security engine API 13 is an interface provided so that an app running in the basic operating system can use the security function of the security engine 20.

When an app running in the basic operating system requests a service to the security engine 20 through the security engine API 130, there is a communication channel 31 that transmits a service request to the hypervisor 30 to deliver the service request. do.

In the security engine 20, when an app running in the basic operating system requests a security function service, there is an access control module 22 that allows or denies a request for a security function service by checking the app and the user who requested the service.

When the access control module 22 allows or denies the requested service, it checks from the access control policy DB (Database) 21 in which the trusted app and user authentication information are stored.

In the access control policy DB 21, information of a trusted app (app ID) and authentication information previously entered by the user, for example, PIN (Personal Identity Number) information, in order to identify the subject of the service requested from the basic operating system 10. Is stored, and is used to check the requesting subject when a request is received through the security engine API 13.

2 is a flowchart illustrating a process of installing and registering a trusted app.

Referring to FIG. 2, a mobile user accesses an app store through a mobile terminal and downloads an app required for a service (S10).

At this time, the app store is separately operated and provided to safely distribute apps for companies or specific organizations to safely provide their own unique services (eg, corporate mail, payment service, etc.).

In addition, the app download may be performed by the app installation module of the mobile terminal downloading an app selected by the user.

Next, the app authentication module 11 performs app authentication through a process of verifying whether the downloaded app is an app distributed through a normal path or from a normal app store, and whether forgery/modification such as including malicious code has occurred. It performs (S20).

Verification of whether it is distributed through a normal path is mainly performed through an electronic signature using a certificate, and whether forgery or alteration is performed through the integrity information authentication of the app file.

If the authentication fails (S20-No), it is regarded that the app has been distributed in an abnormal path or may have been forged/modified, and the installation of the app is stopped (S30) and terminated. At this time, an app that has failed authentication can be installed as a general app so that the security engine cannot be used.

On the other hand, when the authentication is successful (S20-Yes), the security engine API 13 calculates the app ID for the app to be installed, and the calculated app ID is transmitted to the security engine 20 (S40).

At this time, the app ID means a unique value that distinguishes the app, and is safely calculated with a one-way hash algorithm in order to make it difficult for different apps to have the same value and to make guesswork.

The app ID transmitted to the security engine 20 is stored in the access control policy DB 21 and is used when the app is installed and operated to use the security engine 20.

After storing the app ID in the access control policy DB 21, the downloaded app is normally installed (S50), and the installed app is stored in the app storage unit 12.

The above process of installing and registering a trusted app can be applied when installing a trusted app by accessing a specific app store for a specific task. In the case of an app that is generally used, the app is installed by accessing the public app store. . In this case, it may be difficult to authenticate the app, and after that, it is desirable to stop installing the app or install it as a general app so that it cannot be accessed by an isolated security engine.

3 is a flow chart showing a security engine access control process when operating an app.

Referring to Figure 3, the app installed in the mobile terminal is executed, and calls the security engine API (13) (S110). In this case, the app is a trusted app installed on the mobile terminal through the installation and registration process as in FIG. 2.

Next, the security engine API 13 calculates the app ID of the app that called the security engine API 13 and sends the calculated app ID to the access control module 22 to request access permission from the security engine 20 Do (S120). At this time, the security engine API 13 calculates the app ID based on app information (process information) managed at the system level (operating system level) without receiving separate app information at the application level (user level).

When calculating the running app information at the user application level (user level), it is usually normal to enter the running app information, but the trusted app information registered in the access control policy DB (21) for malicious purposes The app ID can be stolen by entering it. If the app ID is calculated in this way, the possibility of app ID theft can be prevented.

In addition, in order to prevent the risk that an app developer with malicious intent will arbitrarily store specific app information in the access control policy DB 21 or delete it from the access control policy DB 21, the security engine API 13 It is not disclosed to, and it is preferable to calculate the app ID in response only by a call within the basic operating system 10.

The access control module 22 determines whether or not the app trying to access the security engine is a trusted app using the transmitted app ID, and at this time, it searches for the app ID registered in the access control policy DB 21 to determine whether to register. By doing so, it is determined whether it is a trusted app (S130).

In this case, if the app ID is not registered, it is determined that it is not a trusted app (S130-No), and access to the security engine is denied (S140).

On the other hand, if it is a registered app ID, it is determined that it is a trusted app (S130-Yes), and user authentication information is requested (S150). In this case, the access control module 22 may request a PIN (Personal Identification Number) input, and based on this, may authenticate whether the user who ran the app is the owner of the mobile terminal.

Based on the input PIN information for the input authentication, the access control module 22 checks whether the input PIN information matches the PIN information preset in the access control policy DB 21 (S150).

At this time, if the entered PIN information and the PIN information previously registered in the access control policy DB 21 do not match (S160-No), the user who ran the app determines that he is not the owner of the mobile terminal and accesses the security engine. Reject (S140).

If the input PIN information and the registered PIN information match (S160-Yes), it is determined that the user who ran the app is the owner of the mobile terminal and allows access to the security engine (S170).

When access to the security engine is allowed (S170), channel communication 31 of the hypervisor 30 that delivers a message of the security engine API so that the function of the security engine can be used without repetitive authentication process while the app is running. Is maintained in an authenticated state (S180).

Thereafter, when the app is terminated, the channel communication 31 of the authenticated hypervisor 30 is terminated and deactivated at the same time as the app is terminated to prevent theft and misuse.

According to this embodiment of the present invention, in a terminal structure having a security engine isolated from a basic operating system directly provided to a user within a mobile terminal, when accessing the security engine from the basic operating system, the trusted app and the mobile terminal owner By passing through two-factor authentication based on authentication, the security of a mobile terminal having a security engine can be enhanced.

Therefore, by reinforcing the security of the mobile terminal, it is possible to increase the reliability of the apps operated in the mobile terminal, thereby reinforcing the safety of financial transactions such as internet banking and stocks. Smart work-type services such as companies and public institutions can also be activated. That is, it can be used to activate various services based on mobile terminals that require terminal reliability.

Meanwhile, the App ID registration system and method of the mobile terminal and the access control system and method of the security engine of the mobile terminal according to the present invention have been described according to embodiments, but the scope of the present invention is not limited to specific embodiments, and the present invention In connection with the invention, it can be implemented with various alternatives, modifications and changes within the range that is obvious to those of ordinary skill in the art.

Accordingly, the embodiments described in the present invention and the accompanying drawings are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments and the accompanying drawings. . The scope of protection of the present invention should be interpreted by the claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

10: Basic operating system
11: App authentication module
12: App storage
13: Security Engine API
20: security engine
21: Access control policy DB
22: access control module
30: hypervisor
31: channel communication

Claims (20)

As an access control system of a security engine of a mobile terminal,
A basic operating system unit that performs app authentication through a verification process for the downloaded app, and calculates an app ID of the downloaded app when the authentication is successful; And
Includes a security engine unit for storing the app ID calculated and transmitted by the basic operating system,
The basic operating system unit
An app authentication module that performs app authentication through a verification process for the downloaded app;
An app storage module in which an app authenticated by the app authentication module is installed; And
Includes a security engine API (Application Programming Interface) for calculating the app ID for the app authenticated by the app authentication module and transmitting it to the security engine unit,
The app storage module transmits the app ID and user authentication information to the security engine unit in order to use the security function of the security engine unit,
The security engine unit authenticates whether or not a trusted app is recognized based on the app ID and the user authentication information transmitted from the basic operating system unit and whether the user executing the trusted app is the owner of the mobile terminal, and the security engine unit Access control system of the security engine of the mobile terminal to allow access to.
delete The method of claim 1,
The security engine unit,
Access control policy DB (Database) for storing the app ID of trusted apps; And
And an access control module for receiving the app ID transmitted from the basic operating system unit and storing it in the access control policy DB.
The method of claim 1,
The basic operating system unit verifies whether the downloaded app is an app distributed through a normal path or from a normal app store, or verifies whether forgery or alteration is used to perform app authentication.
The method of claim 3,
The app ID stored in the access control policy DB is stored by calculating the app ID by the security engine API for the app authenticated as a trusted app by the app authentication module and then transmitting it to the security engine unit. Access control system.
The method of claim 1
The security engine API calculates the app ID in response only to a call within the basic operating system unit.
Downloading an app by accessing the app store through a mobile terminal consisting of a basic operating system and a security engine;
Performing app authentication through a verification process for the downloaded app by the basic operating system;
If authentication is successful, the basic operating system calculates an app ID for the downloaded app and transmits it to the security engine; And
Storing the app ID transmitted from the basic operating system in the security engine;
App ID registration method of a mobile terminal comprising a.
The method of claim 7,
The step of performing the app authentication,
App ID registration method of a mobile terminal to verify whether the downloaded app is an app distributed through a normal path or from a normal app store, or to verify whether the app is forged or altered to perform app authentication.
The method of claim 8,
The verification is performed through an electronic signature using a certificate, or through the integrity information authentication of the app file to register the app ID of the mobile terminal.
The method of claim 7,
If authentication fails, the method of registering the app ID of the mobile terminal is to stop the installation of the downloaded app or install it as a general app.
The method of claim 7,
App ID registration method of a mobile terminal that the app ID calculation for the downloaded app is performed using a one-way hash algorithm.
Executing an app installed in the mobile terminal and calling a security engine API;
Calculating the app ID of the app that called the security engine API and transmitting the calculated app ID to the access control module of the security engine to request permission to access the security engine;
Determining, by the access control module, whether an app to access the security engine is a trusted app using the app ID transmitted from the security engine API;
As a result of the determination, if the app to access the security engine is a trusted app, requesting user authentication information;
Confirming whether the user who ran the app is the owner of the mobile terminal based on user authentication information input by the user; And
Allowing access to the security engine when the user executing the app is a mobile terminal owner;
Access control method of the security engine of the mobile terminal comprising a.
The method of claim 12,
After allowing access to the security engine, channel communication between the security engine API and the security engine is maintained in an authenticated state, and when the app is terminated, the channel communication is terminated and deactivated at the same time as the app is terminated. Access control method of security engine of mobile terminal.
The method of claim 12,
The method for controlling access of the security engine of the mobile terminal to calculate the app ID is performed based on app information managed by an operating system.
The method of claim 12,
The step of determining whether the app is trusted,
The access control method of the security engine of the mobile terminal to determine whether the app ID transmitted from the security engine API is registered in the access control policy DB of the security engine.
The method of claim 12,
In the step of determining whether the app is trusted, if it is determined that the app is not trusted, the access control method of the security engine of the mobile terminal is denied access to the security engine.
The method of claim 12,
The step of determining whether the mobile terminal is the owner,
The access control method of the security engine of the mobile terminal to determine whether the user authentication information input by the user is preset in the access control policy DB of the security engine.
delete delete delete

Images