KR20220066842A - Blockchain-based Smishing Prevention method and apparatus thereof - Google Patents

Abstract

A blockchain-based smishing prevention system of the present invention comprises: a message transmitter terminal that generates message-related information as a transaction; a message server relaying a transmitting message and a receiving message; a message receiver terminal that finally receives a message transmitted by a message transmitter; and a blockchain-based smishing prevention device including a smishing prevention blockchain made of a permission type blockchain and at least one smishing prevention software development kit (SDK) that relays transaction transmission of the message transmitter and receiver.

Description

Blockchain-based Smishing Prevention method and apparatus thereof

The present invention is to solve the smishing attack problem caused by impersonation of courier and public institutions by authenticating the identity of the counterparty who sent the message through the block chain. -fungible token) It relates to a technology that performs user authentication through verification.

Phishing is a compound word of “private data” and “fishing”. It is a fraudulent technique that causes financial damage by illegally obtaining personal information of users based on phone calls, messages, and text messages. Representative types of smishing include voice phishing, smishing, and messenger phishing. In particular, smishing is a compound word of text message (SMS) and phishing. A smishing attacker sends a text message (SMS) containing a malicious app address to an unspecified number of people, and the recipient clicks the malicious app address and attacks the malicious app. It is an attack technique that induces users to install and steals the recipient's financial and personal information. At this time, the smishing attacker approaches the victim in various ways, such as impersonating a courier service, impersonating a public institution, or impersonating an acquaintance, and induces clicks on malicious app addresses. Although smishing has been a well-known attack method for a long time, it continues to occur even today because it is a criminal act using the victim's psychology. The present invention describes a countermeasure against a smishing attack.

In general, users use e-mail, text messages, or message services to deliver information online. In particular, since the text message service can easily transmit information only if the sender knows the recipient's mobile phone number, it is often used as an informal conversation tool with nearby acquaintances, as well as an information delivery method mainly used as a notification service at courier companies or public institutions. to be.

The text message service has the advantage of being very easy to exchange information between senders and receivers because of its very low accessibility, while the fact that any user can send a message only if they know the recipient's mobile phone number, and the user authentication procedure when sending and receiving messages The fact that it does not perform any of these has the problem of being vulnerable to attacks by acquaintances, couriers, and impersonating public institutions. Therefore, the smishing attacker sends a text message containing the address of a malicious app to an unspecified number of people, and cleverly induces the recipient to install the malicious app to try to make small payments and steal personal information. Since the sender's identity is not authenticated, the receiver cannot know whether the sender is a real person, such as a real courier company, a public institution, or a smishing attacker. difficult to determine Since this smishing attack is a method that uses the victim's psychology, damage cases are constantly occurring even now.

Since the text message service has very low accessibility, it is used not only as a means of informal conversation with acquaintances online, but also as an essential service for simple information transfer between users. However, since the service does not perform user identity authentication at all, when the sender transmits a message including an Internet address, the receiver has a problem in that it is difficult to determine whether the address is a correct address or a malicious app address.

The smishing attacker uses the psychology of the person to be smishing based on the above-mentioned problems and attempts to attack in various ways, such as impersonating a courier service, impersonating a public institution, and impersonating an acquaintance. In particular, delivery impersonation smishing is an attack that requires special attention from the recipient, as it accounts for a significant portion of the current smishing damage cases. Delivery service is a service mainly used in modern society, and users who use it generally wait for a delivery-related message from a delivery company official, so they are always exposed to a delivery impersonation smishing attack.

Korean Patent Application No. 10-2020-0045447

An object of the present invention to solve the above problems is to counter a smishing attack impersonating a courier service or a public institution. A block in which the identity authentication of the counterpart who has sent a message in a text message service is provided using block chain technology. It is to provide a chain-based anti-smithing method and apparatus.

A block chain-based anti-missing system according to an embodiment of the present invention for achieving the above object includes: a message sender terminal for generating message-related information as a transaction; a message server for relaying a sent message and a received message; a message receiver terminal that finally receives the message sent by the message sender; and an anti-smithing block chain composed of a permission-type block chain and at least one anti-smishing software development kit (SDK) that relays the transaction transmission of the message sender and receiver. Device; may include

A block chain-based anti-smithing device according to an embodiment of the present invention for achieving another object of the present invention includes: an anti-smithing block chain consisting of a permission-type block chain; at least one anti-smishing software development kit (SDK) for relaying the transaction transmission of the message sender/receiver; processor; and a memory in which at least one instruction to be executed by the processor is stored; Including, but at least one command, the processor: managing the identity information of the text message service user through the block chain; Recording information related to the transmitted message in the block chain; And the message server verifies the identity information of the sender using the information recorded in the block chain from the sender, and relays only the message that blocks smishing by courier service and public institution impersonation to the message receiver; may be configured to perform

The anti-smishing software development kit (Software Development Kit, SDK) includes: a token issuing unit that generates a transaction for issuing an anti-smishing token based on message content on an anti-smishing block chain; a token transmission unit responsible for transmitting the anti-smishing token to other users on the anti-smishing block chain; a token attribute verification unit responsible for authenticating the identity of the user who has issued the non-fungible token; And when the anti-smishing software development kit (Software Development Kit, SDK) receives an event from the anti-smishing block chain, the event unit functions to send a notification to the calling entity; may include

The event delivered by the event unit is, after the message sender terminal requests the issuance of the anti-smithing token through the token issuing unit, and when the token generation is completed on the anti-smishing block chain, the event unit notifies the message sender terminal of the completion of token issuance. After the token owner requests to send the anti-smishing token to another user through the token sender and the transfer is completed on the anti-smishing block chain, the event unit notifies the token sender caller of the successful transfer of ownership as an event. can be informed by

The token issuing unit may issue an anti-smithing token on the anti-smishing block chain by the message sender terminal generating a blockchain transaction through the token issuing unit.

The token transfer unit creates a blockchain transaction in which the owner of the anti-smithing token transfers ownership of the anti-smithing token to another user through the token transfer unit, and when the token transfer unit call is completed, the token owner may be changed.

In the token attribute verification unit, the non-fungible token receiver calls the token attribute verification unit to check the sender name and mobile phone number recorded in the non-fungible token issued by the sender, and user information and public key corresponding to the sender name and mobile phone number are provided to the courier company. Alternatively, the sender party can be authenticated by comparing whether the user information of a public institution official matches the public key.

The anti-smishing token is a non-fungible token for recording message content information on the block chain, and consists of standard properties and on-chain and off-chain extended properties. Standard properties can be composed of token ID properties, token type properties, owner properties, and approver properties, and on-chain extended properties can define sub properties differently depending on the token type of standard properties, The extended attribute is the path attribute that stores the off-chain storage path to connect the off-chain storage when off-chain data is needed when expressing non-fungible tokens, and the merkle root (merkle tree) of the merkle tree consisting of the data in the off-chain storage. merkle root) can be configured as sub-attributes.

The anti-smishing token is an anti-smishing token type that defines on-chain extended properties, and may consist of sender/receiver name, sender/receiver mobile phone number, and message content hash properties, and includes a message sender name and The sender name, sender mobile phone number and receiver name, and receiver mobile phone number properties that store mobile phone number information and the recipient name and mobile phone number information for receiving the message, respectively, can be defined as sub-properties of the on-chain extended properties, and the content of the outgoing message The message content hash property to prove the integrity of the message is defined as a sub-property of the on-chain extended property and can be expressed on the blockchain as a non-fungible token.

A block chain-based anti-smithing method according to an embodiment for achieving another object of the present invention is a block-chain-based anti-missing method for recording message-related information on a block chain, the identity of a text message service user managing information through a blockchain; Recording information related to the transmitted message in the block chain; And the message server verifies the identity information of the sender using the information recorded in the block chain from the sender, and relays only the message that blocks smishing by courier service and public institution impersonation to the message receiver; may include

The method includes the steps of: issuing a non-fungible token including a message sender/receiver name and mobile phone number related to a message to be transmitted by a message sender, and message content hash information; may further include.

The method includes the steps of: sending, by a message sender, the issued non-fungible token to a message server; may further include.

The method includes the steps of: transmitting the non-fungible token-related information issued by the message sender and the content of the sending message to the message server; may further include.

The method includes: verifying, by the message server, the identity of the message sender by using the message sender name and mobile phone number attributes recorded in the non-fungible token, and verifying the integrity of the transmitted message content by using the message content hash information; may further include.

The method comprises the steps of: the message server sending the non-fungible token to the message recipient only when the sender identity and the integrity of the message content are successfully verified; may further include.

The method includes: sending, by a message server, non-fungible token related information and transmission message content to a message recipient; may further include.

The method includes the steps of verifying that the message recipient matches the recipient through the recipient name and mobile phone number recorded in the non-fungible token; may further include.

The method is a data structure expressed as a non-fungible token among methods for recording message-related information on a block chain, and a non-fungible token is expressed as an anti-smishing token attribute. , and the anti-smithing token attribute has token identifier (id), token type (type), owner, operator, and approvee attributes as standard attributes, and on-chain extended attributes (xattr) ) as sub-attributes of the sender/receiver name and mobile phone number, it may have a message content hash attribute to verify the integrity of the anti-smishing message content sent by the sender.

It may be a computer program stored in a computer-readable recording medium for implementing the block chain-based anti-smithing method of any one of the preceding claims.

It may be a computer-readable recording medium for implementing the program of the block chain-based anti-smithing method of any one of the preceding claims.

The present invention has an effect of preventing smishing by courier services and public institutions by determining whether a user's identity is impersonated by applying a block chain technology for providing a user authentication procedure to a text message service among online information delivery means.

If the message sender is an actual courier company or a public institution official, the message sender can provide proof of user authentication by first issuing a non-fungible token on the blockchain and providing non-fungible token information to the message server.

The message server sends a non-fungible token and message to the receiver when user authentication that the sender is a user belonging to a courier company or a public institution is confirmed through the non-fungible token issued and transmitted by the sender and the integrity of the message content is verified do. On the other hand, if user authentication or message content integrity verification fails, it becomes possible to determine the sender as a smishing attacker.

Accordingly, the message server can determine the smishing behavior by verifying the identity authentication of the sender through the block chain, and through this, it becomes possible to relay only text messages that have blocked the smishing behavior to the message recipient.

1 is a diagram showing the configuration of a system including a block chain-based anti-smithing method and apparatus according to an embodiment of the present invention.
2 is a diagram showing the configuration of a smishing prevention software development kit (SDK) when message-related information is expressed as a non-fungible token as an example of utilizing the block chain of the present invention.
3 is a diagram showing a data structure in which message-related information is expressed as a non-replaceable token in order to provide user authentication and integrity verification characteristics for a message to be transmitted and received as an example of utilizing the blockchain of the present invention.
4 is an example of using the block chain of the present invention, and when message-related information is expressed as a non-fungible token, it is a view showing the overall progress of configuring a message system using a block chain-based smishing prevention method and apparatus. .
5 is a block diagram of a block chain-based anti-missing device according to an embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings to be described in detail. However, this is not intended to limit the present invention to specific embodiments, and it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing each figure, like reference numerals have been used for like elements.

Terms such as first, second, A, and B may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. The term “and/or” includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When an element is referred to as being “connected” or “connected” to another element, it is understood that it may be directly connected or connected to the other element, but other elements may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

The blockchain based on the peer-to-peer network disclosed in the present invention ensures that all participating nodes have the same set of transactions through a consensus algorithm, thereby ensuring transparency of transaction data and technology that supports integrity. When performing the consensus algorithm among participating nodes, the newly created block includes the hash value of the previous block and the transaction set. Therefore, all participating nodes maintain the same blockchain data structure linked by block hash values. Even if a specific node arbitrarily attempts to manipulate blockchain data, the manipulated data is not reflected in the blockchain because consensus between nodes has not been performed. As such, blockchain is a technology that supports the integrity and transparency of the data structure that all participating nodes have the same.

Blockchain is divided into permissionless blockchain and permissioned blockchain. In the permissionless blockchain, users and nodes can participate in the blockchain network without any restrictions, and the permissioned blockchain is a blockchain suitable for use in a business environment where only authorized users and nodes can participate in the blockchain network.

A distributed application (dApp) can be developed and operated by configuring business logic in a smart contract, a program running on a block chain. Smart contracts have the advantage of automatically executing each request according to business logic without the intervention of a third party. A representative dApp is a token.

A token is a digital asset expressed on a blockchain. Tokenizing digital assets on the blockchain can secure advantages such as proof of ownership of digital assets, guarantee of transparency, and improved liquidity. Tokens are divided into fungible tokens and non-fungible tokens. A fungible token is a token that expresses a digital asset that can be split, and a non-fungible token is a token that expresses a digital asset that cannot be split.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate the overall understanding, the same reference numerals are used for the same components in the drawings, and duplicate descriptions of the same components are omitted.

The block chain-based anti-smithing system of an embodiment of the present invention utilizes a block chain to perform identity authentication of a message sender.

The present invention includes various methods for maintaining and managing information for providing user identity authentication on a blockchain network. describe how to

The sender issues a non-fungible token based on his/her signature information, and the non-fungible token includes the sender/receiver name, the mobile phone number of the sender and receiver, and message content hash information for message content integrity verification, A method for verifying sender identity and message content integrity can be easily provided. Thus, by issuing and providing a non-fungible token, it becomes possible for the sender to provide solid proof that he or she is not a smishing attacker.

Non-fungible token attributes are defined as token unique identification id attribute, token issuing entity owner attribute, message sender/receiver name, sender mobile phone number and receiver mobile phone number attribute, and message content hash attribute for message content integrity verification, Token properties can be added and defined in various ways if necessary.

When a user sends a text message, the process is as follows. All users have a public key and private key pair based on PKI (Public Key Infrastructure), so it is assumed that all users can create blockchain transactions.

first. The sender composes and sends the text message content.

second. The sender issues a non-fungible token on the block chain based on the message content just sent, and the token attributes include token ID, owner, sender/receiver name, sender/receiver mobile phone number, and message content hash information. include At this time, the signature information of the message sender is included in the transaction information for issuing the token, so the owner of the issued token becomes the message sender.

third. The sender changes the owner of the token to the message server by sending the non-fungible token initialized on the blockchain to the message server.

fourth. The sender sends the non-fungible token related information and message content to the message server.

fifth. The message server verifies the non-fungible token on the blockchain based on the received non-fungible token information, and through this, the sender's identity is authenticated. For example, an attacker impersonating a courier service must issue a non-fungible token based on the signature information of the actual courier company. However, since the courier impersonating smishing attacker cannot know the signature information of the actual courier company official, it cannot issue a non-fungible token to impersonate the courier company official. Accordingly, the message server can determine whether the sender is an actual courier company official or a smishing attacker by checking the sender name and mobile phone number recorded in the non-fungible token issued by the sender.

When the message server completes verifying the identity of the sender, it verifies the integrity of the message content. By comparing the hash value of the message content received by the message server with the message content hash value recorded in the non-fungible token, it is possible to verify whether the message content is intact. At this time, if the message server fails to verify the identity of the sender and the integrity of the message content, the non-fungible token and message are not sent to the receiver.

sixth. When the identity of the sender and the integrity of the message content are verified through a non-fungible token on the blockchain, the message server sends a non-fungible token to the receiver to change the owner.

seventh. The message server sends the non-fungible token related information and message to the message recipient.

eighth. The message recipient uses the non-fungible token attribute to verify that the recipient's name and mobile phone number match their information. If the information matches, the receiver checks the message content.

1 is a diagram showing a system configuration including a block chain-based anti-smithing method and apparatus 400 according to an embodiment of the present invention.

Referring to Figure 1, the block chain-based anti-smithing system of an embodiment of the present invention authenticates the identity of a courier company or a public institution official in advance and uses the anti-smithing block chain 300 to provide a service. consist of

A block chain-based anti-smithing system according to an embodiment of the present invention includes a message sender terminal 100a that transmits a user's message, a message server 100c that relays messages transmitted by the message sender terminal, and a message sender terminal ( Development of anti-smishing software that relays transaction transmission of message receiver terminal 100b that finally receives the message sent by 100a), anti-smishing block chain 300 composed of permission-type block chain, and message sender/receiver terminal kit (Software Development Kit, SDK) 200 .

The message sender terminal 100a may select and transmit a general message and an anti-smishing message. If a general message transmission is selected, it is transmitted through the message server 100c in the same way as in the existing text message service. In conjunction with the kit (Software Development Kit, SDK) 200 , it operates to generate a block chain transaction for anti-smishing in the anti-smishing block chain 300 .

2 is a diagram showing the configuration of a smishing prevention software development kit (Software Development Kit, SDK) 200 of the present invention.

Referring to FIG. 2 , a smishing prevention software development kit (Software Development Kit, SDK) 200 includes a token issuing unit 510 , a token transmitting unit 520 , a token attribute verification unit 530 and an event unit 540 . includes

The token issuing unit 510 creates a transaction for issuing an anti-smithing token based on the message content on the anti-smithing block chain 300 . More specifically, the message sender terminal 100a generates a block chain transaction through the token issuing unit 510 and issues an anti-smithing token on the anti-smishing block chain 300 . The anti-smishing token attribute is described in FIG. 3 . For reference, the token holder is the entity that issued the token.

The token transmission unit 520 is responsible for transmitting the anti-smishing token to another user on the anti-smishing block chain 300 . More specifically, a blockchain transaction is created in which the owner of the anti-smithing token transfers the ownership of the anti-smithing token to another user through the token transfer unit 520 . That is, when the call to the token transmitter 520 is completed, the owner of the token is changed. The right to call the token transmitter 520 is only available to the token owner.

The token attribute verification unit 530 is responsible for authenticating the identity of the user who has issued the non-fungible token. That is, it functions to provide a criterion for determining whether the user who issued the non-fungible token is an actual courier company, a public institution official, or a smishing attacker. Since all users are registered in the anti-smithing blockchain after user identity is verified, only transactions based on signature information related to their user information can be created. Accordingly, the non-fungible token receiver calls the token attribute verification unit 530 to check the sender name and mobile phone number recorded in the non-fungible token issued by the sender, and user information and public key corresponding to the sender name and mobile phone number are By comparing whether or not the user information of a courier company or a person concerned with a public institution matches the public key, authentication of the sender party can be performed. Additionally, since hash information about the message content is stored in the token attribute, the process of verifying the integrity of the received message can also be performed. The message server does not proceed with message relaying if the identity of the sender and the integrity of the message fail.

The event unit 540 functions to send a notification to the calling entity when the anti-smishing software development kit (SDK) 200 receives an event from the anti-smishing block chain 300 . After the token issuing unit 510 and the token transmitting unit 520 are called, when the operation result for the anti-smishing token is finally committed to the anti-smishing block chain 300, the anti-smishing software development kit (Software) Development Kit, SDK) 200 receives the anti-smishing block chain 300 event through the event unit 540 .

In the present invention, the events delivered by the event unit 540 are as follows. After the message sender terminal 100a requests the issuance of the anti-smithing token through the token issuing unit 510, and the token generation on the anti-smishing block chain 300 is completed, the event unit 540 completes the token issuance. The fact is notified to the message sender terminal 100a as an event. In addition, after the owner of the token requests to transmit the anti-smithing token to another user through the token transmitter 520, when the transmission is completed on the anti-smishing block chain 300, the event unit 540 returns a successful ownership The transfer completion is notified to the caller of the token transmitter 520 as an event.

3 is a diagram showing a data structure in which the anti-smishing token attribute structure is expressed as an non-fungible token as one of the examples of using the block chain of the present invention.

Referring to FIG. 3 , the anti-smishing token has token identifier (id), token type (type), owner, operator, and approver properties as standard properties, and on-chain extended properties As a sub-attribute of (xattr), it includes the sender/receiver's name and mobile phone number attributes. In addition, it has a message content hash attribute to verify the integrity of the anti-smithing message content sent by the sender.

The block chain-based anti-smithing method of an embodiment of the present invention is a block-chain-based anti-missing method for expressing message-related information as a non-fungible token among methods for recording message-related information on a block chain, managing identity information of a text message service user through a block chain; Recording information related to the transmitted message in the block chain; And the message server verifies the identity information of the sender using the information recorded in the block chain from the sender, and relays only the message that blocks smishing by courier service and public institution impersonation to the message receiver; includes

A block chain-based anti-smithing method according to an embodiment of the present invention includes: issuing a non-fungible token including a message sender/receiver name and mobile phone number related to a message that a message sender wants to send, and message content hash information; sending, by the message sender, the issued non-fungible token to the message server; transmitting the non-fungible token-related information issued by the message sender and the content of the sending message to the message server; verifying, by the message server, the identity of the message sender by using the message sender name and mobile phone number attributes recorded in the non-fungible token, and verifying the integrity of the sent message content by using the message content hash information; sending, by the message server, the non-fungible token to the message recipient only when the sender identity and the integrity of the message content are successfully verified; transmitting, by the message server, non-fungible token related information and transmission message content to the message recipient; and verifying that the message recipient matches the recipient through the recipient name and mobile phone number recorded in the non-fungible token; includes

A detailed operation of the block-chain-based anti-smithing method using the block-chain-based anti-smithing device 400 of an embodiment of the present invention will be described with reference to FIG. 4 .

4 is a diagram showing the overall process of configuring a message system using a block chain-based anti-smithing method and apparatus when message-related information is expressed as an irreplaceable token as an example of using a block chain.

Referring to FIG. 4 , the message sender/receiver terminals 100a to 100b are users registered in the anti-smishing block chain 300 , and user identity is authenticated upon registration. Each authenticated user is issued a PKI-based public key and private key corresponding to user information. Anti-smishing software development kit (Software Development Kit, SDK) 200 stores information of users and a public key corresponding to the information in order to control so that only authorized users can access the anti-smishing block chain 300 do. Accordingly, each user can perform user authentication through a non-fungible token on the block chain by using the user-specific public key managed by the anti-smishing software development kit (SDK) 200 .

If the message sender terminal 100a wants to transmit the anti-smishing message, it writes the message content and then transmits the anti-smishing message. The message transmission process of the message sender terminal 100a first calls the token issuing unit 510 .

The token issuing unit 510 called by the message sender terminal 100a issues an anti-smithing token (the id of the token is T0) based on the anti-smithing message on the anti-smithing block chain 300 (S210). The issued token T0 is a sub-attribute of the extended attribute and includes message sender/receiver name, mobile phone number, and message content hash information.

The event unit 540 notifies the message sender terminal 100a of successful issuance of the token T0, and the message sender terminal 100a calls the token transmitter 520 to transmit the token T0 to the message server 100c. (S220). When the ownership of the token T0 is successfully transferred to the message server 100c, the event unit 540 notifies the message sender terminal 100a of the successful transfer completion.

Upon receiving the successful notification from the event unit 540, the message sender terminal 100a transmits a smishing prevention message (T0 and transmission message content) to the message server 100c (S110).

Upon receiving the message, the message server 100c calls the token attribute verification unit 530 to verify the identity of the message sender (S230). Since the sender can only issue non-fungible tokens based on his or her signature information, the message server checks the sender name and mobile phone number recorded in the non-fungible token to verify the identity of the user of a related party such as a courier company or a public institution in advance. By comparing whether the information matches or not, the identity of the sender can be verified. When the sender identity verification is successfully completed, the message server 100c verifies the integrity of the message content. Message content integrity can be verified by comparing the hashed value of the message content with the message content hash value recorded in the non-fungible token. At this time, if any one of the user identity and message content integrity verification fails, the message server 100c does not proceed with the message relay operation any more.

When the user identity and message content integrity verification is successfully completed, the message server 100c transmits a non-fungible token to the message receiver terminal 100b (S240).

When the non-replaceable token transmission is successfully completed and the message server 100c receives the corresponding fact as an event, it transmits a smishing prevention message to the message receiver terminal 100b (S120). Finally, the message receiver terminal 100b calls the token attribute verification unit 530 to confirm the transmission message (S250). The message receiver terminal 100b checks the sender/receiver name and mobile phone number in order to confirm that the message is sent to the sender. If the recipient's name and mobile phone number match your information, check the message content.

As described above, according to the present invention, a smishing attack caused by the absence of user authentication of a general message service can be solved by applying a block chain technology, and as a specific embodiment, a smishing attack can be blocked by modeling a non-fungible token and performing user authentication. confirmed that there is.

When the sender's user authentication and message content integrity are verified through the non-replaceable token, the message server can determine that the sender is a courier company or public institution official whose identity has been verified. Conversely, if the sender's user authentication and message content integrity verification fail , it becomes possible to judge the sender as a smishing attacker.

Therefore, user authentication on whether or not the sender is a smishing attacker can be performed in an objective way through the block chain, so that the message server can relay only normal messages that have blocked the smishing attack to the message recipient.

5 is a block diagram of a block chain-based anti-missing device 400 according to an embodiment of the present invention.

Referring to FIG. 5 , the block chain-based anti-missing device 400 according to an embodiment of the present invention includes a processor 410, a memory 420, a transceiver 430, an input interface device 440, and an output. It may be configured to include an interface device 450 , a storage device 460 , and a bus 470 .

The block chain-based anti-missing device 400 of the present invention includes a processor 410 and a memory 420 in which at least one instruction executed through the processor 410 is stored, but at least one The instructions of the processor 410 include the steps of managing the identity information of the text message service user through the block chain, recording the transmitted message related information in the block chain, and the message server receiving the information recorded in the block chain from the sender It is configured to verify the identity information of the sender by using and relay only the message that has blocked smishing by courier and public agency impersonation to the message recipient.

The processor 410 may mean a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which methods according to embodiments of the present invention are performed.

Each of the memory 420 and the storage device 460 may be configured as at least one of a volatile storage medium and a non-volatile storage medium. For example, the memory 420 may be configured as at least one of a read only memory (ROM) and a random access memory (RAM).

In addition, the block chain-based anti-missing device 400 may include a transceiver 430 for performing communication through a wireless network.

In addition, the block chain-based anti-missing device 100 may further include an input interface device 440 , an output interface device 450 , a storage device 460 , and the like.

In addition, each component included in the block chain-based anti-missing device 400 may be connected by a bus 470 to communicate with each other.

As an example of the block chain-based anti-smithing device 400 of the present invention, a communicable desktop computer, a laptop computer, a notebook, a smart phone, a tablet PC (tablet) PC), mobile phone, smart watch, smart glass, e-book reader, PMP (portable multimedia player), portable game console, navigation device, digital camera ), DMB (digital multimedia broadcasting) player, digital audio recorder, digital audio player, digital video recorder, digital video player, PDA (Personal Digital) Assistant) and the like.

The present invention has an effect of preventing smishing by courier services and public institutions by determining whether a user's identity is impersonated by applying a block chain technology for providing a user authentication procedure to a text message service among online information delivery means.

If the message sender is an actual courier company or a public institution official, the message sender can provide proof of user authentication by first issuing a non-fungible token on the blockchain and providing non-fungible token information to the message server.

The message server sends a non-fungible token and message to the receiver when user authentication that the sender is a user belonging to a courier company or a public institution is confirmed through the non-fungible token issued and transmitted by the sender and the integrity of the message content is verified do. On the other hand, if user authentication or message content integrity verification fails, it becomes possible to determine the sender as a smishing attacker.

Accordingly, the message server can determine the smishing behavior by verifying the identity authentication of the sender through the block chain, and through this, it becomes possible to relay only text messages that have blocked the smishing behavior to the message recipient.

The operation of the method according to the embodiment of the present invention can be implemented as a computer-readable program or code on a computer-readable recording medium. The computer-readable recording medium includes all types of recording devices in which data that can be read by a computer system is stored. In addition, the computer-readable recording medium may be distributed in a network-connected computer system to store and execute computer-readable programs or codes in a distributed manner.

In addition, the computer-readable recording medium may include a hardware device specially configured to store and execute program instructions, such as ROM, RAM, and flash memory. The program instructions may include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although some aspects of the invention have been described in the context of an apparatus, it may also represent a description according to a corresponding method, wherein a block or apparatus corresponds to a method step or feature of a method step. Similarly, aspects described in the context of a method may also represent a corresponding block or item or a corresponding device feature. Some or all of the method steps may be performed by (or using) a hardware device such as, for example, a microprocessor, programmable computer or electronic circuit. In some embodiments, one or more of the most important method steps may be performed by such an apparatus.

In embodiments, a programmable logic device (eg, a field programmable gate array) may be used to perform some or all of the functionality of the methods described herein. In embodiments, the field programmable gate array may operate in conjunction with a microprocessor to perform one of the methods described herein. In general, the methods are preferably performed by some hardware device.

Although described above with reference to preferred embodiments of the present invention, those skilled in the art can variously modify and change the present invention within the scope without departing from the spirit and scope of the present invention described in the claims below. You will understand that you can.

Claims (20)

a message sender terminal generating message-related information as a transaction;
a message server for relaying a sent message and a received message;
a message receiver terminal that finally receives the message sent by the message sender; and
A block-chain-based anti-smishing device comprising an anti-smishing block chain composed of a permission-type block chain and at least one anti-smishing software development kit (SDK) that relays the transaction transmission of the message sender and receiver ; containing,
Blockchain-based anti-smithing system. Anti-smishing blockchain consisting of permissioned blockchain;
At least one anti-smishing software development kit (Software Development Kit, SDK) for relaying the transaction transmission of the message sender/receiver;
processor; and
a memory in which at least one instruction executed by the processor is stored; including,
At least one instruction causes the processor to:
managing identity information of a text message service user through a block chain;
Recording information related to the transmitted message in the block chain; and
The message server verifies the identity information of the sender using the information recorded in the block chain from the sender, and relays only the message that blocks smishing by courier service and public institution impersonation to the message receiver; configured to do
Blockchain-based anti-smishing device. The method according to claim 2, Smishing prevention software development kit (Software Development Kit, SDK),
a token issuing unit that generates a transaction for issuing an anti-smishing token based on the message content on the anti-smishing block chain;
a token transmission unit responsible for transmitting the anti-smishing token to other users on the anti-smishing block chain;
a token attribute verification unit responsible for authenticating the identity of the user who has issued the non-fungible token; and
When the anti-smishing software development kit (Software Development Kit, SDK) receives an event from the anti-smishing block chain, the event unit functions to send a notification to the calling entity; containing,
Blockchain-based anti-smishing device. The method according to claim 3, The event delivered by the event unit,
After the message sender terminal requests the issuance of the anti-smithing token through the token issuing unit, and the token generation on the anti-smishing block chain is completed, the event unit notifies the message sender terminal of the completion of the token issuance as an event;
After the token owner requests to transmit the anti-smithing token to another user through the token transfer unit, when the transfer is completed on the anti-smishing block chain, the event unit notifies the token transfer unit caller of the successful transfer of ownership as an event;
Blockchain-based anti-smishing device. The method according to claim 3, The token issuing unit,
The message sender terminal creates a blockchain transaction through the token issuing unit and issues an anti-smishing token on the anti-smishing block chain.
Blockchain-based anti-smishing device. The method according to claim 3, The token transmission unit,
Create a blockchain transaction in which the owner of the anti-smishing token transfers the ownership of the anti-smishing token to another user through the token transfer unit;
When the token sender call is completed, the owner of the token is changed,
Blockchain-based anti-smishing device. The method according to claim 3, The token attribute verification unit,
The non-fungible token receiver calls the token attribute verification unit to verify the sender name and mobile phone number recorded in the non-fungible token issued by the sender,
By comparing whether the user information and public key corresponding to the sender's name and mobile phone number match the user information and public key of a courier company or an official of a public institution, authentication of the sender party is performed,
Blockchain-based anti-smishing device. The method of claim 5, wherein the anti-smishing token is:
As a non-fungible token to record message content information on the blockchain,
It consists of standard properties and on-chain and off-chain extended properties,
Standard properties consist of token ID property, token type property, owner property, and acceptee property,
For on-chain extended properties, sub-properties are defined differently depending on the token type of standard properties,
The off-chain extended attribute is the path attribute that stores the off-chain storage path to connect the off-chain storage when off-chain data is needed when expressing non-fungible tokens, and the merkle tree of the merkle tree consisting of data from the off-chain storage. A hash attribute that stores the root (merkle root) consists of sub-attributes,
Blockchain-based anti-smishing device. The method of claim 5, wherein the anti-smishing token is:
An anti-smishing token type that defines on-chain extended properties.
Consists of sender/receiver name, sender/receiver mobile phone number, and message content hash attributes,
The properties of the sender name and mobile phone number of the message sending the message, and the sender name and mobile phone number information that receive the message, respectively, are set as sub-properties of the on-chain extended properties. defined,
The message content hash attribute to prove the integrity of the transmitted message content is defined as a sub-property of the on-chain extended attribute, which is expressed on the blockchain as a non-fungible token.
Blockchain-based anti-smishing device. In the block chain-based anti-missing method for recording message-related information on a block chain,
managing identity information of a text message service user through a block chain;
Recording information related to the transmitted message in the block chain; and
The message server verifies the identity information of the sender using the information recorded in the block chain from the sender, and relays only the message that blocks smishing by courier service and public institution impersonation to the message receiver; containing,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
issuing a non-fungible token including the message sender/receiver name and mobile phone number related to the message the message sender wants to send, and message content hash information; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
sending, by the message sender, the issued non-fungible token to the message server; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
transmitting the non-fungible token-related information and transmission message content issued by the message sender to the message server; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
verifying, by the message server, the identity of the message sender by using the message sender name and mobile phone number attributes recorded in the non-fungible token, and verifying the integrity of the sent message content by using the message content hash information; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
sending, by the message server, the non-fungible token to the message recipient only when the sender identity and the integrity of the message content are successfully verified; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
transmitting, by the message server, non-fungible token related information and transmission message content to the message recipient; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
verifying that the message recipient matches the recipient through the recipient name and mobile phone number recorded in the non-fungible token; further comprising,
A blockchain-based anti-smithing method. 11. The method of claim 10, wherein the method comprises:
Expressed as a non-fungible token among methods for recording message-related information on the block chain,
Non-fungible tokens have a data structure expressed as anti-smishing token properties,
The anti-smishing token attribute has token identifier (id), token type (type), owner, operator, and approvee attributes as standard attributes, and is a subordinate of on-chain extended attribute (xattr). It includes the name and mobile phone number of the sender/receiver as attributes, and has a message content hash attribute to verify the integrity of the anti-smishing message content sent by the sender,
A blockchain-based anti-smithing method. A computer program stored in a computer-readable recording medium for implementing the block chain-based anti-smithing method of any one of claims 10 to 18. A computer-readable recording medium for implementing the program of the block chain-based anti-smithing method of any one of claims 10 to 18.

Images