KR20240108654A - Method, user device and computer program for providing phishing blocking service that detect and warn phishing through text message - Google Patents

Abstract

A method of providing a phishing blocking service that detects and warns of phishing through text messages in a user terminal includes the steps of: detecting reception of a text message through a text management processor that manages text messages transmitted and received by the user terminal; Confirming the originating number of the detected received text through the text management processor; Confirming whether the calling number is stored through a contact management processor that manages contact information stored in the user terminal; and, if the calling number is a number not stored in the contact list, storing a phishing warning text in the text inbox through the text management processor.

Description

Method of providing a phishing blocking service that detects and warns of phishing through text messages, user terminal and computer program {METHOD, USER DEVICE AND COMPUTER PROGRAM FOR PROVIDING PHISHING BLOCKING SERVICE THAT DETECT AND WARN PHISHING THROUGH TEXT MESSAGE}

The present invention relates to a method, user terminal, and computer program for providing a phishing blocking service that detects and warns of phishing through text messages.

Phishing is a compound word of private data and fishing, and refers to illegally obtaining personal information through mobile devices or e-mails by pretending to send it from a trustworthy person or company.

In particular, text phishing containing URLs from unknown sources can cause malicious code to be installed on mobile devices, thereby stealing the user's personal information and causing secondary damage using that personal information.

Previously, in the case of text containing URLs, there was the inconvenience of being able to block only when the user directly requested blocking for each calling number through the telecommunication company's customer center.

To solve this problem, a service that sends text messages warning of phishing to user terminals was attempted, but it was difficult to commercialize it due to the cost of sending text messages.

Korean Patent Publication No. 10-1862118 (registered on May 23, 2018)

The present invention is intended to solve the above-mentioned problems, and includes a method of providing a phishing blocking service that detects and warns of phishing through text messages, which provides a phishing blocking service that stores phishing warning texts in a text inbox without incurring costs; We aim to provide user terminals and computer programs.

However, the technical challenges that this embodiment aims to achieve are not limited to the technical challenges described above, and other technical challenges may exist.

As a means to achieve the above-described technical problem, an embodiment of the present invention provides a method of providing a phishing blocking service that detects and warns of phishing through text in a user terminal, and manages text transmitted and received by the user terminal. Detecting the reception of an incoming text through a text management processor, confirming the originating number of the detected incoming text through the text management processor, and identifying the originating number through a contact management processor that manages contacts stored in the user terminal. It may include checking whether to store the number and, if the calling number is a number not stored in the contact list, storing a phishing warning text in the text inbox through the text management processor.

Another embodiment of the present invention includes a text reception detection unit that detects the reception of a received text through a text management processor that manages texts transmitted and received by a user terminal, and a text reception detector that detects the originating number of the detected received text through the text management processor. and a calling number verification unit that checks whether the calling number is stored through a contact management processor that manages contact information stored in the user terminal, and, if the calling number is a number not stored in the contact information, through the text management processor. It may be created based on a user terminal that includes a phishing warning text storage unit that stores a phishing warning text in a text inbox.

Another embodiment of the present invention is a computer program stored in a computer-readable recording medium including a sequence of instructions for providing a phishing blocking service that detects and warns of phishing through text messages in a user terminal, wherein the computer program includes When executed by a computing device, the user terminal detects the reception of a received text through a text management processor that manages texts transmitted and received, checks the originating number of the detected received text through the text management processor, and the user terminal Check whether the calling number is stored through a contact management processor that manages contacts stored in the contact list, and if the calling number is a number not stored in the contact information, store a phishing warning text in the text inbox through the text management processor. It may contain a sequence of instructions.

The above-described means for solving the problem are merely illustrative and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description of the invention.

According to one of the means for solving the problems of the present invention described above, a phishing blocking service that stores phishing warning text in a text inbox without incurring a cost, and provides a phishing blocking service that detects and warns of phishing through text messages. Methods, user terminals, and computer programs may be provided.

Figure 1 is a configuration diagram of a phishing blocking system that provides a phishing blocking service that detects and warns of phishing through text messages in an embodiment of the present invention.
Figure 2 is a configuration diagram of a user terminal according to an embodiment of the present invention.
Figure 3 is a signal flow diagram of a method for storing a phishing warning text in a text inbox through a text management processor when the calling number is not stored in the contact list according to an embodiment of the present invention.
Figure 4 shows a method of checking whether a specific program is automatically downloaded when accessing the path corresponding to the URL in the received text and allowing or blocking access to the path corresponding to the URL according to an embodiment of the present invention. This is a signal flow diagram for .
Figure 5 is a flowchart of a method for providing a phishing blocking service according to an embodiment of the present invention.

Below, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. In order to clearly explain the present invention in the drawings, parts unrelated to the description are omitted, and similar parts are given similar reference numerals throughout the specification.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case where it is "directly connected," but also the case where it is "electrically connected" with another element in between. . Additionally, when a part "includes" a certain component, this means that it may further include other components rather than excluding other components, unless specifically stated to the contrary.

In this specification, 'part' includes a unit realized by hardware, a unit realized by software, and a unit realized using both. Additionally, one unit may be realized using two or more pieces of hardware, and two or more units may be realized using one piece of hardware.

In this specification, some of the operations or functions described as being performed by a terminal or device may instead be performed on a server connected to the terminal or device. Likewise, some of the operations or functions described as being performed by the server may also be performed on a terminal or device connected to the server.

Hereinafter, specific details for implementing the present invention will be described with reference to the attached configuration diagram or processing flow diagram.

Figure 1 is a configuration diagram of a phishing blocking system that provides a phishing blocking service that detects and warns of phishing through text messages according to an embodiment of the present invention.

Referring to FIG. 1, the phishing blocking system may include a user terminal 100 and a phishing blocking service server 110. Since the phishing blocking system of FIG. 1 is only an embodiment of the present invention, the present invention is not limited to FIG. 1 .

The user terminal 100 may access the phishing blocking service server 110 through a network.

For example, the user terminal 100 may be installed with a phishing blocking processor, a text management processor, and a contact management processor, which will be described later.

Here, the text management processor is an application that manages texts transmitted and received by the user terminal 100, and may include an application preloaded by the manufacturer of the user terminal 100 and a third-party application installed on the user terminal 100. . The text management processor may provide an interface that allows the user to write text, and may provide a text inbox that stores text received by the user terminal 100 and allows the text to be searched.

Additionally, the contact management processor is an application that manages contacts stored in the user terminal 100 and may include an application preloaded by the manufacturer of the user terminal 100 and a third-party application installed on the user terminal 100. The contact management processor may store contacts in the user terminal 100 and provide an interface for searching the contacts.

The phishing blocking processor is an application for providing a phishing blocking service through the phishing blocking system of the present invention. It has the authority to access the text inbox through the text management processor and can confirm receipt of text.

Additionally, the anti-phishing processor has permission to access contacts through the contact management processor and can search for contacts.

An example of the user terminal 100 is a terminal capable of installing applications, such as a 3G, 4G, 5G terminal, smart phone, smart pad, tablet PC, and PCS (Personal Communication). System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)- 2000, W-CDMA (W-Code Division Multiple Access), Wibro (Wireless Broadband Internet), etc. may include all types of wireless communication devices that guarantee portability and mobility. The phishing blocking service server 110 is a phishing blocking service server 110. It may include a blocking processor 201, a text management service processor 208, and a contact management processor 209.

The phishing blocking service server 110 can check whether a specific program is automatically downloaded when accessing the path corresponding to the URL included in the received text.

For example, the phishing blocking service server 110 may receive a URL included in a received text from the user terminal 100 and request access to a path corresponding to the URL.

The phishing blocking service server 110 checks whether a specific program is automatically downloaded when accessing the path corresponding to the URL included in the received text based on the response from the external server corresponding to the path corresponding to the URL, You can check whether the received text is a phishing text.

Network refers to a connection structure that allows information exchange between nodes such as terminals and servers, including Local Area Network (LAN), Wide Area Network (WAN), and World Wide Area Network (WWW). Wide Web), wired and wireless data communication networks, telephone networks, and wired and wireless television communication networks. Examples of wireless data communication networks include 3G, 4G, 5G, 3GPP (3rd Generation Partnership Project), LTE (Long Term Evolution), WIMAX (World Interoperability for Microwave Access), Wi-Fi, Bluetooth communication, infrared communication, and ultrasound. This includes, but is not limited to, communication, Visible Light Communication (VLC), LiFi, etc.

Figure 2 is a configuration diagram of a user terminal 100 according to an embodiment of the present invention. As shown in FIG. 2, the user terminal 100 may include an anti-phishing processor 201, a text management service processor 208, and a contact management processor 209. Here, the phishing blocking processor 201 includes a text reception detection unit 202, a sender number verification unit 203, a phishing warning text storage unit 204, a phishing confirmation unit 205, a URL extractor 206, and a connection permission unit. It may include part 207.

The text reception detection unit 202 can detect the reception of a text message through the text management processor. For example, the text reception detection unit 202 has the authority to access the text inbox through the text management processor and can confirm receipt of the received text. Alternatively, the text management processor may notify the detection unit 202 when a text is received.

The sending number confirmation unit 203 can check the sending number of the received text through the text management processor. The calling number verification unit 203 can check whether the calling number is stored through the contact management processor. For example, the calling number verification unit 203 has the authority to access the contact information through the contact management processor 209 and can check whether the calling number is a number stored in the contact information.

If the calling number is not stored in the contact list, the phishing warning text storage unit 204 may store the phishing warning text in the text inbox through the text management processor 208.

Specifically, the phishing warning text storage unit 204 may transmit an API to the text management processor 208 to generate a phishing warning text and expose it at the top of the text inbox.

For example, if the received text is a text containing the URL "Go to the site below for a great chance https://examplexxx.com/download/", the phishing warning text storage unit 204 is sent to the text management processor 208. You can send an API that generates a phishing warning text saying, “A suspected phishing text message has just been received, be careful.” and exposes it at the top of the text inbox.

That is, according to this embodiment, the user terminal 100 can operate as if a phishing warning text has been received without the phishing warning text being sent through a communication network. For example, the text management processor 208 generates a phishing warning text through the API from the phishing warning text storage unit 204, then notifies the receipt of the phishing warning text as in the case of receiving a general text, and sends it to the text message. It can be displayed at the top of the inbox.

According to the present invention, the user terminal 100 operates as if it has received a phishing warning text without going through a communication network, thereby preventing text sending costs from being incurred.

The phishing confirmation unit 205 transmits the URL in the received text to the phishing blocking service server 110 and checks whether a specific program is automatically downloaded when the phishing blocking service server 110 accesses the path corresponding to the URL. You can do it.

Generally, when a user clicks on a URL in a received text message, the browser mounted on the user terminal 100 connects to an external server and executes a command from the external server. If an external server transmits a command to install a specific program to the browser, the browser installs the specific program on the user terminal 100 through the command.

The present invention can prevent a specific program from being installed on the user terminal 100 by allowing the phishing blocking service server 110 to connect to a path corresponding to the URL instead of the user terminal 100. At this time, the anti-phishing service server 110 does not include a browser, so even if a response (including a command) from an external server is received, a specific program may not be installed on the anti-phishing service server 110.

More specifically, the phishing prevention service server 110 may transmit a request to confirm the file size responded by the external server to the external server corresponding to the path corresponding to the URL. At this time, if the response from the external server is a file, the external server transmits the file size value to the phishing blocking service server 110, and if the response is not from the external server, a value preset to the phishing blocking service server 110 (e.g. , 0 or -1) can be transmitted.

When receiving a file size value from an external server, the phishing blocking service server 110 determines that a specific program is automatically downloaded when accessing the path corresponding to the URL, and when receiving a preset value from an external server, the phishing blocking service server 110 determines that a specific program is automatically downloaded. When accessing the corresponding path, it may be determined that a specific program is not automatically downloaded.

Additionally, the phishing confirmation unit 205 can check whether a specific program is automatically downloaded immediately after the reception of an incoming text message is detected.

Additionally, the phishing confirmation unit 205 can check whether a specific program is automatically downloaded immediately after the selection of the received text is detected. That is, the phishing confirmation unit 205 can check whether a specific program is automatically downloaded not only immediately after the received text is received, but also immediately after the user selects the received text.

This is to prevent the risk of being exposed to phishing again if the user clicks on the URL of the text message even if the user is warned by storing the phishing warning text immediately after receiving the text message.

The URL extraction unit 206 can generate an image including text in a received character, extract text from the image using OCR, and extract a URL from the text.

For example, if an incoming text containing “Big chance, please visit the site below https://examplexxx.com/download/ ” is stored in the text inbox, “For big chance, please visit the site below: https://examplexxx.” com/download/" can be created as an image, and only the URL "examplexxx.com/download/" can be extracted from the generated image using OCR.

If a specific program is not automatically downloaded when accessing the path corresponding to the URL, the access permission unit 207 may permit access to the path corresponding to the URL.

If a specific program is automatically downloaded when accessing the path corresponding to the URL, the access permission unit 207 may block access to the path corresponding to the URL.

Specifically, the phishing blocking service server 110 connects to the URL in the received text, receives a response from the external server 120, checks whether a specific program is automatically downloaded according to the received response, and sends the confirmation result to the user terminal. It can be sent to (100).

The access permission unit 207 can determine whether to permit or block the download of a specific program through the confirmation result of the phishing blocking service server 110.

Figure 3 is a signal flow diagram of a method for storing a phishing warning text in a text inbox through a text management processor when the calling number is not stored in the contact list according to an embodiment of the present invention.

Referring to FIG. 3, in step S301, the anti-phishing processor 201 may detect the receipt of an incoming text message through the text management service processor 208.

In step S302, the anti-phishing processor 201 may request confirmation of the originating number of the received text message through the contact management processor 209.

In step S303, the contact management processor 209 may transmit to the phishing blocking processor 201 whether the originating number of the received text is stored in the contact list.

If the calling number is stored in the contact list in step S304, the phishing blocking processor 201 may be terminated in step S305.

If the calling number is not stored in the contact list in step S304, the phishing blocking processor 201 may store a phishing warning text in the text inbox through the text management service processor 208 in step S306.

From the above description. Steps S301 to S306 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present invention. Additionally, some steps may be omitted or the order between steps may be switched as needed.

Figure 4 shows a method of checking whether a specific program is automatically downloaded when accessing the path corresponding to the URL in the received text and allowing or blocking access to the path corresponding to the URL according to an embodiment of the present invention. This is a signal flow diagram for .

Referring to FIG. 4, in step S401, the user terminal 100 may extract a URL from the received text.

In step S402, the user terminal 100 may transmit the extracted URL to the phishing blocking service server 110.

In step S403, the phishing blocking service server 110 may transmit a request to confirm the file size responded to by the external server.

In step S404, the external server may transmit a response to the connection request. At this time, if the external server's response is a file, the external server transmits the file size value to the phishing blocking service server 110, and the external server's response If this is not the case, a preset value (eg, 0 or -1) may be transmitted to the phishing prevention service server 110.

In step S405, the anti-phishing service server 110 may check whether a specific program is automatically downloaded according to the response type. For example, when receiving a file size value from an external server, the phishing blocking service server 110 determines that a specific program is automatically downloaded when accessing the path corresponding to the URL, and receives a preset value from the external server. In one case, when accessing the path corresponding to the URL, it may be determined that a specific program is not automatically downloaded.

In step S406, the anti-phishing service server 110 may transmit to the user terminal 100 whether to download a specific program based on the determination result in step S405.

In step S406, the user terminal 100 may permit or block access to a specific program based on whether the specific program is downloaded.

Figure 5 is a flowchart of a method for providing a phishing blocking service according to an embodiment of the present invention.

The method of providing a phishing blocking service according to the embodiment shown in FIG. 5 includes steps processed in time series according to the embodiment shown in FIGS. 1 to 4.

Therefore, even if the content is omitted below, it also applies to the user terminal that provides the phishing blocking service according to the embodiment shown in FIGS. 1 to 5.

In step S501, the reception of a text through the text management processor 208, which manages text transmitted and received by the user terminal, can be detected.

In step S502, the originating number of the received text detected through the text management processor can be confirmed.

In step S503, it is possible to check whether the calling number is saved through the management processor 209, which manages the contact information stored in the user terminal.

If the calling number is not saved in the contact list in step S504, the phishing warning text may be stored in the text inbox through the text management processor.

One embodiment of the present invention may also be implemented in the form of a recording medium containing instructions executable by a computer, such as program modules executed by a computer. Computer-readable media can be any available media that can be accessed by a computer and includes both volatile and non-volatile media, removable and non-removable media. Additionally, computer-readable media may include all computer storage media. Computer storage media includes both volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data.

The description of the present invention described above is for illustrative purposes, and those skilled in the art will understand that the present invention can be easily modified into other specific forms without changing the technical idea or essential features of the present invention. will be. Therefore, the embodiments described above should be understood in all respects as illustrative and not restrictive. For example, each component described as single may be implemented in a distributed manner, and similarly, components described as distributed may also be implemented in a combined form.

The scope of the present invention is indicated by the claims described later rather than the detailed description, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. .

100: user terminal
110: Anti-phishing processor server
201: Anti-phishing processor
202: Text reception detection unit
203: Caller number confirmation unit
204: Phishing warning text storage unit
205: Phishing confirmation unit
206: URL extractor
207: Access permission unit
208: Character management processor
209: Contact Management Processor

Claims (17)

In a method of providing a phishing blocking service that detects and warns of phishing through text messages on a user terminal,
Detecting reception of a received text through a text management processor that manages text transmitted and received by the user terminal;
Confirming the originating number of the detected received text through the text management processor;
Confirming whether the calling number is stored through a contact management processor that manages contact information stored in the user terminal; and
If the calling number is a number not stored in the contact list, storing a phishing warning text in the text inbox through the text management processor.
A method of providing a phishing blocking service including.
According to claim 1,
The step of saving the phishing warning text is
A method of providing a phishing blocking service, comprising the step of transmitting an API that generates the phishing warning text to the text management processor and exposes it at the top of the text inbox.
According to claim 1,
Checking whether a specific program is automatically downloaded when accessing the path corresponding to the URL in the received text message
A method of providing a phishing blocking service, further comprising:
According to claim 3,
The step of checking whether the specific program is automatically downloaded is
A method of providing a phishing blocking service, which is performed immediately after the reception of the received text message is detected.
According to claim 3,
The step of checking whether the specific program is automatically downloaded is
A method of providing a phishing blocking service, which is performed immediately after selection of the received text is detected.
According to claim 3,
The step of checking whether the specific program is automatically downloaded is
generating an image including text within the received character; and
Extracting the text from the image using OCR and extracting a URL from the text
A method of providing a phishing blocking service, including:
In clause 3
The step of checking whether the specific program is automatically downloaded is
If the specific program is not automatically downloaded when accessing the path corresponding to the URL, allowing access to the path corresponding to the URL, a method of providing a phishing blocking service.
In clause 3
A method of providing a phishing blocking service, comprising the step of blocking access to the path corresponding to the URL when the specific program is automatically downloaded when accessing the path corresponding to the URL.
In a user terminal that provides a phishing blocking service that detects and warns of phishing through text messages,
a text reception detection unit that detects receipt of a text message received through a text management processor that manages text messages transmitted and received by the user terminal;
A calling number confirmation unit that checks the calling number of the detected received text through the text management processor and checks whether the calling number is stored through a contact management processor that manages contact information stored in the user terminal; and
a phishing warning text storage unit that stores a phishing warning text in a text inbox through the text management processor when the calling number is a number not stored in the contact list;
A user terminal including. According to clause 9,
The phishing warning text storage unit transmits an API that generates the phishing warning text to the text management processor and exposes it at the top of the text inbox.
According to clause 9,
Phishing confirmation unit that checks whether a specific program is automatically downloaded when accessing the path corresponding to the URL in the received text message
A user terminal further comprising:
According to claim 11,
The phishing confirmation unit checks whether the specific program is automatically downloaded when accessing the path corresponding to the URL in the received text immediately after the reception of the received text is detected.
According to claim 11,
The phishing confirmation unit checks whether the specific program is automatically downloaded when accessing the path corresponding to the URL in the received text immediately after the selection of the received text is detected.
According to claim 11,
The phishing confirmation unit generates an image including text in the received text, extracts the text from the image using OCR, and includes a URL extractor for extracting a URL from the text.
According to claim 11,
The phishing confirmation unit includes a connection permission unit that allows access to the path corresponding to the URL when the specific program is not automatically downloaded when accessing the path corresponding to the URL.
According to claim 14,
The access permission unit blocks access to the path corresponding to the URL when the specific program is automatically downloaded when accessing the path corresponding to the URL.
A computer program stored in a computer-readable recording medium containing a sequence of instructions for providing a phishing blocking service that detects and warns of phishing through text messages at a user terminal, comprising:
When the computer program is executed by a computing device,
Detects reception of incoming text through a text management processor that manages text sent and received by the user terminal,
Confirm the originating number of the detected received text through the text management processor,
Check whether the calling number is stored through a contact management processor that manages contact information stored in the user terminal,
A computer program stored in a computer-readable recording medium, comprising a sequence of instructions for storing a phishing warning text in a text inbox through the text management processor when the calling number is a number not stored in the contact information.

Images