KR20140044974A - Method of enhancing security based on permission detection for android applications, and computer-readable recording medium with android security program based on permission detection for the same - Google Patents

Abstract

The present invention relates to a technique to enhance security based on the permission detection for Android applications in the Android operating system and, more specifically, to a technique to enhance security based on the permission detection for Android applications, which is capable of detecting the existence of malicious codes (for example, security attacks such as a malicious program, debugging or hooking) by detecting elevated rights of an administrator of the Android operation system such that an application, such as a financial program (for example, a banking application and a stock application), which requires a high level of security, can be operated in a safe environment in the Android operation system. According to the present invention, it is possible to secure a high level of security for a financial program (for example, a banking application and a stock application) and to further flexibly deal with the debugging or hooking attacks by an unknown malicious code by detecting malicious codes through the permission detection. [Reference numerals] (AA) Start; (BB) End; (S31) Read a file directory; (S32) Read file property information; (S33) Does the readout succeed?; (S34) Is elevation of rights possible?; (S35) Determine that a file has a potential security risk and process security therefor; (S41) Check whether a folder is a directory, of which readout is prohibited, as system default; (S42) Check whether the folder has execution rights; (S43) Determine that a file having a potential security risk is hidden or a file system is changed and process security for the folder

Description

METHOD OF ENHANCING SECURITY BASED ON PERMISSION DETECTION FOR ANDROID APPLICATIONS, AND COMPUTER-READABLE RECORDING MEDIUM WITH ANDROID SECURITY PROGRAM BASED ON PERMISSION DETECTION FOR THE SAME}

The present invention relates to an application security enhancement technology based on permission detection in the Android operating system. More specifically, the present invention detects an increase in the administrator's authority of the Android operating system in order to enable a highly secure application such as a financial program (eg, banking application, securities application) in the Android operating system to operate in a safe environment. The present invention relates to a security enhancement technology based on permission detection that detects the presence of malicious code (eg, malicious programs, security attacks such as debugging or hooking).

FIG. 1 is a diagram illustrating a conventional method of detecting a rootable program by inspecting a file system based on an Android operating system. Referring to FIG. 1, if the prior art method finds a malicious program (eg, 'su') that enables rooting by searching a specific location or the entire file system of an Android operating system-based file system, We took a warning and stopped the security application.

The prior art method as shown in FIG. 1 is a method of analyzing a known routing program and checking whether a corresponding file exists at a hidden location. However, recently, the intelligent malicious application has a problem that it is impossible to perform a complete inspection in the prior art method because the file is encrypted to prevent access or hide it in a difficult place to find a security application.

Accordingly, in the technical field, there is an urgent need for technology development to prevent the unknown routing attempt by a malicious program after the security application is executed.

[Related Technical Literature]

1. Application data security method installed on a mobile terminal (Patent Application No. 10-2012-0017716)

2. Mobile terminal with its own security function and its security strengthening method (Patent Application No. 10-2011-0032328)

It is an object of the present invention to securely execute an application (eg, various financial transaction applications such as banking applications and securities applications) that require high security in consideration of the fact that various financial transactions are recently made in an Android terminal. It is to provide technology.

In addition, an object of the present invention is to detect the increase in the administrator's authority of the Android operating system to ensure the safe execution of financial transaction applications (eg banking applications, securities applications) on the Android terminal, such as malware (eg malware, debugging or hooking) It is to provide security enhancement technology based on authorization detection to detect the presence of security attacks, etc.).

In addition, the object of the present invention is to determine in advance whether the Android operating system is operating in a safe environment as a whole before running the Android application, and to detect the safety in real time even while the Android application is running to prevent damage caused by malware It is to provide detection-based Android application security enhancement technology.

The present invention for achieving this problem is a method for enhancing the security of the Android application based on the authorization detection in the user terminal based on the Android operating system, security risks that have previously obtained administrator authority through the elevation of privileges among applications currently running on the user terminal Detecting a application and executing a predetermined security process accordingly; Detecting, by the user terminal, a potential security risk file having an attribute capable of obtaining administrator authority and accordingly executing a preset security process; And detecting a potential security risk file concealed by the user terminal and a file system change of the Android operating system and executing a preset security process accordingly.

In the Android application security enhanced method according to the present invention, the first step includes: obtaining the entire process list from the process directory of the user terminal; Obtaining application attribute information from the entire process list; Recognizing an application that has previously obtained administrator authority by referring to the application attribute information; Collecting an application which does not correspond to an application having administrator authority as an Android system default among the recognized applications, and identifying the application as a security risk application; And executing a predetermined security process for the security risk application.

In addition, the second step in the Android application security enhanced method according to the invention, the step of reading the file attribute information for the file; Determining, from the file attribute information, whether the file has an attribute capable of obtaining administrator authority at execution time; If it is determined that the administrator has the property to obtain authority, identifying as a potential security risk file; Executing preset security processing on the identified potential security risk file; Determining that the file failed to read the attribute information is prohibited from being read by the Android system default when the file attribute information has failed to be read; Determining whether execution permission is set in a folder of a file; As a result of the determination, determining that there is a potential security risk when the file that fails to read the attribute information is not prohibited from being read by the Android system default and the execution authority is set in the folder of the file; And executing a predetermined security process on a folder of the file.

At this time, whether the file has an attribute for obtaining administrator authority at the time of execution may be performed by checking whether the st_mode member of the stat structure provided by the Android operating system has a super permission.

On the other hand, the computer-readable recording medium according to the present invention records the Android security program based on the authority detection for executing the above-described method of strengthening the application security.

According to the present invention, there is an advantage of ensuring high security for a financial program (for example, a banking application or a stock application) in an Android terminal. In addition, according to the present invention there is an advantage that the security program can flexibly respond to the debugging or hooking attacks by unknown malware to detect malware through the administrator authority detection of the Android operating system.

1 is a diagram of a prior art method for detecting if a rootable program exists in the Android operating system.
2 is a diagram showing the configuration of a user terminal that is implemented based on the authorization detection Android application security enhancement method according to the present invention.
3 and 4 are flowcharts conceptually illustrating a method for strengthening security based on authorization detection according to the present invention.
FIG. 5 is a flowchart specifically illustrating a process of detecting a security risk application that has obtained administrator rights in the present invention. FIG.
6 is a flowchart specifically illustrating a process of detecting a potential security risk file and a file system change in the present invention.
7 is a view showing an example of a program source code for detecting a security risk application in the present invention.
8 is a view showing an example of program source code for detecting a potential security risk file and file system change in the present invention.
9 is a view showing an example of a directory entry without read permission and only execute permission in the Android operating system.

Hereinafter, the present invention will be described in detail with reference to the drawings.

2 is a diagram illustrating an internal configuration of a user terminal 10 in which an authorization detection-based Android application security strengthening method according to the present invention is implemented. Referring to FIG. 2, the user terminal 10 includes a transceiver 11, an I / O interface 12, a central controller 13, a security processing module 14, an input / output unit 15, and a storage unit 16. And a system memory 17, wherein the security processing module 14 includes a rights risk detection means 14a and a potential rights risk detection means 14b. In general, the user terminal 10 is formed of a smartphone or a smart pad.

Hereinafter, the security processing module 14 of the user terminal 10 will be described in detail with respect to an Android application security enhancement method based on permission detection according to the technical idea of the present invention.

3 and 4 are an overall flowchart illustrating a method for strengthening security of an android application based on permission detection according to the present invention.

2 to 4, the authority risk detection means 14a of the security processing module 14 checks the currently running applications through the entire process list and has already obtained and executed the administrator authority. The security risk application is detected and secured (S20).

After step S20, the potential authority risk detection means 14b of the security processing module 14 detects a potential security risk file having attributes capable of obtaining administrator authority by inspecting the entire Android file system stored in the storage unit 16. Process to secure (S30). In this case, it is efficient to check the files related to the application already secured in step S20 from the beginning. That is, the potential authority risk detection means 14b examines an application file that has not yet been executed from the entire file system of the Android operating system but has a possibility (potential) of gaining administrator authority if executed in the future.

Subsequent to step S30 (implementation scheme of [FIG. 3]) or simultaneously (implementation scheme of [FIG. 4]), the potential authority risk detection means 14b of the security processing module 14 is detected earlier in step S30. While detecting potential hidden security risk files that are not hidden, it is checked whether a change to the file system of the Android operating system has been made through firmware replacement, etc., and in this case, security processing is performed.

The security risks (potential security risks) detected in the steps S20, S30, and S40 are thus security-processed. Security processing in the present invention means applying a process for preventing debugging or hooking for the application related to the detected security risk. Security processing to prevent debugging or hooking for a particular Android application is already known in the prior art, so the detailed description thereof is omitted herein.

FIG. 5 is a flowchart specifically illustrating a process of detecting a security risk application that has previously obtained administrator authority among security detection-based Android application security methods shown in FIGS. 3 and 4, and FIG. FIG. 7 is a diagram illustrating an example of a program source code for detecting a security risk application that is obtained by obtaining administrator authority in the present invention.

The authority risk detection means 14a of the security processing module 14 acquires an administrator's authority from among Android applications, first obtains a list of all currently running processes, and then, among them, the privilege is elevated. Checks if an unknown process is running that is a process and not applicable to the Android default processes (/ init, / sbin / ueventd, / system / bin / void, / system / bin / netd, / system / bin / installd, zvgote, etc.). .

To this end, the authority risk detection means 14a browses the process directory for the currently running application (S21).

After step S21, the permission risk detection means 14a performs attribute information on the application file stored in the process directory (for example, PID (Process ID), Type (TYPE), Name (NAME), Mode (MODE), UID ( User ID)] (S22). In the Android operating system, various attribute information (PID, type, name, mode, UID) are defined and used, and each step of the present invention utilizes necessary information among them. Whether to read all the attribute information or only the information necessary for each step is a matter that can be arbitrarily selected according to the designer's intention.

After step S22, the authority risk detection means 14a checks whether the UID value is 0 among the attribute information of the application file, in particular (S23). This is because it is an application (root application) that has a. If the UID value is not 0 in step S23, no further review is required for the application file. However, when the UID value other than 0 is set for the root application or when the operating system is designed to additionally set a value other than 0, the determination of step S23 may be changed to adapt thereto.

After step S23, the authority risk detection means 14a determines whether the administrator authority application having the UID value of 0 is the system default, that is, the application originally set to UID = 0 in the Android operating system (S24). Again, if the UID value is set to 0 by default by the Android operating system in step S24, no further review is required for the application file.

If it is determined in step S24 that the system is not the default, the authority risk detecting means 14a determines that the application is an elevated application (security risk application) and extracts it (S25).

After step S25, the authority risk detection means 14a determines whether the end of file (EOF) has been reached, that is, whether the review of all applications stored in the process directory has been completed (S26).

As a result, if the EOF is reached, the authority risk detecting means 14a ends the process of step S20 and proceeds to step S30. On the contrary, if the EOF has not yet been reached, the authority risk detection means 14a returns to step S22 to determine whether the application is a security risk application by applying the process of steps S22 to S25 for the next application. Do this.

[FIG. 6] is a flowchart showing the process (S30, S40) of detecting potential security risk file and file system change in the present invention shown in [FIG. 3] and [FIG. 4], [FIG. 8] is such a potential security A diagram showing an example of a program source code for detecting a dangerous file and a file system change.

In the present invention with reference to FIGS. 2 to 6 and the process of detecting the application file having the possibility (potential) to obtain the administrator authority (Spotential) to perform a security process (S31 to S36) and file system The security process (S41 to S42) to be performed at the time of change will be described integrally.

The potential authority risk detection means 14b of the security processing module 14 scans the entire file system of the Android operating system and checks whether each application file has an attribute to obtain administrator authority when it is executed in the future. These files are detected because of the potential for security risks.

In the process, if there is a case where the inside of the directory cannot be checked because the read permission is not set for the checking directory, the potential permission risk detection means 14b is executed without the directory that the Android operating system forbids by default. The folder in which the permission is set is regarded as hiding application files that can obtain the administrator's authority or the operating system's file system is changed, which means that security processing is executed.

To this end, the potential authority risk detection means 14b browses the entire file system (file directory) of the Android system (S31).

After step S31, the potential authority risk detection means 14b examines the file items one by one from the file directory, and attempts to read the attribute information for the file to be inspected (i.e., unauthorized file) (S32). In this case, optionally, step S32 may be configured to be performed to exclude files related to the security risk application detected in step S25 of FIG. 5.

According to step S32, the potential authority risk detection means 14b determines whether or not the attribution information reading according to step S32 is successful (S33).

If the attribute information reading succeeds as a result of the determination in step S33, the potential authority risk detection means 14b can determine whether there is a possibility of elevation of privilege when the file is executed in the future, that is, if it is executed, can obtain administrator authority. It is determined whether or not having an attribute (S34). In this case, whether or not a particular file may acquire an administrator authority in the future may be checked by checking the st_mode member having various mode information of directories / files in the stat structure provided by the Android operating system. That is, it is possible to check whether the st_mode member of a specific file has super permission permission. In the Android operating system, a file with super permission permission should not exist.

If it is determined in step S34 that the test file has an attribute capable of obtaining administrator authority through future elevation, the potential authority risk detection means 14b determines the file as a potential security risk file. According to the security process (S35).

On the other hand, if the reading of the attribute information fails as a result of the determination in step S33, that is, when the authority to read the attribute information has not been obtained for the application, the read-attempt folder corresponds to a directory prohibited from being read by the system default in the Android operating system. It is checked whether or not (S41).

As a result of the determination in step S41, if the system corresponds to a directory whose reading is prohibited, no further examination is required for the application. In the Android operating system, some directories (hidden directories) that are prohibited to be read for system protection purposes are set even under normal circumstances.

On the contrary, if the directory is not prohibited to read by the system default, it is further checked whether the folder has execution permission (S42). You can also check whether a folder has execute permission from the st_mode member of the stat structure provided by the Android operating system. That is, in step S42, a directory in which the other permission has no read permission but the execution permission is detected in the entire directory list. FIG. 9 illustrates an example of a directory entry without read permission and only execute permission.

As a result of the determination in step S42, if the folder does not have execution authority, no further review is required for the application. On the contrary, in the case of the folder having the execution right, it is determined that the potential security risk file is hidden in the folder or the file system has been changed, and then security processing is performed on the folder (S43). In other words, it is determined that there is a potential security risk in this case.

After the steps S35 and S43, the potential authority risk detection means 14b determines whether the EOF has been reached, that is, whether the review of all applications stored in the file directory has been completed (S36).

As a result, if the EOF is reached, the potential authority risk detection means 14b ends the security process. On the contrary, if the EOF has not yet been reached, the potential authority risk detection means 14b returns to step S32 to apply the security process according to steps S32 to S43 for the next application.

The present invention can also be embodied in the form of computer readable code on a computer readable recording medium. At this time, the computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage, and the like, and may be implemented in the form of a carrier wave . The computer-readable recording medium can also be stored and executed by a computer-readable code in a distributed manner on a networked computer system. And functional programs, codes, and code segments for implementing the present invention can be easily deduced by programmers skilled in the art to which the present invention belongs.

As described above, the embodiments of the present invention have been disclosed in the present specification and drawings, and although specific terms have been used, they have been used only in a general sense to easily describe the technical contents of the present invention and to facilitate understanding of the invention. And is not intended to limit the scope of the invention. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

10: User terminal
11: Transmitting /
12: I / O Interface
13: central control unit
14: security processing module
14a: Authority risk detection means
14b: Potential Rights Risk Detection
15: Input /
16:

Claims (6)

As a method for enhancing Android application security based on authorization detection in a user terminal based on the Android operating system,
A first step of detecting a security risk application that has previously obtained the administrator's authority through an elevation of an application among applications currently running in the user terminal and executing a preset security process accordingly;
A second step of detecting a potential security risk file having an attribute capable of obtaining administrator authority in the user terminal and executing a preset security process accordingly;
A third step of detecting a potential security risk file and a file system change of an Android operating system concealed at the user terminal and executing a preset security process accordingly;
Android application security enhancement method based on the permission detection is configured to include.
The method according to claim 1,
In the first step,
Obtaining a complete process list from the process directory of the user terminal;
Obtaining application attribute information from the entire process list;
Recognizing an application that has previously obtained administrator authority by referring to the application attribute information;
Collecting an application that does not correspond to an application having administrator authority as an Android system default among the recognized applications, and identifying the application as a security risk application;
Executing a preset security process for the security risk application;
Authorization detection-based Android application security strengthening method, characterized in that comprises a.
The method according to claim 2,
The second step comprises:
Identifying a file of an entire Android file system from a file directory of the user terminal;
Reading file attribute information for the file;
Determining, from the file attribute information, whether the file has an attribute capable of obtaining an administrator right when executed;
Identifying as a potential security risk file when the determination result has an attribute capable of obtaining administrator authority;
Executing preset security processing on the identified potential security risk file;
Authorization detection based Android application security enhancement method, characterized in that configured to include.
The method of claim 3,
The second step comprises:
If the file attribute information reading fails, determining whether the file that fails to read the attribute information is prohibited from being read by the Android system default;
Determining whether an execution right is set in a folder of the file;
Determining that a potential security risk exists when a file that fails to read the attribute information is not prohibited from being read by the Android system default and execution rights are set in a folder of the file;
Executing a preset security process on the folder of the file;
Authorization detection based Android application security enhancement method, characterized in that further comprises a.
The method of claim 3,
Determining whether the file has an attribute for obtaining administrator authority at execution time is performed by checking whether the st_mode member of the stat structure provided by the Android operating system has a super permission. How to strengthen security.
A computer-readable recording medium having recorded an authorization security-based Android security program for executing the application security strengthening method according to any one of claims 1 to 5.

Images