KR20200000576A - A Method For Detecting Counterfeit application in Mobile Device Based On Blockchain - Google Patents

Abstract

The present invention relates to a method for detecting a counterfeit mobile application based on a block chain. The method comprises: a first step of constructing a consortium block chain network consisting of trusted nodes receiving rights of verification on whether a mobile application is counterfeit and registration of a normal mobile application; a second step in which the trusted nodes verify APK files to store identification information of APK files including hash values of APK files determined to be normal in a block chain; a third step in which a client node generates a hash value of a downloaded APK file; a fourth step in which the client node transmits the generated hash value of the APK file to the consortium block chain network; a fifth step in which the trusted nodes compare whether a hash value among the stored hash values, which is equal to the received hash value, exists; and a sixth step in which the consortium block chain network transmits a comparison result of the hash value to the client node. According to the present invention, a detection and determination function for a mobile application of a normal form and a malicious counterfeit application is provided and security of a mobile terminal can be increased in using an application.

Description

A Method For Detecting Counterfeit application in Mobile Device Based On Blockchain}

The present invention relates to a mobile counterfeit app detection method, and more particularly, a hash value of a normal app is registered in a transaction in each block of a trusted node composed of authorized institutions, and recorded in a block of the app and the trusted node to be verified. The present invention relates to a technique for quickly determining whether an app is normal or fake by comparing hash values.

As the number of smartphone users exploded in recent years, the stability and security of Android platform-based applications should be improved. Most users use smart-phone applications to perform mobile financial transactions, mobile stocks, SNS, e-mail and paperwork.

In particular, since various apps are installed in the terminal, they are conveniently performing anytime, anywhere regardless of time and place. In addition, important personal information is also stored in the terminal is the most important device indispensable in modern society. However, if the Android platform-based app is built on Java, Android apps are easy to reverse engineer, so counterfeit apps can be easily produced. However, most Android platform-based smartphones currently do not provide a mechanism for determining whether a mobile app is forged.

In 2017, Google blocked about 700,000 malicious apps every year among Android apps registered in the Google Play Store. In particular, the counterfeit app, which has almost the same appearance and operation as the existing normal app, is emerging as a serious security threat because it causes problems such as leaking personal information to the outside without the knowledge of the mobile terminal user.

Online users can use online malware scanning services such as VirusTotal system to determine whether they are malicious or forged against Android apps.

If the user wants to determine whether it is malicious or not, the user accesses the online malware scanning system and uploads the file to be scanned. The online malware scanning system uses the built-in DB and the static / dynamic analysis method to normal or counterfeit the Android app. Determine whether or not and provide the result.

In the case of VirusTotal system, hash values for each app are stored internally, and the virus scanning software engine scans suspicious files using the stored hash values. VirusTotal System Performs the process of determining the presence or absence of virus for uploaded files by using up to 43 different virus scanning software. In addition, VirusTotal system performs static / dynamic analysis of Android apps to measure the similarity with malicious codes using the existing malicious app DB information and present the results.

However, in the process of using an online malware scanning service such as VirusTotal service, a file uploaded by each user is also shared with other users, so that an e-mail containing confidential corporate information is leaked. This is because the corporate security manager first uploads suspicious e-mails or files to an online malware scanning system and determines whether they are malicious. As a result, uploaded e-mail contents, etc., to determine whether or not malicious codes are shared with other users in the online malware scanning system. In addition, some security equipment is automatically linked with the online malware scanning system to reveal confidential information inside the company without a person in charge.

Recently, Android apps developed by each company are increasing, and counterfeit apps are increasing rapidly.

As a technique for checking forgery and alteration of a file using a blockchain, Korean Patent Application Publication No. 2018-0036140 has been proposed. According to the prior art, when a first user terminal uploads a file owned by the first user terminal to its terminal or an external server, calculates a hash value of the uploaded file, and registers it in the blockchain, the second user terminal may be configured as a first user terminal or After downloading the uploaded file by accessing the external server, the hash value of the downloaded file is calculated, and the file is forged or not according to the comparison result between the hash value of the file stored in the blockchain and the downloaded file. I'm trying to.

The registration of the file hash value in the prior document is calculated based on the generated blockchain address after calculating the hash value of the file to be uploaded by the user and generating the blockchain address based on the public key stored in the user terminal. The hash value of the compiled file is registered in the blockchain.

However, the preceding document is a prerequisite that the file to be uploaded by the user is an essential requirement, and when the user uploads a file which has been maliciously forged or is forged by a hacker during the upload process, the user downloads the forged file. There is a problem that you can receive.

As a similar domestic precedent document, Korean Laid-Open Patent Publication No. 2018-0030971 also has a technology of generating a transaction including a first hash value and a final hash signature value from a photographing apparatus connected to the blockchain network and transmitting the transaction to the blockchain network. This also has a problem similar to the above literature.

Therefore, there is an urgent need for the development of a technology that can effectively determine whether a forgery of a mobile application is made with the advantages of a blockchain technology having the advantage of ensuring integrity.

1. Korean Patent Application Publication No. 2018-0036140 (Invention name: File forgery test method and terminal device using the file hash value) 2. Korean Patent Application Publication No. 2018-0030971 (Invention: Photographing apparatus for generating digital image capable of forgery verification using blockchain, digital image generating method by it, and digital image verification method generated by the same)

Accordingly, the present invention was created in view of the above-described circumstances, and in order to determine whether the mobile app is normal, authorized nodes that do not depend on a specific site, such as the existing VirusTotal service, are distributed in a distributed form. Its technical purpose is to enable anyone to conveniently determine whether a forgery is a test target without risk.

In addition, after verifying the mobile app in the trusted node authorized to verify the mobile app, only the hash value of the verified mobile app is stored in the form of a blockchain so that it is possible to reliably determine whether the mobile app is forged or not. Another major purpose.

According to an aspect of the present invention for achieving the above object, the first step of configuring a consortium blockchain network consisting of trusted nodes authorized to verify the forgery of the mobile app and registration of the normal mobile app, the trust A second step in which the nodes verify APK files and store APK file identification information including a hash value of the APK file determined as normal in the blockchain, and a third step in which the client node generates a hash value of the downloaded APK file A fourth step of transmitting, by the client node, the hash value of the generated APK file to the consortium blockchain network, wherein each of the trusted nodes has a hash value equal to the received hash value among the stored hash values. A fifth step of comparing and the consortium blockchain network to compare the hash value comparison result with the client The block chain based mobile forged app detection method comprising: a sixth step of transmitting the draw is provided.

Here, the APK file identification information may include at least one of bundle identification information, app name information, and version information in addition to the hash value.

In the storing of the APK file identification information in the second step, extracting app-related basic information existing in the APK file through static analysis, generating a hash value by applying a hash function to the basic information, and The basic information and the hash value are preferably stored through the step of storing the transaction data.

The basic information related to the app may be extracted through static analysis of the AndroidManifest.xml file.

In addition, the verification target APK file in the second step may be any one of the APK files that are downloaded from the Internet or downloaded from the APK file registered in the app development company.

In the present embodiment, the consortium blockchain network uses a Hyperledger Fabric framework, key values are the bundle identification information, app name information and version information, and it is preferable to query the information registered in the blockchain using the key values. .

According to the present invention, a detection and discrimination function for a normal mobile app and a malicious counterfeit app is provided, and the use of the app can further improve the security of the mobile terminal.

1 is a block diagram of a blockchain-based mobile counterfeit app detection system according to the present invention.
2 shows a data structure of a blockchain according to the present invention.
3 illustrates a detailed blockchain connection structure of the consortium blockchain.
4 is an overall flowchart illustrating a process of performing a blockchain-based mobile counterfeit app detection method according to the present invention.
5 is a flowchart illustrating a process of verifying a mobile app and registering normal mobile app information in a consortium blockchain network.
Figure 6 shows the structure of the AndroidManifest.xml file.
7 is for explaining the extraction of mobile app identification information through static analysis from the APK file.
8 is for explaining the chaincode data structure.
9 is a program code for registering an APK file determined to be normal.
10 is a flowchart illustrating a process of verifying whether the APK file downloaded from the client node is forged.
11 illustrates a program code for querying a hash value of a verification target APK file.

Configurations shown in the embodiments and drawings described in the present invention are merely preferred embodiments of the present invention, and do not represent all of the technical idea of the present invention, the scope of the invention is the embodiments and drawings described in the text It should not be construed as limited by That is, since the embodiments may be variously modified and may have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea. In addition, the objects or effects presented in the present invention does not mean that a specific embodiment should include all or only such effects, the scope of the present invention should not be understood as being limited thereby.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. The terms defined in the dictionary used in general should be interpreted to coincide with the meanings in the context of the related art, and should not be construed as having an ideal or excessively formal meaning not explicitly defined in the present invention.

 Figure 1 shows the configuration of a blockchain-based mobile counterfeit app detection system according to the present invention, Figure 2 shows a data structure of the blockchain according to the present invention, Figure 3 is a detailed blockchain connection of the consortium blockchain The structure is shown.

As shown in FIG. 1, the blockchain-based mobile counterfeit app detection system according to the present invention includes a plurality of trusted nodes 10 and a plurality of client nodes 20.

In the present invention, the plurality of trusted nodes 10 are interconnected in the form of a consortium blockchain.

Blockchain provides a distributed ledger system using P2P networks, and blockchain technology ensures its own integrity and stability. Basically, the blockchain generates small data called 'block' as the data to be managed and is stored as distributed data in the form of a chain link created in a P2P manner. It is a distributed computing technology that no one can modify arbitrarily, and everyone can read the change.

The inventors of the present invention can provide a function that can discriminate against malicious / counterfeit apps if the blockchain technology is a technology that can prevent forgery and tampering with data, and store and manage information on a normal Android app in the blockchain. The present invention has been proposed in consideration of the fact that there will be.

Commonly used blockchain technology corresponds to the public blockchain. In the case of public blockchains, anyone can participate in the network to read, verify, and create transactions. In addition, the public blockchain uses a consensus algorithm that allows partial branching, and the processing speed is very slow.

Consortium blockchains, on the other hand, can use network membership to restrict participation. Therefore, only authorized agencies are responsible for verifying and creating transactions. In addition, the consensus algorithm also has the advantage of fast processing speed by using fast BFT (Byzantine Fault Tolerance) based algorithm without allowing partial branching.

The trusted nodes 10 verify the Android apps and store hash values of the apps determined to be normal in the blockchain form shown in FIG. 2.

In the blockchain, a plurality of blocks are connected in a chain form, and each block 30 is divided into a block header 31 and a block data 32. In the block header 31, a hash value of a previous block is stored so that the block and the block are connected in time series.

In the block header 31, information such as Merkle root, time stamp, and Nonnce are recorded in addition to the hash value as the identification information of the previous block.

The block data 32 is a portion where transaction details are recorded in transaction units whenever a transaction occurs in the transaction area.

If you use the block structure to register the information about the entire app for each transaction to determine the forgery of the mobile app, there is a high possibility that the storage space will not be utilized efficiently. Therefore, in the present invention, the hash value of the normal APK file is stored in the transaction, thereby reducing the size of the transaction and minimizing the comparison time required to determine whether the mobile app is forged or not. In this case, in addition to the hash value of the APK file, each transaction may store the name and version information of the corresponding app.

As shown in FIG. 3, the trusted nodes 10 consist only of approved institutions to form one closed blockchain. 3 illustrates a case in which four trust nodes 10 are interconnected to form a consortium blockchain. Each of the trusted nodes 10 stores hash value information of normal apps in the blockchain, and when the hash value of the inspection target APK file is received from the client node 20, the comparison result is compared with the hash value stored in the blockchain. To be transmitted to the client node 20.

If all client nodes (end users) can perform the registration process on the blockchain, counterfeit or forged applications can also be registered. In this case, the distinction between the malicious app and the normal app is blurred, and an error in which the malicious app is determined as a normal APP may occur.

 Therefore, in order to implement a mechanism that registers a normal app and compares APK files based on this, and implements a mechanism for judging whether it is a forgery, it is important to set a permission so that only an authorized agency can perform a normal app registration and verification function.

The client node 20 extracts a hash value from the APK file of the mobile app downloaded as a smart terminal of general users and transmits the hash value to the trusted nodes 10 to receive a comparison result value from each trusted node 10. When the client node 20 receives a result value indicating that the mobile app is normal from all trusted nodes, the client node 20 determines that the mobile app is a counterfeit or unmodified normal app and installs the APK file.

4 is a flowchart illustrating a process of performing a blockchain-based mobile counterfeit app detection method according to the present invention.

In FIG. 4, an operation performed by the client node is indicated by a black arrow, and an operation process for app verification and registration by an app developer is indicated in blue.

App verification and registration process (blue)

When app development company requests APK file verification to consortium blockchain network (CB), consortium blockchain network (CB) verifies whether APK file is forged based on hash values stored in blockchain and then judges it as normal. If so, register the APK file information and notify the app development company of the verification result.

Download App Validation Process on Clients (Black)

Then, the client node 20 generates a hash value of the APK file before installing the downloaded APK file, and transmits it to the consortium blockchain network (CB), and the consortium blockchain network (CB) sends the APK file. The hash value of the registered APK file is compared with the hash value of the APK file to be verified, and the result is provided to the client node 20.

The app verification and registration process and the download app verification process of the client will be described in more detail with reference to FIGS. 5 to 11 as follows.

5 is a flowchart illustrating a process of verifying a mobile app and registering normal mobile app information in a consortium blockchain network.

If the app development company (terminal) of the app is newly developed or the existing app is updated, and transmits the developed or updated APK file to the consortium blockchain network (CB) and requests verification of the APK file (S500).

Each trust node 10 constituting the consortium blockchain network (CB) extracts basic information of the app by analyzing the APK file received from the app developer (S510). Basic information of the app can be obtained through static analysis of the AndroidManifest.xml file.

The AndroidManifest.xml file is the file responsible for the configuration of the entire Android app, and serves as an application specification. In other words, AndroidManifest.xml file contains the project's configuration file (name, version, configuration, etc.).

Referring to FIG. 6 showing the structure of the AndroidManifest.xml file, information about a package name, a version code, and an app name is included.

Next, each trust node 10 verifies whether the corresponding mobile app is forged (S520).

 Each trust node 10 performs a static / dynamic analysis function for the corresponding mobile app to determine whether the mobile app is forged.

As a result of the verification, when it is determined that the app is a normal app, a hash value is generated by applying a hash function to the APK (S530). Here, the hash function is very diverse, such as MD1, MD4, MD5, SHS, SHA-1, HAS-16, HAVAL, RIMEMD-160, in this embodiment, SHA-1, which is used in representative sites that provide APK mirror files, SHA-256 was applied to the APK to generate SHA-1 and SHA-256 hash values. 7 is for explaining the extraction of mobile app identification information through static analysis from the APK file, when applying a static analysis function for KakaoTalk 7.0.5 version, bundle ID (package ID) (com.kakao.talk ), Basic information such as app name (kakaoTalk) and version information (7.0.5), and SHA-1 and SHA-256 hash values are extracted.

When two hash values are generated, previously extracted app basic information and the generated two hash values are stored in the transaction area of the block (S560). 8 illustrates a structure of chaincode data stored in a blockchain. Keys must be unique because the state is managed through the Key-Value Store in Hyperledger Fabric. In the present invention, this key consists of a bundle ID (package ID), an app name (package name), and version information. The chaincode data includes object type, bundle ID, APK package name, version information, two hash values, registration date and modification date and time.

FIG. 9 illustrates a program code in which call processing for registering an APK file determined to be normal is performed. Referring to FIG. 9, the call processing includes a chaincode ID, a function, arguments, a chain ID, and the like. Here, the function is the registration of the APK file, and the arguments include the bundle ID, APK package name, version information, and two hash values. 9, the following figure shows that the transaction registration resulted in the call processing. In other words, the app basic information and hash value of the APK file to be registered are registered in the transaction area.

If it is determined that the app is forged, the APK file is discarded.

Finally, the consortium blockchain network CB notifies the client node 20 of the verification result (S570).

As such, when the hash values of the mobile apps determined to be normal are stored in the blockchain, the client node 20 which is a general user may use the same to verify forgery and alteration of the mobile app. The explanation is as follows. 10 is a flowchart illustrating a process of verifying whether a forged APK file downloaded from a client node is forged.

The client node 20 accesses the app store through the Internet and downloads the desired APK file (S600).

Before installing the downloaded APK file, the client node 20 obtains a hash value by applying a hash function to the APK file (S610), and transmits the hash value to the trusted nodes 10 for download. Request verification for the received APK file (S620).

Each trust node 10 constituting the consortium blockchain network (CB) reads the hash values of the APK file registered as a normal app in the blockchain ledger (S630). 11 illustrates a program code for querying a hash value of a verification target APK file. The inquiry function can be used to inquire APK information registered in the call processing or to fetch information stored in the blockchain for the determination of the counterfeit app. In the inquiry process, the app basic information obtained through the static analysis is used as a kit value, and information recorded in the chaincode data is inquired.

Each trust node 10 checks whether the same hash value exists by comparing the hash values of each normal app and the hash value of the APK file downloaded by the user (S640).

The consortium blockchain network (CB) determines whether the app is a normal app or a counterfeit or tampering threat as a result of the presence or absence, and notifies the client node 20 of the result (S650).

The client node 20 displays the determination result of the consortium blockchain network (CB) on the screen or expresses it to the user through sound (S660).

The user checks the determination result provided by the client node 20, that is, the terminal, installs the corresponding APK when it is determined to be a normal app (S670), and deletes the corresponding APK file when the corresponding app is determined to be forged ( S680).

In the above, when an app developer requests an app verification, the trusted node verifies whether the app is normal.In addition, each trusted institution downloads an app uploaded to an app store such as the Play Store, and directly verifies the app. It is also possible to register the hash value of the app that turns out to be normal in the transaction.

CB: Consortium Blockchain
10: trusted node 20: client node
30: block 31: block header
32: block data

Claims (7)

A first step of constructing a consortium blockchain network composed of trusted nodes authorized to verify forgery of the mobile app and to register a normal mobile app;
A second step in which the trusted nodes verify APK files and store APK file identification information including a hash value of the APK file determined as normal in the blockchain;
Generating a hash value of the APK file downloaded by the client node;
Transmitting, by the client node, a hash value of the generated APK file to the consortium blockchain network;
A fifth step of comparing each of the trusted nodes with a hash value equal to the received hash value among the stored hash values; And
And a sixth step of sending, by the consortium blockchain network, the hash value comparison result to the client node.
The method of claim 1,
The APK file identification information includes at least one of bundle identification information, app name information, and version information in addition to the hash value.
The method of claim 2,
The storing of the APK file identification information in the second step,
Extracting app-related basic information existing in the APK file through static analysis;
Generating a hash value by applying a hash function to the basic information; And
Blockchain-based mobile counterfeit app detection method characterized in that through the step of storing the basic information and the hash value as transaction data.
The method of claim 3,
The app-related basic information is a blockchain-based mobile counterfeit app detection method, characterized in that extracted through static analysis of the AndroidManifest.xml file.
The method of claim 1,
In the second step, the verification target APK file is a blockchain-based mobile counterfeit app detection method, characterized in that the APK file downloaded from the Internet or requested to be verified by the app development company.
The method of claim 1,
The consortium blockchain network uses a Hyperledger Fabric framework, and key values are the bundle identification information, the app name information, and the version information.
The method of claim 6,
Blockchain-based mobile counterfeit app detection method, characterized in that for querying the information registered in the blockchain using the key value.

Images