KR20030039665A - Method and Mobile Communication Terminal for Limiting Authority to use Application Programming Interface of Contents Application Program for Mobile Communication Device - Google Patents

Abstract

PURPOSE: A method for restricting usable rights of an API(Application Programming Interface) of a contents program for a mobile communication terminal and a mobile communication terminal using the same are provided to identify unauthorized programs, and to restrict rights of an application program to use the API having an important authorized level, thereby preventing program damage and information leakage. CONSTITUTION: A mobile communication terminal downloads a contents application program(S310), and decides whether the program is downloaded with a serial interface(S311). If so, the terminal forcibly sets an API access level field of the corresponding application program to a normal API access level(S313). If the program is downloaded with a wireless Internet access unit without using the serial interface, the terminal decides whether a downloading server is authorized(S312). If not, the terminal forcibly sets the API access level field to a normal level(S313). The terminal stores the corresponding application program in a terminal storage space(S314).

Description

Method of restricting usage rights of application programming interface of mobile communication terminal and method using mobile communication terminal {Method and Mobile Communication Terminal for Limiting Authority to use Application Programming Interface of Contents Application Program for Mobile Communication Device}

The present invention relates to a method of restricting an application programming interface (API) permission of contents for a mobile terminal, and more particularly, to identify an unauthorized program among mobile application programs produced by using an API, The present invention relates to a method for preventing terminal program damage and information leakage by restricting the use of an API of an important authentication level.

Recently, with the widespread use of mobile communication services, almost all citizens are provided with one or more mobile communication services. These mobile communication services are expanding to basic voice calls, text and voice message transmissions, wireless Internet services, and contents for mobile communication terminals.

Among these, the wireless Internet service can be connected to a server on the Internet using a terminal to obtain necessary information as well as wirelessly download and use wireless Internet contents such as various images, ringtones, and games.

In order to download and execute the wireless Internet contents, an operating system or a hardware independent platform is mainly used, and the contents are prepared using a predetermined development kit.

An application program for a mobile communication terminal should be produced in a small capacity due to terminal memory limitation, etc., and uses an API which is a standardized library for convenience of programming and execution. These APIs are stored together with the platform for content execution of the terminal, thereby simplifying and reducing the content application program.

The Application Programming Interface (API) is a tool that consists of more than 1000 functions that let you do things like create windows and open files when creating applications in the operating system or in languages like C, C ++, Pascal, and so on.

These APIs have a language or message format that is used when an application communicates with a system program, such as an operating system or database management system, and the API is implemented by calling a function that provides a link to a specific subroutine for execution within the program. do. Thus, an API has several program modules or routines that must already exist or be linked in order to perform the work requested by the function call.

As shown in FIG. 1, the API includes a normal level API related to basic functions such as screen display and sound generation, and an authentication level API performing a function related to the basic operation of the system. Separated by. The authentication level API requires special management because it enables access to the main system of the terminal and enables access to confidential information such as terminal identification codes (ESN, NAM). Thus, if an unauthorized application freely accesses these authentication level APIs, it may cause a fatal error in the system or change or leak important information.

Therefore, the application for content operating on the platform of the terminal sets a permission level that restricts the APIs available and unusable APIs in the program, and restricts the permission of the API according to the permission level. Doing.

However, there is no problem when a legitimate program that appropriately assigns a permission level when producing an application is downloaded through an authorized download server, but content produced for an illegal purpose is downloaded through another path, for example, an unauthorized download server. Alternatively, when downloaded and executed by a wired download through a serial cable, there is a disadvantage that it is not possible to prevent system damage caused by malicious virus programs and alteration and replication of secret information such as ESN.

SUMMARY OF THE INVENTION The present invention has been made in view of the above, and is intended to prevent harmful effects of contents for mobile communication terminals by identifying unauthorized content application programs and forcibly restricting APIs that the application programs can use.

It is an object of the present invention to provide a method for identifying the authenticity of a content program for a mobile communication terminal and limiting the authority to use an API of an unauthorized program and a mobile communication terminal using the same.

Another object of the present invention is a method of authenticating the possession of an application for a terminal through a download method and a download server, and accordingly a method for restricting the use authority of important authentication level APIs among APIs stored in the terminal and mobile communication using the same. It is to provide a terminal.

1 illustrates two levels of API features and the like classified according to importance.

FIG. 2 is a diagram illustrating a hierarchical structure of internal software of a mobile communication terminal and an internal structure of a content program execution file used in the present invention.

3 and 4 illustrate a flow of a method for controlling API usage rights of contents for a mobile communication terminal according to a first embodiment of the present invention. FIG. 3 is a download / save step, and FIG. 4 is an execution step.

5 and 6 illustrate a flow of a method for controlling API usage rights of contents for a mobile communication terminal according to a second embodiment of the present invention. FIG. 5 is a download / save step, and FIG. 6 is an execution step.

The mobile communication terminal for achieving the object of the present invention as described above is composed of an input unit, an output unit, a storage unit, a wireless transmission and reception unit and a control unit, the control unit is a download path of a content application program downloaded from the outside, the download server Recognizes API value and API access level field value, and if the application uses API of authentication level, judges whether it matches with download path and server information pre-stored in storage, and download path and server information. If one or more of the two do not match, limit the execution.

In the first embodiment, the control unit determines whether the download path and the download server of the content application program downloaded from the outside match the download path and server information previously stored in the storage unit, so that at least one of the download path and the server information matches. If not, the API access level field in the executable file of the corresponding content program is set to a normal level and stored in the storage unit.

When there is a request to execute a specific stored content application, the API function used by the content application and the API access level field value of the application are searched and extracted, so that at least one API function used requires authentication. Is an API function, and execution is limited only when the field value is "normal level".

The control unit according to the second embodiment determines whether the download path and the download server information of the received content application program is consistent with the official download path and the server information stored in the storage unit in advance, and the application authentication information according to the match is determined. In the authentication information registration table of the terminal storage unit,

If there is a request for execution of a specific content application of the storage unit, at least one API function used by searching for the API function used by the application is an API function of "authentication level" requiring authentication, and the authentication extracted from the authentication information registration table. Restrict execution if the information is "unauthenticated".

In order to achieve the above object, the method of controlling API usage rights of contents for a mobile communication terminal according to the present invention has the following configuration.

A method using a mobile communication terminal having a platform for downloading and executing a content program produced using an API,

The mobile communication terminal recognizes the download path and the download server of the received content program, determines whether the recognized download path and the download server match the preset official download path and server information, and determines one of the download path and server information. If the above does not match, downloading and storing the content application program setting and storing an API access level field in the executable file of the corresponding content program to a normal level;

When there is a request to execute a specific content application, 1) when the API function used by the content application is searched, and 2) when the API function used consists only of "normal level" functions that do not require authentication. 3) the third step of extracting the API access level field value of the corresponding application if at least one of the second and 3) API functions used is an API function of "authentication level" requiring authentication; When the API access level field value is "authentication level", the content application program execution step includes a fourth step that allows execution, and when the field value is "normal level", the fourth step is not allowed.

In another embodiment of the present invention, as a method using a mobile communication terminal having a platform for downloading and executing a content program produced using an API,

The mobile communication terminal recognizes the download path and the download server of the received content application program and determines whether the download path and the download server match the preset download path and server information. A download / save step of storing in the authentication information registration table in the table; And,

When a user requests to execute a specific content application, 1) the first step of searching for an API function used by the content application, and 2) the API function used consists of only "normal level" functions that do not require authentication. The second step of allowing execution; and 3) if at least one of the API functions used is an API function of an "authentication level" requiring authentication, extracting authentication information of the corresponding application from the authentication information registration table. Step 3, and 4) the content application program is executed if the extracted authentication information is "authentication status", and if the extracted authentication information is "unauthentication status", the fourth step is not allowed. It consists of;

The preset download path is a download through a wireless Internet connection, and the download server is preferably information about a content providing server or a download server authorized by a mobile communication service provider. Therefore, even if the server is downloaded through a serial cable or the like without using a predetermined wireless Internet connection, or if the downloaded server is an unauthorized content server or a download server, the use of the authentication level API of the program is restricted. can do.

Whether or not the downloaded server is authorized is determined by any method such as comparing the location information such as the IP address of the server or checking the validity of the encryption key included in the program. Can be used.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention;

1 illustrates types of APIs classified according to importance.

As described above, the APIs used for the production and execution of content programs usually include a normal level API related to basic functions such as display and sound generation, and an authentication level for performing functions related to the basic operation of the system. It is divided into API (Authorized Level API). This distinction is determined by the function of each element constituting the API, the reference routine, the object of reference, and the like, and is determined at the time of production of the API.

FIG. 2 is a diagram illustrating a hierarchical structure of internal software of a mobile communication terminal and an internal structure of a content program execution file used in the present invention.

As shown in Figure 2a, the program stack of the mobile communication terminal is composed of an operating system (OS), an application platform, an API, and a plurality of applications from below. By using this software layer, it is possible to provide a standardized API and to execute an application (content) produced using the API regardless of the operating system.

The platform is a software layer that provides a standardized API and provides an environment for running applications built using the API.

FIG. 2B illustrates elements constituting an application executable file, and includes an API access level field in addition to basic matters such as program code, initialization information, and program title. In the present invention, such an API access level field is divided into "Authorized Access Level" and "Normal Level", the former is a program that must call at least one authentication level API, the latter only calls a general level API. Means a program that can be used.

All content applications for mobile communication terminals must be "validated" by an authorized organization operating a download server, for example a mobile communication service provider. That is, if the API access level of the content application program is an authentication level, the mobile service provider investigates whether the terminal causes damage, information tampering or leakage when executed, and registers with the download server only when the integrity is verified. do.

However, in the case of an application program that has not been verified by an authorized authority, since the integrity of the application program having the authentication level is not authenticated, it is necessary to limit the use of the authentication level API. Accordingly, the present invention provides a method for performing integrity verification of such a content application program and limiting the use of an authentication level API.

3 and 4 illustrate a flow of a method for controlling API usage rights of contents for a mobile communication terminal according to a first embodiment of the present invention.

It can be largely divided into the download and storage step of FIG. 3 and the execution step of FIG. 4. In the download and storage step, the content application is downloaded (S310), and the download path or the download means is identified to identify a serial interface. It is determined whether the download is used (S311). In the case of a download using the serial interface, it is regarded as an illegal download and the API access level field of the corresponding application program is forced to a normal level (normal API access level) (S313). In addition, in the case of downloading using the wireless Internet access means without using the serial interface, it is determined whether the download server is an authorized server (S312). At this time, whether the download server is authorized or not may be determined by using location information such as the IP address of the server or verifying the validity of a key included in the program by an appropriate encryption algorithm. If the download is not from an authorized server, the API access level field is forced to the general level as in the case of downloading using the serial interface (S313). After performing the above process, the application is stored in the terminal storage space (S314).

In the execution step of the content application program of FIG. 4, when there is a request for executing the content application program by the user (S410), an API function in the corresponding application program is searched to determine whether the API of the authentication level is used (S411). S412). If the API of the authentication level is not used at all, the program is allowed to be executed immediately (S415), and if the API of one or more authentication levels is used, the API access level field value of the corresponding application is read (413).

If the value of the API access level field is "Authorized level", the application is allowed to run because it is an authorized download path and a legitimate application downloaded from the server (S415), and the value of the API access level field is "general level ( normal level) ", the application is determined to be unauthorized in the download / save phase and terminates without allowing the program to run.

As a result, it is possible to achieve an execution limit of an unauthorized content application program using an authentication level API.

5 and 6 illustrate a flow of a method for controlling API usage rights of contents for a mobile communication terminal according to a second embodiment of the present invention.

In this embodiment, the API access level field value of the content application program is not changed, and only the program authentication status is registered (stored) separately, and if requested, execution is executed based on the registered authentication status information. Determine whether to allow it.

FIG. 5 is a step of downloading and storing a content application program according to the second embodiment. The content application program is downloaded (S510), and a download path or a download means is identified to determine whether the download is using a serial interface. (S511). In the case of the download using the serial interface, it is recognized as an illegal download and registered as "unauthenticated" in the program authentication information registration table (S513).

In addition, in the case where the download server is downloaded in a legitimate path using the wireless Internet access means without using the serial interface, it is determined whether the download server is an authorized server (S512). At this time, the determination of whether the download server is authorized may be performed by using location information such as the IP address of the server or a method of verifying the validity of a key included in the program by an appropriate encryption algorithm. If it is not a download from an authorized server, it is also registered as "uncertified" in the program authentication information registration table (S513), and if the download server is an authorized server, it is registered as "authentication" in the authentication information registration table (S514). ).

Therefore, the authentication information registration table of the content application program should include a program identification code (title or unique number) and a code for authentication.

FIG. 6 is a flowchart illustrating a content application program execution step according to a second embodiment of the present invention. When a content application program execution request is requested by a user (S610), an API function in the corresponding application program is searched and authenticated. It is determined whether the level API is used (S611, S612). If the API of the authentication level is not used at all, the program is allowed to be executed immediately (S613), and when using the API of one or more authentication levels, the application authentication information registration table is searched and the code for authentication of the corresponding application is searched. Extract (S614).

If the extracted authentication code is "authentication", the authorized download path and the legitimate application downloaded from the server allow execution (S613), and if the authentication code is "unauthenticated", it is not authorized. Because it is determined that the application has not been made, the program is terminated without allowing the program to run.

As a result, it is possible to achieve an execution limit of an unauthorized content application program using an authentication level API.

By using the method according to the present invention as described above, it is possible to prevent the unauthorized application of the content application program for the mobile communication terminal to access the important API, it is possible to prevent damage to the terminal system, illegal change and leakage of secret information.

Therefore, by securing the trust in the content, it is possible to activate the production and use of the wireless Internet content of the mobile communication terminal.

Claims (5)

It consists of input unit, output unit, storage unit, wireless transmitter and receiver, The controller recognizes at least one of a download path, a download server, a used API function, and an API access level field value of a content application downloaded from the outside, and when the corresponding application uses an API of an authentication level, And determining whether the data match the stored download path and server information and limiting execution when at least one of the download path and server information does not match. The method of claim 1, The control unit determines whether the download path and the download server of the content application downloaded from the outside match the download path and server information previously stored in the storage unit, and when one or more of the download path and the server information do not match, An API access level field in an executable file of a content program is set to a normal level and stored in the storage unit; When there is a request to execute a specific stored content application, the API function used by the content application and the API access level field value of the application are searched and extracted, so that at least one API function used requires authentication. A mobile communication terminal, characterized in that the execution is restricted only when the field value is "normal level". The method of claim 1, The controller determines whether the download path and the download server information of the received content application program are identical to the authorized download path and server information stored in the storage unit in advance, and registers the authentication information of the application in accordance with the match. Save it to a table, If there is a request for execution of a specific content application of the storage unit, at least one API function used by searching for the API function used by the application is an API function of "authentication level" requiring authentication, and the authentication extracted from the authentication information registration table. A mobile communication terminal, characterized in that the execution is restricted only when the information is in the "unauthenticated state." As a method using a mobile communication terminal having a platform for downloading and executing a content application produced using an API (Application Programming Interface), The mobile communication terminal recognizes the download path and the download server of the received content program, determines whether the recognized download path and the download server match the preset download path and server information, and at least one of the download path and server information. If they do not match, downloading and storing the content application program setting and storing an API access level field in the executable file of the content program at a normal level; And, When there is a request to execute a specific content application, 1) when the API function used by the content application is searched, and 2) when the API function used consists only of "normal level" functions that do not require authentication. 3) the third step of extracting the API access level field value of the application if at least one of the second and 3) API functions used is an API function of "authentication level" requiring authentication; And a fourth step of allowing the execution if the API access level field value is "authentication level" and not allowing execution if the field value is "normal level". Method of restricting API usage rights of a content program for a mobile communication terminal. As a method using a mobile communication terminal having a platform for downloading and executing a content application produced using an API (Application Programming Interface), The mobile communication terminal recognizes the download path and the download server of the received content application program and determines whether the download path and the download server match the preset download path and server information. A downloading and storing step of storing the authentication information in a registration table; When a user requests to execute a specific content application, 1) the first step of searching for an API function used by the content application, and 2) the API function used consists of only "normal level" functions that do not require authentication. The second step of allowing execution; and 3) if at least one of the API functions used is an API function of an "authentication level" requiring authentication, extracting authentication information of the corresponding application from the authentication information registration table. Step 3, and 4) the content application program is executed if the extracted authentication information is "authentication status", and if the extracted authentication information is "unauthentication status", the fourth step is not allowed. Restriction method for using the API of the content program for a mobile communication terminal comprising a.