WO2019135425A1

WO2019135425A1 - Open source software license verification method and system

Info

Publication number: WO2019135425A1
Application number: PCT/KR2018/000162
Authority: WO
Inventors: 김태우; 정명주; 전상훈
Original assignee: 라인플러스 주식회사
Priority date: 2018-01-04
Filing date: 2018-01-04
Publication date: 2019-07-11
Also published as: KR102462541B1; JP2021516379A; KR20200096766A; JP7119096B2

Abstract

Disclosed are an open source software license verification method and system. The license verification method, according to embodiments of the present invention, may enable the testing of an open source software license. The license verification method, according to one embodiment, may enable the verification of an open source software license through a binary code built without the source code of the developer by using a predetermined code form such as a smali code in an android environment. The license verification method, according to another embodiment, may enable the verification of an open source software license, even for a code having an obfuscated character string, by comparing forms according to package file structure.

Description

Methods and systems for validating licenses for open source software

The following description relates to a method and system for validating licenses for open source software, and more particularly to a method of validating licenses for examining licenses for open source software, computing devices that perform the above license verification methods, And a computer program stored in a computer-readable recording medium for causing the computer to execute the license verification method and a recording medium therefor.

Open source software is freely used in software development, but if used for commercial purposes, you must adhere to the license terms. Depending on the organization and nature of the open source software, different licenses are followed. Typically, there are licenses such as Berkeley Software Distribution (BSD), General Public License (GPL), and Apache, licensed for use, reproduction, adaptation, There is also.

In addition, as the use of open source software increases, the number of cyber attacks exploiting open source security vulnerabilities is increasing every year. Even with security vulnerabilities already found in poor open source security management, the situation has been left untouched and the damage is occurring. Because open source, including vulnerabilities, can be included in the software and distributed, it requires management of the open source used.

In the prior art, the open source license inspection system receives the developer's source code as input, and compares the developer's code with the code of the open source software to determine the open source software used. In this case, the developer must deliver the source code to the system for the open source license inspection, and leakage of the source code, which is the developer's property, may cause inconvenience and disfavor .

A computer program for performing the license verification method, and a computer program stored in a computer-readable recording medium for causing the computer to execute the license verification method in combination with the computer, Thereby providing a recording medium.

A license verification method that can validate the license of open source software through a binary code that is built without a developer's source code by utilizing predetermined code form such as smali code in an Android environment, a computer device performing the license verification method, And a computer program stored in a computer-readable recording medium for causing the computer to execute the license verification method in combination with the computer.

A license verification method capable of verifying license of open source software for a code obfuscated through a type comparison according to the structure of a package file, a computer device performing the license verification method, and a computer verification device A computer program stored in a computer-readable recording medium for causing the computer to execute the program, and a recording medium therefor.

A method for validating a license, comprising: downloading open source software; Extracting method call information from the downloaded open source software; Generating a pattern of a predetermined code type using the extracted method call information; And storing the generated pattern in a database in association with the identifier of the downloaded open source software.

According to one aspect, the license verification method includes: receiving a package file to be inspected; Extracting an executable file of the package file; Converting the extracted executable file into the predetermined code form; Extracting method call information from an executable file converted into the predetermined code form; And comparing the extracted method call information with a pattern stored in the database.

A method for validating a license, comprising: downloading open source software; Generating data of a first tree structure corresponding to a directory structure of the downloaded open source software; And storing the data of the first tree structure in association with an identifier of the corresponding open source software in a database.

According to one aspect of the present invention, the license verification method includes: receiving a package file to be inspected; Generating data of a second tree structure corresponding to a directory structure of the input package file; And comparing the data of the second tree structure with the data of the first tree structure stored in the database.

There is provided a computer program stored in a computer-readable medium for causing a computer to execute the license verification method in combination with a computer.

There is provided a computer readable recording medium having recorded thereon a program for causing a computer to execute the license verification method.

A computer device comprising: at least one processor configured to execute computer readable instructions, the at least one processor downloading open source software, extracting method call information from the downloaded open source software, Generates a pattern of a predetermined code type using the extracted method call information, and stores the generated pattern in a database in association with the identifier of the downloaded open source software.

A computer device, comprising: at least one processor configured to execute computer readable instructions, the at least one processor downloading open source software, 1 tree structure, and stores the data of the first tree structure in association with the identifier of the corresponding open source software in the database.

A computer program for performing the license verification method, and a computer program stored in a computer-readable recording medium for causing the computer to execute the license verification method in combination with the computer, A recording medium can be provided.

You can also validate open source software licenses through binary code that is built without the developer's source code, using preconfigured code types such as the smali code in the Android environment.

You can verify the license of open source software for code obfuscated by string through the type comparison according to the structure of the package file.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.

2 is a block diagram illustrating an example of a computing device in accordance with an embodiment of the present invention.

Figure 3 is a flow chart illustrating an example of a method for collecting patterns of open source software in one embodiment of the present invention.

4 is a flowchart illustrating an example of a method for checking whether open source software is used using a pattern in an embodiment of the present invention.

5 is a diagram showing an example of generating a pattern of the smali code form from the source code of open source software in an embodiment of the present invention.

6 and 7 are diagrams illustrating an example of converting a Dex file into an smali code in an embodiment of the present invention.

8 is a diagram showing an example of a smali code corresponding to a Java code and a Java code in an embodiment of the present invention.

9 is a flowchart illustrating an example of a method of collecting the structure of a package file as a pattern of open source software, according to an embodiment of the present invention.

FIG. 10 is a flowchart illustrating an example of a method for checking whether open source software is used through a type comparison according to the structure of a package file, according to an embodiment of the present invention.

11 is a diagram showing an example of a directory structure of a package file according to an embodiment of the present invention.

12 is a diagram showing an example of a tree structure corresponding to a directory structure in an embodiment of the present invention.

13 is a diagram showing an example of an aligned tree structure in an embodiment of the present invention.

14 is a diagram showing an example of serialized and stored data in an embodiment of the present invention.

15 and 16 are views showing a comparative example of a tree structure in an embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The license verification system according to embodiments of the present invention can be implemented through a computer device such as a server to be described later. At this time, a computer program according to an embodiment of the present invention can be installed and driven in the computer apparatus, and the computer apparatus can perform the license verification method according to the embodiments of the present invention under the control of the computer program that is driven . The above-described computer program may be stored in a computer-readable recording medium in combination with a computer apparatus for executing a license verification method on the computer.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. 1 shows an example in which a plurality of

electronic devices

110, 120, 130, 140, a plurality of

servers

150, 160, and a network 170 are included. 1, the number of electronic devices and the number of servers are not limited to those shown in FIG.

The plurality of

electronic devices

110, 120, 130, 140 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the plurality of

electronic devices

110, 120, 130 and 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook, a digital broadcast terminal, a PDA (Personal Digital Assistants) ), And tablet PCs. For example, FIG. 1 illustrates the shape of a smartphone as an example of the first electronic device 110, but in the embodiments of the present invention, the first electronic device 110 transmits the network 170 using a wireless or wired communication method. Or any of a variety of physical computer devices capable of communicating with other

electronic devices

120, 130, 140 and / or servers 150,

The communication method is not limited, and may include a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 may include, as well as a short-range wireless communication between the devices. For example, the network 170 may be a personal area network (LAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN) , A network such as the Internet, and the like. The network 170 may also include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, It is not limited.

Each of the

servers

150 and 160 is a computer device or a plurality of computers that communicate with a plurality of

electronic devices

110, 120, 130 and 140 through a network 170 to provide commands, codes, files, Lt; / RTI > devices. For example, the server 150 may be a system that provides a first service to a plurality of

electronic devices

110, 120, 130, 140 connected through a

network

170, 170, and 140 to the first and second

electronic devices

110, 120, 130, and 140, respectively. As a more specific example, the server 150 transmits a file for installing and operating an application to a plurality of

electronic apparatuses

110, 120, 130, 140 as a first service, ). In addition, the server 160 can provide a service desired by the application to the plurality of

electronic devices

110, 120, 130, and 140 as the second service through the application.

At this time, a license verification system according to embodiments of the present invention may be implemented in the server 150. [ The license verification system can detect the use of the open source software for the file for installing and running the application registered in the server 150 from the developer and can provide the license information of the detected open source software to the administrator. The license verification system may be implemented as a separate computer device that is separate from the server 150 and may be linked to the server 150 through the network 170. [

2 is a block diagram illustrating an example of a computing device in accordance with an embodiment of the present invention. Each of the plurality of

electronic devices

110, 120, 130, 140 described above or the

servers

150, 160 and the license verification system according to the embodiments of the present invention are connected to the computer device 200 shown in FIG. 2 And a license verification method according to an embodiment may be performed by a license verification system implemented by such a computer device 200. [ If a license verification system is implemented in the server 150, another license verification method may be performed in embodiments of the present invention by the computer device 200 implementing the server 150. [ For example, a computer program according to one embodiment may be installed and operated in the computer device 200, and the computer device 200 may be provided with a license verification method according to embodiments of the present invention Can be performed. According to an embodiment, the license verification system may be implemented through a combination of a plurality of computer devices.

The computer device 200 may include a memory 210, a processor 220, a communication interface 230, and an input / output interface 240, as shown in FIG. The memory 210 may be a computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), and a disk drive. The non-decaying mass storage device, such as a ROM and a disk drive, may be included in the computer device 200 as a separate persistent storage device separate from the memory 210. Also, the memory 210 may store an operating system and at least one program code. These software components may be loaded into the memory 210 from a computer readable recording medium separate from the memory 210. [ Such a computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, and a memory card. In other embodiments, the software components may be loaded into the memory 210 via the communication interface 230 rather than from a computer readable recording medium. For example, the software components may be loaded into the memory 210 of the computer device 200 based on a computer program installed by files received via the network 170.

The processor 220 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the processor 220 by the memory 210 or the communication interface 230. For example, the processor 220 may be configured to execute a command received in accordance with a program code stored in a recording device, such as the memory 210. [

The communication interface 230 may provide functionality for the computer device 200 to communicate with another device (e. G., The storage devices described above) via the network 170. For example, a request, command, data, file, or the like, generated by the processor 220 of the computer device 200 according to the program code stored in the recording device such as the

memory

210, 170 to other devices. Conversely, signals, commands, data, files, etc., from other devices may be received by the computer device 200 via the communication interface 230 of the computer device 200 via the network 170. Data or the like received via the communication interface 230 may be transferred to the processor 220 or the memory 210 and the file or the like may be transferred to a storage medium Permanent storage).

The input / output interface 240 may be a means for interfacing with the input / output device 250. For example, the input device may include a device such as a microphone, a keyboard or a mouse, and an output device may include a device such as a display, a speaker, and the like. As another example, the input / output interface 240 may be a means for interfacing with a device having integrated functions for input and output, such as a touch screen. The input / output device 250 may be composed of the computer device 200 and one device.

Also, in other embodiments, the computer device 200 may include fewer or more components than the components of FIG. However, there is no need to clearly illustrate most prior art components. For example, the computer device 200 may be implemented to include at least some of the input / output devices 250 described above, or may further include other components such as a transceiver, database, and the like.

Figure 3 is a flow chart illustrating an example of a method for collecting patterns of open source software in one embodiment of the present invention. The method according to the present embodiment may be included in the license verification method according to an embodiment, and may be performed by the computer device 200 described above. For example, the processor 220 of the computer device 200 may be implemented to execute control instructions in accordance with the code of the operating system or the code of at least one program that the memory 210 includes. Here, the processor 220 is configured to cause the computer device 200 to perform the steps 310 to 340 included in the method of FIG. 3 in accordance with the control command provided by the code stored in the computer device 200. [ Can be controlled.

At step 310, the computer device 200 may download open source software. For example, the computer device 200 may download a plurality of open source software from at least one of a plurality of sites that share the source code of the open source software, (320) to (340) below.

In step 320, the computer device 200 may extract the method call information from the downloaded open source software. For example, the method call information is information required to call a specific method. In Java code, it may include a class path name, a class name, a method name, a number of method arguments, and a type of each argument. At this time, the computer device 200 can extract at least the class path name, the class name, and the method name as the method calling information. Depending on the embodiment, at least one of the number of method arguments and the type of each argument may be further extracted as method call information.

In step 330, the computer device 200 may generate a pattern of a predetermined code type using the extracted method call information. For example, the computer device 200 can generate a pattern of a smali code form used in an APK (Android application package) file, which is a package file for an Android application, using the extracted method call information. As will be described in more detail later, the pattern of the smali code form may include a class path name, a class name, and a method name.

In step 340, the computer device 200 may store the generated pattern in a database in association with the identifier of the corresponding open source software. For example, the identifier of the open source software may be the name of the corresponding open source software. In addition, at least one pattern may be generated for each of the plurality of downloaded open source software, and the generated patterns may be stored in the database in association with the identifiers of each of the plurality of open source software.

4 is a flowchart illustrating an example of a method for checking whether open source software is used using a pattern in an embodiment of the present invention. The method according to the present embodiment can also be included in the license verification method according to the embodiment. For example, after patterns for each of the various open source software are generated and databaseized through the method according to the embodiment of FIG. 3, an open source software check is performed for a particular application via the method according to the embodiment of FIG. . The method according to the present embodiment can also be performed by the computer apparatus 200 described above. For example, the processor 220 of the computer device 200 may be implemented to execute control instructions in accordance with the code of the operating system or the code of at least one program that the memory 210 includes. Here, the processor 220 is configured to cause the computer device 200 to perform the steps 410 to 440 of the method of FIG. 4 in accordance with the control command provided by the code stored in the computer device 200, Can be controlled.

In step 410, the computer device 200 can receive a package file to be inspected. For example, when the Android application is to be inspected, the computer device 200 can receive an APK file for installing and running the corresponding Android application.

At step 420, the computer device 200 may extract an executable file of the package file. In the above-described example of the Android application, the computer device 200 can decompress the inputted APK file and extract a DAX file such as 'classes.dex' as an executable file. After decompression, the file is located in the root directory of the decompressed directory.

In step 430, the computer device 200 may convert the extracted executable file into a predetermined code format. For example, in the case of using the smali code form described in FIG. 3, the computer device 200 can convert the executable file into the smali code using the baksmali library. If the baksmali library is embedded in the apktool, which is a tool for decompressing the APK file in step 420, the compression of the APK file and the conversion of the dex file into the smali code may be performed at the same time.

In step 440, the computer device 200 may extract the method call information from the executable file converted into a predetermined code form. At this time, the extracted method call information may have the same or similar form as the pattern generated in step 330 of FIG. 3 because the executable file has been converted into the predetermined code form, and at least the class path name, the class name, . &Lt; / RTI > At least one of the number of method arguments and the type of each argument may be further included in the method call information extracted in step 440 according to an embodiment.

At step 450, the computer device 200 may compare the extracted method call information with the pattern stored in the database. At this time, if there is a pattern matching the extracted method call information (or including the extracted method call information) in the database, it is determined in step 410 whether or not the pattern is inputted in accordance with the identifier of the open- You can see that the package file uses the corresponding open source software.

The computer device 200 may then provide the identifier of the searched open source software and the license information matched to the corresponding open source software. In this case, the administrator can know which open source software the package file to search for is using and which license is being applied.

5 is a diagram showing an example of generating a pattern of the smali code form from the source code of open source software in an embodiment of the present invention. FIG. 5 shows an example of Java code 520 included in the Java code file 'Square.java' 510 and 'Square.java' 510 for the corresponding open source software. According to the Java code 520, the 'Square' class shown in the second dotted line box 522 is defined in the package path of 'com.sample.math' shown in the first dotted line box 521, The class includes the method 'getWidth ()' shown in the third dashed line box 523.

The computer device 200 extracts the package path name 'com.sample.math', the class name 'Square', and the method name 'getWidth ()' as the method calling information from the Java code 520 at step 320 .

In this case, the computer device 200 may generate the information 530 in the form of a corresponding smali code, as shown in FIG. 5, using the information extracted in step 330. The 'invoke-virtual' command in the smali code-type information (530) is a command to call a virtual method in the smali code form. In this case, the called method should not be a static method, a private method, a final method, or a constructor method. 'v0' is an instance of the class, 'L' before the class path name 'com.sample.math' may mean that the class is an object type, and 'V' after the method name 'getWidth () It can mean void. The invoke-super command invokes the virtual method of the superclass, the invoke-direct command invokes the direct method B, the invoke-static command invokes the static method, the invoke- interface 'command can be used. At this time, the method invoked through the 'invoke-super' command must not be a static method, a private method, a final method, or a constructor method. Also, the method invoked via the 'invoke-direct' command must not be a static method, and the 'invoke-direct' command can be used to invoke methods that can not be overridden, such as private methods and constructor methods. .

In this case, if you call 'getWidth ()' of the 'Square' class through the class path 'com.sample.math' in the executable file of a particular package file, You will notice that you are using open source software.

Since the package name, which is a path of a class, generally includes a unique name such as a company name and a software name, the risk of redundancy is low. In the case of generating a pattern for two or more classes and methods, Is close to zero.

At this time, the computer device 200 may store 'Lcom / sample / math / square; -> getWidth () V' shown in the fourth dotted line box 540 as a pattern in the database.

6 and 7 are diagrams illustrating an example of converting a Dex file into an smali code in an embodiment of the present invention. The first box 610 in FIG. 6 shows a part of the code of the Dex file 'classes.dex', and the second box 620 in FIG. 7 converts the Dex file 'classes.dex' using the baksmali library It shows some of the code of the smali file 'class.smali'. For example, the computer device 200 converts a dex file 'classes.dex' to a smali file 'class.smali' through a command such as '$ java -jar baksmali.jar -o <output directory> classes.dex' can do.

At this time, the computer device 200 can identify a code for calling a method through the 'invoke-virtual' command in the converted smali file 'class.smali', and extract the method call information from the code.

8 is a diagram showing an example of a smali code corresponding to a Java code and a Java code in an embodiment of the present invention. 7, the first box 710 shows an example of a Java code for outputting a simple message "Toast Hello" using Android 'Toast', and the second box 720 includes a first box 710 ) Is converted into the form of smali code. Actually, it is required to convert the Java code into the code form of the Dex file, and then convert the Dex file to the smali file form as shown in FIG.

At this time, as shown in the dotted box 830, if we look at the code that calls the method 'show ()' of class 'Toast', 'v1' is an instance of class 'Toast', and 'android / widget / Toast' The class path and class, 'show ()' the method, and 'V' the return type void. Thus, the computer device 200 is able to extract the method call information from the executable code converted into the smali code form, and preferably, for comparison with the pattern stored in the database in FIG. 3, "Landroid / widget / Toast; -> show () V "to retrieve method call information.

The computer device 200 can compare the extracted method call information and the pattern read from the database to determine whether they match or not. If they match, the computer device 200 searches the target of the inspection through the identifier of the open source software stored in the database It can be determined that the package file is using the open source software. Since the package name (class path name), class name, and method name represent the company name and the function name, respectively, the risk of duplication is small. However, if there is a risk of duplication, the probability of false positives can be reduced by comparing two or more patterns.

In addition, if it is determined that the package file is using the corresponding open source software, the computer device 200 may determine that the identifier of the corresponding open source software (e.g., open source software name) and the license used by the corresponding open source software An identifier (e.g., a license name) may be provided.

Hereinafter, an embodiment of verifying the license through the type comparison according to the structure of the package file will be described.

9 is a flowchart illustrating an example of a method of collecting the structure of a package file as a pattern of open source software, according to an embodiment of the present invention. The method according to the present embodiment may be included in the license verification method according to an embodiment, and may be performed by the computer device 200 described above. For example, the processor 220 of the computer device 200 may be implemented to execute control instructions in accordance with the code of the operating system or the code of at least one program that the memory 210 includes. Here, the processor 220 may cause the computer device 200 to perform steps 910 through 940, including the method of Figure 9, in accordance with a control command provided by a code stored in the computer device 200. [ Can be controlled.

At step 910, the computer device 200 may download open source software. For example, the computer device 200 may download a plurality of open source software from various sites that share the source code of the open source software, and perform the following steps 920 (Step 940). This step 910 may correspond to the step 310 described with reference to FIG. 3, and if the license verification method includes both the method of FIG. 3 and the method of FIG. 9,

steps

310 and 910 are the same Step.

At step 920, the computer device 200 may generate the tree structure data corresponding to the directory structure of the downloaded open source software. The Java source code collects Java classes of similar nature and creates and classifies directories. This type of directory structure can be a feature of open source software and can be expressed in a tree structure. For example, a directory may be a branch node, and Java code files stored in a directory may be represented by a leaf node. These directory and tree structures are described in more detail below.

At step 930, the computing device 200 may sort the nodes of the generated tree structure. Alignment of nodes in the tree structure may be performed to compare the correspondence with other tree structures, and may be omitted according to the embodiment. Detailed alignment methods are described in more detail below.

In step 940, the computer device 200 may store the data of the aligned tree structure in association with the identifier of the corresponding open source software in the database. The data of the tree structure may be stored in the database as it is in a tree structure, but it may be serialized and stored in consideration of the complexity of database structure of the tree structure. The serialization of data of such a tree structure will be described in more detail later.

In addition, data of this tree structure can be generated for each of a plurality of open source software to be downloaded, and data of the generated tree structure can be stored in a database in association with an identifier of each of a plurality of open source software.

FIG. 10 is a flowchart illustrating an example of a method for checking whether open source software is used through a type comparison according to the structure of a package file, according to an embodiment of the present invention. The method according to the present embodiment can also be included in the license verification method according to the embodiment. For example, after the data of the tree structure is generated for each of the various open source software through the method according to the embodiment of FIG. 9 and then converted into a database, a method according to the embodiment of FIG. A software check can be performed. The method according to the present embodiment can also be performed by the computer apparatus 200 described above. For example, the processor 220 of the computer device 200 may be implemented to execute control instructions in accordance with the code of the operating system or the code of at least one program that the memory 210 includes. Here, the processor 220 may be configured to cause the computer device 200 to perform steps 1010 through 1040, including the method of Figure 10, in accordance with a control command provided by a code stored in the computer device 200. [ Can be controlled.

In step 1010, the computer device 200 may receive a package file to be inspected. For example, when the Android application is to be inspected, the computer device 200 can receive an APK file for installing and running the corresponding Android application.

In step 1020, the computer device 200 may generate data of a tree structure corresponding to the directory structure of the input package file. This step 1020 may be the same as the process of generating the data of the tree structure in the step 920.

At step 1030, the computing device 200 may arrange the nodes of the generated tree structure. This step 1030 may be the same as the process of sorting the data of the tree structure in step 930.

In step 1040, the computer device 200 may compare the data of the ordered tree structure with the data of the tree structure stored in the database. At this time, if the data of the tree structure extracted from the database matches the data of the tree structure aligned in the step 1030, the computer device 200 displays the data of the tree structure inputted in the step 1010 through the identifier of the open- You can see that the package file uses the corresponding open source software.

If obfuscation is applied to a string in the package file, the classpath name, class name, method name, etc. may be changed. However, in the present embodiment, the use of the open source software is checked based on the structure of the package file such as the directory code and the Java code file stored in the directory, so that the obfuscation is applied to the package file Can be used.

FIG. 11 is a diagram showing an example of a directory structure of a package file in an embodiment of the present invention. FIG. 12 is a diagram showing an example of a tree structure corresponding to a directory structure in an embodiment of the present invention to be.

11 shows nine directory and eight Java code files as an example of the directory structure of the package file. In this case, FIG. 12 represents a directory with a circle-shaped branch node, and a Java code file is represented by a rectangular leaf node. In this case, the first number in the circle can denote the degree that is the number of the child nodes, and the second number can denote the difference, which is the number of all the nodes at the bottom. For example, the first directory 'com' in FIG. 11 is represented as a root node with degree 1 and number 16 in FIG. The second directory 'sample' in FIG. 11 is represented as a branch node having degree 1 and degree 15 in FIG. Also, the first Java code file 'Internet.java' in FIG. 11 is represented by the first leaf node having a depth of 5 when the depth of the root node is 0 in FIG.

Thus, the computer device 200 can generate the tree structure data while circulating the directory structure of the package file of FIG. 11 from left to right and from top to bottom. As described above, a branch node may mean a directory, and may have a branch node or a leaf node as a child node (child node). Each node can have degree and degree sum information. Also, a leaf node can mean a Java code file and can not have a child node. Information about the class may be included, and information about the included class includes information such as the number of member variables, the number of member functions, the signature of each member function, the method return type, the number of arguments, and the corresponding information . &Lt; / RTI > For example, in code 'public static void main (String [] args), the return type is' void', the number of arguments is 2, and the argument types are 'String []' and 'args'.

As described above, the arrangement of the tree structure can be performed in order to compare the correspondence with other tree structures in the future. The sorting criterion can be that a branch node has a higher priority than a leaf node, and branch nodes having the same parent can be sorted in descending order or ascending order. Branch nodes having the same order among the sorted branch nodes using order can be sorted in descending order or ascending order by using the sort order. Leaf nodes having the same parent can be sorted in descending order or ascending order based on the number of methods (the number of member functions). The sorting method is not limited to the above-described embodiment as long as the sorting method can be applied in the same manner to the tree structure created for the directory structure of open source software and the tree structure created for the directory structure of the package file.

13 is a diagram showing an example of an aligned tree structure in an embodiment of the present invention. 12 and 13, when the first branch node 1210 has a degree of 1 and the second branch node 1220 has a degree of 2, the second branch node 1220 is connected to the first branch node 1210 In the left-hand side of Fig. It can be seen that all the nodes of the tree structure are arranged according to the above-described sorting method in accordance with the arrangement change between the first branch node 1210 and the second branch node 1220.

In addition, the computer device 200 may serialize the data of the tree structure using Java object serialization, and then store the serialized data in a database. More specifically, the computer device 200 traverses a directory, makes each directory a Java object, and stores objects sorted in descending order or ascending order according to orders. In order to store the non-linear data structure of the tree structure in the relational database, the implementation becomes complicated because the parent-child relation for each node must be checked and stored in the database. Accordingly, in order to easily store this, the computer device 200 can serialize data of the tree structure using Java object serialize based on the root node, and then store the data in the database. At this time, objects required for storage should implement 'java.io.Serializable', and the member variable should be filled with information necessary for saving. In the case of a leaf node, the number of member variables, the number of member functions, the signature of each member function (the method return type , The number of arguments, the type of each argument), and parent node information can be defined as member variables.

Table 1 shows an example of information defining the relationship between a parent and a child, Table 2 shows an example of information defining a branch node, and Table 3 shows an example of information that defines a leaf node.

public class Node <T> implements Serializable {private T data; private Node <T> parent; private List <Node <T >> children;

public class Branch {private int degree; // order private int degreeSum; // Tea collection

public class Leaf {private int cntField; // number of member variables private int cntMethod; // the number of methods private List <MethodSignature> methodList; // Signatures for each member function

14 is a diagram showing an example of serialized and stored data in an embodiment of the present invention. The Java serialization process can be a process of transforming data into continuous data to write an object to a heap region of memory created in the form of a class. For example, As shown in FIG. The serialized and stored data can be stored in a form that is difficult for human to recognize as shown in FIG.

In order to determine whether open source software has been used in the package file to be inspected, the computer device 200 may first generate and arrange the tree structure data by traversing the root directory of the package file through the subdirectories . In addition, the computer device 200 may deserialize the data stored in the database and read it into the memory 210. The deserialization process may be the reverse of the serialization process. When the deserialization process is completed, an object can be created and loaded into the heap area of the memory before serialization. The computer device 200 can use this object to compare two tree structures.

15 and 16 are views showing a comparative example of a tree structure in an embodiment of the present invention. A dotted box 1510 in FIG. 15 shows an example of a tree structure (hereinafter, referred to as 'open source tree structure') corresponding to a directory structure of open source software. 16 shows an example of a tree structure (hereinafter referred to as a "package file tree structure") corresponding to the directory structure of the package file. At this time, the second dashed box 1620 in Fig. 16 shows a subtree structure coinciding with the tree structure indicated by the dashed box 1510 in Fig.

For example, the computer device 200 traverses the nodes of the package file tree structure and finds a node that matches the information (degree, order) of the root node of the open source tree structure. If a matching node is found, it can be compared while traversing the open-source tree structure with the subtree containing the found node. The comparison of the branch nodes can compare whether the node information (degree, difference) is matched. The leaf node comparison compares the number of member variables, the number of member functions, and the signature of each member function . However, the type of the argument in the function signature comparison may not be included in the comparison object because only the Java primitive type is compared and the non-primitive type is likely to be obfuscated.

The above-described two embodiments (the embodiment using the patterns described with reference to Figs. 3 to 8 and the embodiment using the tree structure described with reference to Figs. 9 to 16) may be used individually or in combination . For example, when obfuscation is not applied to a package file to be inspected, an embodiment using a pattern may be applied, and in a case where obfuscation is applied to a package file, an embodiment using a tree structure may be applied.

As described above, according to the embodiments of the present invention, it is possible to verify the license of the open source software through the binary code that is built without the developer's source code by utilizing the predetermined code form such as the smali code in the Android environment . In addition, it is possible to verify the license of open source software for code obfuscated by string through type comparison according to the structure of package file.

The system or apparatus described above may be implemented as a hardware component, a software component or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device As shown in FIG. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments, or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Such a recording medium may be a variety of recording means or storage means in the form of a single or a plurality of hardware combined and is not limited to a medium directly connected to any computer system but may be dispersed on a network. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims

In the license verification method,

Downloading open source software;

Extracting method call information from the downloaded open source software;

Generating a pattern of a predetermined code type using the extracted method call information; And

Storing the generated pattern in association with an identifier of the downloaded open source software in a database

The license verification method comprising:
The method according to claim 1,

Wherein the method call information is information required for calling a specific method, and includes a class path name, a class name, and a method name in Java code.
The method according to claim 1,

The predetermined code type includes a smali code form used in an APK (Android application package) file, which is a package file for an Android application,

Wherein the pattern is generated in a form including the method call information required to extract a method in the smali code form.
The method according to claim 1,

Receiving a package file to be inspected;

Extracting an executable file of the package file;

Converting the extracted executable file into the predetermined code form;

Extracting method call information from an executable file converted into the predetermined code form; And

Comparing the extracted method call information with a pattern stored in the database

Further comprising the step of verifying the license.
5. The method of claim 4,

Wherein the comparing comprises:

And searching the database for a pattern including the method call information extracted from the executable file converted into the predetermined code form.
5. The method of claim 4,

And an identifier of the open-source software stored in the database in association with the pattern, and an identifier of the open-source software stored in the database, if the pattern includes the method call information extracted from the executable file converted into the pre- Provide an identifier for the license

Further comprising the step of verifying the license.
5. The method of claim 4,

Wherein the step of generating the pattern of the pre-

Generate more than one pattern for one open source software,

Wherein the comparing comprises:

And comparing two or more method call information extracted from the executable file converted into the predetermined code form with each of the two or more patterns.
In the license verification method,

Downloading open source software;

Generating data of a first tree structure corresponding to a directory structure of the downloaded open source software; And

Storing the data of the first tree structure in association with an identifier of the corresponding open source software in a database

The license verification method comprising:
9. The method of claim 8,

Wherein the generating comprises:

Wherein the tree structure data including the directory structure of the directory structure as a branch node and the Java code file of the directory structure as a leaf node is generated.
10. The method of claim 9,

Wherein the branch node includes a differential sum corresponding to a degree corresponding to the number of child nodes and a number of all lower nodes,

Wherein the leaf node includes a number of member variables of a corresponding Java code file, a number of member functions, and a signature of each member function.
9. The method of claim 8,

And arranging the nodes of the generated tree structure

Further comprising the step of verifying the license.
12. The method of claim 11,

Wherein the aligning comprises:

And arranging the leaf nodes having the same parent included in the generated tree structure on the basis of the degree and the difference included in each of the branch nodes, Based on the number of member functions of the Java code file corresponding to each of the nodes.
9. The method of claim 8,

Wherein the storing step comprises:

Wherein the data of the first tree structure is serialized using Java object serialization and stored in the database.
14. The method of claim 13,

Wherein the Java object serialization defines each of the nodes of the first tree structure as a Java object and transforms the data of the first tree structure into data of successive Java objects.
9. The method of claim 8,

Receiving a package file to be inspected;

Generating data of a second tree structure corresponding to a directory structure of the input package file; And

Comparing data of the second tree structure with data of the first tree structure stored in the database

Further comprising the step of verifying the license.
16. The method of claim 15,

Wherein the comparing comprises:

Whether or not the data of the first tree structure is included as data of the subtree structure of the second tree structure.
17. The method of claim 16,

Wherein the comparing comprises:

A comparison between the degree and the division included in the branch nodes of the first tree structure and the second tree structure, and the number of the member variables included in the leaf nodes of the first tree structure and the second tree structure, And comparing the data of the second tree structure with the data of the first tree structure stored in the database based on a comparison between the signatures of the respective member functions.
A computer-readable recording medium having recorded thereon a program for causing a computer to execute the method according to any one of claims 1 to 17.