KR20170040945A - Web resource security method for hybrid application, and computer-readable recording medium with program for the same - Google Patents

Abstract

A web resource security method for a hybrid application including a web resource unit, a native plug-in unit, and an HTML rendering engine unit according to the present invention comprises the following steps of: storing encrypted source information in the web resource unit; and reading the encrypted source information corresponding to requested source information when a local web server included in the hybrid application is required for the source information stored in the web resource unit from the HTML rendering engine unit, and decrypting the read, encrypted source information to return the same to the HTML rendering engine unit. The local web server performs interface between the HTML rendering engine unit and the web resource unit, and the encrypted source information is a resource for constituting a web page.

Description

Technical Field [0001] The present invention relates to a Web resource security method for a hybrid application, and a computer readable recording medium storing a program for executing the method,

The present invention relates to a hybrid application, and more particularly, to a hybrid application, in which source information of a hybrid application is encrypted and stored in an encrypted web resource unit, and the local web server encrypts the encryption information requested by a Hypertext Markup Language (HTML) Readable and readable only by the source information and providing it to the HTML rendering engine so as to protect the source information of the hybrid application from routing or jailbreak. To a recording medium on which the recording medium can be recorded.

In general, a hybrid application (App) makes a Web service available in a mobile application, and is a method of coexisting with a web that evolves into an information platform including an existing application and OS. These hybrid applications are a compromise between a mobile web-based implementation that allows content to be written across multiple mobile platforms and a mobile application development approach that maximizes the unique characteristics of mobile devices.

In other words, it is called hybrid web or hybrid application that introduces a development method that deals with information by applying web technology such as JavaScript, HTML5, CSS3 inside general application.

As described above, the hybrid application is an application developed by embodying an internal structure and a user interface through a web technology and implementing a unique function of a mobile device such as a camera or a sensor operation as an app, This is because it has the advantage of being able to update in real time on the same web as the web, and because it can be managed only by knowledge of the web, it is very efficient in terms of operation.

FIG. 1 shows a structure of a conventional hybrid application. The hybrid application 100 is implemented on a mobile OS 200. FIG. The hybrid application 100 includes an HTML rendering engine (web view) 102, a web resource unit 106, and a native plug-in unit 104. The HTML rendering engine unit 102 includes OS APIs 108 Is connected to the mobile OS 200 via the HTML / JS APIs 110 and is connected to the web resource unit 106 through the HTML / JS APIs 110 and is connected to the native plugin unit 104 through the native APIs 112.

The web resource unit 106 includes source information such as HTML information 116, javascript information 118, css information 120, and image information 122.

The native plug-in 104 is composed of functional units for realizing functions of a mobile device. This native plug-in 104 is connected to the mobile OS 200 via the OS APIs 114.

The mobile OS 200 includes an input processor 202, a service processor 204, a graphic processor 206 and a sensor processor 208.

The hybrid application requires the source information of the web resource part as a plain text in the HTML / JS interface according to the Web standard technology. Accordingly, the source information stored in the web resource unit is stored in a plain text form even when the source information is stored in the storage space of the terminal. Accordingly, there is a problem that the source information may be exposed due to routing or jailbreak by a malicious user.

More specifically, the source information of the hybrid application includes not only information for web connection but also information for services that need to be kept confidential such as finance or payment. However, as described above, the hybrid application is easily exposed by simple routing or jailbreak, and thus the source information can not be protected from the malicious user.

Korean Patent Publication No. 1020140017864 Korean Patent Publication No. 1020140026815 Korean Patent Publication No. 1020130017337 Korean Patent Publication No. 1020130082810

The present invention stores encrypted source information of a hybrid application in an encrypted web resource unit, and the local web server reads and decrypts only the encrypted source information requested by the HTML rendering engine (web view) and provides it to the HTML rendering engine, It is an object of the present invention to provide a computer readable recording medium storing a program for executing a method of security of a web resource of a hybrid application capable of protecting source information of a hybrid application from routing or jailbreak and a method therefor.

According to another aspect of the present invention, there is provided a method of securing a web resource of a hybrid application including a web resource unit, a native plugin unit, and an HTML rendering engine unit, the method comprising: storing encrypted source information in the web resource unit; And when a local web server included in the hybrid application receives a request for source information stored in the web resource unit from the HTML rendering engine unit, it reads the encrypted source information corresponding to the requested source information, Decrypting the source information and returning the decoded source information to the HTML rendering engine unit, wherein the local web server implements an interface between the HTML rendering engine unit and the web resource unit, and the encrypted source information constitutes a web page And is a resource for doing so.

The present invention differs from the conventional data format in which the source information of the hybrid application is stored only in plain text. The source information of the hybrid application is encrypted and stored in the encrypted web resource unit, It is possible to prevent the source information of the hybrid application from being routed or jailbreak by allowing only the encrypted source information requested by the view to be read and decoded to be provided to the HTML rendering engine and the temporary file including the plain text can be excluded have.

1 is a structural view of a conventional hybrid application.
2 is a structural view of a hybrid application according to a preferred embodiment of the present invention.
FIG. 3 through FIG. 5 illustrate processing of a local web server of a hybrid application according to a preferred embodiment of the present invention.

The present invention stores encrypted source information of a hybrid application in an encrypted web resource unit, and the local web server reads and decrypts only the encrypted source information requested by the HTML rendering engine (web view) and provides it to the HTML rendering engine, Protects the source information of the hybrid application from routing or jailbreak.

The Web resource security method of the hybrid application of the present invention will be described in detail with reference to the drawings.

<Hybrid Application Structure>

A hybrid application structure according to a preferred embodiment of the present invention will be described with reference to FIG.

The hybrid application 300 includes an HTML rendering engine unit 302, an encrypted web resource unit 304, a native plugin unit 306, a local web server 308, and a plurality of APIs 310, 312, 336, 338 and 340.

The mobile OS 200 includes an input processing unit 202, a service processing unit 204, a graphic processing unit 206, a sensor processing unit 208, and the like. The input processing unit 202 receives and processes data from a screen, and the service processing unit 204 is not a component that interacts with a user, but is a component operating in the background. That is, the processing is performed so that the application can be operated even when the application is terminated. The graphic processing unit 206 images and displays data to be displayed to guide the user. The sensor processing unit 208 processes data such as an accelerometer, a magnetic field, and a touch sensor included in the mobile device.

The HTML rendering engine unit 302 of the hybrid application 300 transmits the source information stored in the encrypted web resource unit 304 to the local web server 304 in response to a request from the mobile OS 200 or the native plug- 308 and provides the decrypted source information provided by the local web server 308 to view the content according to the decrypted source information on the screen. The HTML rendering engine unit 302 is connected to the mobile OS 400 and the OS APIs 336. The HTML rendering engine unit 302 is connected to the local web server 308 and the decoded HTML / LJS APIs 310, 306 and the native APIs 340.

The encrypted web resource unit 304 encodes and stores HTML information 314 and image information 320, CSS information 318 and JavaScript information 316 and the like, Lt; / RTI &gt; As described above, the present invention can protect source information even if routing or jailbreak occurs by encrypting source information.

The local web server 308 provides an HTML / JS interface function with the HTML rendering engine unit 302. The local web server 308 encrypts the encrypted web resource 304 in the encrypted web resource unit 304 in response to a request from the HTML rendering engine unit 302. [ Reads the source information, decrypts the encrypted source information, and provides the decrypted source information to the HTML rendering engine unit 302. To this end, the local web server 308 is connected to the HTML rendering engine unit 302 through the decoded HTML / JS APIs 310. The encrypted HTML / JS APIs 312 are encrypted with the encrypted web resource unit 304, Lt; / RTI &gt;

The native plug-in unit 306 includes a variety of functional units for executing a hybrid application. The functional units include an accelerometer 322, a camera 324, a compass 326, a custom plug-ins 328, a geolocation 330 media 332, network 334, and so on. The accelerometer 322 processes necessary data using an acceleration sensor of the device and transmits the processed data to the HTML rendering engine unit 302. The camera 324 controls the camera of the device. The compass 326 performs a compass function using the magnetic sensor of the device. The custom plug-ins 328 is a collection of functions that developers can separately create native plug-ins to control devices, in addition to the functions provided by native plug-ins. The geolocation 330 performs a function of searching for a current location by latitude and longitude using a GPS (Global Positioning System) of the device. The media 332 functions to utilize images, moving pictures, audio, etc. stored in the device. The network 334 performs communication between the server and the client and between the client and the client using the communication module of the device. These functional units are selectively employed according to the configuration of the hybrid application. The native plug-in unit 306 is connected to the HTML rendering engine unit 302 through the native APIs 340 and is connected to the OS 200 through the encrypted OS APIs 312.

The present invention is performed by the local web server 308, which is an intermediary medium, without the HTML rendering engine 302 directly participating in the HTML / JS interface function. The local web server 308 takes charge of the HTML / JS interface, temporarily decodes only the source information requested by the HTML rendering engine unit 302 among the source information of the encrypted web resource unit 304, (302). Since the encrypted source information stored in the encrypted web resource unit 304 is decrypted and transferred to the memory representing the web view temporarily, it is stored in the storage space of the terminal which can be checked through routing or jailbreak Do not. Thus, the present invention can protect the source information stored in the web resource unit.

Now, an example in which the operation of the local web server 308 applied to the process of the hybrid application is applied will be described.

<Major Implementation Process>

First, the main execution process of the hybrid application 300 according to the preferred embodiment of the present invention will be described with reference to FIG.

The HTML rendering engine unit 302 requests the local web server 402 for source information necessary for performing the function of the hybrid application 300 (operation 400). In response to the request, the local web server 308 reads and decrypts the requested encrypted source information out of the encrypted source information stored in the encrypted web resource 304, and outputs the encrypted source information to the HTML rendering engine 302 (402 step). The HTML rendering engine 302 receives the decoded source information and performs parsing to generate a DOM (Document Object Model) tree (operation 404). The HTML rendering engine unit 302 generates a render tree from the DOM tree (step 406). The HTML rendering engine unit 302 implements a style resolution to generate a render style from the render tree (step 408). Then, the HTML rendering engine unit 302 generates layouts and line boxes, which are layout information, from the render style (step 410). The HTML rendering engine unit 302 performs painting according to the layer and line boxes (step 412).

<HTML processing>

The HTML process of the hybrid application 300 according to the preferred embodiment of the present invention will be described with reference to FIG.

When the encrypted source information is loaded from the encrypted web resource 304 in step 500, the local web server 308 decrypts the encrypted source information and outputs the decrypted source information to the HTML rendering engine 302 ). The decoded source information is HTML information. The HTML rendering engine 302 receives the decoded source information and performs HTML processing in step 504. This HTML processing process can be divided into an HTML document as an HTML HTML element, a HTML HTML element as an HTML body element, an HTML body element as an HTML div element and an HTML paragraph element, a HTML div element as an HTML image element, To text.

<Process of JavaScript processing>

The JavaScript processing procedure of the hybrid application 300 according to the preferred embodiment of the present invention will now be described with reference to FIG.

In response to a request from a multimedia thread, a JS worker thread, a network thread, a geolocation, or the like, the local web server 308 sends a request to the local web server 308 of the main loop 600 of the web kit main thread, (Step 602). In response to the request, the local web server 308 reads the corresponding source information from the encrypted web resource unit 304, decrypts it, and returns it to the webkit main thread. Here, the decoded source information is JavaScript information. In step 608, the web kit main thread receives and parses the decrypted source information in step 606, and executes JavaScript according to the parsed result in step 608. In step 612, the web kit main thread generates a render tree according to the JavaScript execution result (step 610), and executes style resolution to generate a render style according to the render tree (step 612). In step 614, the web kit main thread receives the render style and generates layout information, layers, and line boxes. The web kit main thread transitions the painting according to the layer and line boxes (step 616).

Here, we will talk more about multimedia threads, JS worker threads, network threads, and geolocation. While the screen is being rendered, it can take a long time to work, a very busy mathematical computation task, access to resources at a remote location (or access to a local store), a long time in the background , It uses various types of threads to perform tasks such as continuous execution without disturbing the UI thread.

Among the various types of threads, the multimedia thread performs functions such as reading and playing data such as image, moving picture, voice, and the like, and the JS worker thread processes in the background for long tasks in the JavaScript task. The network thread performs a function of exchanging data between the server and the client and between the client and the client by utilizing the communication module of the device. The geo-location uses the GPS of the device to retrieve the current location by latitude and longitude .

300: Hybrid application
302: HTML rendering engine unit
304: Encrypted Web resource part
306: Native plugin part
308: Local Web server

Claims (4)

A Web resource security method of a hybrid application including a Web resource unit, a native plugin unit, and an HTML rendering engine unit,
Storing encrypted source information in the web resource unit; And
When a local web server included in the hybrid application receives a request for source information stored in the web resource unit from the HTML rendering engine unit, it reads the encrypted source information corresponding to the requested source information, Decrypting the information and returning the information to the HTML rendering engine unit,
The local web server performs an interface between the HTML rendering engine unit and the web resource unit,
Wherein the encrypted source information is a resource for configuring a web page. The method according to claim 1,
The HTML rendering engine generates and parses the decoded source information to generate a DOM tree, generates a render tree from the DOM tree, and executes style resolution according to the render tree to generate a render style, Generating layout information according to the layout information, and performing painting according to the layout information,
Wherein the source information is HTML information. The method according to claim 1,
The HTML rendering engine unit receives the decoded source information and parses it to execute a Java script, generates a render tree from the execution result, and performs style resolution according to the render tree to generate a render style, Generating layout information according to the layout information, and performing painting according to the layout information,
Wherein the source information is JavaScript information. A computer-readable recording medium having recorded thereon a program for executing each step of a web resource security method of a hybrid application according to any one of claims 1 to 3.

Images