KR20070075223A - Apparatus and method for managing security of multimedia middleware in terminal - Google Patents

Abstract

An apparatus and a method for managing security of multimedia middleware in a terminal are provided to improve security by including a block for managing security and a mutual relation with the block. An apparatus for managing security of multimedia middleware in a terminal includes a service manager(113), a physical service block(112), an executing situation processing unit(114), and a security manager(115). The service manager(113) receives a multimedia service process, and manages questions of authority and service execution. The physical service block(112) provides a physical service. The executing situation processing unit(114) inspects an executing situation of the service and processes the situation. The security manager(115) has authority information of each service, provides the authority information in case of the question of the authority, and grants the authority.

Description

Apparatus and method for managing security of multimedia middleware in a terminal {APPARATUS AND METHOD FOR MANAGING SECURITY OF MULTIMEDIA MIDDLEWARE IN TERMINAL}

1 is a system structure diagram of a user terminal having a multimedia middleware according to an embodiment of the present invention;

2 is a service flow diagram of a security process for internal service access in accordance with the present invention;

3 is a security process flow diagram for accessing a specific platform resource in accordance with the present invention;

4 is an overall data structure diagram of an access right expression according to an embodiment of the present invention;

5 is a data structure diagram for representing an access subject according to a preferred embodiment of the present invention;

6 is a data structure diagram for representing an access type according to an embodiment of the present invention;

7 is a data structure diagram for representing an access target according to an embodiment of the present invention;

8 is a data structure diagram for expressing an access condition according to a preferred embodiment of the present invention;

9 is an overall data structure diagram of an access right expression group according to an embodiment of the present invention;

10 is a basic structural diagram expressing a right according to the present invention using a license structure of the right expression language (REL) technology currently being used.

The present invention relates to an apparatus and method for security of multimedia used in a terminal, and more particularly, to an apparatus and method for managing security of multimedia in middleware used in a terminal.

In the early days of the computer, the data that could be processed in a computer could be processed only by numbers or a programming language developed to replace the numbers. However, with the development of technology, input and output of information are possible in various ways, and it is possible to process various media such as voice, figures, and images in addition to text. As such, various media are collectively called multimedia. Such multimedia are currently implemented in various forms such as mobile communication terminals or PDAs or MP3 players as well as computers.

As there are various types of terminals and various types of multimedia services, security problems have started to occur in terminals providing multimedia services. For example, a virus may be provided to a terminal providing a multimedia service to cause damage to the inside of the device. This is because in the multimedia middleware technology known to date, even when a specific service in the middleware uses a resource in the terminal platform, the access right check for controlling the use right is not performed. Malicious codes and viruses can be easily distributed using these security loopholes, and no method can be used to control resource usage. This example is a phenomenon that sometimes occurs in a mobile terminal using a mobile communication system.

Recently, multimedia services are protected by copyright. However, a problem may occur such that an unauthorized user illegally accesses and plays a multimedia service. In addition, there is a problem that the multimedia service is not protected due to the act of arbitrarily damaging or arbitrarily changing the multimedia service data in which the copyright is set.

In addition, in various terminals providing multimedia services, a problem may occur as to whether or not an application program driven by the user has appropriate authority for the desired multimedia service. For example, when a contract is provided so that a multimedia service stored in a specific format can be provided only through a player provided by a specific company, there are various cases in which the contract situation is used regardless of the contract situation.

In other words, the multimedia middleware technology provided so far provides a systematic and standardized expression of access that can check whether an application has permission to use a service when an application requests a use of a specific middleware service. Didn't exist. In other words, there is no method of granting access to only a specific program and a user when a multimedia middleware service such as a specific API is distributed. As a result, it was not possible to control the misuse and abuse of services for specific programs, and it was difficult to present a business model based on the distribution of services. Therefore, there is a need for an apparatus and method for managing security of multimedia services.

Accordingly, an object of the present invention is to provide an apparatus and method for maintaining security in a terminal providing a multimedia service.

Another object of the present invention is to provide an apparatus and method for performing security management in a multimedia middleware.

It is still another object of the present invention to provide an apparatus and method for maintaining security by checking a right through a security management device in a terminal middleware.

It is still another object of the present invention to provide an apparatus and method for checking whether a specific service in a middleware has access authority even when accessing or using a resource of a terminal platform.

Another object of the present invention is to provide a rights expression structure of the multimedia middleware.

The method of the present invention for achieving the above object is a security management method in the multimedia middleware of the terminal, the process of requesting review of the access authority in response to the service request when the service request exists, and reviewing the access authority and the Initializing the service after responding to the result; and driving a service handler for managing the service after initialization of the service.

An apparatus of the present invention for achieving the above objects is a security management device of the multimedia middleware in the terminal, the service management unit for receiving the multimedia service processing to manage the query and service execution of authority, and the physical service to provide a physical service It includes a block, an execution state processing unit for inspecting and processing an execution state of a service, and a security management unit including authority information of each service, providing authority information when an authority query is requested, and granting authority.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the preferred embodiment of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users or operators, and the definitions should be made based on the contents throughout the present specification.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In the present invention, in providing a terminal middleware service required by a multimedia application program in a multimedia terminal, verifying whether the application program has access and use rights to the service, and using the resource of the terminal platform in the terminal middleware service, The middleware service provides a procedure and an access right for verifying that the middleware service has a right to access and use a resource by using a metadata structure.

In this case, the metadata expressing the access rights is defined as a principal, an access object, a condition, and an access type in order to express 'any object can access any object to any object under any condition.' (AccessType) is provided, and a method and apparatus for checking access and usage rights between a multimedia application program and a middleware service and a middleware service and a platform resource using the same are provided.

1 is a system structural diagram of a user terminal having a multimedia middleware according to an embodiment of the present invention. Hereinafter, a system structure and operation of a user terminal having a multimedia middleware will be described with reference to FIG. 1.

Here, the user terminal means a wired terminal, for example, a device such as a computer having a network connection means or a wireless terminal, for example, a cellular phone, a PCS, a PDA, an IMT-2000, a PDA phone, a smart phone, and the like. The structure of a user terminal system including a multimedia middleware having a security manager 115 includes a multimedia service application block 100, a multimedia middleware block 110, and a platform block 120. Here, the multimedia middleware block 110 includes a logical service 111 composed of service metadata, a physical service 112 composed of implementation codes, a service manager 113 for managing logical services and physical services, and an execution status processor 114. And a security management unit 115. The operation of each of the above components will be described in more detail with reference to a flowchart to be described later.

2 is a service flow diagram of a security process for internal service access in accordance with the present invention. Hereinafter, a process of a security process for accessing an internal service in an apparatus according to the present invention will be described with reference to FIGS. 1 and 2.

The security manager 115 is responsible for maintaining and managing internal security through a security procedure when the service application processing block 100 for processing a multimedia service requests a specific service in the middleware. Therefore, if a multimedia service is requested from a user, the multimedia service application processing block 100 obtains execution of a new service to the service manager 113 in step 200. Then, the service manager 113 requests the security manager 115 to check it in step 202 to check the access right to the service. In step 204, the security manager 115 examines a license list in which the access right is expressed and checks whether the corresponding service application processing block 100 has the authority for the corresponding service. The service manager 113 responds. The service manager 2003 initializes the corresponding service in step 208 according to the response result provided to the security manager 2005 in step 206, and passes the handler for the service to the service application processing block 100 in step 210. Through this process, the service manager 113 may check whether the requested service can be processed in the corresponding application program. Therefore, the security manager 115 must have a license list according to the access right according to the present invention, and must check the access right and provide a response to the result to the service manager 113. In addition, the service manager 113 may inquire about the access authority to the security manager 115 whenever there is a request for a specific service from the service application processing block 100, and may or may not provide a service according to the result. have.

3 is a security process flow diagram for accessing a particular platform resource in accordance with the present invention. Hereinafter, a flow of a security process when accessing a specific platform resource according to the present invention will be described with reference to FIGS. 1 and 3.

In order for a specific service to access a specific platform resource, the service first requests a new resource access right to the security manager 115 in step 300. In step 302, the security manager 115 examines an access policy list to generate a new access ID, responds to the service in step 304, and executes a new access ID in step 308. 114). In step 308, the execution status processing unit 114 examines a license list in which the access right is expressed and checks the access request. In this case, the service provided with the new access ID requests the execution situation processor 114 to access a specific platform resource using the service access information in step 310. The execution status processor 114 then provides a response in step 312.

4 is an overall data structure diagram of an access right expression according to a preferred embodiment of the present invention. Hereinafter, the entire data structure of the access right expression according to the present invention will be described with reference to FIG. 4.

Looking at the overall structure, below the AccessRight 401, there is a principle for recording multimedia middleware (m3w-r: Principal) 411 and access types of multimedia middleware (m3w-r: AccessTypes) 412. 413, the access target (m3w-r: AccessObject) 414 of the multimedia middleware, the access conditions (m3w-r: Conditions) 415, etc. of the multimedia middleware should be specified. 4 is a description of symbols shown in the access right type 410 of FIG. 4. That is, a case including a subfolder not shown or including a plurality of subfolders or a subfolder is shown, but only a part or a whole of the subfolder is shown. In addition, the line connecting the access right 401 is shown with a symbol indicating that there are a plurality of rights.

5 is a data structure diagram for representing an access subject according to a preferred embodiment of the present invention.

In the data structure for the access subject shown in FIG. 5, an object to which access is granted is specified. At this time, the access subject may be an application program or a service. The data structure for representing an access subject includes an identifier (511) for the access subject and authorized key information (KeyHolder) 512 generated from an electronic signature scheme.

6 is a data structure diagram for representing an access type according to a preferred embodiment of the present invention.

In FIG. 6, an access type permitted to an access subject is specified. In this case, one type or multiple types of access types 601 and 602 may be allowed. That is, it has been shown that there may be a plurality of types granted to a specific service or service application processing block in the access type indicated by reference numeral 603. For example, each type may have values such as open, write, read, and execute.

7 is a data structure diagram for representing an access target according to an exemplary embodiment of the present invention.

In FIG. 7, the object authorized to the access subject is specified. In this case, the access target 701 may be a service or platform resource. At this time, to represent the access target includes an identifier (711) of the access target, authorized key information (KeyHolder) 712 generated from the digital signature scheme, platform resources (PlatformResources) 713. In addition, the platform resource 713 may be represented by being replaced with actual resources such as a file system (714), a memory (715), a socket (716).

8 is a data structure diagram for expressing an access condition according to a preferred embodiment of the present invention.

In FIG. 8, a condition 801 in which an authorized access subject can access an access target is specified. Specific examples of these conditions are shown at 810. In this case, the access condition 811 may be expressed by being replaced with a size 813 indicating the size of the accessible file system and the memory in bytes or an access count 812 indicating the number of accesses.

9 is an overall data structure diagram of an access right expression group according to an embodiment of the present invention.

In FIG. 9, a structure for expressing a right to a plurality of access targets that an access subject has, or a group of access rights that a single access target may have. At this time, the access right expression group 901 has one of an access subject group (PricipalGroup) 911 or an access object group (AccessObjectGroup) 921 and an access right expression (AccessRight) structure described with reference to FIG. 4. At this time, if there is an access subject group, it has the value of AccessObject among the expressions of access rights, but it does not have a principal, whereas if it has an access target group, it has a value in the principal during the access authority expression. The access object is not displayed.

Tables 1a to 1d below are examples of describing the entire structure of the access right expression data of FIG. 4 defined in the present invention in XML.

<? xml version = "1.0" encoding = "UTF-8"?> <schema targetNamespace = "http://mccb.icu.ac.kr/M3WAccessRightExpression" xmlns = "http://www.w3.org/2001 / XMLSchema "xmlns: m3w-r =" http://mccb.icu.ac.kr/M3WAccessRightExpression "xmlns: dsig =" http://www.w3.org/2000/09/xmldsig# "elementFormDefault =" qualified "attributeFormDefault =" unqualified "> <import namespace =" http://www.w3.org/2000/09/xmldsig# "schemaLocation =" dsig.xsd "/> <element name =" AccessRight "type =" m3w- r: AccessRightType "/> <complexType name =" AccessRightType "> <sequence> <element ref =" m3w-r: Principal "minOccurs =" 0 "/> <choice> <element ref =" m3w-r: AccessType "/ > <element ref = "m3w-r: AccessTypes" /> </ choice> <element ref = "m3w-r: AccessObject" minOccurs = "0" /> <element ref = "m3w-r: Conditions" minOccurs = " 0 "/> </ sequence> </ complexType> <element name =" AccessRightGroup "type =" m3w-r: AccessRightGroupType "/> <complexType name =" AccessRightGroupType "> <sequence> <choice> <element ref =" m3w -r: PrincipalGroup "/> <el ement ref = "m3w-r: AccessObjectGroup" /> </ choice> <element ref = "m3w-r: AccessRights" /> </ sequence> </ complexType> <element name = "AccessRights" type = "m3w-r : AccessRightsType "/> <complexType name =" AccessRightsType "> <sequence> <element ref =" m3w-r: AccessRight "maxOccurs =" unbounded "/> </ sequence> </ complexType> <element name =" AccessTypes "type = "m3w-r: AccessTypesType" /> <complexType name = "AccessTypesType"> <sequence> <element ref = "m3w-r: AccessType" maxOccurs = "unbounded" />

</ sequence> </ complexType> <element name = "AccessType" type = "m3w-r: AccessTypeType" /> <simpleType name = "AccessTypeType"> <restriction base = "string"> <enumeration value = "Open" / > <enumeration value = "Write" /> <enumeration value = "Read" /> <enumeration value = "Execute" /> </ restriction> </ simpleType> <complexType name = "ObjectType"> <sequence> <choice> <element name = "Identifier" type = "anyURI" /> <element ref = "m3w-r: KeyHolder" /> <element ref = "m3w-r: PlatformResource" /> </ choice> </ sequence> <attribute name = "type" type = "m3w-r: ObjectTypeType" use = "required" /> </ complexType> <simpleType name = "ObjectTypeType"> <restriction base = "string"> <enumeration value = "Platform" /> <enumeration value = "Service" /> <enumeration value = "Application" /> </ restriction> </ simpleType> <element name = "PlatformResource" type = "m3w-r: PlatformResourceType" /> <complexType name = "PlatformResourceType "/> <element name =" FileSystem "type =" m3w-r: FileSystemType "substitutionG roup = "m3w-r: PlatformResource" /> <complexType name = "FileSystemType"> <complexContent> <extension base = "m3w-r: PlatformResourceType"> <attribute name = "location" type = "anyURI" use = "required "/> </ extension> </ complexContent> </ complexType>

<element name = "Memory" type = "m3w-r: MemoryType" substitutionGroup = "m3w-r: PlatformResource" /> <complexType name = "MemoryType"> <complexContent> <extension base = "m3w-r: PlatformResourceType"> <attribute name = "address" type = "string" use = "required" /> </ extension> </ complexContent> </ complexType> <element name = "Socket" type = "m3w-r: SocketType" substitutionGroup = " m3w-r: PlatformResource "/> <complexType name =" SocketType "> <complexContent> <extension base =" m3w-r: PlatformResourceType "> <attribute name =" port "type =" integer "use =" required "/> </ extension> </ complexContent> </ complexType> <element name = "KeyHolder" type = "m3w-r: KeyHolderType" /> <complexType name = "KeyHolderType"> <sequence> <element name = "info" type = "dsig: KeyInfoType" /> </ sequence> </ complexType> <element name = "Principal" type = "m3w-r: PrincipalType" /> <complexType name = "PrincipalType"> <complexContent> <restriction base = "m3w -r: ObjectType "> <sequence> <choice> <element name =" Identifier "type =" anyURI "/> <element ref =" m3w-r: KeyHolder "/> </ choice> </ sequence> </ restriction> </ complexContent> </ complexType>

<element name = "AccessObject" type = "m3w-r: ObjectType" /> <element name = "PrincipalGroup" type = "m3w-r: PrincipalType" /> <element name = "AccessObjectGroup" type = "m3w-r: ObjectType "/> <element name =" Conditions "type =" m3w-r: ConditionsType "/> <complexType name =" ConditionsType "> <sequence> <element ref =" m3w-r: Condition "minOccurs =" 0 "/ > </ sequence> </ complexType> <element name = "Condition" type = "m3w-r: ConditionType" /> <complexType name = "ConditionType" /> <element name = "Size" type = "m3w-r: SizeType "substitutionGroup =" m3w-r: Condition "/> <complexType name =" SizeType "> <simpleContent> <extension base =" integer "> <attribute name =" unit "type =" m3w-r: UnitType "use = "required" /> </ extension> </ simpleContent> </ complexType> <simpleType name = "UnitType"> <restriction base = "string"> <enumeration value = "byte" /> <enumeration value = "kilobyte" / > <enumeration value = "megabyte" /> <enumeration value = "gigabyte" /> </ restriction> </ simpleType> <element name = "AccessCount" type = " m3w-r: AccessCountType "substitutionGroup =" m3w-r: Condition "/> <complexType name =" AccessCountType "> <simpleContent> <extension base =" integer "/> </ simpleContent> </ complexType> </ schema>

Meanwhile, a program or algorithm capable of providing a middleware structure for effectively managing the access right expression structure for the multimedia middleware service of the present invention can be recorded and used on a recording medium that can be mounted or mounted on a specific device. The medium can be read using a device such as a computer.

10 is a basic structure expressing a right according to the present invention using a license structure of a right expression language (REL) technology currently being used.

The REL technology currently used corresponds to MPEG-21 Part 5, which is a machine-readable type that can express various rights and permissions for content using terms defined in the Right Data Dictionary (RDD) of MPEG-21 Part 6. Right expression language. Flexibility to protect digital publications such as movies, music, e-books, and games when publishing, distributing and using them, and to use digital resources more transparently and widely, while preserving the rights, conditions, and fees specified for each content. The goal is to provide an interoperable mechanism. Based on XrML 2.0 of ContentGuard, it is a rights expression language expressing rights and usage rules related to the use and distribution of content in Extensible Generation Language (XML).

The title 1001 of FIG. 10 is a field specifying a title of a license, and a grant 1012 and a grant group 1013 indicate a user or a group of users who are permitted to use the license. This is a field to specify, issuer 1014 is a field specifying the original owner of the license, and encryptedLicense 1015 is a data structure specifying an encrypted license.

Table 2 below is a prefix and namespace definition for extending the right expression for multimedia middleware in the conventional Right Expression Language (REL) technology.

The first prefix 'r' defined in Table 2 above is a prefix for specifying the core expression of the conventional REL technology. And 'sx' is a prefix for specifying extension techniques for specifying privileges other than core expressions. And 'mx' is an extension prefix to specify the permissions associated with multimedia. In addition, 'mdx' is a prefix newly added by the present invention and is an extension prefix for specifying the authority related to the middleware.

Tables 3a and 3b are tables showing the overall structure and fields of the license of FIG. 10, and elements named mdx, which is an extended namespace for multimedia middleware, are shown in Tables 3a and 3b. Is an element newly added to the REL currently used by the present invention.

<Table 4> is a structure of an element that specifies a platform resource added to r: resource of <Table 3b>, and a description that specifies this in XML.

<Table 5> is a structure of an identifier element added to r: Resource and r: Principal of <Table 3b> and a description in XML.

Table 6 below is a structure of an open permission element added to r: right of Table 3a and a description in XML.

<Table 7> is a structure of a read permission element added to r: right of <Table 3a>, and a description that specifies this in XML.

<Table 8> is a structure of a write permission element added to r: right of <Table 3a>, and a description that specifies this in XML.

Table 9 below is a structure of a ListenSocket right element added to r: right of Table 3a and a description in XML.

Table 10 below is a structure of an access address condition element added to r: condition of <Table 3b> and a description in XML.

Table 11 below shows the structure of an accessPort condition element added to r: condition of Table 3b and a description in XML.

Table 12 below shows the structure of an accessSize condition element added to r: condition of Table 3b and a description in XML.

In another embodiment of the present invention described above, when using the REL technology that is currently being used as an authority expression language for middleware, a new prefix and a namespace can be added to the REL technology. Easily compatible Therefore, since the multimedia right expression and the middleware right expression can be used simultaneously as one right expression language, it is particularly advantageous to use the middleware for the multimedia service more effectively.

In the above description, the present invention has been described with reference to preferred embodiments, but the present invention is not necessarily limited thereto, and one of ordinary skill in the art to which the present invention pertains may have various modifications without departing from the technical spirit of the present invention. It will be readily appreciated that branch substitutions, modifications and variations are possible.

As described above, the terminal has a block for managing security in the multimedia middleware and has a mutual relationship with the block, thereby increasing security.

Claims (2)

In the security management device of the multimedia middleware in the terminal, A service manager which receives a multimedia service process and manages a query of authority and service execution; A physical service block that provides a physical service, An execution status processing unit for inspecting and processing the execution status of the service; The security management apparatus of the multimedia middleware in the terminal, comprising a security management unit for providing authorization information when authorization questions are provided and authorization information of each service is provided. In the security management method in the multimedia middleware of the terminal, Requesting a review of access rights in response to a service request, if a service request exists; Initializing a service after reviewing the access right and responding to the result; And a service handler for managing a corresponding service after initialization of the service.

Images