KR102348095B1 - Real-time monitoring system for preventing malicious code penetration and a counterfeit access of user mobile terminal and method thereof - Google Patents

Abstract

The present invention relates to a real-time monitoring system and method for preventing malicious code penetration and unauthorized access of a user's mobile terminal. A user mobile terminal that transmits an access right request message in real time, blocks access to data and external devices based on preset blacklist data and access right decision information, and information on the presence or absence of malicious code transmitted from the user mobile terminal is provided, diagnoses it, adds it to a preset blacklist, determines storage and deletion of the data, and transmits the data added to the blacklist to the user mobile terminal in real time, and access transmitted in real time from the user mobile terminal By including a remote monitoring server that determines whether access is safe based on the permission request message and transmits the access right determination information according to the user's security level to the user's mobile terminal in real time, the security policy can be updated and security will be further strengthened can have an effect.

Description

Real-time MONITORING SYSTEM FOR PREVENTING MALICIOUS CODE PENETRATION AND A COUNTERFEIT ACCESS OF USER MOBILE TERMINAL AND METHOD THEREOF

The present invention provides a real-time monitoring system and method for preventing malicious code penetration and unauthorized access in a user's mobile terminal, which can effectively prevent information leakage through real-time monitoring of malicious code penetration and unauthorized access in the user's mobile terminal is about

Recently, the use of high-performance portable terminals such as user mobile terminals (eg, smart phones) has increased significantly. Such a user mobile terminal is a mobile communication terminal that provides functions such as program driving, data communication, and interworking with a personal computer (PC), and provides advanced functions such as a PC.

That is, the user mobile terminal provides a standardized interface and platform for application developers, and general users other than terminal manufacturers or mobile communication service providers can freely install and use various applications they want. In addition to this, an application to be installed on a user's mobile terminal may be developed and provided.

In addition, with the activation of the user's mobile terminal, application stores in which various applications used in the user's mobile terminal are traded have appeared, and general users can download and install a desired application to the user's mobile terminal through the application store.

Since these user mobile terminals are supported by an open platform and various network access environments, they receive relatively security threats such as information leakage through malicious code infection and hacking, billing, and terminal failure compared to conventional mobile phones.

Currently, security technologies used in user mobile terminals have been mainly developed based on software-based vaccine programs or network traffic control technologies. However, in the case of user mobile terminals, user information is easily exposed through hardware control. Because the risk is large, it is impossible to provide sufficient security with only the conventional security technology.

In particular, in relation to the open platform of the user's mobile terminal, a technology for ensuring the reliability of the terminal (hardware) from jail break or rooting, a technology for fundamentally preventing the execution of malicious codes, and the In relation to distribution, application security verification technology, data protection technology to encrypt data stored in the terminal to prevent information leakage, technology to remotely control the terminal in case of loss, and electronic financial transaction related technology There is a need for secure payment and secure storage technology for payment information so that payment services can be safely performed.

Domestic Patent Registration No. 10-1266254

The present invention has been devised to solve the above problems, and an object of the present invention is to prevent information leakage through real-time monitoring of the penetration of malicious code and unauthorized access in the user's mobile terminal, as well as the black level of the remote monitoring server. A real-time monitoring system for preventing malicious code penetration and unauthorized access of user mobile terminals that can classify safe data providers and external device access based on the list, and update security policies through this to further strengthen security and to provide a method therefor.

Another object of the present invention is to immediately respond to the abnormal operation state of the user's mobile terminal by monitoring in real time, such as collecting, analyzing, and managing data generated between application use included in the user's mobile terminal through a remote monitoring server. An object of the present invention is to provide a real-time monitoring system and method for preventing malicious code penetration and unauthorized access of a user's mobile terminal capable of coping with situations such as loss, stolen information leakage, and malicious code intrusion in real time.

In order to achieve the above object, the first aspect of the present invention is to inspect the presence or absence of malicious code in data received or downloaded from the outside, transmit the inspection result information and an access right request message for access to an external device in real time, and a user mobile terminal that blocks access to data and external devices based on blacklist data and access right determination information; and the user mobile terminal receives the inspection result information on whether or not there is a malicious code, diagnoses it, adds it to a preset blacklist, determines storage and deletion of the data, and transfers the data added to the blacklist to the user mobile device. A remote monitoring server that transmits to the terminal in real time, determines whether it is safe access based on the access permission request message transmitted in real time from the user's mobile terminal, and transmits the access right determination information according to the security level of the user to the user's mobile terminal in real time. It is to provide a real-time monitoring system for preventing malicious code penetration and unauthorized access of a user's mobile terminal, including

Here, the user mobile terminal stores the access right determination information for the access right request transmitted in real time from the remote monitoring server in a separate memory, and based on this, immediately blocks the access of the external device according to the user's security level It is preferable to

Preferably, the user mobile terminal includes: a device monitoring module for inspecting the presence or absence of malicious code in data received or downloaded from the outside, and detecting an external device access; a security management module for storing and managing blacklist data and access right determination information transmitted in real time from the remote monitoring server; and control to be transmitted to the remote monitoring server in real time by receiving inspection result information on the presence or absence of malicious code from the device monitoring module, and to generate an access permission request message for external device access and control it to be transmitted to the remote monitoring server in real time and a terminal control module for blocking data storage and access of external devices based on the blacklist data managed by the security management module and access right determination information.

Preferably, the device monitoring module detects at least one of unauthorized access or USB (Universal Serial Bus), SD (Secure Digital) card, NFC (Near Filed Communication) and Wi-Fi (Wireless Fidelity) access can do.

Preferably, at least one management item data among the installation, driving and deletion details of the application installed in the user mobile terminal is stored for each time period, and data generated through the operation of the application installed in the user mobile terminal is encrypted and stored. data storage module; And according to the function restriction and user authentication request information transmitted from the remote monitoring server, the function of the user mobile terminal is stopped, and the user authentication is requested to the corresponding user, and the corresponding user for the data encrypted and stored in the data storage module Further comprising a user authentication module requesting transmission of a decryption key to the remote monitoring server according to the access right request information by the terminal control module, the management item data stored from the data storage module and the encrypted data It can be controlled to be backed up by sending it to a remote monitoring server.

Preferably, the terminal control module can control the encrypted and stored data in the data storage module to be accessible through user authentication and a decryption key transmitted from the remote monitoring server at the request of the user authentication module.

Preferably, the data storage module includes: a data recording unit for storing at least one management item data of installation, driving and deletion details of an application installed in the user mobile terminal for each time period; and a data management unit that encrypts, stores, and manages data generated by driving an application installed in the user's mobile terminal.

Preferably, the user authentication module receives the function limitation and user authentication request information transmitted from the remote monitoring server, and based on this, stops the function of the user mobile terminal and requests user authentication from the corresponding user. ; and an access right requesting unit that transmits a request message for transmission of a decryption key to the remote monitoring server when receiving access right request information from a corresponding user for data encrypted and stored in the data storage module.

Preferably, the remote monitoring server receives the management item data stored from the data storage module and compares the current state of the user mobile terminal with the past usage history based on this to determine another operation state, the user authentication module a data monitoring module for transmitting function limitation and user authentication request information; And it receives the management item data stored in the data storage module, stores and manages it as a database (DB) for each user mobile terminal according to whether the user has registered the backup data, and provides data encrypted and stored in the data storage module to the user. It may include a backup data management module that transmits a corresponding decryption key to the user authentication module when an access right is requested by the user.

Preferably, the backup data management module transmits the user authentication request information for the access right request to the user authentication module when the user requests the access right to the data encrypted and stored in the data storage module, and the user mobile When receiving the user authentication response information to the access right request from the terminal and comparing it with preset user authentication information, the corresponding decryption key may be transmitted to the user authentication module.

Preferably, the data monitoring module, when the size of the data currently generated is greater than the size of the data generated in the past of the user mobile terminal is greater than a preset allowable threshold, the data utilized in the user mobile terminal is completely through an external action When at least one of a case of requesting deletion and a case of requesting data extraction, transmission and manipulation through an external device or a specific App, user authentication request information can be transmitted to the user authentication module .

Preferably, the remote monitoring server receives information on the presence or absence of malicious code transmitted from the user mobile terminal, diagnoses it, adds it to a preset blacklist, determines storage and deletion of the corresponding data, and determines the storage and deletion of the data, and the blacklist a data diagnosis module that transmits the added data to the user mobile terminal in real time; and an access authority determination module for receiving the access authority request message transmitted from the user mobile terminal, determining whether it is safe access based on this, and transmitting access authority determination information to the user mobile terminal in real time.

A second aspect of the present invention is a real-time monitoring method for preventing malicious code penetration and unauthorized access of the user's mobile terminal by using a system including a remote monitoring server connected through a user's mobile terminal and a communication network, wherein (a) the user Inspecting the data received or downloaded from the outside for malicious code through the mobile terminal, and transmitting the inspection result information and an access right request message for accessing the external device in real time; (b) through the remote monitoring server, the real-time transmitted information on the presence or absence of malicious code transmitted in step (a) is diagnosed and added to a preset blacklist to determine storage and deletion of the data, and to the blacklist transmitting the added data in real time; (c) determining whether access is safe based on the access right request message transmitted in real time in step (a) through the remote monitoring server, and transmitting access right determination information according to the user's security level in real time; and (d) blocking access of data and external devices based on the blacklist data and access right determination information transmitted in real time in steps (b) and (c) through the user mobile terminal. It is to provide a real-time monitoring method to prevent malicious code penetration and unauthorized access of a user's mobile terminal.

Here, in step (a), the user mobile terminal inspects the presence or absence of malicious code in the data received or downloaded from the outside in real time and detects access to the external device in real time, and then information on the presence of the malicious code is transmitted to the remote monitoring server in real time, and an access permission request message for external device access is generated and transmitted to the remote monitoring server in real time.

Preferably, the user mobile terminal detects at least one of unauthorized access or USB (Universal Serial Bus), SD (Secure Digital) card, NFC (Near Filed Communication) and Wi-Fi (Wireless Fidelity) access can do.

Preferably, in step (d), the user mobile terminal stores and manages the blacklist data and access right determination information transmitted in real time in steps (b) and (c), and then the stored and managed Based on the blacklist data and access right decision information, data storage and access to external devices can be blocked immediately.

Preferably, before or after the step (a), at least one management item data of installation, driving, and deletion details of an application installed in advance through the user mobile terminal is stored for each time period, and the application installed in the user mobile terminal Encrypting and storing data generated through the operation of the mobile terminal, stopping the function of the user mobile terminal according to the function limitation and user authentication request information transmitted from the remote monitoring server through the user mobile terminal, and the corresponding user requesting user authentication, and requesting transmission of a decryption key to the remote monitoring server according to the access right request information by the user for the encrypted and stored data; and the stored management item data through the user mobile terminal. and transmitting the encrypted data to be backed up to the remote monitoring server.

Preferably, the user mobile terminal, the encrypted stored data can be accessed using a decryption key transmitted from the remote monitoring server in response to user authentication and the user's request.

Preferably, the user mobile terminal may transmit a request message for transmission of a decryption key to the remote monitoring server when receiving access right request information from the corresponding user with respect to the encrypted and stored data.

Preferably, the remote monitoring server receives the management item data stored in the user mobile terminal and compares the current state of the user mobile terminal with the past usage history based on it and compares the current state of the user mobile terminal to determine another operation state, the user mobile terminal function limitation and user authentication request information can be transmitted.

Preferably, the remote monitoring server may further include the step of receiving the management item data stored in the user mobile terminal and storing and managing the database (DB) for each user mobile terminal according to whether the user has registered the backup data. .

Preferably, the remote monitoring server may transmit a corresponding decryption key to the user's mobile terminal when receiving an access right request message by the user for data encrypted and stored in the user's mobile terminal.

Preferably, the remote monitoring server transmits the user authentication request information for the access right request to the user mobile terminal when the user requests the access right to the data encrypted and stored in the user mobile terminal, and then the user mobile When receiving the user authentication response information to the access permission request from the terminal and comparing it with preset user authentication information, the corresponding decryption key may be transmitted to the user mobile terminal.

Preferably, the remote monitoring server, when the size of the data currently generated is greater than the size of the data generated in the past of the user mobile terminal is greater than a preset allowable threshold, the data utilized in the user mobile terminal is completely through an external action When at least one of a case of requesting deletion and a case of requesting data extraction, transmission and manipulation through an external device or a specific App, user authentication request information can be transmitted to the user mobile terminal .

A third aspect of the present invention provides a computer-readable recording medium in which a program capable of executing the above-described real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal is recorded.

The real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to the present invention may be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all types of recording devices in which data readable by a computer system is stored.

For example, computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, removable storage device, and non-volatile memory (Flash Memory). , and optical data storage devices.

According to the real-time monitoring system and method for preventing malicious code penetration and unauthorized access in a user's mobile terminal as described above, information through real-time monitoring of malicious code penetration and unauthorized access in the user's mobile terminal In addition to preventing leakage, it is possible to classify the access of a secure data provider and an external device based on the blacklist of the remote monitoring server, and through this, the security policy can be updated and security can be further strengthened.

In addition, according to the present invention, data generated between application use included in the user's mobile terminal is monitored in real time through a remote monitoring server, such as collection, analysis, and management, thereby immediately responding to the abnormal operation state of the user's mobile terminal. It has the advantage of being able to respond in real time to situations such as loss, stolen information, and malicious code intrusion.

In addition, according to the present invention, a specific action applied to the user's mobile terminal (eg, installation, operation, deletion, etc. of an application) and data generated therefrom are monitored remotely, and elements such as backup and access right control are included. By doing so, there is an advantage that double security can be applied.

In addition, according to the present invention, when a different operating state is confirmed by analyzing the past history of data generated through the operation of an application included in the user's mobile terminal, the data access authority is adjusted and restricted through user authentication, There is an advantage that can be expected of security.

1 is an overall block diagram illustrating a real-time monitoring system for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to an embodiment of the present invention.
2 is a detailed block diagram illustrating a user mobile terminal applied to an embodiment of the present invention.
3 is a detailed block diagram illustrating a remote monitoring server applied to an embodiment of the present invention.
4 is an overall flowchart illustrating a real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to an embodiment of the present invention.

The above-described objects, features and advantages will be described below in detail with reference to the accompanying drawings, and accordingly, those of ordinary skill in the art to which the present invention pertains will be able to easily implement the technical idea of the present invention. In describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted.

Terms including an ordinal number such as 1st, 2nd, etc. may be used to describe various elements, but the elements are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise.

The terms used in the present invention have been selected as currently widely used general terms as possible while considering the functions in the present invention, but these may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technology, and the like. In addition, in a specific case, there is a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term and the overall content of the present invention, rather than the name of a simple term.

In the entire specification, when a part "includes" a certain element, this means that other elements may be further included, rather than excluding other elements, unless otherwise stated.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the embodiments of the present invention illustrated below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below. The embodiments of the present invention are provided to more completely explain the present invention to those of ordinary skill in the art.

Each block in the accompanying block diagram and combinations of steps in the flowchart may be executed by computer program instructions (execution engine), which are executed by a processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment. It may be mounted so that the instructions, which are executed by the processor of a computer or other programmable data processing equipment, create means for performing the functions described in each block of the block diagram or in each step of the flowchart. These computer program instructions may also be stored in a computer usable or computer readable memory which may direct a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer usable or computer readable memory. It is also possible to produce an article of manufacture containing instruction means for performing the functions described in each block of the block diagram or each step of the flowchart, the instructions stored in the block diagram.

And, since the computer program instructions may be mounted on a computer or other programmable data processing equipment, a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other program It is also possible that instructions for performing the possible data processing equipment provide steps for carrying out the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a module, segment, or portion of code comprising one or more executable instructions for executing specified logical functions, and in some alternative embodiments the blocks or steps referred to in some alternative embodiments. It should be noted that it is also possible for functions to occur out of sequence. For example, it is possible that two blocks or steps shown one after another may be performed substantially simultaneously, and also the blocks or steps may be performed in the reverse order of the corresponding functions, if necessary.

1 is an overall block diagram illustrating a real-time monitoring system for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to an embodiment of the present invention, and FIG. 2 is a user mobile device applied to an embodiment of the present invention. It is a detailed block diagram for explaining a terminal, and FIG. 3 is a detailed block diagram for explaining a remote monitoring server applied to an embodiment of the present invention.

1 to 3 , a real-time monitoring system for preventing malicious code penetration and unauthorized access of a user mobile terminal according to an embodiment of the present invention is largely comprised of at least one user mobile terminal 100-1 to 100-N. ) and the remote monitoring server 200 and the like.

Here, each user mobile terminal 100-1 to 100-N is connected to the remote monitoring server 200 through the communication network 10, and in this case, the communication network 10 is a large-scale communication network capable of large-capacity, long-distance voice and data services. It is a communication network that is a high-speed backbone network of , and may be a next-generation wireless network including the Internet or Wi-Fi, Wibro, and Wimax for providing high-speed multimedia services.

The Internet includes the TCP/IP protocol and various services existing in its upper layers, namely HTTP (Hyper Text Transfer Protocol), Telnet, FTP (File Transfer Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), It means a worldwide open computer network structure that provides SNMP (Simple Network Management Protocol), NFS (Network File Service), NIS (Network Information Service), etc., and each user's mobile terminal (100-1 to 100-N) is remote An environment that enables access to the monitoring server 200 is provided. Meanwhile, the Internet may be a wired or wireless Internet, or may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet.

If the communication network 10 is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. As an example of the asynchronous mobile communication network, a wideband code division multiple access (WCDMA) type communication network may be used. In this case, although not shown in the drawings, the mobile communication network may include, for example, a Radio Network Controller (RNC). Meanwhile, although the WCDMA network is taken as an example, it may be a next-generation communication network such as a 3G LTE network, a 4G network, or a 5G network, or other IP-based IP networks. The communication network 10 serves to mutually transmit signals and data between each user's mobile terminals 100-1 to 100-N and the remote monitoring server 200 .

In addition, each user mobile terminal 100-1 to 100-N inspects the presence or absence of malicious code in data received or downloaded from the outside, and remotely transmits the inspection result information and an access right request message for accessing an external device. It performs a function of real-time transmission to the monitoring server 200 .

In addition, each user mobile terminal 100-1 to 100-N receives or downloads from the outside based on preset blacklist data, that is, blacklist data transmitted from the remote monitoring server 200 and access right determination information. ) to block access to received data and external devices.

In addition, each user mobile terminal (100-1 to 100-N) is a separate memory (not shown), for example, the security management module 120, the access authority determination information for the access authority request transmitted in real time from the remote monitoring server 200 ), and based on this, you can immediately block access from external devices according to the user's security level.

Each of these user mobile terminals 100-1 to 100-N may include a communication module 110 , a device monitoring module 120 , a security management module 130 , and a terminal control module 140 . . In addition, each user mobile terminal 100-1 to 100-N may further include a data storage module 150, a user authentication module 160, and the like. Meanwhile, since the components shown in FIGS. 1 and 2 are not essential, each of the user mobile terminals 100 - 1 to 100 -N may have more or fewer components.

Here, the communication module 110 may include one or more modules that enable wired and/or wireless communication between each user mobile terminal 100-1 to 100-N and the remote monitoring server 200 . For example, the communication module 110 may include a mobile communication module 111 , a wireless network communication module 112 , and a short-range communication module 113 .

That is, the mobile communication module 111 transmits and receives a wireless signal to and from at least one of a base station, an external terminal, and a server on a mobile communication network. The wireless signal may include various types of data according to transmission/reception of a voice call signal, a video call call signal, or a text/multimedia message.

The wireless network communication module 112 is a generic term for communication components that connect wireless communication, and may be built-in or external to each user mobile terminal 100-1 to 100-N, and transmits/receives a radio frequency signal of a specific frequency band. It is configured to include at least one antenna, an RF module, a baseband module, and a signal processing module, and is connected to the terminal control module 140 by a bus to display an operation result corresponding to wireless communication among various operation results of the terminal control module 140 . Transmitting data through wireless communication or receiving data through wireless communication and transmitting the data to the terminal control module 140, while maintaining the procedures of access, registration, communication, and handoff of the wireless communication.

In addition, the wireless network communication module 112 may include a mobile communication configuration for performing at least one access to a mobile communication network, location registration, call processing, call connection, data communication, and handoff according to the CDMA/WCDMA standard. On the other hand, according to the intention of those skilled in the art, the wireless network communication module 112 is connected to the portable Internet (eg, WLAN (Wi-Fi), Wibro, Wimax, HSDPA, LTE, etc.) according to the IEEE 802.16 standard, location registration, data communication, It may further include a portable Internet communication configuration for performing at least one handoff, and it is clear that the present invention is not limited by the wireless communication configuration provided by the wireless network communication module 112 . In addition, the wireless network communication module 112 may be integrated with the mobile communication module 111 .

The short-distance communication module 113 is composed of a short-distance wireless communication module that connects a communication session using a radio frequency signal as a communication medium within a certain distance, preferably Bluetooth communication according to ISO 180000 series standard, RFID (Radio) It may include at least one of Frequency Identification) communication, infrared (IrDA) communication, Ultra Wideband (UWB) communication, and ZigBee communication. In addition, the short-range communication module 113 may be integrated with the wireless network communication module 112 .

The device monitoring module 120 inspects the presence or absence of malicious code in data received or downloaded from the outside through the communication module 110 according to the control of the terminal control module 140, and detects the access of the external device in real time. perform the function

This device monitoring module 120, for example, unauthorized access or USB (Universal Serial Bus), SD (Secure Digital) card, NFC (Near Filed Communication) and Wi-Fi (Wireless Fidelity) at least one of the access detection is desirable.

The security management module 130 performs a function of storing and managing blacklist data and access right determination information transmitted in real time from the remote monitoring server 200 through the communication module 110 under the control of the terminal control module 140 . do.

The terminal control module 140 is a module in charge of overall control of each user's mobile terminals 100-1 to 100-N, and receives information from the device monitoring module 120 to determine whether or not there is a malicious code in the communication module ( 110) performs a control function to be transmitted to the remote monitoring server 200 in real time.

In addition, when the terminal control module 140 detects the access of an external device through the device monitoring module 120, it generates an access permission request message for the external device through the communication module 110 to the remote monitoring server 200 ) to control the transmission in real time.

In addition, the terminal control module 140 stores and stores data received or downloaded from the outside through the communication module 110 based on the blacklist data managed by the security management module 130 and access right determination information. It performs the function of blocking access to the device.

In addition, the terminal control module 140 transmits the management item data stored in the data storage module 150 and the data encrypted and stored in the data storage module 150 to the remote monitoring server 200 through the communication module 110 in real time or periodically. It performs the function of controlling the transmission to be backed up.

In addition, the terminal control module 140 allows access to data encrypted and stored in the data storage module 150 through the decryption key transmitted from the remote monitoring server 200 by the request of the user authentication and user authentication module 160 . perform the control function.

The data storage module 150 stores the management item data of at least one of the installation, driving and deletion details of applications installed in each user mobile terminal 100-1 to 100-N according to the control of the terminal control module 140 in a time zone. It stores for each user, and performs a function of encrypting and storing data generated by running an application installed in each user's mobile terminals 100-1 to 100-N.

That is, the data storage module 150 is a data recording unit 151 that stores at least one management item data among the installation, driving, and deletion details of applications installed in each user mobile terminal 100-1 to 100-N for each time period. and a data management unit 152 that encrypts, stores, and manages data generated by driving an application installed in each user's mobile terminals 100-1 to 100-N, and the like.

The user authentication module 160 receives the function limitation and user authentication request information transmitted from the remote monitoring server 200 through the communication module 110 according to the terminal control module 140, and based on this, each user mobile terminal 100 -1 to 100-N) functions are stopped, and a function of requesting user authentication to the corresponding user is performed.

In addition, the user authentication module 160 receives the access right request information by the user for the data encrypted and stored in the data storage module 150 under the control of the terminal control module 140, and based on this, the communication module 110 ) through the remote monitoring server 200 performs a function of requesting the transmission of the decryption key.

That is, the user authentication module 160 receives the function limitation and user authentication request information transmitted from the remote monitoring server 200 through the communication module 110 under the control of the terminal control module 140, and based on this, each user The function control unit 161 that stops the functions of the mobile terminals 100-1 to 100-N and requests user authentication from the user, and the data storage module 150 according to the control of the terminal control module 140 When receiving access permission request information from the user for encrypted and stored data, the access permission request unit 162, etc., that transmits a transmission request message of the decryption key to the remote monitoring server 200 through the communication module 110, etc. may be included.

Each of the user mobile terminals 100-1 to 100-N configured as described above includes, for example, at least one mobile terminal device of a smart phone, a smart pad, or a smart note. This is preferable, but is not limited thereto. For example, remote monitoring such as Palm PC, mobile play-station, DMB (Digital Multimedia Broadcasting) phone with communication function, tablet PC, iPad, etc. It may comprehensively mean all wired and wireless home appliances/communication devices having a user interface for accessing the server 200 .

In particular, when each user mobile terminal (100-1 to 100-N) is implemented as a normal smart phone, the smart phone is different from a general mobile phone (aka feature phone), various applications desired by the user (Application). ) A phone based on an open operating system that can be downloaded, used, and deleted freely. It is desirable to understand it as a communication device that does not have a voice call function, but includes any Internet phone or tablet PC that can connect to the Internet.

Such a smart phone may be implemented as a smart phone equipped with various open operating systems, and the open operating systems include, for example, Symbian of Nokia, BlackBerry of RIMS, iPhone of Apple, It can be made of Windows Mobile of Microsoft, Android of Google, Sea of Samsung Electronics, etc.

As such, since the smart phone uses an open operating system, a user can arbitrarily install and manage various application programs, unlike a mobile phone having a closed operating system.

That is, the smartphone basically includes a control unit, a memory unit, a screen output unit, a key input unit, a sound output unit, a sound input unit, a camera unit, a wireless network communication module, a short-range wireless communication module, and a battery for supplying power.

The control unit is a generic term for functional components that control the operation of the smartphone, and includes at least one processor and an execution memory, and is connected to each function component provided in the smartphone through a bus (BUS).

The control unit loads at least one program code provided in the smart phone through the processor into the execution memory for operation, and transmits the result to at least one function component through the bus to control the operation of the smart phone. .

The memory unit is a generic term for non-volatile memory provided in a smart phone, and stores and maintains at least one program code executed through the control unit and at least one data set using the program code. The memory unit basically stores a system program code and system data set corresponding to the operating system of the smartphone, a communication program code and communication data set for processing wireless communication connection of the smartphone, and at least one application program code and application data set, , program codes and data sets for implementing the present invention are also stored in the memory unit.

The screen output unit is composed of a screen output device (eg, LCD, LED device) and an output module driving the same, and is connected to the control unit by a bus to output the operation result corresponding to the screen output among various operation results of the control unit. output to the device.

The key input unit includes a key input device having at least one key button (or a touch screen device interlocking with the screen output unit) and an input module for driving the key input unit, and is connected to the control unit through a bus to perform various operations of the control unit. input a command for commanding , or input data necessary for the operation of the control unit.

The sound output unit includes a speaker that outputs a sound signal and a sound module that drives the speaker, and is connected to the control unit by a bus to output an operation result corresponding to a sound output among various operation results of the control unit through the speaker . The sound module decodes sound data to be output through the speaker and converts it into a sound signal.

The sound input unit includes a microphone that receives a sound signal and a sound module that drives the microphone, and transmits sound data input through the microphone to the control unit. The sound module encodes and encodes a sound signal input through the microphone.

The camera unit includes an optical unit, a CCD (Charge Coupled Device), and a camera module driving the same, and acquires bitmap data input to the CCD through the optical unit. The bitmap data may include both image data of a still image and video data.

The wireless network communication module is a generic term for communication components that connect wireless communication, and includes at least one antenna for transmitting and receiving a radio frequency signal of a specific frequency band, an RF module, a baseband module, and a signal processing module, and the control unit and It is connected to a bus and transmits an operation result corresponding to wireless communication among various operation results of the control unit through wireless communication, or receives data through wireless communication and transmits it to the control unit, and accesses and registers the wireless communication , communication, and handoff procedures.

In addition, the wireless network communication module includes a mobile communication configuration for performing at least one of access to a mobile communication network, location registration, call processing, call connection, data communication, and handoff according to the CDMA/WCDMA standard. Meanwhile, according to the intention of those skilled in the art, the wireless network communication module may further include a portable Internet communication configuration for performing at least one access to, location registration, data communication, and handoff in accordance with the IEEE 802.16 standard, and the wireless network It is clear that the present invention is not limited by the wireless communication configuration provided by the communication module.

The short-distance wireless communication module is composed of a short-distance wireless communication module that connects a communication session using a radio frequency signal as a communication medium within a certain distance, preferably, ISO 180000 series standard RFID communication, Bluetooth communication, Wi-Fi communication, public It may include at least one of wireless communication. In addition, the short-range wireless communication module may be integrated with the wireless network communication module.

In addition, the remote monitoring server 200 is connected to each user mobile terminal 100-1 to 100-N through the communication network 10, and malicious transmitted from each user mobile terminal 100-1 to 100-N. Receives information on the result of code presence or absence, diagnoses it, adds it to a preset blacklist, determines storage and deletion of the data, and stores the data added to the blacklist to each user's mobile terminals 100-1 to 100-N ) to transmit in real time.

In addition, the remote monitoring server 200 determines whether access is safe based on the access right request message transmitted in real time from each user's mobile terminals 100-1 to 100-N, and provides access right determination information according to the security level of the user. It performs a function of real-time transmission to the corresponding user mobile terminals 100-1 to 100-N.

The remote monitoring server 200 may include a communication module 210 , a data monitoring module 220 , a backup data management module 230 , and a server control module 240 . In addition, the remote monitoring server 200 may further include a data diagnosis module 250 and an access right determining module 260 . On the other hand, since the components shown in FIGS. 1 and 3 are not essential, the remote monitoring server 200 may have more or fewer components than that.

Here, the communication module 210 may include one or more modules that enable wired and/or wireless communication between each user mobile terminal 100-1 to 100-N and the remote monitoring server 200 . For example, the communication module 210 includes a mobile communication module 211, a wireless network communication module 212 and a short-range communication module ( 213) and the like. A detailed description thereof will be omitted since it is the same as the above-described communication module 110 .

The data monitoring module 220 receives management item data stored in the data storage module 150 of each user mobile terminal 100-1 to 100-N through the communication module 210 under the control of the server control module 240 . Based on this, the current state of each user's mobile terminals 100-1 to 100-N is compared with the past usage history, and when a different operating state is confirmed, the function of generating and transmitting function limitation and user authentication request information is provided. carry out

At this time, the data monitoring module 220 is a first condition when the size of the data currently generated is greater than the size of the data generated in the past of each user mobile terminal 100-1 to 100-N is greater than the preset tolerance threshold, each The second condition when the data utilized in the user mobile terminals 100-1 to 100-N requests complete deletion through an external action, and data extraction and transmission through an external device or a specific App and when at least one of the third conditions of requesting operation is met, user authentication request information is generated and each user mobile terminal 100 through the communication module 210 under the control of the server control module 240 -1 to 100-N) is preferably transmitted to the user authentication module 160 .

The backup data management module 230 is the management item data stored in the data storage module 150 of each user mobile terminal 100-1 to 100-N through the communication module 210 under the control of the server control module 240 . It performs a function of storing and managing the database (DB) for each user's mobile terminal according to whether the user's backup data is registered or not.

In addition, the backup data management module 230 is the server control module 240 when the user requests access to the data encrypted and stored in the data storage module 150 of each user's mobile terminals 100-1 to 100-N. ) to transmit the corresponding decryption key to the user authentication module 160 of each user mobile terminal 100-1 to 100-N through the communication module 210 in accordance with the present invention.

That is, the backup data management module 230 is the server control module 240 when the user requests access to the data encrypted and stored in the data storage module 150 of each user's mobile terminals 100-1 to 100-N. ) performs a function of generating and transmitting user authentication request information for an access right request to the user authentication module 160 of each user mobile terminal 100-1 to 100-N according to the control.

In addition, the backup data management module 230 is the user authentication response information to the access right request from each user mobile terminal (100-1 to 100-N) through the communication module 210 under the control of the server control module 240 is provided and compared with the preset user authentication information, if they match, the corresponding decryption key is generated or the preset decryption key is transmitted through the communication module 210 to the user authentication module of each user mobile terminal (100-1 to 100-N) ( 160) to transmit the function.

The server control module 240 is a module responsible for overall control of the remote monitoring server 200, and is transmitted to the data storage module 150 of each user mobile terminal 100-1 to 100-N through the communication module 210. It receives the stored management item data in real time or periodically and transmits it to the data monitoring module 220 , receives the function limitation and user authentication request information generated from the data monitoring module 220 , and receives each user through the communication module 210 . It performs a control function to be transmitted to the user authentication module 160 of the mobile terminals (100-1 to 100-N).

In addition, the server control module 240 receives the management item data stored in the data storage module 150 of each user mobile terminal 100-1 to 100-N through the communication module 210, and whether the user registers the backup data. It performs a function of transferring the data to the backup data management module 230 so that it is stored and managed in a database (DB) for each user's mobile terminal.

In addition, the server control module 240 requests an access right by the user to the data encrypted and stored in the data storage module 150 of each user mobile terminal 100-1 to 100-N through the communication module 210 . It receives the message and delivers it to the backup data management module 230, and receives the user authentication request information for the access right request generated from the backup data management module 230 through the communication module 210 to each user mobile terminal ( 100-1 to 100-N) performs a control function to be transmitted to the user authentication module 160 .

The data diagnosis module 250 is provided with information on the presence or absence of malicious code transmitted from each user's mobile terminals 100-1 to 100-N through the communication module 210 under the control of the server control module 240 . It is diagnosed and added to a preset blacklist to determine storage and deletion of the corresponding data, and the data added to the blacklist is transmitted to each user mobile terminal 100-1 to 100-N through the communication module 210 It performs the function of real-time transmission.

The access authority determination module 260 receives the access authority request message transmitted from each user mobile terminal 100-1 to 100-N through the communication module 210 under the control of the server control module 240 and based on it to determine whether the access is safe and perform a function of transmitting access right determination information to each user's mobile terminals 100-1 to 100-N in real time through the communication module 210 .

On the other hand, in an embodiment of the present invention, each component (eg, the data monitoring module 220, the backup data management module 230, the data diagnosis module ( 250) and the access right determination module 260) and each user mobile terminal 100-1 to 100-N are configured to transmit and receive data, but the present invention is not limited thereto. 100-1 to 100-N) and may be configured to transmit and receive data independently.

Hereinafter, a real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to an embodiment of the present invention will be described in detail.

4 is an overall flowchart illustrating a real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to an embodiment of the present invention.

1 to 4 , a real-time monitoring method for preventing malicious code penetration and unauthorized access of a user mobile terminal according to an embodiment of the present invention, first, each user mobile terminal 100-1 to 100-N Inspects the presence or absence of malicious code in the data received or downloaded from the outside, and transmits the inspection result information and an access right request message for external device access to the remote monitoring server 200 in real time (S100).

At this time, in step S100, each user mobile terminal 100-1 to 100-N inspects the presence or absence of malicious code in data received or downloaded from the outside in real time and detects access to an external device in real time, and then the malicious code It is preferable to transmit the inspection result information on the presence or absence to the remote monitoring server 200 in real time, and to generate an access permission request message for external device access and transmit it to the remote monitoring server 200 in real time.

In addition, each user mobile terminal (100-1 to 100-N), for example, unauthorized access or USB (Universal Serial Bus), SD (Secure Digital) card, NFC (Near Filed Communication) and Wi-Fi (Wireless Fidelity) ) of at least one approach can be detected.

Thereafter, through the remote monitoring server 200, the inspection result information of the presence or absence of malicious code transmitted in real time in step S100 is diagnosed and added to a preset blacklist to determine storage and deletion of the corresponding data and to the blacklist. The added data is transmitted in real time to each user mobile terminal 100-1 to 100-N (S200).

Then, it is determined whether the access is safe based on the access permission request message transmitted in real time in step S100 through the remote monitoring server 200, and access right determination information according to the security level of the user is transmitted to each user mobile terminal 100-1. to 100-N) in real time (S300).

Next, based on the blacklist data and access right determination information transmitted in real time in steps S200 and S300 through each user mobile terminal 100-1 to 100-N, access to data and external devices is blocked (S400) ).

In this case, in step S400, each user mobile terminal 100-1 to 100-N stores and manages the blacklist data and access right determination information transmitted in real time in steps S200 and S300, and then stores and manages the storage and management It is desirable to immediately block data storage and external device access based on the blacklist data and access right decision information.

Additionally, before or after the step S100, at least one management item data of the installation, driving, and deletion details of applications installed in advance through each user mobile terminal 100-1 to 100-N is stored for each time period, and each A step of encrypting and storing data generated by driving an application installed in the user mobile terminals 100-1 to 100-N, and the remote monitoring server 200 through each user mobile terminal 100-1 to 100-N ) to stop the function of each user mobile terminal 100-1 to 100-N according to the function limitation and user authentication request information transmitted from the The step of requesting transmission of the decryption key to the remote monitoring server 200 according to the access right request information by the user, and the stored management item data and the encrypted data through each user mobile terminal 100-1 to 100-N The method may further include transmitting the data to be backed up to the remote monitoring server 200 .

At this time, each user mobile terminal (100-1 to 100-N) can access the encrypted stored data using the decryption key transmitted from the remote monitoring server 200 by user authentication and the user's request. have.

In addition, when each user mobile terminal 100-1 to 100-N receives access right request information from the corresponding user for the encrypted and stored data, the remote monitoring server 200 sends a request message for transmission of the decryption key. can be transmitted

On the other hand, the remote monitoring server 200 receives the management item data stored in each user mobile terminal (100-1 to 100-N) and based on this, the current state of each user mobile terminal (100-1 to 100-N) and When a different operation state is confirmed by comparing the past usage history, it is preferable to transmit function limitation and user authentication request information to each user mobile terminal 100-1 to 100-N.

Furthermore, the remote monitoring server 200 receives the management item data stored in each user mobile terminal 100-1 to 100-N, and according to the user's backup data registration, converts it into a database (DB) for each user mobile terminal and stores and It may further include a step of managing.

In addition, when the remote monitoring server 200 receives an access right request message by the user for data encrypted and stored in each user mobile terminal 100-1 to 100-N, each user mobile terminal 100-1 to 100-N) to transmit the corresponding decryption key.

In addition, the remote monitoring server 200 is each user mobile terminal (100-1 to 100-N) each user mobile terminal (100-1 to 100-N) when a request for access right by the user to the encrypted stored data in each user mobile terminal (100-1 to 100-N) After transmitting the user authentication request information for the access permission request to In this case, the corresponding decryption key may be transmitted to each user mobile terminal 100-1 to 100-N.

In addition, the remote monitoring server 200 is a first condition when the size of the data currently generated is greater than the size of the data generated in the past of each user mobile terminal (100-1 to 100-N) is greater than the preset allowable threshold, each The second condition when data utilized in the user mobile terminals 100-1 to 100-N requests complete deletion through an external action, and data extraction, transmission and manipulation through an external device or a specific App When at least one of the third conditions of the request is satisfied, user authentication request information may be transmitted to each user mobile terminal 100-1 to 100-N.

Meanwhile, the real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to an embodiment of the present invention may also be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all types of recording devices in which data readable by a computer system is stored.

For example, computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, removable storage device, and non-volatile memory (Flash Memory). , and optical data storage devices.

In addition, the computer-readable recording medium may be distributed in computer systems connected through a computer communication network, and stored and executed as readable codes in a distributed manner.

Although a preferred embodiment of a real-time monitoring system and method for preventing malicious code penetration and unauthorized access of a user's mobile terminal according to the present invention has been described above, the present invention is not limited thereto, and the claims and detailed description of the invention It is possible to carry out various modifications within the scope of the description and the accompanying drawings, and this also belongs to the present invention.

100-1 to 100-N: user mobile terminal;
110: communication module,
120: device monitoring module;
130: security management module;
140: terminal control module,
150: data storage module;
160: user authentication module;
200: remote monitoring server;
210: communication module,
220: data monitoring module;
230: backup data management module;
240: server control module,
250: data diagnosis module,
260: access right determination module

Claims (25)

Inspects the data received or downloaded from outside for malicious code, transmits the scan result information and an access right request message for external device access in real time, and based on the preset blacklist data and access right decision information, data and external devices user mobile terminal to block the access of; and
The user mobile terminal receives and diagnoses the information on the presence or absence of malicious code transmitted from the user mobile terminal, adds it to a preset blacklist, determines storage and deletion of the corresponding data, and inserts the data added to the blacklist to the user mobile terminal. and a remote monitoring server that transmits the access right determination information according to the user's security level to the user mobile terminal in real time by determining whether it is safe access based on the access right request message transmitted in real time from the user's mobile terminal but,
The user mobile terminal inspects the presence or absence of malicious code in data received or downloaded from the outside, and a device monitoring module that detects an external device access, and stores blacklist data and access right determination information transmitted in real time from the remote monitoring server and a security management module that manages, and receives inspection result information on the presence or absence of malicious code from the device monitoring module and controls it to be transmitted to the remote monitoring server in real time, and generates an access right request message for accessing an external device to access the remote device A terminal control module that controls to be transmitted to a monitoring server in real time, and blocks data storage and access to external devices based on blacklist data managed from the security management module and access right determination information, and an application installed on the user's mobile terminal a data storage module for storing at least one management item data of at least one of the installation, driving and deletion details for each time period, and encrypting and storing data generated through the operation of an application installed in the user mobile terminal, and from the remote monitoring server According to the transmitted function restriction and user authentication request information, the function of the user mobile terminal is stopped, the user authentication is requested to the user, and the access right request information by the user to the data encrypted and stored in the data storage module and a user authentication module for requesting transmission of a decryption key to the remote monitoring server according to
The terminal control module transmits the management item data and the encrypted data stored from the data storage module to the remote monitoring server and controls so as to be backed up. surveillance system.
According to claim 1,
The user mobile terminal stores the access right determination information for the access right request transmitted in real time from the remote monitoring server in a separate memory, and based on this, immediately blocks the access of the external device according to the user's security level. A real-time monitoring system to prevent malicious code penetration and unauthorized access of the user's mobile terminal.
delete According to claim 1,
The device monitoring module is characterized in that it detects at least one of unauthorized access or USB (Universal Serial Bus), SD (Secure Digital) card, NFC (Near Filed Communication) and Wi-Fi (Wireless Fidelity) A real-time monitoring system to prevent malicious code penetration and unauthorized access of users' mobile terminals.
delete According to claim 1,
The terminal control module, user mobile terminal, characterized in that the control so that the data stored encrypted in the data storage module can be accessed through user authentication and a decryption key transmitted from the remote monitoring server in response to a request of the user authentication module Real-time monitoring system to prevent malicious code penetration and unauthorized access.
According to claim 1,
The data storage module,
a data recorder for storing at least one management item data of installation, driving, and deletion details of an application installed in the user's mobile terminal for each time period; and
A real-time monitoring system for preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that it comprises a data management unit that encrypts, stores, and manages data generated by running an application installed in the user's mobile terminal.
According to claim 1,
The user authentication module,
a function control unit that receives the function limitation and user authentication request information transmitted from the remote monitoring server, stops the function of the user mobile terminal based on the information, and requests user authentication from the user; and
A user, characterized in that it comprises an access right requesting unit that transmits a request message for transmission of a decryption key to the remote monitoring server when receiving access right request information from the user for data encrypted and stored in the data storage module A real-time monitoring system to prevent malicious code penetration and unauthorized access in mobile devices.
According to claim 1,
The remote monitoring server,
When receiving the management item data stored from the data storage module and comparing the current state of the user mobile terminal with the past usage history based on the data storage module and other operating states are confirmed, the user authentication module sends function restrictions and user authentication request information. data monitoring module to transmit; and
Receive management item data stored in the data storage module, store and manage it as a database (DB) for each user mobile terminal according to the user's registration of backup data, and use the data encrypted and stored in the data storage module by the user A real-time monitoring system for preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that it includes a backup data management module that transmits a corresponding decryption key to the user authentication module when an access right is requested.
10. The method of claim 9,
The backup data management module transmits the user authentication request information for the access right request to the user authentication module when the user requests the access right to the data encrypted and stored in the data storage module, and the access right from the user mobile terminal For preventing malicious code penetration and unauthorized access of a user mobile terminal, characterized in that receiving user authentication response information for a request, comparing it with preset user authentication information, and transmitting the corresponding decryption key to the user authentication module Real-time monitoring system.
10. The method of claim 9,
The data monitoring module, when the size of the data currently generated is greater than the size of the data generated in the past of the user mobile terminal is greater than a preset allowable threshold, the data used in the user mobile terminal is completely deleted through an external action request When at least one condition of data extraction, transmission and manipulation is requested through an external device or a specific App, the user authentication request information is transmitted to the user authentication module A real-time monitoring system to prevent malicious code penetration and unauthorized access to user mobile devices.
According to claim 1,
The remote monitoring server,
The user mobile terminal receives and diagnoses the information on the presence or absence of malicious code transmitted from the user mobile terminal, adds it to a preset blacklist, determines storage and deletion of the corresponding data, and inserts the data added to the blacklist to the user mobile terminal. a data diagnosis module that transmits data in real time; and
User mobile terminal, characterized in that it comprises an access right determination module for receiving the access authority request message sent from the user mobile terminal, determining whether it is safe access based on this, and transmitting the access authority determination information to the user mobile terminal in real time Real-time monitoring system to prevent malicious code penetration and unauthorized access.
A real-time monitoring method for preventing malicious code penetration and unauthorized access of the user mobile terminal using a system including a remote monitoring server connected through a user mobile terminal and a communication network,
(a) inspecting the presence or absence of malicious code in data received or downloaded from the outside through the user's mobile terminal, and transmitting the inspection result information and an access right request message for access to an external device in real time;
(b) through the remote monitoring server, the real-time transmitted information on the presence or absence of malicious code transmitted in step (a) is diagnosed and added to a preset blacklist to determine storage and deletion of the data, and to the blacklist transmitting the added data in real time;
(c) determining whether access is safe based on the access right request message transmitted in real time in step (a) through the remote monitoring server, and transmitting access right determination information according to the user's security level in real time; and
(d) blocking the access of data and external devices based on the blacklist data and access right determination information transmitted in real time in steps (b) and (c) through the user mobile terminal,
Before or after the step (a), at least one management item data of the installation, driving, and deletion details of the application installed in advance through the user mobile terminal is stored for each time period, and the operation of the application installed in the user mobile terminal is performed Encrypting and storing data generated through the user mobile terminal, stopping the function of the user mobile terminal according to the function limitation and user authentication request information transmitted from the remote monitoring server through the user mobile terminal, as well as user authentication to the user and requesting transmission of a decryption key to the remote monitoring server according to the access right request information by the user for the encrypted and stored data; and the stored management item data and the encryption through the user mobile terminal. Real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that it further comprises the step of transmitting the data to be backed up to the remote monitoring server.
14. The method of claim 13,
In step (a), the user mobile terminal inspects the presence or absence of malicious code in the data received or downloaded from the outside in real time and detects access to the external device in real time, and then displays the inspection result information on the presence or absence of the malicious code. A real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that it is transmitted in real time to a remote monitoring server, and also generates an access permission request message for external device access and transmits the message to the remote monitoring server in real time.
15. The method of claim 14,
The user mobile terminal, unauthorized access or USB (Universal Serial Bus), SD (Secure Digital) card, NFC (Near Filed Communication) and Wi-Fi (Wireless Fidelity) to detect at least one of the access A real-time monitoring method to prevent malicious code penetration and unauthorized access to user mobile devices.
14. The method of claim 13,
In the step (d), the user mobile terminal stores and manages the blacklist data and access right determination information transmitted in real time in the steps (b) and (c), and then the stored and managed blacklist data A real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that it immediately blocks the storage of data and access of external devices based on the access right decision information.
delete 14. The method of claim 13,
In the user mobile terminal, the encrypted and stored data is accessible by user authentication and a decryption key transmitted from the remote monitoring server according to the user's request. Real-time monitoring method to prevent access.
19. The method of claim 18,
The user mobile terminal, when receiving access right request information from the corresponding user for the encrypted and stored data, transmits a request message for transmission of a decryption key to the remote monitoring server. Real-time monitoring methods to prevent intrusion and unauthorized access.
14. The method of claim 13,
The remote monitoring server receives the management item data stored in the user mobile terminal, compares the current state of the user mobile terminal with the past usage history based on this, and when another operation state is confirmed, the function is limited to the user mobile terminal and a real-time monitoring method for preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that it transmits user authentication request information.
14. The method of claim 13,
The remote monitoring server, receiving the management item data stored in the user mobile terminal, according to the user's backup data registration or not according to the database (DB) for each user mobile terminal, the user characterized in that it further comprises the step of storing and managing A real-time monitoring method to prevent malicious code penetration and unauthorized access in mobile devices.
14. The method of claim 13,
The remote monitoring server, when receiving an access right request message by a corresponding user for data encrypted and stored in the user mobile terminal, transmits a corresponding decryption key to the user mobile terminal. Real-time monitoring method to prevent code penetration and unauthorized access.
23. The method of claim 22,
The remote monitoring server, after transmitting the user authentication request information for the access right request to the user mobile terminal when the user requests the access right to the data encrypted and stored in the user mobile terminal, the access right from the user mobile terminal For preventing malicious code penetration and unauthorized access of a user's mobile terminal, characterized in that receiving user authentication response information for a request, comparing it with preset user authentication information, and transmitting the corresponding decryption key to the user's mobile terminal Real-time monitoring method.
24. The method of claim 23,
The remote monitoring server requests complete deletion of data utilized in the user mobile terminal through an external action when the size of the data currently generated is greater than the size of the data generated in the past of the user mobile terminal is greater than a preset allowable threshold. When at least one condition of data extraction, transmission and manipulation is requested through an external device or a specific App, the user authentication request information is transmitted to the user mobile terminal, characterized in that Real-time monitoring method to prevent malicious code penetration and unauthorized access of user's mobile device.
A computer-readable recording medium in which a program capable of executing the method of any one of claims 13 to 16 and 18 to 24 by a computer is recorded.

Images