KR20200006841A - Communication terminal and method for providing security when foreground service of application is running - Google Patents

Abstract

Disclosed are a method for providing security by preventing an attack by a malicious script when a foreground service of an application is executed on an operating system such as Android and a communication terminal therefor. According to an aspect of the present invention, the communication terminal comprises: a memory for storing programs; and a processor coupled with the memory to execute the programs. The programs include a foreground service control module which transmits, on detection of a clear all input to terminate all recently launched applications from a user at once, a foreground service shutdown command to at least one application that is currently running in a background and can be terminated through a status bar.

Description

COMMUNICATION TERMINAL AND METHOD FOR PROVIDING SECURITY WHEN FOREGROUND SERVICE OF APPLICATION IS RUNNING

The present invention relates to a foreground service technology of an application on an operating system such as Android, and more particularly, to a method for providing security when a foreground service of an application is executed on an operating system such as Android, and a communication terminal therefor. .

Recently, with the development of digital technology, various types of communication terminals such as mobile communication terminals, PDAs (Personal Digital Assistants), electronic notebooks, smart phones, tablet PCs, and wearable devices have been widely used. Such a communication terminal may be a voice call, a message transmission such as SMS (Short Message Service) / MMS (Multimedia Message Service), a video call, an electronic notebook, photographing, an e-mail transmission, a broadcast play, the Internet, a music play, a schedule management, a social network Various functions such as social networking service (SNS), messenger, dictionary, game, etc. are provided.

Representative operating systems of the current communication terminal include Android (Android) and IOS. The Android operating system was developed by Google and supports downloading and installing applications from the Google App Store. These applications provide their own user interface (UI) and at the same time support the display of Web pages like a browser. The Android operating system is tightly coupled with its own communication terminal, providing a user experience such as push, background services, and foreground services. The background service is a service that the user does not recognize that something is currently running, and the foreground service is a service that the user knows that something is currently running.

The recently released version of Android O forces the background service to be restricted to improve the battery life problem. In other words, all existing background services have been switched to the foreground service so that the user should be informed via the status bar at the top that the foreground service is running. The user has been forced to shut down the foreground service from the status bar at the top. In other words, if a screen is not displayed on the display and is running in the background, it is called a background service. However, even if the screen is not displayed on the display, the status bar indicates that the service is running. It is defined as a foreground service.

As such, the foreground service running in the background and notifying it via the status bar can only be terminated through the status bar. That is, in the communication terminal of the Android operating system, pressing the menu at the bottom left brings up a list of recently executed applications, and pressing 'Clear All' allows all tasks of the recently executed application to be deleted and terminated. Foreground services that say they are running must not be terminated via 'Erase All', but only through the status bar. In other words, you must shut down the foreground service individually after lowering the status bar. 6 is a screen for notifying the foreground service when the status bar is lowered.

These characteristics can be targeted by hackers. For example, when an application displays a web page, the web page is not normally displayed and a blank page occurs. This can happen if the application did not receive the data, if the cookie is not normal information, due to the inflow of incorrect data, or by accessing a URL containing malicious script. In this way, the application continues to maintain a web connection even when a blank page occurs. When such an error occurs, users who use a smartphone generally terminate the application through the 'Erase All' menu rather than closing the application by lowering the status bar. However, 'Clear All' does not terminate the foreground service of the application, so malicious information may be continuously taken by a malicious script.

The present invention has been proposed to solve the above problems, and provides a method and a communication terminal for providing security by preventing attacks by malicious scripts when the foreground service of the application is executed on the operating system, such as Android There is a purpose.

According to an aspect, a communication terminal includes a memory configured to store programs; And a processor coupled with the memory to execute the programs, wherein the programs are currently running in the background and via a status bar upon detection of an erase all input to terminate all recently executed applications from a user at one time. And a foreground service control module for transmitting a foreground service termination command to at least one or more applications that can terminate.

The programs may further include a scheduler, and the foreground service control module may receive a pre-allowed list of foreground services from the at least one or more applications, register with the scheduler, and then transmit the foreground service termination command. .

When the response to the foreground service termination command is received, the scheduler may re-execute the foreground service of the previously allowed foreground service list.

The foreground service control module may receive a list of previously permitted foreground services from the at least one application that is currently running in the background and may be terminated through the status bar, upon registration of the erase all input, and register with the scheduler. Can be.

The foreground service control module receives and stores a list of previously allowed foreground services from the corresponding application every time the application is installed, and when the context creation request is requested from a specific foreground service, the specific foreground service is allowed to the foreground. If it does not belong to the service list, it can return a context failure response.

The foreground service control module and the scheduler belong to the kernel layer of the Android operating system.

According to another aspect of the present invention, a method of providing security by a foreground service control module in a communication terminal includes: detecting an all erase input for terminating all recently executed applications from a user at one time; And sending a foreground service termination command to at least one or more applications that are currently running in the background and that can be terminated through the status bar.

The method may further include receiving, from the at least one or more applications, a previously allowed list of foreground services from the at least one application and registering with the scheduler.

The method may further include re-executing a foreground service of the previously allowed foreground service list when a response to the foreground service termination command is received after the transmitting.

The registering with the scheduler may be repeated every time the erase all input is detected.

The method may further include: receiving and storing a list of allowed foreground services from a corresponding application every time an application is installed, before the detecting; And returning a context failure response when the context creation request from the specific foreground service does not belong to the previously allowed foreground service list.

According to the present invention, when an application generates a context creation request for displaying a web page, when the request is not from a previously permitted foreground service, the context creation is failed, thereby preventing the execution of the unauthorized foreground service itself. To strengthen.

According to the present invention, even when the user inputs 'erase all' without entering an exit from the status bar in the communication terminal, the foreground service can be quickly terminated by forcibly terminating all foreground services, thereby enhancing security.

1 is a view showing a communication terminal according to an embodiment of the present invention.
2 is a diagram illustrating programs of a communication terminal according to an embodiment of the present invention.
3 is a diagram illustrating a configuration for program layer control of the foreground service according to an embodiment of the present invention.
4 is a flowchart illustrating a method of forcibly terminating a foreground service according to an embodiment of the present invention.
5 is a flowchart illustrating a method of blocking execution of a foreground service according to another embodiment of the present invention.
6 is a screen for notifying the foreground service when the status bar is lowered.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing a communication terminal according to an embodiment of the present invention. Referring to FIG. 1, the communication terminal 100 may include a bus 110, a processor 120, a memory 130, an input / output interface 150, a display 160, and a communication interface 170. In some embodiments, the communication terminal 100 may omit at least one of the components or may further include other components.

The bus 110 may include circuitry that connects the components 110-170 to each other and transfers communication (eg, control messages or data) between the components. The processor 120 may include one or more of a central processing unit (CPU), an application processor (AP), or a communication processor (CP). The processor 120 may execute, for example, operations or data processing related to control and / or communication of at least one other component of the communication terminal 100.

The memory 130 may include volatile and / or nonvolatile memory. The memory 130 may store, for example, commands or data related to at least one other component of the communication terminal 100. According to an embodiment of the present disclosure, the memory 130 may store software and / or a program 140. The program 140 may include, for example, a kernel 141, middleware 143, an application programming interface (API) 145, and / or an application 147. At least a portion of kernel 141, middleware 143, or API 145 may be referred to as an operating system. The kernel 141 may be, for example, system resources (eg, used to execute actions or functions implemented in other programs (eg, middleware 143, API 145, or application 147). The bus 110, the processor 120, or the memory 130, or the like. In addition, the kernel 141 may provide an interface for controlling or managing system resources by accessing individual components of the communication terminal 100 from the middleware 143, the API 145, or the application 147. have.

The middleware 143 may serve as an intermediary for allowing the API 145 or the application 147 to communicate with the kernel 141 to exchange data. In addition, the middleware 143 may process one or more work requests received from the application 147 according to priority. For example, the middleware 143 may preferentially use system resources (eg, the bus 110, the processor 120, or the memory 130, etc.) of the communication terminal 100 for at least one of the applications 147. Rank and process the one or more work requests.

The API 145 is an interface for the application 147 to control functions provided by the kernel 141 or the middleware 143. For example, the API 145 may include at least the following: file control, window control, image processing, or character control. It can contain one interface or function (eg command). The input / output interface 150 may transmit, for example, a command or data input from a user or another external device to other component (s) of the communication terminal 100, or other components of the electronic device 101 ( Commands or data received from the device) can be output to the user or other external device.

Display 160 may be, for example, a liquid crystal display (LCD), a light emitting diode (LED) display, an organic light emitting diode (OLED) display, or a microelectromechanical system (MEMS) display, or an electronic paper display. It may include. The display 160 may display, for example, various types of content (eg, text, images, videos, icons, and / or symbols) to the user. The display 160 may include a touch screen and, for example, may receive a touch, gesture, proximity, or hovering input using an electronic pen or a part of a user's body. The communication interface 170 may establish communication between the communication terminal 100 and an external device, for example. For example, the communication interface 170 may be connected to a network to communicate with the external device 106 through wireless or wired communication.

Wireless communication may include, for example, LTE, LTE advance (LTE-A), code division multiple access (CDMA), wideband CDMA (WCDMA), universal mobile telecommunications system (UMTS), wireless broadband (WiBro), or GSM (global). system for mobile communications), and the like. According to one embodiment, the wireless communication is, for example, wireless fidelity (WiFi), Bluetooth, Bluetooth low energy (BLE), Zigbee (Nigital), near field communication (NFC), magnetic secure transmission (magnetic secure) transmission, radio frequency (RF), or body area network (BAN).

2 is a diagram illustrating programs of a communication terminal according to an embodiment of the present invention. 2, the programs may include a kernel 141, middleware 143, an API 145, and an application 147. At least some of the programs may be preloaded on the communication terminal 100 or may be downloaded from an external device, for example, a server such as Google Play. At least a portion of kernel 141, middleware 143, or API 145 may be referred to as an operating system. The operating system may include, for example, Android, iOS, Windows, Symbian, Tizen, or Bada. Preferably the operating system is Android.

The kernel 141 may include, for example, a system resource manager 221 and / or a device driver 222. The system resource manager 221 may perform control, allocation, or retrieval of system resources. According to an embodiment, the system resource manager 221 may include a process manager, a memory manager, or a file system manager. The device driver 222 may include, for example, a display driver, a camera driver, a Bluetooth driver, a shared memory driver, a USB driver, a keypad driver, a WiFi driver, an audio driver, or an inter-process communication (IPC) driver. .

The middleware 143 may provide various functions through the API 145, for example, to provide functions commonly required by the application 147 or to allow the application 147 to use limited system resources inside the communication terminal. May be provided to the application 147. According to an embodiment, the middleware 143 includes an application manager 211, a window manager 212, a resource manager 213, a notification manager 214, and the like. The application manager 211 may manage, for example, the life cycle of the application 147. The window manager 212 may manage GUI resources used on the screen. The resource manager 213 may manage space of source code or memory of the application 147. The notification manager 214 may provide an event to the user, for example, an arrival message, an appointment, a proximity notification, and the like. In addition, it can include a power manager, runtime library, package manager, connectivity manager, and so on. The middleware 143 may provide a module specialized for each type of operating system.

The API 145 is a set of API programming functions, for example, and may be provided in different configurations depending on the operating system. For example, in the case of Android or iOS, one API set may be provided for each platform, and in Tizen, two or more API sets may be provided for each platform.

The application 147 may include, for example, a home 201, a dialer 202, a browser 203, a camera 204, and the like. In addition, it may include SMS / MMS, instant message (IM), alarm, album, and email.

3 is a diagram illustrating a configuration for program layer control of the foreground service according to an embodiment of the present invention. Referring to FIG. 3, the application 147 includes an activity component 301, a service component 302, a broadcast receiver component 303, and a content provider component 304.

The activity component 301 is a component constituting a user interface (UI) to be shown to the user, and is present in at least one application 147. This activity component 301 must be declared in the manifest. The service component 302 includes a foreground service and a background service. The foreground service is a service that a user can recognize, and the backround service is a service that a user cannot recognize. The broadcast receiver component 303 is a component that receives and processes an event or information occurring in the communication terminal 100. For example, it receives and processes events or information generated by the communication terminal 100 such as low battery, WiFi setting, and receiving a call or text message. The content provider component 304 is a component that shares data between applications.

In the present invention, in the application 147, a list of allowed foreground services is set in advance. In the development stage of the application 147, the developer may set the application 147. In the Android operating system, a task is a concept of a group grouping the related components of the executed application when the application is executed. That is, a task may mean a job executed with a certain program area (eg, code, variables, stack, etc.). Tasks can represent requests from users. For example, the task may mean a minimum unit of scheduling in an embedded system. In addition, a process may mean that a program related to the task is loaded in the memory 130 and executed by the processor 120. Therefore, the process and the task may mean the same program that is performed in the communication terminal 100 only in the different layers to be processed. In addition, the term 'service' in the present invention may mean a task more comprehensively. Termination of the foreground service may include termination of a task or termination of a process.

If you press the bottom left menu button on the Android operating system's smartphone, a list of recently executed applications is displayed and a 'Delete all task' menu is provided to delete all of them. When the user enters 'Erase All', the Android operating system terminates all recently executed applications (ie tasks). However, the conventional Android operating system operates in the background of the application and does not terminate the foreground service indicating that the application is running in the status bar. Starting with the Androde O version, the user must manually select Exit from the status bar. Referring to FIG. 3, the middleware 143 of the kernel layer includes a foreground service control module 320 and a scheduler 330, and the foreground service control module 320 and the scheduler 330 are in the foreground. Forcibly shut down and restart the service.

The foreground service control module 320 detects an input regarding 'erase all' from the user. When the foreground service control module 320 detects a user's “erase all” input, the foreground service control module 320 reads a list of allowed foreground services from an application running the foreground service and registers it with the scheduler 330. This registration is performed whenever a 'clear all' input is detected. 'Erase All' can be found by pressing the bottom menu in the Android operating system or by lowering the status bar. Then the foreground service control module 320 forcibly terminates by sending a termination command to the running foreground service. The remaining recently executed tasks are terminated normally by the operating system.

The scheduler 330 receives and registers a list of allowed foreground services from the foreground service control module 320, and receives a completion signal of the foreground service from the foreground service control module 320. Rerun the foreground services corresponding to the registered foreground service list. If an error occurs in the foreground service that runs in the background but the status bar is running, causing a blank page, etc., the user can execute 'clear all', and the foreground service is conventionally terminated in the status bar. Unless otherwise terminated, in the present invention, the foreground service is forcibly terminated upon 'clear all'. Since the foreground service requires continuous execution, the foreground service is automatically restarted to display a normal page that eliminates errors such as blank pages.

4 is a flowchart illustrating a method of forcibly terminating a foreground service according to an embodiment of the present invention.

Referring to FIG. 4, the application 147 may be a hybrid application. That is, the user may implement the UI to display the content, or access the URL input from the user to receive and display the web page. In this embodiment, the application 147, preferably the activity component 301 is described to access a URL input from the user to receive a web page. The application 147 requests creation of a context to the window manager 212 of the kernel layer in order to display a web page (S401). The window manager 212 is a component of the kernel layer that manages GUI resources used on the screen, and returns a context to the application 147 (S402).

The application 147 executes the foreground service using the context received from the window manager 212 (S403). The application 147 generates and displays a web screen using the context (S404). However, due to the inflow of wrong data, the web screen may not be displayed normally and a blank page may be generated. Even when a blank page occurs, the foreground service of the application 147 maintains the web connection.

Therefore, when an error such as a blank page occurs, the user inputs 'erase all' in the communication terminal 100, and the foreground service control module 320 of the kernel layer detects an 'erase all' input of the user (S405). ). Accordingly, the foreground service control module 320 requests an allowed foreground service list registered in the corresponding application 147 to the application 147 currently executing the foreground service and receives a response (S406 and S407). . In operation S408, the foreground service control module 320 transmits the received response, that is, the list of allowed foreground services to the scheduler 330.

Subsequently, the foreground service control module 320 transmits a termination command to the application 147, more specifically, the foreground service component 302 (S409). The foreground service component 302 terminates according to the termination command and returns a response thereto (S410). The foreground service control module 320 transmits the returned response to the scheduler 330 (S411), and the scheduler 330 re-executes the allowed foreground service registered in step S408. That is, the scheduler 330 requests the application 147 to re-execute the foreground service (S412). Accordingly, the foreground service which has been terminated may be re-executed to display a normal web screen.

5 is a flowchart illustrating a method of blocking execution of a foreground service according to another embodiment of the present invention.

Referring to FIG. 5, an application 147 capable of receiving and displaying a web page by accessing a URL input from a user is installed in the communication terminal 100 (S501). For example, Google Play of the communication terminal 100 downloads and installs the application 147 selected by the user from the app store server. After installation, the application 147 transmits a previously registered allowed foreground service list to the foreground service control module 320 of the kernel layer (S502). The foreground service control module 320 stores the received allowed foreground service list (S503).

Meanwhile, the application 147 may be executed by the user. In the present embodiment, the application 147, preferably the activity component 301 or the foreground service component 302 is connected to the URL to receive the web page. The application 147 requests creation of a context to the window manager 212 of the kernel layer to display a web page (S504). The window manager 212 is a component of the kernel layer that manages GUI resources used on the screen. Before returning a context to the application 147, the foreground service requesting the creation of the context is a foreground service that is allowed. A request is made to the module 320 (S505). The foreground service control module 320 compares the foreground service requested for confirmation with the allowed foreground service list stored in step S503 and responds to the confirmation result (S506). If the foreground service requesting the context is the allowed foreground service, the window manager 212 returns the context (S507). Otherwise, the window manager 212 returns a failure response to the application 147 without returning the context.

According to the embodiment referring to FIG. 5, by blocking the execution of the unregistered foreground service itself, it is possible to maintain a secure application use environment to protect personal information. If the allowed foreground service is hacked by the hacker, the foreground service may not be blocked by the embodiment of FIG. 5, but the foreground service may be terminated through 'delete all' according to the embodiment of FIG. 4. For example, two levels of security procedures can be specified.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, the features described in the individual embodiments herein can be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment herein can be implemented individually in various embodiments or in combination appropriately.

Although the operations are described in a particular order in the drawings, they should not be understood as being performed in a particular order as shown, or in a sequence of successive orders, or all described actions being performed to obtain a desired result. . Multitasking and parallel processing may be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be packaged in a single software product or multiple software products.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily carried out by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

100: communication terminal
141: kernel
143: middleware
147: Application
301: Activity
302: Service
303: Broadcast
304: content provider
320: foreground service control module
330: Scheduler

Claims (12)

A memory for storing programs; And
A processor coupled with the memory to execute the programs;
The programs,
Foreground service that sends a foreground service exit command to at least one application that is currently running in the background and can be terminated through the status bar upon detection of a Clear All input to terminate all recently launched applications from the user at once. Communication terminal comprising a control module. The method of claim 1,
The programs further include a scheduler,
The foreground service control module,
And transmitting the foreground service termination command after receiving a previously permitted list of foreground services from the at least one application and registering with the scheduler. The method of claim 2,
The scheduler,
And when a response to the foreground service termination command is received, re-execute a foreground service of the previously allowed foreground service list. The method of claim 2,
The foreground service control module,
And each time a detection of the clear all input is received, a list of allowed foreground services is registered in the scheduler from at least one or more applications currently running in the background that can be terminated through a status bar. The method of claim 1,
The foreground service control module,
Whenever an application is installed, a list of pre-allowed foreground services is received and stored from the application, and when the context creation request is requested from a specific foreground service, a context failure response is received if the specific foreground service does not belong to the pre-listed foreground service list. A communication terminal, characterized in that for replying. The method according to any one of claims 1 to 5,
The foreground service control module and the scheduler, characterized in that belonging to the kernel layer of the Android operating system. A method for providing security by a foreground service control module in a communication terminal,
Detecting an erase all input for terminating all recently executed applications from the user at once; And
Sending a foreground service termination command to at least one or more applications currently running in the background that can be terminated via the status bar. The method of claim 7, wherein
Prior to the transmitting step,
Receiving from the at least one application, a list of previously allowed foreground services, and registering with the scheduler. The method of claim 8,
After the transmitting step,
And if a response to the foreground service termination command is received, re-executing a foreground service of the previously allowed foreground service list. The method of claim 8,
Registering with the scheduler,
And repeatedly performing the detection of the erase all input. The method of claim 7, wherein
Prior to the detecting step,
Receiving and storing a list of the foreground services allowed in advance from the corresponding application every time the application is installed; And
Returning a context failure response when the context creation request from a particular foreground service does not belong to the list of allowed foreground services. A computer program recorded on a recording medium as a computer program for executing the method according to any one of claims 7 to 11 through a computer system.

Images