[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

KR101575021B1 - Mobile terminal for executing integrity verification and controll method thereof - Google Patents

Mobile terminal for executing integrity verification and controll method thereof Download PDF

Info

Publication number
KR101575021B1
KR101575021B1 KR1020150117525A KR20150117525A KR101575021B1 KR 101575021 B1 KR101575021 B1 KR 101575021B1 KR 1020150117525 A KR1020150117525 A KR 1020150117525A KR 20150117525 A KR20150117525 A KR 20150117525A KR 101575021 B1 KR101575021 B1 KR 101575021B1
Authority
KR
South Korea
Prior art keywords
memory
operating system
integrity
booting
mobile terminal
Prior art date
Application number
KR1020150117525A
Other languages
Korean (ko)
Inventor
강태인
김훈규
이노복
권미영
이상훈
이성기
박재경
Original Assignee
국방과학연구소
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 국방과학연구소 filed Critical 국방과학연구소
Priority to KR1020150117525A priority Critical patent/KR101575021B1/en
Application granted granted Critical
Publication of KR101575021B1 publication Critical patent/KR101575021B1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G06F9/4406—Loading of operating system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G06F9/4406—Loading of operating system
    • G06F9/441—Multiboot arrangements, i.e. selecting an operating system to be loaded

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Telephone Function (AREA)

Abstract

The present invention relates to a mobile terminal for performing integrity verification and a control method thereof. According to an embodiment of the present invention, a mobile terminal includes a first memory having an operating system and an application, a second memory storing integrity data for the operating system and an application, Wherein the control unit includes a boot loader for booting the operating system and a cryptographic I / O module connectable to the second memory, wherein the integrity verification includes: The boot loader is executed during booting of the operating system, and the booting is performed through the encrypted input / output module after booting of the operating system is completed.

Description

[0001] MOBILE TERMINAL FOR EXECUTING INTEGRITY VERIFICATION AND CONTROLL METHOD THEREOF [0002]

The present invention relates to a mobile terminal performing integrity verification and a control method thereof, and more particularly, to a mobile terminal capable of ensuring integrity of an operating system and an application provided in a mobile terminal through integrity verification, and a control method thereof will be.

[0002] In recent years, development and dissemination of mobile terminals (e.g., smart phones, etc.) are proceeding at a rapid pace, so that mobile terminals are similar to fixed terminals (e.g., To a level where it can provide services at a level of

Accordingly, security threats to mobile terminals are similar to those of fixed terminals. For example, a security threat to a mobile terminal is a tendency to take root authority of a mobile terminal, hacking through a malicious code, forgery of an operating system / application, and the like, in mobile network environment.

Therefore, there is a need for research on a system capable of comprehensively responding to a security threat to a mobile terminal. A method of verifying / ensuring the integrity of the operating system and applications can be used as a way to prevent damage to security threats.

Integrity can include meaning such as precision, accuracy, completeness, validity, and certainty.

Specifically, integrity may mean certainty that in data and network security, the data (or information) can only be accessed or changed by an authorized user. In other words, integrity can mean that the inherent content of the data is not altered from unauthorized access, so that it always maintains normal data.

Accordingly, in recent years, a mobile terminal capable of verifying / securing the integrity of an operating system, an application, and the like provided in the mobile terminal and a control method thereof have been actively developed.

It is an object of the present invention to provide a mobile terminal and a control method thereof capable of ensuring integrity of an operating system and an application.

It is another object of the present invention to provide a mobile terminal and its control method capable of performing integrity verification in an optimized manner.

According to an embodiment of the present invention, a mobile terminal includes a first memory having an operating system and an application, a second memory storing integrity data for the operating system and an application, And a control unit for performing integrity verification on the application.

The control unit may include a boot loader for booting the operating system and an encrypted input / output module capable of connecting to the second memory.

The integrity verification is performed through the boot loader during booting of the operating system, and is performed through the encrypted input / output module after the booting of the operating system is completed.

In an embodiment, connection to the second memory is enabled through the boot loader during booting of the operating system, and is available through the encrypted input / output module after booting of the operating system is completed.

In an embodiment, the first memory and the second memory may be separate memories that are separate from each other in terms of hardware.

In an embodiment, the first memory and the second memory are memory areas that are separated from each other in one memory.

In an exemplary embodiment, the control unit may perform integrity verification of the plurality of operating systems through the boot loader when a plurality of operating systems are provided in the first memory, And booting any one of the systems.

The method of claim 1, further comprising the step of: communicating with an external device, wherein when the integrity data for the booting operating system does not exist in the second memory while booting the operating system, The boot loader receives integrity information on the operating system from the external device through the communication unit, and the boot loader performs integrity verification on the booting operating system based on the received integrity information.

According to the present invention, it is possible to prevent a malicious code from being infiltrated and forging or forging an operating system and an application, thereby stealing or damaging data (information) stored in the mobile terminal.

In addition, the present invention can further enhance the integrity of the operating system and applications by performing integrity verification during booting of the operating system and performing integrity verification even after booting is completed.

Further scope of applicability of the present invention will become apparent from the following detailed description. It should be understood, however, that the detailed description and specific examples, such as the preferred embodiments of the invention, are given by way of illustration only, since various changes and modifications within the spirit and scope of the invention will become apparent to those skilled in the art.

1 is a block diagram illustrating a mobile terminal according to an embodiment of the present invention.
FIG. 2A and FIG. 2B are flowcharts for explaining a method for performing integrity verification when the mobile terminal boots an operating system according to an embodiment of the present invention.
3 is a flowchart illustrating a method of controlling a mobile terminal according to an exemplary embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, wherein like reference numerals are used to designate identical or similar elements, and redundant description thereof will be omitted. The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role. In the following description of the embodiments of the present invention, a detailed description of related arts will be omitted when it is determined that the gist of the embodiments disclosed herein may be blurred. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. , ≪ / RTI > equivalents, and alternatives.

Terms including ordinals, such as first, second, etc., may be used to describe various elements, but the elements are not limited to these terms. The terms are used only for the purpose of distinguishing one component from another.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The singular expressions include plural expressions unless the context clearly dictates otherwise.

In the present application, the terms "comprises", "having", and the like are used to specify that a feature, a number, a step, an operation, an element, a component, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

The mobile terminal described in this specification includes a mobile phone, a smart phone, a laptop computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a navigation device, a slate PC A tablet PC, an ultrabook, a wearable device such as a smartwatch, a smart glass, and a head mounted display (HMD). have.

However, it will be appreciated by those skilled in the art that the configuration according to the embodiments described herein may be applied to fixed terminals such as a digital TV, a desktop computer, a digital signage, and the like, will be.

Referring to FIG. 1, FIG. 1 is a block diagram illustrating a mobile terminal according to an embodiment of the present invention. Referring to FIG.

The mobile terminal 100 according to the present invention may include a communication unit 110, a memory 170, a control unit 180, and the like. Although not shown in FIG. 1, the mobile terminal 100 related to the present invention may include an input unit, a sensing unit, an output unit, an interface unit, a power supply unit, and the like. The above-described components are not essential for implementing a mobile terminal, so that the mobile terminal described herein can have more or fewer components than those listed above.

The communication unit 110 may communicate with the mobile terminal 100 and the wireless communication system or between the mobile terminal 100 and another mobile terminal 100 or between the mobile terminal 100 and an external device Lt; RTI ID = 0.0 > wireless < / RTI > In addition, the communication unit 110 may include one or more modules that connect the mobile terminal 100 to one or more networks. The communication unit 110 may be referred to as a wireless communication unit.

The communication unit 110 may include at least one of a broadcast receiving module 111, a mobile communication module 112, a wireless Internet module 113, a short distance communication module 114, and a location information module 115.

The memory 170 stores data supporting various functions of the mobile terminal 100. [ The memory 170 may store a plurality of application programs or applications running on the mobile terminal 100, data for operation of the mobile terminal 100, and commands. At least a part of these application programs can be downloaded from an external device (or an external server) via wireless communication. Also, at least a part of these application programs may exist on the mobile terminal 100 from the time of shipment for the basic functions (e.g., telephone call receiving function, message receiving function, and calling function) of the mobile terminal 100. Meanwhile, the application program may be stored in the memory 170, installed on the mobile terminal 100, and may be operated by the control unit 180 to perform the operation (or function) of the mobile terminal.

More specifically, the memory 170 may be a flash memory type, a hard disk type, a solid state disk type, an SDD type (Silicon Disk Drive type), a multimedia card micro type (RAM), a static random access memory (SRAM), a read-only memory (ROM), an EEPROM , electrically erasable programmable read-only memory (PROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, and optical disk. The mobile terminal 100 may operate in association with a web storage that performs the storage function of the memory 170 on the Internet.

In addition to the operations related to the application program, the control unit 180 typically controls the overall operation of the mobile terminal 100. The control unit 180 may process or process signals, data, information, and the like input or output through the above-mentioned components, or may drive an application program stored in the memory 170 to provide or process appropriate information or functions to the user.

In addition, the controller 180 may control at least some of the components discussed above to drive an application program stored in the memory 170. [ In addition, the controller 180 may operate at least two of the components included in the mobile terminal 100 in combination with each other for driving the application program.

At least some of the components may operate in cooperation with one another to implement a method of operation, control, or control of a mobile terminal according to various embodiments described below. In addition, the operation, control, or control method of the mobile terminal may be implemented on the mobile terminal by driving at least one application program stored in the memory 170. [

Meanwhile, the mobile terminal 100 capable of including at least one of the components described above can perform integrity verification. In detail, the controller 180 may perform integrity verification of an operating system (OS) and an application stored in the memory 170.

The integrity verification (or integrity check) determines whether the data (or information) implementing (or corresponding) the operating system and the application provided in the memory 170 of the mobile terminal 100 is normal data It can mean to do. Specifically, integrity verification may be understood as a process of determining whether the inherent contents of the operating system and data implementing the application have not been tampered with.

That is, verifying the integrity of the operating system and applications can be taken to mean verifying the integrity of the data that implements the operating system and applications.

The integrity of the data that implements the operating system and applications can be ensured through data access restrictions, strict authentication procedures, and so on.

In addition, the mobile terminal 100 related to the present invention can be used to secure the integrity of the operating system and applications (i.e., to prevent data loss, corruption, damage, ), Hardware and software configurations.

Referring to FIG. 1, the memory 170 may include a first memory 171 and a second memory 172.

For example, the first memory 171 and the second memory 172 may be separate hardware memories. Specifically, the first memory 171 and the second memory 172 may be separate hardware components.

As another example, the first memory 171 and the second memory 172 may be memory areas that are separated from each other in one memory. Specifically, the first memory 171 and the second memory 172 may denote different areas of memory areas implemented on any one of the memories. The control unit 180 may divide (divide, set) one memory area into the first memory 171 and the second memory 172 according to a user setting (or a request). In this case, the first memory 171 may be referred to as a first memory area, and the second memory 172 may be referred to as a second memory area.

At least one operating system (OS) and applications that can be operated by the mobile terminal 100 may be stored (stored) in the first memory 171. The application may be executed in a system environment provided by an operating system.

The first memory 171 may be a general memory that is not limited in data access and does not require any authentication. The first memory 171 may be referred to as a general memory.

In the first memory 171, at least one operating system and at least one application can be stored.

In the meantime, the second memory 172 may store integrity data for an operating system and an application provided in the first memory 171. The integrity data (or integrity information) may refer to data that normally (or inherently) implements the operating system and applications. The integrity data may include an operating system and an algorithm for implementing the application, program information, and the like. It should be understood that the integrity data also includes data generated during the execution of the operating system and applications.

Unlike the first memory 171, the second memory 172 may be a memory having limited data access or requiring a separate authentication. The second memory 172 may be referred to as a secure memory.

The second memory 172 can be formed to be accessible only through predetermined (or previously authenticated) components, modules, applications, and the like. For example, the second memory 172 may be configured to be accessible (or accessible) only through a boot loader 182, a cryptographic input / output module 184, (Operations) such as reading, writing, modifying (changing) the integrity data stored in the second memory 172 only through these configurations.

The control unit 180 may be configured to access the second memory 172 by an external terminal connected to the mobile terminal 100 through communication or by a specific code (for example, malicious code, etc.) If an attempt (or an access attempt) is detected, the connection is blocked and a notification message can be output through the output unit. In addition, the control unit 180 can disconnect the communication with the external terminal or delete the specific code when the connection attempt is detected.

With this configuration, in the present invention, integrity data for the operating system and the application is stored in the second memory 172, i.e., the security memory, different from the first memory 171 having the operating system and the application, And integrity of the application.

Hereinafter, a method for verifying integrity of an operating system and an application according to an embodiment of the present invention will be described in more detail.

The control unit 180 can perform integrity verification of the operating system and the application based on the integrity data for the operating system and the application stored in the second memory 172 (security memory). For example, the control unit 180 extracts data of a currently operating system or an application currently being executed, and compares the extracted data with integrity data stored in the second memory 172 to perform integrity verification can do. In addition, the control unit 180 may perform integrity verification through various integrity verification algorithms for the operating system and the application.

Meanwhile, in the present invention, the integrity verification of the operating system and the application is performed first, and the integrity verification of the operating system and the application is performed secondarily after the booting of the operating system is completed .

The control unit 180 of the mobile terminal 100 according to the present invention includes a boot loader 182 for booting the operating system and a boot loader 182 for booting the operating system, And an encryption / input / output (I / O) module 184.

The boot loader 182 may be configured to boot the operating system. Specifically, when power is supplied through the power supply unit, the control unit 180 can boot the operating system provided in the memory 170 (for example, the first memory 171) via the boot loader 182 have. The boot loader 182 may have a separate hardware configuration from the controller 180 or may be a software module (or program). Alternatively, the boot loader 182 may be the control unit 180 itself.

The boot loader 182 may be capable of accessing (or accessing) the second memory 172. Specifically, the boot load 182 may be set (set) so that connection to the second memory 172 (security memory) is permitted (permitted).

The control unit 180 may control the boot load 182 to perform integrity verification during booting of the operating system. Specifically, the bootload 182 may perform integrity verification of the operating system and the application during booting of the operating system. That is, integrity verification may be performed through the boot loader 182 during booting of the operating system.

The bootload 182 may connect to the second memory 172 to perform integrity verification during booting of the operating system. The bootloader 182 may then verify the integrity of the operating system and applications provided in the first memory 171 based on the integrity data stored in the second memory 172. [

Meanwhile, the encryption input output module 184 may be a module that is executed after booting of the operating system is completed. The encrypted input / output module 184 may have a separate hardware configuration from the controller 180 or may be a software module (or a program). Also, the encrypted input / output module 184 may be implemented as a component that is a software unit configuration.

The encryption input / output module 184 may be formed to be able to access (or access) the second memory 172. That is, the encrypted input / output module 184 may be a configuration in which connection to the second memory 172 is popular (set).

After the booting of the operating system is completed, the control unit 180 may perform integrity verification through the encryption input / output module 184. [ Specifically, the cryptographic I / O module 184 may perform integrity verification for the operating system and applications periodically, or at predetermined time intervals, after the booting of the operating system is completed.

The cryptographic I / O module 184 may connect to the second memory 172 to perform integrity verification after the booting of the operating system is completed. The encryption input and output module 184 can then verify the integrity of the operating system and applications provided in the first memory 171 based on the integrity data stored in the second memory 172. [

If there is a connection request to the second memory 172, the control unit 180 may perform user authentication through the encrypted input / output module 184. [ After the user authentication is successful, the control unit 180 accesses the second memory 172 through the encrypted input / output module 184 and controls (e.g., reads, modifies, adds, deletes, etc.) can do. The encryption input / output module 184 can encrypt and store or retrieve the integrity data in the second memory 172.

In summary, the control unit 180 related to the present invention performs integrity verification of the operating system and the application through the boot load 182 during booting of the operating system, and after the booting of the operating system is completed, Modules can be used to perform integrity verification for operating system-specific applications.

At this time, access to the second memory 172 to perform integrity verification is enabled through the boot loader 182 during the booting of the operating system, and after the booting of the operating system is completed, through the encrypted input / output module It can be possible.

The boot loader 182 is connected to the second memory 172 through the encryption input and output module 184 during the booting of the operating system and stores the integrity data stored in the second memory 172 And perform integrity verification of the operating system and application. In this case, the connection to the second memory 172 can be implemented only through the encrypted input / output module 184.

In addition, the boot loader 182 may be implemented to perform integrity verification prior to initiating a boot to the operating system. For example, if the memory 170 (e.g., the first memory 171) is provided with at least one operating system (a plurality of operating systems), the boot loader 182, Integrity verification for one operating system and application can be performed.

Through this configuration, in the present invention, integrity verification is performed primarily during booting of the operating system, and integrity verification is continuously performed even after the booting is completed, thereby significantly improving the integrity of the operating system and the application.

Hereinafter, a method for performing integrity verification during boot will be described in more detail with reference to FIGS. 2A and 2B.

FIG. 2A and FIG. 2B are flowcharts for explaining a method for performing integrity verification when the mobile terminal boots an operating system according to an embodiment of the present invention.

First, with reference to FIG. 2A, a control method in a case where a plurality of operating systems are provided in a mobile terminal related to the present invention will be described.

First, the control unit 180 drives the boot loader 182 when power is supplied through the power supply unit (S210).

If a plurality of operating systems are provided in the first memory 171, the controller 180 performs integrity verification for a plurality of operating systems through the boot loader 182 (S220). At this time, the second memory 172 stores integrity data for a plurality of operating systems. The boot loader 182 accesses the second memory 172 and then performs integrity verification for a plurality of operating systems based on the integrity data for the plurality of operating systems.

Thereafter, the control unit 180 boots one of the plurality of operating systems based on the verification result (S230). Specifically, the boot loader 182 may perform an integrity verification on a plurality of operating systems, and then select any one of a plurality of operating systems based on the verification result.

For example, the boot loader 182 may boot an operating system whose priority is set to the highest priority among the operating systems whose integrity is guaranteed (that is, without tampering with, tampering with integrity data, etc.) You can boot the booted operating system.

Here, the most recently booted operating system refers to the most recently booted operating system among the operating systems whose integrity is guaranteed.

Also, the boot loader 182 outputs information related to the operating system whose integrity is assured to an output unit (e.g., a display unit), and when any one of the information related to the operating system is selected by the user, The operating system corresponding to the information may be booted.

When the booting of any one of the plurality of operating systems is completed, the controller 180 may perform integrity verification periodically or every time a predetermined time elapses through the encrypted input / output module 184.

Hereinafter, a control method in the case where there is no integrity data in the second memory 172 will be described with reference to FIG. 2B.

Referring to FIG. 2B, when the power is supplied through the power supply unit, the controller 180 drives the boot loader and starts booting the operating system (S310).

Thereafter, the boot loader 182 (or the control unit 180) connects to the second memory 172 to perform integrity verification on the operating system being booted. Thereafter, the boot loader 182 accesses the second It is determined whether integrity data for the operating system being booted exists in the memory 172 (S320).

If there is no integrity data for the booting operating system in the second memory 172 during the booting of the operating system, the control unit 180 (or the boot loader 182) Request / receive integrity information for the operating system being booted to an external device.

The integrity information may be integrity data itself or at least a portion of the integrity data.

Specifically, the control unit 180 (or the boot loader 182) controls the communication unit 110 during booting of the operating system to store information (for example, a unique number Etc.). Then, the external device can transmit the integrity information to the mobile terminal based on the information about the operating system.

Thereafter, the boot loader 182 performs an integrity verification on the booting operating system based on the received integrity information (S340).

The received integrity information may be stored in the second memory 172 via the boot loader 182 or the encrypted input and output module 184.

On the other hand, if there is integrity data for the operating system being booted in the second memory 172, the boot loader 182 can perform integrity verification on the booting operating system using the stored integrity data.

3 is a flowchart illustrating a method of controlling a mobile terminal according to an exemplary embodiment of the present invention.

Referring to FIG. 3, in step S410, a secure memory area is secured. More specifically, the control unit 180 determines whether or not a memory area in a memory area, which is restricted in data access, or in a secure memory area requiring separate user authentication (for example, A second memory (area)). The securing (or setting) of the secure memory area may be performed after the operating system is booted.

Also, the control unit 180 can generate an encrypted input / output module (S420).

Thereafter, the control unit 180 may store the integrity data for the operating system and the application in the secure memory area through the encrypted input / output module (S430). At this time, the encrypted input / output module may encrypt the integrity data and store the integrity data in the secure memory area.

Thereafter, the control unit 180 may generate a security application that uses the encrypted input / output module based on the user request (S440). The secure application may be implemented to be interoperable with the encrypted input / output module, and the encrypted input / output module may not be driven by an application other than the secure application.

That is, the use of the encrypted input / output module as described in FIGS. 1 to 3 can be performed through the security application.

Thereafter, the controller 180 may store the integrity data in the secure memory area through the security application or access the integrity data stored in the secure memory area (S450). In this case, the integrity data may be read, modified, deleted, added, etc., under the operation of the security application.

Specifically, when the security application is executed, the control unit 180 can switch the encrypted input / output module from the inactive state to the active state. Then, when a specific operation (for example, modification) is requested for the specific integrity data stored in the second memory through the security application, the control unit 180 controls the encryption module to store the integrity data in the second memory 172 And perform a specific operation on the specific integrity data stored in the second memory 172. [

If a specific operation for specific integrity data stored in the second memory is requested through the security application and another application, the control unit 180 may ignore or reject the request.

Thereafter, the control unit 180 can control the encrypted input / output module through the security application and perform integrity verification of the operating system and the application based on the integrity data stored in the second memory 172. [

With this configuration, the present invention can prevent the malicious code from being infiltrated and forging or tampering with the operating system and the application, thereby stealing or damaging the data (information) stored in the mobile terminal.

In addition, the present invention can further enhance the integrity of the operating system and applications by performing integrity verification during booting of the operating system and performing integrity verification even after booting is completed.

The present invention described above can be implemented as computer readable codes on a medium on which a program is recorded. The computer readable medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of the computer readable medium include a hard disk drive (HDD), a solid state disk (SSD), a silicon disk drive (SDD), a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, , And may also be implemented in the form of a carrier wave (e.g., transmission over the Internet). In addition, the computer may include a control unit 180 of the terminal. Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention.

100: mobile terminal 110:
170: memory 171: first memory
172: second memory
180: control unit 182: boot loader
184: Encryption I / O module

Claims (6)

A first memory having an operating system and an application;
A second memory for storing integrity data for the operating system and applications; And
And a control unit for performing integrity verification of the operating system and the application based on the integrity data,
Wherein,
A boot loader for booting the operating system; And
And a cryptographic input / output module connectable to the second memory,
The integrity verification includes:
During the booting of the operating system, through the boot loader,
And after the booting of the operating system is completed, is performed through the encrypted input / output module,
Wherein,
Wherein when the plurality of operating systems are provided in the first memory, integrity verification is performed on the plurality of operating systems through the boot loader, and one of the plurality of operating systems is booted based on the verification result To the mobile terminal.
The method according to claim 1,
The connection to the second memory may include:
During the booting of the operating system, through the boot loader,
And after the booting of the operating system is completed, the encrypted input / output module is enabled.
The method according to claim 1,
Wherein the first memory and the second memory are separate memories in hardware.
The method according to claim 1,
Wherein the first memory and the second memory are memory areas separated from each other in a single memory.
delete The method according to claim 1,
Further comprising a communication unit for performing communication with an external device,
Wherein,
If integrity data for the booting operating system does not exist in the second memory during booting of the operating system, receives integrity information for the operating system from the external device via the communication unit,
The boot loader includes:
And performs integrity verification on the booting operating system based on the received integrity information.
KR1020150117525A 2015-08-20 2015-08-20 Mobile terminal for executing integrity verification and controll method thereof KR101575021B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
KR1020150117525A KR101575021B1 (en) 2015-08-20 2015-08-20 Mobile terminal for executing integrity verification and controll method thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
KR1020150117525A KR101575021B1 (en) 2015-08-20 2015-08-20 Mobile terminal for executing integrity verification and controll method thereof

Publications (1)

Publication Number Publication Date
KR101575021B1 true KR101575021B1 (en) 2015-12-08

Family

ID=54872960

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020150117525A KR101575021B1 (en) 2015-08-20 2015-08-20 Mobile terminal for executing integrity verification and controll method thereof

Country Status (1)

Country Link
KR (1) KR101575021B1 (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20180052024A (en) * 2016-11-09 2018-05-17 주식회사 엔오디비즈웨어 Method for operating application performing security function and corresponding application
KR20190009825A (en) * 2019-01-22 2019-01-29 주식회사 엔오디비즈웨어 Method for operating application performing security function and corresponding application
KR20190092235A (en) 2018-01-30 2019-08-07 고려대학교 산학협력단 An efficient control-flow integrity vefifing method based on unpredictability
KR20200038452A (en) * 2020-04-07 2020-04-13 주식회사 엔오디비즈웨어 Application performing security function

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20180052024A (en) * 2016-11-09 2018-05-17 주식회사 엔오디비즈웨어 Method for operating application performing security function and corresponding application
KR101951201B1 (en) * 2016-11-09 2019-02-25 주식회사 엔오디비즈웨어 Method for operating application performing security function and corresponding application
KR20190092235A (en) 2018-01-30 2019-08-07 고려대학교 산학협력단 An efficient control-flow integrity vefifing method based on unpredictability
KR20190009825A (en) * 2019-01-22 2019-01-29 주식회사 엔오디비즈웨어 Method for operating application performing security function and corresponding application
KR102101614B1 (en) * 2019-01-22 2020-04-17 주식회사 엔오디비즈웨어 Method for operating application performing security function and corresponding application
KR20200038452A (en) * 2020-04-07 2020-04-13 주식회사 엔오디비즈웨어 Application performing security function
KR102180691B1 (en) * 2020-04-07 2020-11-19 주식회사 소버린월렛 Application stored on recording medium that perform security function, and electronic device

Similar Documents

Publication Publication Date Title
US9245143B2 (en) Security policy for device data
US10073966B2 (en) Operating system-independent integrity verification
US9177122B1 (en) Managing secure firmware updates
KR102324336B1 (en) User device and integrity verification method for the same
US8156331B2 (en) Information transfer
US20140095853A1 (en) Alternative boot path support for utilizing non-volatile memory devices
US8725995B1 (en) Systems and methods for updating system-level services within read-only system images
CN105446713A (en) Safe storage method and equipment
CN105934751B (en) Data erasure for target devices
US20130227652A1 (en) Terminal and method for assigning permission to application
KR101575021B1 (en) Mobile terminal for executing integrity verification and controll method thereof
US10102154B2 (en) Protected memory area
CN117378173A (en) Transfer of ownership of computing device via secure processor
US20160132681A1 (en) Method for performing a secure boot of a computing system and computing system
US20190332392A1 (en) Information Handling Systems And Related Methods For Establishing Trust Between Boot Firmware And Applications Based On User Physical Presence Verification
KR20170136406A (en) Electronic device for authenticating application and operating method thereof
US9887979B1 (en) Systems and methods for enabling users to launch applications without entering authentication credentials
US10019577B2 (en) Hardware hardened advanced threat protection
US10192056B1 (en) Systems and methods for authenticating whole disk encryption systems
US11281472B2 (en) System and method for securing compromised information handling systems
JP4728343B2 (en) Information updating method, program, and information processing apparatus
KR20140088967A (en) Identity module management method and apparatus for user equipment
US20090187898A1 (en) Method for securely updating an autorun program and portable electronic entity executing it
CN103020509A (en) Terminal equipment encryption and decryption method, device and terminal equipment
KR102538096B1 (en) Device and method of verify application

Legal Events

Date Code Title Description
E701 Decision to grant or registration of patent right
GRNT Written decision to grant