WO2012148098A1

WO2012148098A1 - Safeguard device and method

Info

Publication number: WO2012148098A1
Application number: PCT/KR2012/002664
Authority: WO
Inventors: 배현섭; 오승욱; 조민성; 박달호
Original assignee: 슈어소프트테크주식회사
Priority date: 2011-04-28
Filing date: 2012-04-09
Publication date: 2012-11-01
Also published as: KR101283884B1; KR20120121977A

Abstract

One embodiment of the present invention relates to a safeguard device and method, and more particularly, to a safeguard device and method for blocking the execution of a specific application program in advance on the basis of an action of the latter. The safeguard device according to said embodiment comprises: a monitoring unit for determining whether or not a call is a monitoring target after receiving said call from an application program; a blocking unit for receiving, from said monitoring unit, an inquiry request on whether or not to execute said call if said call is a target for said monitoring; and a blocking determining unit for receiving, from said blocking unit, said inquiry request on whether or not to execute the call, determining whether or not to execute said call according to a blocking rule, and requesting that the blocking unit block the execution of said application program if the blocking rule applies to said call. Said blocking unit blocks the execution of said application program when a request for blocking said application program is received from said blocking determining unit.

Description

Safeguard device and method

An embodiment of the present invention relates to a safeguard device and method, and more particularly to a safeguard device and method that can block the execution of a specific application in advance based on the behavior.

The mobile phone market is rapidly developing centering on the smartphone market equipped with a predetermined operating system. The most important factor that distinguishes between ordinary mobile phones and smartphones is whether users can install the desired application.

The mobile platform refers to a foundational software environment for running mobile phone applications.

An example of a mobile platform is the Android platform.

The Android platform represents Google's open source software platform and peripherals for mobile phones.

The Android platform consists of five software layers. The five layers are Applications, Application Framework, Libraries, Android Runtime, and Linux Kernel.

The Android platform is evolving through the Open Handset Alliance (OHA), which includes major mobile phone and semiconductor manufacturers worldwide, as well as carriers, system software developers, and application developers.

The Android platform is based on Linux, an open source operating system, so it is easy to port to various hardware or give new functions, uses the Java language, and has an API (Application Programming Interface) that can directly use Google's various Internet services. .

However, these Android platforms have several security vulnerabilities: For example, unlike the Apple App Store, Android Market does not have a developer verification process or an application security verification process, making it easy to register malicious applications. In addition, the user's responsibility for judging and installing malicious applications is entirely up to the user. In other words, there is no verification process for the user to control the access rights of the malicious application. In addition, there is a problem that a malicious application disguised as a normal application operates through a multitasking function.

On the other hand, in certain conventional areas, for example, national institutions and private companies that require security maintenance, stickers are attached to USB ports or cameras of visitors' terminals (laptops, mobile phones, etc.). This is to prevent leakage of important information of institutions and companies through the terminal of the visitor.

This method requires manual labor, which may cause difficulties in operation and may also cause damage to the visitor's terminal. In addition, even if the sticker is attached to the visitor's terminal, the visitor can easily remove the sticker, it is difficult to maintain security.

The embodiment provides a safeguard device and a method which can block execution of a specific application in advance.

In addition, the embodiment provides a safeguard device and method that can block the execution of a specific application in advance at a specific time or a specific region.

According to an embodiment of the present disclosure, a safeguard device may include: a monitoring unit configured to receive a call from an application program and determine whether the call is to be monitored; A blocking unit provided with an inquiry request for executing the call from the monitoring unit if the call is the monitoring target; And receiving the execution status inquiry request from the blocking unit, determining whether to execute the call according to a blocking rule, and determining whether to block the execution of the application program to the blocking unit if the call corresponds to the blocking rule. And a blocking unit that blocks the execution of the application program when the blocking determination unit is requested to block the application program.

Here, the monitoring unit may have a specific call list, and the monitoring unit may determine whether the call is the monitoring target by using the specific call list.

The blocking determination unit may include a database, and the database may store the blocking rule, and record a call corresponding to the blocking rule and the application program.

Here, the blocking determination unit may request an update of the blocking rule to the safeguard server, and receive the updated blocking rule from the safeguard server.

The apparatus may further include a confirmation unit configured to receive and display call information corresponding to the blocking rule and information of the application program from the blocking determination unit.

The blocking determination unit may update the blocking rule from a safeguard server, the confirmation unit may receive the updated blocking rule information from the blocking determination unit, and display the provided blocking rule information to the user.

Here, the confirmation unit may include a database, and the database may store and record call information corresponding to the blocking rule and information of the application program.

The safeguard device may be included in an Android operating system, the detecting unit and the blocking unit may be included in a library core of the Android operating system, and the blocking determining unit may be included in an application framework of the Android operating system.

The confirmation unit may further include a confirmation unit that receives the call information corresponding to the blocking rule and the application program information from the blocking determination unit and displays the same to the user, and the confirmation unit may be implemented as an application of the Android operating system.

According to an exemplary embodiment, a safeguard method may include: determining whether a call is to be monitored when receiving a call from an application program; Requesting whether the call is executed if the call is to be monitored; Determining if the call corresponds to a blocking rule; And blocking the execution of the application if the call corresponds to the blocking rule.

Here, if the call is not the monitoring target may include executing the application program.

Here, if the call does not correspond to the blocking rule may include executing the application program.

Here, the method may further include receiving the blocking rule from the safeguard server.

The method may further include displaying call information corresponding to the blocking rule and information of the application program.

Here, the step of updating the blocking rule from the safeguard server; And displaying the update blocking rule information.

Using the safeguard device and method according to the embodiment, since the execution of the application to perform a specific action in advance, there is an advantage that can protect the user information from potential security threats defined by the specific action. This can effectively block unknown malicious applications compared to the method based on the list of malicious applications taken by existing vaccines, and thus can proactively block security threats.

In addition, at a specific time or in a specific region, for example, the execution of a predetermined application among the applications included in the terminal of a user entering or exiting a government agency or a corporation is blocked in advance, thereby providing valuable information of a national agency or a private company. There is an advantage that can be protected safely.

1 is a block diagram of an application blocking system according to an embodiment.

FIG. 2 is a flowchart of a safeguard device according to an embodiment of the present invention shown in FIG. 1.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an application program blocking system according to an exemplary embodiment.

Referring to FIG. 1, an application blocking system may include a safeguard device 100 and a safeguard server 300.

The safeguard device 100 may be software included in an operating system of a user terminal. It may also be hardware included in the user terminal.

The safeguard device 100 may block execution of a specific application in the application unit 170 in advance or may execute execution of an abnormal application that operates in conjunction with a normally operating application. You can block in advance. Hereinafter, the safeguard device 100 will be described in detail.

The safeguard apparatus 100 may include a monitoring unit 110, a blocking unit 130, and a blocking determining unit 150.

The monitoring unit 110 receives a call from all application programs App1, App2, and App3 of the application program unit 170, and determines whether the call is to be monitored.

Here, the monitoring unit 110 has a specific call list and may determine whether the call is to be monitored using the specific call list. The specific call list monitors the call of the second or third application (App2, App3) when the second or third application (App2, App3) is called together with the call of the first application (App1). Or if the second or third application (App2, App3) is called while the first application (App1) is running, the call of the second or third application (App2, App3) is designated as a watch target. It may include. In addition, the specific call list may include content of designating a call of a specific application among all the applications (App1, App2, App3) as a monitoring target at a specific time or at a specific place.

When the monitoring unit 110 receives a call from the applications (App1, App2, App3), the monitoring unit 110 determines whether or not the current call is monitored by comparing with a predetermined specific call list. If the call is to be monitored, the monitoring unit 110 requests the blocking unit 130 to check whether the call is executed. On the other hand, if the call is not watched, the application runs. Here, the execution request inquiry request for the call may include the information of the call and other calls, or the information of the currently running application program.

For example, if a specific call list of the monitoring unit 110 includes a call of the recording function together with a call of the telephone function, and a call of the recording function during the execution of the telephone function, the monitoring unit 110 calls the recording function. After determining that it corresponds to the monitoring target, the request is made to the blocking unit 130 to determine whether the call is executed.

When the blocking unit 130 receives a call execution inquiry request from the monitoring unit 110, the blocking unit 130 transmits the request to the blocking determining unit 150.

When the blocking unit 130 receives a call execution result inquiry result from the blocking determining unit 150, that is, a blocking request of the application program, the blocking unit 130 blocks the execution of the application program through an exception.

The blocking determination unit 150 receives a request for inquiring whether to execute a call from the blocking unit 130. Then, the block determining unit 150 determines whether the call is executed. The execution of the call can be determined by querying a pre-stored blocking rule.

The blocking rule may be similar to a specific call list stored in the monitoring unit 110.

In addition, the blocking rule may be stored in the blocking rule database DB. In this case, the blocking determination unit 150 may determine whether the call is executed by calling the blocking rule stored in the blocking rule database DB. Here, the blocking rule database DB may be included in the blocking determining unit 150.

The block determining unit 150 determines whether the call is executed or not by using a blocking rule and determines whether to block the application that is the subject of the call if the call corresponds to the blocking rule. request.

The blocking determination unit 150 may record the call information corresponding to the blocking rule and the information of the application program which is the subject of the call, and transmit the recorded call information and the information of the application program to the confirming unit 190. Here, the recorded call information and the information of the application program may be stored in the blocking record database DB. Here, the blocking record database may be included in one database together with the blocking rule database, or may be separate databases.

The blocking determination unit 150 may receive the blocking rule from the safeguard server 300. The blocking determination unit 150 may receive a new blocking rule from the safeguard server 300 by periodically requesting the update to the safeguard server 300. In addition, when the blocking rule stored in the safeguard server 300 is newly updated, the safeguard server 300 may immediately provide the new blocking rule to the blocking determination unit 150. When the blocking determination unit 150 receives a new blocking rule from the safeguard server 300, the blocking determining unit 150 may store or update the new blocking rule in the blocking rule database DB.

The blocking determination unit 150 may store / update the new blocking rule and then transfer the stored / updated blocking rule information to the confirming unit 190.

The safeguard device 100 may further include a verification unit 190.

The identification unit 190 receives the call information corresponding to the blocking rule and the information of the application program that is the subject of the call from the blocking determination unit 150. In addition, it is provided with the information of the saved / updated blocking rule.

The identification unit 190 may display the call information corresponding to the blocking rule and the information of the application program that is the subject of the call and notify the user. In addition, the identification unit 190 may display the stored / updated blocking rule information and provide the same to the user.

Meanwhile, the blocking rule database and the blocking record database may not be included in the blocking determining unit 150 but may be included in the checking unit 190.

The safeguard device 100 may be applied to an Android operating system, which is an example of an open operating system (OS). In detail, the monitoring unit 110 and the blocking unit 130 may be applied to a library core of the Android OS, and the blocking determination unit 150 may be applied to an application framework. In addition, the verification unit 190 may be applied as an application program. When the safeguard device 100 is included in the Android operating system (OS), the user terminal having the Android operating system may block execution of a specific application in advance. Here, the safeguard device 100 may be used in other operating systems as well as the Android operating system. For example, the safeguard apparatus 100 may be applied to a remote operating system.

The safeguard server 300 provides a blocking rule to the blocking determining unit 150 of the safeguard device 100. The safeguard server 300 may provide the blocking rule only when the blocking determination unit 150 requests it, and may provide the blocking rule to the blocking determination unit 150 without a request. Here, the blocking rule may be a list of application programs that the safeguard device 100 should block. The list of applications may include applications that need to be blocked as well as applications that need to be blocked. By the safeguard server 300, the safeguard device 100 may update an application that is continuously changed / added and block the execution of a specific application in advance.

The safeguard system according to an embodiment of the present invention may block execution of a specific application program of a terminal of a visitor visiting a national institution or a private company, in particular, a camera, recording, wireless network connection, and file upload / download. . Here, it is assumed that the safeguard device 100 is built in the terminal of the visitor.

For example, a national agency / private enterprise (User) may request the safeguard server 300 to block execution of a specific application of a specific terminal through wired / wireless communication. The safeguard server 300 generates a new blocking rule and transmits the generated blocking rule to the visitor's terminal. Here, the generated blocking rule may include blocking execution of a specific application at a specific time or at a specific region. Until the user unblocks the specific application, the visitor's terminal continues to block the execution of the specific application in advance.

Since the visitor's terminal receiving the blocking rule from the safeguard server 300 has a built-in safeguard device 100, when the blocking rule is updated from the safeguard server 300, the visitor's terminal receives the blocking rule from the safeguard server 300. Execution is blocked in advance.

2 is a flowchart of a safeguard device 100 according to an exemplary embodiment of the present invention shown in FIG. 1.

1 and 2, when a specific call of a certain application program is transmitted to the detection unit 110 (S201), the detection unit 110 determines whether the call is to be monitored (S202). Here, the detection unit 110 may determine whether the call is to be monitored using a specific call list. If the call is to be monitored, the detection unit 110 requests the blocking unit 130 to inquire whether to execute the call (S203), and the blocking unit 130 transmits the inquiry to the blocking determination unit 150. . On the other hand, if the call is not monitored, the safeguard device 100 executes an application program.

The blocking determination unit 150 determines whether the call corresponds to a blocking rule (S204). If the call corresponds to a blocking rule, the blocking determination unit 150 instructs the blocking unit 130 to block the execution of the application, and the blocking unit 130 blocks the execution of the application (S209). Here, the block determining unit 150 transmits the call information and application information corresponding to the blocking rule to the check unit 190 before giving the block command to the block unit 130, the check unit 190 to the user The call information and the application program information can be informed (S208). When the information is transmitted to the identification unit 190 and the identification unit 190 informs the user, the user may provide an opportunity to delete the harmful application later. When the user inputs a block confirmation through the check unit 190, the check unit 190 informs this information to the block determining unit 150, the block determining unit 150 to block the application program block 130 You can also lower.

The identification unit 190 may receive the details of the application programs blocked from the past to the present from the blocking determination unit 150 and display the details to the user (S210).

Meanwhile, between S203 and S204, the block determining unit 150 may request the safeguard server 300 to update the blocking rule and receive a new blocking rule from the safeguard server 300 (S205).

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

Claims

A monitoring unit which receives a call from an application program and determines whether the call is to be monitored;

A blocking unit provided with an inquiry request for executing the call from the monitoring unit if the call is the monitoring target; And

A blocking determination unit which receives the execution status inquiry request from the blocking unit, determines whether the call is executed according to a blocking rule, and requests that the execution of the application program be blocked by the blocking unit if the call corresponds to a blocking rule; Including;

The blocking unit, the safeguard device to block the execution of the application when the request to block the application from the blocking determination unit.
The method of claim 1,

The monitoring unit has a specific call list,

And the monitoring unit determines whether the call is to be monitored using the specific call list.
The method of claim 1,

The blocking determination unit includes a database,

The database stores the blocking rule and records the call and the application corresponding to the blocking rule.
The method of claim 1,

The blocking determining unit may request an update of the blocking rule to a safeguard server, and receive an updated blocking rule from the safeguard server.
The method of claim 1,

And a confirmation unit for receiving and displaying call information corresponding to the blocking rule and information of the application from the blocking determination unit.
The method of claim 5,

The blocking determination unit updates the blocking rule from the safeguard server,

The confirmation unit receives the updated blocking rule information from the blocking determination unit, and displays the provided blocking rule information to the user.
The method of claim 5,

The verification unit includes a database,

The database is a safeguard device for storing and recording the call information and the information of the application corresponding to the blocking rule.
The method of claim 1,

The safeguard device is included in the Android operating system,

The detection unit and the blocking unit is included in the library core of the Android operating system,

The blocking determination unit is a safeguard device included in an application framework of the Android operating system.
The method of claim 8,

Further comprising a confirmation unit for receiving the call information and the application information corresponding to the blocking rule from the blocking determination unit to display to the user,

The confirmation unit is a safeguard device implemented as an application of the Android operating system.
When receiving a call from an application program, determining whether the call is to be monitored;

Requesting whether the call is executed if the call is to be monitored;

Determining if the call corresponds to a blocking rule; And

Blocking execution of the application if the call corresponds to the blocking rule;

Safeguard method comprising a.
The method of claim 10,

And if the call is not the monitored object, executing the application program.
The method of claim 10,

Running the application if the call does not correspond to the blocking rule.
The method of claim 10,

Safeguard method further comprises the step of updating the blocking rule from the safeguard server.
The method of claim 10,

And displaying the call information corresponding to the blocking rule and the information of the application program.
The method of claim 14,

Receiving the blocking rule from a safeguard server; And

And displaying the update blocking rule information.