KR101915718B1 - PS-LTE terminal device and PS-LTE communication network security method and system thereof - Google Patents

Abstract

The present invention relates to an application and hardware operation information-based PS-LTE terminal apparatus security method, which comprises the steps of: (a) transmitting an application and hardware operation information request signal from a device management (DM) server to a PS-LTE terminal apparatus; (b) collecting operation information of an application and hardware installed in the PS-LTE terminal apparatus from the PS-LTE terminal apparatus which receives the application and hardware operation information request signal; (c) transmitting the application and hardware operation information collected from the PS-LTE terminal apparatus to the DM server from the PS-LTE terminal apparatus; (d) checking whether the application is illegal/erroneous based on the application and hardware operation information received from the PS-LTE terminal apparatus in the DM server; and (e) transmitting an operation command from the DM server to the PS-LTE terminal apparatus based on a result of checking whether the application is illegal/erroneous in the step (d), wherein the steps (a) to (e) may be repeated at predetermined intervals.

Description

The present invention relates to a PS-LTE terminal apparatus and a PS-LTE communication network,

The present invention relates to a security method and system for a PS-LTE terminal device based on application and hardware operation information.

More particularly, the present invention relates to a method for detecting whether an illegal / faulty application is installed in a PS-LTE based on an application installed in a PS-LTE terminal apparatus and a capacity of an AP and a memory of a PS-LTE terminal apparatus.

2. Description of the Related Art In recent years, a variety of attacks using malicious applications distributed as if they are malicious code containing a malicious code are increasing in terminal devices. Particularly, attacking malicious code by inserting malicious code into a malicious application to perform a rooting attack can cause a serious security problem.

Rooting refers to a process of obtaining administrator rights from a terminal device and accessing all files and programs in the terminal device by obtaining a root account which is the highest privilege account of the Android operating system in a Linux environment

On the other hand, when a routing attack occurs in the Android-based terminal device, personal information stored in the terminal device may be leaked to the outside without the user's knowledge. In addition, contact information, SMS transmission / reception history, and web page access record in the terminal device may be leaked to the outside, which may cause a serious problem in the terminal device.

In particular, when the above-mentioned routing attack occurs in the PS-LTE terminal device used in the public safety network, the damage may be more serious.

Accordingly, the present invention proposes a method and system for maintaining the security state of the PS-LTE terminal apparatus by preventing malicious applications from being installed by sharing information on malicious applications in the PS-LTE network in order to prevent the spread of such malicious applications .

The present invention detects a PS-LTE terminal apparatus, a PS-LTE communication network security method, and a PS-LTE terminal apparatus by detecting an application installed in the PS-LTE terminal apparatus, determining whether the application is illegal / Provides a network security system.

The PS-LTE terminal device security method based on application and hardware operation information according to an embodiment of the present invention includes: (a) requesting application and hardware operation information from a DM server (device management server) to a PS- (B) collecting application information and hardware operation information installed in the PS-LTE terminal apparatus from the PS-LTE terminal apparatus which has received the application and hardware operation information request signal, (c) LTE terminal apparatus to the DM server; (d) transmitting application information and hardware operation information received from the PS-LTE terminal apparatus to the DM server; (E) checking whether the application is illegal / error based on the step (d) And transmitting an operation command to the PS-LTE terminal device based on the result of the determination. The steps (a) to (e) may be repeated at predetermined intervals.

The application information collected by the PS-LTE terminal apparatus in (b) includes an application name, an application maker, application installation information, application capacity information, and application rights information, A system service record of the PS-LTE terminal machine executed by the application, and a memory access record of the PS-LTE terminal machine.

The step (d) of verifying whether the application is illegal / erroneous may include: if the application information and the hardware operation information of the PS-LTE terminal apparatus received in the step (c) fall within a predetermined allowable range, If the application information and the hardware operation information of the PS-LTE terminal device received in (c) above are outside the predetermined allowable range, the application can be determined to be an illegal / faulty application.

The method of claim 1, wherein, in the step (e), when an analysis result of step (d) is determined to be an illegal / faulty application, an application that does not match the previously stored application and hardware operation information is registered as an illegal / / Erroneous application or an installation prevention command to the PS-LTE terminal apparatus.

A PS-LTE network security method including a plurality of PS-LTE terminal apparatuses based on application and hardware operation information according to an embodiment of the present invention is characterized in that one of the plurality of PS- A new application installation step of installing a new application in a terminal device, a new application information sharing step of sharing new application information installed in any one of the PS-LTE terminal devices with another PS-LTE terminal device, A new application information and hardware operation information transmission step of transmitting information and hardware operation information of the new application from the terminal device to the DM server and the DM server transmitting the new application information and the information of the new application transmitted in the hardware operation information transmission step And hardware behavior information based on the new application Illustration are in accordance with the result of the new application determination step, and the new application determination step of determining whether the normal application if illegal / error the application can be configured to include a command transmission step of transmitting a command to the plurality of PS-LTE terminal.

In the new application information sharing step, the plurality of PS-LTE terminal devices are connected in a block chain, and new application information can be shared using hash information.

Wherein the new application information is configured to include a name of a new application, a new application maker, installation information of a new application, capacity information of a new application and authority information of a new application, and the hardware operation information is executed A system service record of the PS-LTE terminal unit, and a memory access record of the PS-LTE terminal unit.

Wherein the new application determination step determines that the new application is a normal application if any of the new application information and the hardware operation information falls within a predetermined allowable range, If it is outside the predetermined allowable range, the new application can be judged to be an illegal / faulty application.

The command transmission step may include a normal application registration step of registering the new application as a normal application when it is determined that the application is a normal application in the new application verification step, Registration of a new application as an illegal / faulty application, deletion of the illegal / error application if a plurality of PS-LTE terminal devices registered in the PS-LTE network are installed, and deletion of an application for transmitting an illegal / And an installation prohibition command transmission step,

A security system of a PS-LTE network, which comprises a plurality of PS-LTE terminal apparatuses according to an embodiment of the present invention and a DM (device management) server for managing and controlling the plurality of PS-LTE terminal apparatuses, Each of the PS-LTE terminal apparatuses includes a memory in which an application is installed and data is stored, an application information collection unit for collecting application information stored in the memory, a system service record and a memory access record of the PS- And a hardware operation information transmitting unit for transmitting data collected by the application information collecting unit and the hardware operation information collecting unit to the DM server, wherein the DM server comprises: a PS-LTE Application information installed in each of the terminal apparatuses and hardware resources of each of the PS-LTE terminal apparatuses An application determining unit for determining whether an application is illegal / erroneous based on information received by the information receiving unit, application information received from the information receiving unit, and hardware operation information of each PS-LTE terminal apparatus; And a command transmission unit for transmitting an operation command to each of the plurality of PS-LTE terminal units. Information of a predetermined application installed in each of the PS-LTEs can be shared with other PS-LTE terminal units through a block chain .

The application information collected by the application information collection unit may be configured to include a name of the application, an application maker, installation information of the application, capacity information of the application, and permission information of the application.

Wherein the application determining unit determines that the application is a normal application when the application information and the hardware operation information received from the information receiving unit are within a predetermined allowable range, If any one of them is out of a predetermined allowable range, the application can be judged to be an illegal / faulty application.

Wherein the command transmission unit registers the application as a normal application when the application determination unit determines that the application is a normal application, and registers the new application as an illegal / error application when the application determination unit determines that the application is an illegal / If the illegal / faulty application is installed in the plurality of PS-LTE terminal apparatuses, it is possible to delete the illegal / erroneous application installation prohibition command.

The present invention can quickly delete an illegal / faulty application installed in the PS-LTE terminal apparatus.

In addition, the present invention can share information on illegal / faulty applications among a plurality of PS-LTE terminal devices registered in the PS-LTE network.

1 is a flowchart of a security method of a PS-LTE terminal apparatus according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating a security method of a PS-LTE network according to an embodiment of the present invention.
3 is a configuration diagram of a PS-LTE communication network security system according to an embodiment of the present invention.
4 is a diagram illustrating an entire PS-LTE communication network according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Terms including ordinals, such as first, second, etc., may be used to describe various elements, but the elements are not limited to these terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as " comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise. The word " step (or step) " or " step " used to the extent that it is used throughout the specification does not mean " step for.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Also, in certain cases, there may be a term selected arbitrarily by the applicant, in which case the meaning thereof will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term, not on the name of a simple term, but on the entire contents of the present invention.

1. A security method for a PS-LTE terminal apparatus according to an embodiment of the present invention.

1 is a flowchart illustrating a security method of a PS-LTE terminal apparatus according to an embodiment of the present invention.

Hereinafter, a PS-LTE terminal device security method according to an embodiment of the present invention will be described with reference to FIG.

The method of securing a PS-LTE terminal apparatus according to an embodiment of the present invention includes the steps of: (a) transmitting an application and a hardware operation information request signal from a DM server to a PS-LTE terminal apparatus; (b) collecting application information and hardware operation information installed in the PS-LTE terminal apparatus from the PS-LTE terminal apparatus which has received the application and hardware operation information request signal, (c) (D) transmitting, by the DM server, application information and hardware operation information collected from the PS-LTE terminal apparatus to the DM server, (d) Based on the result of the illegal / erroneous check in step (d), the DM server confirms whether the application is illegal / It can comprise a step (S150) of transmitting the operation command to the device.

Meanwhile, the steps (a) to (e) may be repeatedly performed at predetermined intervals.

Meanwhile, the application information collected by the PS-LTE terminal apparatus in the step (b) may include the name of the application, the application maker, the installation information of the application, the capacity information of the application, and the rights information of the application.

Meanwhile, the hardware operation information may include a system service record of the PS-LTE terminal machine executed by the application and a memory access record of the PS-LTE terminal machine.

Such application information and hardware operation information can be used in an illegal / error checking step of an application to be described later.

On the other hand, in the case of the PS-LTE terminal device, since it is a terminal device used in the public safety network, security should be greatly enhanced. If an illegal / faulty application is installed in such a PS-LTE handset, serious information may be sent out to the outside.

Therefore, the security of the PS-LTE terminal apparatus must be maintained by checking the illegal / error of the application by a method to be described later.

The step (S140) of checking whether the application is illegal / erroneous based on the application information and the hardware operation information received from the PS-LTE terminal apparatus (d) in the step (d) The application is determined to be a normal application when the application information and the hardware operation information of the LTE terminal device fall within a predetermined allowable range, and any one of the application information and the hardware operation information received in the step (c) If it is outside the predetermined allowable range, the application can be judged to be an illegal / faulty application.

More specifically, if the access right to the camera of the PS-LTE terminal apparatus is not authorized, the camera system service of the PS-LTE terminal apparatus may not be operated by the application. However, if the application is an illegal / faulty application, it may be indicated that the application information does not have camera access authority, but actual hardware operation information may contain a record that the camera system service of the PS- have.

Accordingly, when the rights information provided by the application and the actual application are different from the access records of the system service of the PS-LTE terminal apparatus, the corresponding application can be judged to be an illegal / faulty application.

As another example, when the data transmitted to the outside from the PS-LTE terminal apparatus is transmitted to a third party instead of being transmitted to the application maker, it can also be determined that the application is an illegal / error application.

The step (e) of transmitting an operation command to the PS-LTE terminal apparatus based on the illegal / erroneous check result of step (d) in the DM server may include: If it is determined that the application is an error application, an instruction for deleting the illegal / error application after registering an application that does not match the pre-stored application and hardware operation information with the DM server as an illegal / Lt; / RTI >

If the DM server directly issues an application deletion command to the PS-LTE terminal device, the security of the PS-LTE terminal device can be enhanced because the application can be deleted even if it is determined that the installed application is an illegal / .

2. A PS-LTE network security method according to an embodiment of the present invention.

2 is a flowchart illustrating a PS-LTE network security method according to an embodiment of the present invention.

Hereinafter, a PS-LTE network security method according to an embodiment of the present invention will be described with reference to FIG.

The PS-LTE network security method according to the embodiment of the present invention may be a method of securing a plurality of PS-LTE terminal devices registered in the PS-LTE network.

More specifically, the PS-LTE network security method according to an exemplary embodiment of the present invention includes a new application installation step (S210) of installing a new application in one of the plurality of PS-LTE terminal devices, A new application information sharing step (S220) of sharing new application information installed in any one of the PS-LTE terminal devices with another PS-LTE terminal device; The DM server transmits information of the new application and hardware operation information transmitted in the step S230 of transmitting the new application information and the hardware operation information to the DM server in step S230. Based on whether the new application is a normal application or an illegal / faulty application It may be configured to include a command transmission step (S250) of transmitting a command to the plurality of PS-LTE terminal apparatus according to the end result of the new application determination step (S240) and the new application determination step.

Meanwhile, in the new application information sharing step (S210), the plurality of PS-LTE terminal devices are connected in a block chain, and new application information can be shared using hash information.

By using the block chain in this way, it is possible to easily share information of a new application installed in any one of a plurality of PS-LTE terminal equipments.

In addition, since the plurality of PS-LTE terminal devices registered in the PS-LTE network are collated if the hash information is shared by the block chains, hacking and falsification can be prevented.

On the other hand, the new application information is configured to include a name of a new application, a new application maker, installation information of a new application, capacity information of a new application, and authority information of a new application, A system service record of the PS-LTE terminal machine executed by the PS-LTE terminal machine, and a memory access record of the PS-LTE terminal machine.

If the new application information and the hardware operation information are within a predetermined allowable range, the new application determination step S240 determines that the new application is a normal application. If the new application information and hardware operation information If any one of them is out of a predetermined allowable range, the new application can be judged to be an illegal / faulty application.

More specifically, if the access right to the camera of the PS-LTE terminal apparatus is not authorized, the camera system service of the PS-LTE terminal apparatus may not be operated by the application. However, if the application is an illegal / faulty application, it may be indicated that the application information does not have camera access authority, but actual hardware operation information may contain a record that the camera system service of the PS- have.

Accordingly, when the rights information provided by the application and the actual application are different from the access records of the system service of the PS-LTE terminal apparatus, the corresponding application can be judged to be an illegal / faulty application.

As another example, when the data transmitted to the outside from the PS-LTE terminal apparatus is transmitted to a third party instead of being transmitted to the application maker, it can also be determined that the application is an illegal / error application.

Meanwhile, in the command transmission step S250, when it is determined that the application is a normal application in the new application verification step, a normal application registration step of registering the new application as a normal application is performed. In the new application verification step, , It registers the new application as an illegal / faulty application, deletes the illegal / error application if it is installed in a plurality of PS-LTE terminal devices registered in the PS-LTE network, It is possible to carry out an application deletion and an installation prohibition command transmission step for transmitting the command.

3. Security system of PS-LTE communication network according to the embodiment of the present invention

3 is a block diagram illustrating a security system of a PS-LTE communication network according to an embodiment of the present invention.

Hereinafter, a security system for a PS-LTE communication network according to an embodiment of the present invention will be described with reference to FIG.

The PS-LTE communication network according to the embodiment of the present invention includes a plurality of PS-LTE terminal apparatuses 100 and a DM (device management) server 200 for managing and controlling the plurality of PS-LTE terminal apparatuses .

Each of the plurality of PS-LTE terminal apparatuses 100 includes a memory 110 in which an application is installed and data is stored, an application information collecting unit 120 A hardware operation information collecting unit 130 for collecting system service records and memory access records of the PS-LTE terminal apparatus, data collected by the application information collecting unit 120 and hardware operation information collecting unit 130, And a hardware operation information transmitting unit 140 for transmitting the application information and the hardware operation information transmitted to the DM server.

Meanwhile, information of a predetermined application installed in each of the PS-LTEs may be shared with other PS-LTE terminals through a block chain.

By using the block chain in this way, it is possible to easily share information of a new application installed in any one of a plurality of PS-LTE terminal equipments.

In addition, since the plurality of PS-LTE terminal devices registered in the PS-LTE network are collated if the hash information is shared by the block chains, hacking and falsification can be prevented.

Meanwhile, the DM server 200 includes an information receiving unit 210 receiving application information installed in each of the plurality of PS-LTE terminal apparatuses 100 and hardware operation information of each of the PS-LTE terminal apparatuses, An application determination unit 220 for determining whether an application is illegal or erroneous based on application information received from the application server 210 and hardware operation information of each PS-LTE terminal apparatus, And an instruction transmission unit 230 for transmitting an operation command to each of the LTE terminal apparatuses.

Meanwhile, the application information collected by the application information collection unit 120 may include an application name, an application maker, application installation information, application capacity information, and application privilege information.

Meanwhile, when the application information and the hardware operation information received from the information receiving unit 210 are within a predetermined allowable range, the application determining unit 220 determines that the application is a normal application, 210 may be determined to be illegal / faulty if any of the application information and the hardware operation information received in the mobile station 210 is out of a predetermined allowable range.

Meanwhile, if the application determining unit determines that the application is a normal application, the command transmitting unit 230 registers the application as a normal application. If the application determining unit determines that the application is an illegal / Error application, and if the illegal / wrong application is installed in the plurality of PS-LTE terminal apparatuses, the illegal / erroneous application installation prohibition command can be transmitted.

4 is a diagram illustrating a PS-LTE network according to an exemplary embodiment of the present invention.

Referring to FIG. 4, a PS-LTE network according to an embodiment of the present invention may include a plurality of PS-LTE terminals, a wireless network, and a DM server.

More specifically, the plurality of PS-LTE terminal apparatuses can perform voice communication and data communication through a wireless network in the same manner as a general LTE terminal apparatus.

Meanwhile, the plurality of PS-LTE terminal devices transmit application information and hardware operation information installed in the terminal device to the DM server in addition to voice communication and data communication, and transmit the PS-LTE terminal device control command from the DM server Can be received.

Meanwhile, the PS-LTE terminal apparatus according to the embodiment of the present invention may further include various functions in order to satisfy the security standard of the PS-LTE terminal apparatus. For example, Table 1 is a table showing the PS-LTE terminal equipment control security standard and necessary functions for satisfying it.

NO Terminal Device Control Security Standard Required function Application part One Identify and authenticate terminal device users Terminal lock setting function, USIM PIN lock setting function MMI, USIM 2 Identification and authentication of subscriber terminal equipment Terminal device - Network authentication check function CP 3 Media control communication path access control Bluetooth blocking function, 3G / LTE blocking function, WiFi blocking function, USB blocking function BT / LTE / WiFi / USB 4 Stored data protection SD card blocking function, Screen Shot blocking function SD card / Screen Shot 5 Prevent USIM replication hijacking Terminal device - Network authentication check function USIM 6 Detect malware Mobile Vaccine (Touch En, m Vaccine) UI 7 Certificate protection and digital signature verification Certificate and digital signature software update capability UI 8 Remote lock and remote wipe Call blocking, SMS blocking, MMS blocking, Application deletion UI 9 Screen lock Password force setting function UI 10 System service access control GPS blocking function, microphone blocking function, camera blocking function GPS / Microphone / Camera

Table 1 is an example of the PS-LTE terminal equipment control security standard, and the functions required for the security standard of the PS-LTE terminal equipment control security standard may be added or deleted.

Meanwhile, the PS-LTE terminal device applying the PS-LTE terminal device control security standard authenticates the PS-LTE terminal device and the user authentication of the PS-LTE terminal device using information such as fingerprint recognition, iris recognition, and face recognition can do. As a method for protecting the data transmitted in the authentication process, a data security method based on a block chain can be used.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention.

100: PS-LTE terminal device
110: Memory
120: Application information collection unit
130: hardware operation information collecting unit
140: Application information and hardware operation information transmission unit
200: Device management server
210:
220:
230: command transmission unit

Claims (13)

delete delete delete delete delete delete delete delete delete A security system of a PS-LTE network including a plurality of PS-LTE terminal apparatuses and a DM (device management) server for managing and controlling the plurality of PS-LTE terminal apparatuses,
Each of the plurality of PS-LTE terminal apparatuses
A memory where applications are installed and data is stored;
An application information collection unit for collecting application information stored in the memory;
A hardware operation information collecting unit for collecting system service records and memory access records of the PS-LTE terminal apparatus;
An application information collecting unit and a hardware operation information collecting unit, and transmitting the collected data to the DM server;
And,
The DM server includes:
An information receiving unit receiving application information installed in each of the PS-LTE terminal apparatuses and hardware operation information of each of the PS-LTE terminal apparatuses;
An application determining unit for determining whether an application is illegal or not based on application information received from the information receiving unit and hardware operation information of each PS-LTE terminal apparatus; And
An instruction transmission unit for transmitting an operation command to each of the plurality of PS-LTE terminal units according to a result of the application determination unit;
And,
And the information of a predetermined application installed in each of the PS-LTEs is shared with another PS-LTE terminal device through a block chain.
The method of claim 10,
Wherein the application information collected by the application information collection unit includes:
A name of the application, an application maker, installation information of the application, capacity information of the application, and authorization information of the application.
The method of claim 10,
The application judging unit judges,
When the application information received in the information receiving unit and the hardware operation information are within a predetermined allowable range, the application is determined as a normal application,
Wherein the application is judged to be an illegal / faulty application when any one of the application information and the hardware operation information received from the information receiving unit is out of a predetermined allowable range.
The method of claim 12,
The command transmission unit transmits,
If it is determined that the application is a normal application,
Registers the application as a normal application,
If it is determined that the application is an illegal / faulty application,
And transmits the illegal / erroneous application installation prohibition command when the illegal / error application is installed in the plurality of PS-LTE terminal equipments, Security system.

Images