KR20050113059A - Terminal and method for protecting virus of data - Google Patents

Abstract

The present invention relates to a terminal for operating an antivirus for detecting and processing a virus of data and a method thereof. To this end, the present invention provides a mobile terminal, an internet protocol network connected to the mobile terminal through a mobile communication network, an authentication server and a billing server connected to the internet protocol network, and the mobile terminal for data. In the method for preventing a virus infection, requesting the antivirus program download and update request to the antivirus server through the mobile communication network, if the antivirus program is received from the antivirus server through the mobile communication network And a process of performing a virus test on the data of the mobile terminal at a predetermined virus test time point.

Description

Terminal and method for preventing virus infection of data {TERMINAL AND METHOD FOR PROTECTING VIRUS OF DATA}

The present invention relates to a terminal for preventing viral infection of data and a method thereof, and more particularly, to a terminal for operating a virus vaccine for detecting and processing a virus of data and a method thereof.

Current mobile terminals not only provide voice call services but also support various multimedia services. Recently, such mobile terminals have developed not only as simple communication devices but also as tools for personal information and assets such as credit card functions and mobile banking services. In the other direction, mobile and PDA have been integrated and mobile computing is possible. Now, convergence of digital small home appliances such as MP3 and digital camera is expected to be active. Therefore, the communication environment of the mobile terminal is not only a voice transmission network server but also a number of services are provided, the access to the content server and web server will be active. In addition, while many services are provided due to the opening of the wireless network, virus infections will occur in the communication environment of the mobile terminal as in the wired Internet environment.

A process for preventing data virus infection caused by transmission and reception of viruses and file data between terminals in a conventional mobile system will be described with reference to FIG. 1. 1 is a flowchart illustrating a process for preventing virus infection of data in a server of a general wireless communication system.

In step 100, the server scans the virus for data to be sent to the called terminal. If a virus is found in step 104, the server proceeds to step 108 after the virus treatment using an antivirus program in step 106 and stores it in the server memory space. Thereafter, the stored data is transmitted to the called terminal. That is, in the past, when transmitting voice and data to the called terminal, the server checks whether the data is infected with the virus, and treats and transmits the virus based on the infection.

However, when a large number of applications are generated and a corresponding amount of data traffic is expected in the future, the method of checking whether all data is infected by a virus has limitations in processing capacity of servers and network communication devices. In addition, if the server side performs virus scan, remediation, and retransmission for such a large amount of data traffic, it not only incurs server overload but also incurs high costs such as massive expansion and upgrade of the server. Also, as the wireless network is opened, virus processing in the wireless network server is not enough. This is because, in the wired Internet network, if there are a large number of unauthorized servers, hundreds of servers are created and disappeared a day.

As described above, the function of the mobile terminal is expanded day by day, and important information required by many individuals is recorded and stored in the terminal. Therefore, the unique information protection function of the terminal is essential, and it is urgent to defend against and cope with the most basic virus attack.

Accordingly, an object of the present invention is to provide a terminal and a method thereof for optimized system monitoring on a limited resource of a terminal by downloading the antivirus in a system supporting antivirus download.

Another object of the present invention relates to a terminal and a method thereof for preventing virus infection occurring during data communication.

Another object of the present invention relates to a terminal and a method thereof for preventing a virus infection of the boot code.

The present invention for achieving the above object is a wireless communication system consisting of a mobile terminal, and an internet protocol network connected to the mobile terminal through a mobile communication network, connected to the internet protocol network, and stores the antivirus program and the An antivirus server providing the antivirus program according to an antivirus program download and update request, and the mobile terminal requests the antivirus program download and update request to the antivirus server through the mobile communication network; When the antivirus program is received from the antivirus server through the mobile communication network, the antivirus program is stored in the antivirus server, and the antivirus program is operated at a preset virus scan time. And perform a virus scan of the data.

The present invention for achieving the above object is a wireless communication comprising a mobile terminal, an internet protocol network connected to the mobile terminal and a mobile communication network, and an antivirus server connected to the internet protocol network and stores an antivirus program. In the mobile terminal of the system, requesting the antivirus program download and update request to the antivirus server through the mobile communication network, and if the antivirus program is received from the antivirus server through the mobile communication network and stored therein Thereafter, the antivirus program is operated at a preset virus scan time to perform a virus scan on the data of the mobile terminal.

The present invention for achieving the above object is a mobile terminal, the mobile terminal and the Internet protocol network is connected via a mobile communication network, the wireless communication system consisting of an authentication server and billing server connected to the Internet protocol network A method for preventing a virus from infecting data with a terminal, the method comprising requesting the antivirus program download and update request to the antivirus server through the mobile communication network, and from the antivirus server through the mobile communication network. When a program is received, storing the program, and performing a virus scan on the data of the mobile terminal at a predetermined virus scan time.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

Next, a system for preventing virus infection of data in a mobile terminal according to the present invention will be described with reference to FIG. 2. 2 is a diagram illustrating a system for preventing virus infection of data according to an embodiment of the present invention.

First, the mobile terminal 200 (Mobile Station (MS)) is connected to the base station 202 through an air interface when a call is set up. The mobile terminal 200 may perform a voice call, and Alternatively, a data service such as an image is possible, etc. The base station 202 wirelessly connected to the mobile communication terminal 200 is connected to the base station controller 204 by wire, and is connected to the mobile terminal 200 through a wireless section when setting up a call. In addition, the base station controller 204 is connected to a packet data processing device 206 for processing packet data, and the packet data processing device 206 is connected to an Internet protocol network (IP network) 210 for providing Internet services. In addition, the authentication server 212 for authenticating the terminal, the charging server 214 for processing the charge to the terminal when downloading the antivirus program, and stores the antivirus program and the data Antivirus server 216 and IP network 210 for managing the virus. In order to perform virus infection prevention in the mobile terminal 200 as in the embodiment of the present invention, the antivirus server 216 is first used. After downloading the antivirus program, check for data infection.

The virus infection inspection and treatment method in the mobile terminal 200 has a limited battery power and limited resources, unlike a personal computer that is supported with sufficient power and many resources, so the method of operating an antivirus program is very important. In other words, the virus should be searched for in the minimum time and optimal state, treated and reported quickly in case of discovery, and then a series of tasks to check normal operation should be optimally operated according to the state of the terminal. The present invention will be described in the following three embodiments of a virus processing operation method that satisfactorily uses resources, minimizes power consumption, and simultaneously satisfies a system monitoring function for monitoring a virus and a virus monitoring function for traffic data. Embodiments of the present invention may be used simultaneously or may be selected and used in combination according to the situation, and may be independently applied to determine whether or not to use the terminal according to the environment of the terminal.

Next, a process of downloading an antivirus program from the antivirus server 216 in the mobile terminal 200 will be described with reference to FIG. 3. 3 is a signal flow diagram illustrating a process for downloading an antivirus in a mobile terminal according to an embodiment of the present invention.

First, when the mobile terminal 200 requests the antivirus program download and update to the packet data processing apparatus 206 in step 300, the packet data processing apparatus 206 performs the authentication server 212 in steps 302 and 304. The authentication process of the mobile terminal 200 is performed. In this case, when the mobile terminal 200 is authenticated, the packet data processing apparatus 206 processes the charging in steps 308 and 310 through the charging server 214, and then the antivirus program to the antivirus server 216 in step 312. Request download and update service. Thereafter, in step 314, the packet data processing apparatus 206 receives the antivirus program to be downloaded and updated from the antivirus server 216 and transmits it to the mobile terminal 200 in step 316. Then, the mobile terminal 200 stores the antivirus program, and when the reception is completed, the mobile terminal 200 transmits a message indicating that the download and update of the antivirus program is completed to the packet data processing apparatus 206 in step 318. Upon receiving this, the packet data processing apparatus 206 notifies the antivirus server 216 that the antivirus program download and update to the mobile terminal 200 is completed in step 320.

As described above, the mobile terminal 200 first downloads an antivirus program, and then performs virus scan and treatment recovery on data stored in the mobile terminal 200 and data received during communication.

Next, a process of performing a virus scan and a repair recovery on data stored in the mobile terminal 200 and data received during communication will be described with reference to FIGS. 4 to 7.

4 is a flowchart illustrating a process for preventing data virus infection in the mobile terminal 200 according to the first embodiment of the present invention. The data virus infection prevention method according to the first embodiment of the present invention operates the antivirus program only in a state where communication traffic exists in the mobile terminal 200. That is, since the power consumption is large in order to always run the antivirus as a main program, such as a computer, the mobile terminal 200 according to the first embodiment of the present invention operates only when there is communication traffic.

If it is recognized that the mobile terminal 200 is set as a call in step 400, an antivirus program is operated to perform a virus check on the received data. In other words, after performing a signaling process for channel setup for data transmission and reception, it is operated to activate an antivirus program when data transmission and reception starts. Thereafter, the method checks whether a virus is infected with the data received in step 402. If a virus is found in the data received in step 404, the virus is treated and coped with in step 406. In step 406 to step 407, it is checked whether the call path is canceled. If the call path is still set, the process proceeds to step 402. Otherwise, the process proceeds to step 408, and the virus infection situation and treatment by the antivirus server 216 is performed. And reporting the coping situation. That is, in step 408, the mobile terminal 200 reports the antivirus server 216 to the antivirus server 216 for the characteristic pattern of the virus itself, the date of occurrence, whether to fix it, and the modifications thereof, and receives the antivirus server 216. ) Records the characteristic patterns of the virus and records the date and time of occurrence, treatment status, and modifications in the database.

In other words, the antivirus program does not operate in the idle state or in a state in which traffic is not activated, such as a menu search. That is, only when the traffic channel is activated, the antivirus program searches for viruses for the received data. By implementing in this way, the mobile terminal 200 having the limit of the battery capacity can bring the maximum effect with the minimum operation of the virus program. Traffic here means both voice and data traffic. In addition, when a session is completed as a control channel where voice data traffic starts and a voice data channel is opened, the operation of the antivirus program should be started from that point.

For example, when the vaccine program is operated to prevent virus infection of voice data of the mobile terminal 200 in GSM, the base station 202 transmits an alerting message and transmits the data as a connect message. 200 is the point of reception.

When the mobile terminal 200 receives a Connect message from a call manager process (or thread or task) in charge of a voice call, the mobile terminal 200 transmits a virus routine start message to the vaccine process. Afterwards, the incoming messages are scanned and repaired by the antivirus process and start post-operation. At this time, it is preferable to use the interprocess communication (IPC) of the operating system for message transfer between the call management process and the vaccine process. However, you can use your own message exchange. In addition, even in a communication method such as CDMA or UMTS, the operation principle of the GSM method and an antivirus program operation method for data received after setting as a call are the same.

As another example, when the mobile terminal 200 receives the GPRS packet data, the antivirus program starts to be driven at the time when data traffic starts during the setup signaling for receiving the GPRS packet data. More specifically, the vaccine operation is started at the SGSN-initiated PDP Context Modification Procedure after several procedures for channel setup and authentication for communication. As such, the antivirus program is operated from the beginning of the data traffic, and the virus is detected and treated when the virus is detected for the data received through the data traffic.

5 is a flowchart illustrating a process for preventing data virus infection in a mobile terminal according to a second embodiment of the present invention. A second embodiment of the present invention is to run the antivirus program at a specific integer multiple of the basic idle time of the mobile terminal. Therefore, the present invention must set in advance a virus test cycle of a specific integer multiple of the idle time. Specifically, the mobile terminal is in the idle state of the standby state, and wakes up at each preset idle period of the terminal to check whether there is a paging signal received or any change in the operation of the terminal, and processes the corresponding operation in response thereto. In the present invention, the antivirus program is operated by adding a routine for detecting and processing a virus as well as a routine for checking the operation change of the terminal every idle cycle.

Referring to FIG. 5, in step 500, the mobile terminal 200 checks whether a virus scan cycle has occurred. That is, it checks whether the virus is scanned at the time when the terminal wakes up by the idle cycle. Referring to FIG. 6, the virus scan cycle is set every 4 times the idle cycle. In this way, the virus scan cycle of a specific integer multiple of the preset idle time is examined.

After that, in the virus scan cycle, the virus scan of the memory region is started. That is, an antivirus program is executed to check for viruses in the memory area storing data. If a virus is found in step 504 during virus scanning, the virus is treated in step 506 or deleted if it cannot be cured. In step 507, the virus scan time is checked. The virus scan time may be illustrated as Td of FIG. 6, and is a time for checking whether the data in the memory area is infected with a virus, and is a time before an idle cycle starts at the start of the virus scan cycle. If the virus scan time is not exceeded, the process proceeds to step 502 to continuously scan for virus infection. Otherwise, the process proceeds to step 508 and the information on the virus scan is stored in the dispatch memory area to the present time. Report to the antivirus server.

The time required for virus search, discovery, treatment and post processing according to virus discovery is very time-consuming. In general personal computer, all data can be inspected and post-processed, and then other programs can be started. However, in case of mobile terminal, it is important to use real time and equal resources, so even if the memory area is scanned every virus cycle, If longer, the dispatch memory area is used. Specifically, if a virus is detected and the virus scan time is exceeded, the result is stored in the dispatch memory and the standby state is maintained again. In addition, if the virus scan time is exceeded, the virus treatment is first performed when the virus is found, and as a result, the data is stored in the dispatch memory area to maintain the standby state. Then, when the next virus scan cycle is reached, the scan starts again from the memory area according to the virus scan status stored in the dispatch memory. By doing so, you can maximize the real-time performance of the device, use resources evenly, and reduce battery consumption. At this time, the cycle for virus scan may be set using the idle cycle as described above, or the specific cycle may be set using a watchdog timer or a general timer interrupt supported by the communication device. In addition, the dispatch memory area may use a memory provided by an operating system, and a programmer may set and process a specific area.

7 is a flowchart illustrating a process for preventing data virus infection in a mobile terminal according to a third embodiment of the present invention.

In general, the mobile terminal 200 configures a processing routine for an exception handling situation when it is not normal terminal operation. That is, when an operation such as a data abortion exception occurs in access to the data area, such as an access to an inaccessible data area occurs, the mobile terminal 200 operates normally. If not, it operates the corresponding exception handling routine. In particular, if the virus is infected with a boot virus, a file, or a worm virus, the terminal malfunctions, and most of the exception handling routines occur. Therefore, in the third embodiment of the present invention, the virus scan process is also performed in the exception handling routine as described above. That is, a virus processing routine is implemented in the exception handling routine to search for and treat a virus. At this time, the virus is processed with higher priority than other processes, and then the system operates normally.

In step 700, if it is an exception processing situation that is not normal terminal operation, the flow proceeds to step 702 to check whether there is a problem with an address packet or a problem with a data area access. If there is a problem with the address packet or a problem with access to the data area, proceed to step 704 to perform a virus scan for the memory area. If a virus is found in step 706, proceed to step 706 to treat and cope with the virus. . Thereafter, the process proceeds to step 710 and reports to the antivirus server 216.

The mobile terminal 200 of the present invention downloads the antivirus program in the same manner as in FIG. 3 described above, and then updates it continuously to update it with a new vaccine. The mobile terminal 200 executes the virus vaccine to meet the characteristics and limitations of the terminal to prevent the infection of the virus in advance without significantly reducing the operation or resources of the mobile terminal, and to immediately treat and delete the infection. Also, it is an antivirus execution and operation process in the terminal after download / update, and it is possible to run only one of virus scan during traffic data reception, virus scan at specific period, virus scan in exception handling routine, or simultaneously or in combination. It may be. When such a virus is detected after such a virus search, virus treatment is performed and the result is reported to the virus server 216 and stored. Reporting of such viral treatment results can be used as recovery or vaccine data for other mobile terminals. Therefore, personal information can be protected from invasion of the virus, and at the same time, it prevents the spread of the virus, thereby preventing confusion of information and communication environment of others using the wireless environment.

As described above, after downloading and updating the antivirus program in the mobile terminal, it is possible to protect the important information in the terminal by executing the antivirus execution and the operation process to scan the virus itself and report the result to the server. In addition, there is an advantage to prevent the spread to the wireless mobile terminal network environment. In addition, while obtaining the same effect as the operation of the vaccine used in the personal computer, it is possible to minimize the consumption of the battery, etc. by saving the resources and processing evenly.

1 is a flowchart illustrating a process for preventing virus infection of data in a server of a general wireless communication system;

2 is a diagram illustrating a system for preventing virus infection of data according to an embodiment of the present invention;

3 is a signal flow diagram illustrating a process for downloading an antivirus in a mobile terminal according to an embodiment of the present invention;

4 is a flowchart illustrating a process for preventing data virus infection in a mobile terminal according to a first embodiment of the present invention;

5 is a flowchart illustrating a process for preventing data virus infection in a mobile terminal according to a second embodiment of the present invention;

6 is a diagram illustrating a virus scan cycle for preventing data virus infection in a mobile terminal according to a second embodiment of the present invention;

7 is a flowchart illustrating a process for preventing data virus infection in a mobile terminal according to a third embodiment of the present invention.

Claims (13)

In a wireless communication system consisting of a mobile terminal and an internet protocol network connected to the mobile terminal through a mobile communication network, An antivirus server connected to the Internet protocol network, storing an antivirus program and providing the antivirus program according to the antivirus program download and update request, The mobile terminal requests the antivirus program download and update request to the antivirus server through the mobile communication network, stores the antivirus program when the antivirus program is received from the antivirus server through the mobile communication network, and then presets the antivirus program. And a virus scan of the data of the mobile terminal by operating the antivirus program at the time of virus scan. The method of claim 1, wherein the mobile terminal, If a virus for the data of the mobile terminal is found, the virus is repaired. If all viruses are checked for the data, if a virus for the data is found, information about the data virus infection is sent to the antivirus server. Device characterized in that reporting. The method of claim 1, wherein the preset virus scan time is a time point for establishing a communication path for communication of the mobile terminal, a specific period set for the virus test, a problem about an address patch that is not normal operation of the mobile terminal, or the like. And at least one of the time points at which an exception handling operation routine is initiated by access of an inaccessible data area. 4. The method of claim 3, wherein when the preset virus test point is a time point for communication of the mobile terminal, a virus test is performed on data received through the communication path, and when the call path setting is terminated, A device characterized by stopping a virus scan. The exception processing operation of claim 3, wherein the preset virus scanning time is a specific period set for the virus scanning or a problem about an address patch that is not a normal operation of the mobile terminal, and an access to an inaccessible data region. And when the routine is one of the time points at which the routine starts, performing a virus check on the data stored in the mobile terminal. The apparatus of claim 3, wherein the specific period set for the virus test is a period set by a specific integer multiple of an idle period set by the mobile terminal to check a state of the terminal or a period set directly by a user. . In the mobile terminal of a wireless communication system comprising a mobile terminal, an internet protocol network connected to the mobile terminal through a mobile communication network, and an antivirus server connected to the internet protocol network and storing an antivirus program, The antivirus program download and update request is made to the antivirus server through the mobile communication network, and when the antivirus program is received from the antivirus server through the mobile communication network, the antivirus program is stored and stored at a predetermined time of virus scanning. And operating the antivirus program to perform a virus check on the data of the mobile terminal. Preventing a virus from infecting data by a mobile terminal in a wireless communication system including a mobile terminal, an internet protocol network connected to the mobile terminal through a mobile communication network, and an authentication server and a billing server connected to the internet protocol network. In the method for Requesting the antivirus program download and update request to the antivirus server through the mobile communication network and storing the antivirus program when the antivirus program is received from the antivirus server through the mobile communication network; And performing a virus scan on the data of the mobile terminal at a preset virus scan time. The method of claim 8, If a virus for the data of the mobile terminal is found, the virus is repaired. If a virus for the data is found when the virus check for the data is completed, the information about the data virus infection is reported to the antivirus server. And further comprising a process of doing so. The method of claim 8, wherein the preset virus scan time is a time point for establishing a communication path for communication of the mobile terminal, a specific period set for the virus test, a problem about an address patch that is not normal operation of the mobile terminal, or At least one of the time points at which an exception handling operation routine is initiated by access of an inaccessible data region. The method of claim 10, wherein the specific period set for the virus test is a period set to a specific integer multiple of an idle period set for the mobile terminal to check the state of the terminal or a period set directly by the user. . The method of claim 10, wherein when the preset virus test point is a time point for communication of the mobile terminal, a virus test is performed on data received through the communication path, and when the call path setting is terminated, Stop virus scanning. 11. The method of claim 10, wherein the predetermined virus scanning time is an exception processing operation due to a problem of an address patch and an access to an inaccessible data region that is not a specific period set for the virus scanning or a normal operation of the mobile terminal. If one of the time points at which the routine is started, performing a virus check on the data stored in the mobile terminal.