Electronic device and method for verifying integrity of data by electronic device

Abstract

An electronic device according to various embodiments of the present disclosure may comprise a memory for storing instructions, and at least one processor operatively connected to the memory, wherein the instructions are configured to, when executed by the at least one processor, cause the electronic device to: use first software of a first authority level to identify whether data of a first area of the memory satisfies a designated condition related to a security level when the data of the first area needs to be used; if the data satisfies the designated condition, store a first value, which is an initial value of the data, and a first address corresponding to the first value in a second area of the memory; as the data of the first area is updated, use the first software to store, in a third area of the memory, values updated in the first area; and when a designated event occurs, use second software to perform security verification by identifying, in reverse order of update, the values stored in the third area. Other embodiments may also be possible.

Description

Electronic devices and methods for verifying the integrity of data in electronic devices

[0001] Various embodiments of the present disclosure relate to a method for verifying the integrity of data in an electronic device.

[0002] Integrity verification of data in electronic devices can be the process of ensuring that data remains unaltered. Electronic devices can securely store data and restrict processes (e.g., software or programs) that access the data using permissions (e.g., access rights). Integrity verification can also be performed to determine whether the data has been tampered with or corrupted. Methods for verifying data integrity can vary.

[0003] Electronic devices can use privileged levels to control access to resources (e.g., memory areas, I / O ports, special instructions, etc.) of software (or programs or processes) running on the processor.

[0004] Electronic devices can hardware-wise distinguish between a normal area (e.g., normal area (or world)) and a secure area (e.g., secure area (or world)) and set an access level for the secure area to be higher than the access level for the normal area. Within each area (normal area or secure area), the electronic device can allow software to have one of multiple privilege levels (e.g., exception level (EL) 0 to EL3), and the multiple privilege levels can include the lowest privilege 0 to the highest privilege n (e.g., n=3). For example, the electronic device can use privilege level n for the kernel and privilege level 0 for application programs.

[0005] The processor of an electronic device can exploit differences in the privilege levels of software to allow high-privilege software to access and process important or security-required data. For example, the electronic device can allow high-privilege software (e.g., software in the secure domain) to access DRM (digital rights management) data, and when low-privilege software (e.g., software in the general domain) transfers (or shares) content (or the address of the memory where the content is stored) to the secure domain, the high-privilege software can process the content using the DRM data and then transfer (or share) the processed content (or the address of the memory where the processed content is stored) back to the general domain so that the low-privilege software can use it. In addition, the electronic device can restrict write operations by low-privilege kernel domain software or user domain software to designated memory (e.g., secure memory) or designated areas of memory (e.g., secure domain) (e.g., page tables for the kernel), while allowing high-privilege software, such as a hypervisor, to perform write operations. Additionally, electronic devices can restrict access to sensitive keys that require security from software with lower privilege levels, while allowing software with higher privilege levels to access the keys.

[0006] The processor of an electronic device may frequently encounter situations where it needs to perform data processing (e.g., write operations) that require a higher privilege level while using software with a lower privilege level, and in such situations, it may need to generate a trap and request the software with a higher privilege level.

[0007] Electronic devices must back up the context of the low-privilege software's operations when a trap occurs and then restore the backed-up context when the high-privilege software resumes operation after processing data. This can be time-consuming. Furthermore, electronic devices must use policies to check whether the high-privilege software's operations (e.g., write operations) are legal each time a trap occurs, which can be time-consuming.

[0008] For very important data (e.g., data with a very high security level), having high-privilege software process it every time even if it takes a long time can increase data security. However, for relatively less important data (e.g., data with a low security level), having high-privilege software run by generating a trap every time can lower data processing efficiency.

[0009] According to one embodiment, an electronic device and a method for verifying the integrity of data in an electronic device can be provided that can reduce data processing time and power consumption while maintaining data security by reducing the number of times software with a high privilege level is used by not generating a trap for data having a security level designated as relatively less important data.

[0010] According to one embodiment of the present disclosure, an electronic device may include a memory storing instructions and at least one processor (120, 220) operatively connected to the memory. The instructions, when executed by the at least one processor, may be configured to cause the electronic device to, using first software of a first privilege level, identify whether data in a first area of ​​the memory satisfies a specified condition related to a security level when the data is to be used. The instructions, when executed by the at least one processor, may be configured to cause the electronic device to, if the data satisfies the specified condition, store a first value, which is an initial value of the data, and a first address corresponding to the first value, in a second area of ​​the memory. The instructions, when executed by the at least one processor, may be configured to cause the electronic device to, using the first software, store values ​​updated in the first area in a third area of ​​the memory as the data in the first area is updated. The above commands, when executed by the at least one processor, may be configured to cause the electronic device to perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order using the second software when a specified event occurs.

[0011] In one embodiment of the present disclosure, a method for verifying the integrity of data in an electronic device may include an operation of using first software of a first authority level to identify whether data in a first area of ​​a memory of the electronic device satisfies a specified condition related to a security level when the data in the first area is to be used. The method may include an operation of storing a first value, which is an initial value of the data, and a first address corresponding to the first value, in a second area of ​​the memory when the data satisfies the condition. The method may include an operation of using the first software to store values ​​updated in the first area in a third area of ​​the memory as the data in the first area is updated. The method may include an operation of performing security verification by using the second software to check values ​​stored in the third area in a reverse order of the updated order when a specified event occurs.

[0012] According to one embodiment of the present disclosure, a non-volatile storage medium storing commands is provided, wherein the commands are configured to cause the electronic device to perform at least one operation when executed by the electronic device, wherein the at least one operation may include: an operation of identifying, by using first software of a first authority level, whether data of a first area of ​​a memory (130, 230) of the electronic device is data of an intermediate security level lower than a high security level when the data of the first area is to be used; an operation of storing a first value, which is an initial value of the data, and a first address corresponding to the first value, in a second area of ​​the memory when the data of the first area satisfies the specified condition; an operation of storing updated values ​​in the first area in a third area of ​​the memory, by using the first software, as the data of the first area is updated; and an operation of performing security verification by using the second software to check the values ​​stored in the third area in a reverse order of the updated order when a specified event occurs.

[0013] FIG. 1 is a block diagram of an electronic device within a network environment according to one embodiment.

[0014] Figure 2 is a block diagram of an electronic device according to one embodiment.

[0015] FIG. 3 is a diagram showing a program stored in memory when the memory is operated without distinction between a general area and a secure area according to one embodiment.

[0016] FIG. 4 is a diagram showing a program stored in memory when the memory is operated by dividing it into a general area and a secure area according to one embodiment.

[0017] FIG. 5 is a diagram illustrating a data integrity verification operation in an electronic device according to one embodiment.

[0018] FIG. 6 is a diagram showing a storage area of ​​a memory according to one embodiment.

[0019] FIG. 7A is a flowchart illustrating the operation of a processor when data of a first area to be used through a first software of a first authority level is data of a first security level according to an embodiment.

[0020] FIG. 7b is a flowchart illustrating the operation of a processor when data in a first area to be used through a first software of a first authority level according to an embodiment is data of a second security level.

[0021] In connection with the description of the drawings, the same or similar reference numerals may be used for identical or similar components.

[0022] The terms used in this document are used only to describe specific embodiments and may not be intended to limit the scope of other embodiments. The singular expression may include the plural expression unless the context clearly indicates otherwise. All terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by those of ordinary skill in the art of the present invention. Terms defined in commonly used dictionaries may be interpreted as having the same or similar meaning in the context of the relevant technology, and shall not be interpreted in an idealized or overly formal sense unless explicitly defined in this document. In some cases, even if a term is defined in this document, it cannot be interpreted to exclude embodiments of the present invention.

[0023] FIG. 1 is a block diagram of an electronic device (101) within a network environment (100) according to one embodiment.

[0024] Referring to FIG. 1, in a network environment (100), an electronic device (101) may communicate with an electronic device (102) via a first network (198) (e.g., a short-range wireless communication network), or may communicate with at least one of an electronic device (104) or a server (108) via a second network (199) (e.g., a long-range wireless communication network). According to one embodiment, the electronic device (101) may communicate with the electronic device (104) via the server (108). According to one embodiment, the electronic device (101) may include a processor (120), a memory (130), an input module (150), an audio output module (155), a display module (160), an audio module (170), a sensor module (176), an interface (177), a connection terminal (178), a haptic module (179), a camera module (180), a power management module (188), a battery (189), a communication module (190), a subscriber identification module (196), or an antenna module (197). In some embodiments, the electronic device (101) may omit at least one of these components (e.g., the connection terminal (178)), or may have one or more other components added. In some embodiments, some of these components (e.g., the sensor module (176), the camera module (180), or the antenna module (197)) may be integrated into one component (e.g., the display module (160)).

[0025] The processor (120) may control at least one other component (e.g., a hardware or software component) of the electronic device (101) connected to the processor (120) by executing, for example, software (e.g., a program (140)), and may perform various data processing or calculations. According to one embodiment, as at least a part of the data processing or calculation, the processor (120) may store a command or data received from another component (e.g., a sensor module (176) or a communication module (190)) in a volatile memory (132), process the command or data stored in the volatile memory (132), and store the resulting data in a non-volatile memory (134). According to one embodiment, the processor (120) may include a main processor (121) (e.g., a central processing unit or an application processor) or a secondary processor (123) (e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor) that can operate independently or together therewith. For example, if the electronic device (101) includes a main processor (121) and a secondary processor (123), the secondary processor (123) may be configured to use less power than the main processor (121) or to be specialized for a specified function. The secondary processor (123) may be implemented separately from the main processor (121) or as a part thereof.

[0026] The auxiliary processor (123) may control at least a part of functions or states associated with at least one component (e.g., a display module (160), a sensor module (176), or a communication module (190)) of the electronic device (101), for example, on behalf of the main processor (121) while the main processor (121) is in an inactive (e.g., sleep) state, or together with the main processor (121) while the main processor (121) is in an active (e.g., application execution) state. In one embodiment, the auxiliary processor (123) (e.g., an image signal processor or a communication processor) may be implemented as a part of another functionally related component (e.g., a camera module (180) or a communication module (190)). In one embodiment, the auxiliary processor (123) (e.g., a neural network processing unit) may include a hardware structure specialized for processing artificial intelligence models. The artificial intelligence models may be generated through machine learning. This learning can be performed, for example, on the electronic device (101) itself where the artificial intelligence model is executed, or can be performed through a separate server (e.g., server (108)). The learning algorithm can include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above. The artificial intelligence model can include multiple artificial neural network layers.The artificial neural network may be one of a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more of the above, but is not limited to the examples described above. In addition to, or alternatively to, a hardware structure, an artificial intelligence model may include a software structure.

[0027] The memory (130) can store various data used by at least one component (e.g., processor (120) or sensor module (176)) of the electronic device (101). The data can include, for example, software (e.g., program (140)) and input data or output data for commands related thereto. The memory (130) can include volatile memory (132) or non-volatile memory (134).

[0028] The program (140) may be stored as software in the memory (130) and may include, for example, an operating system (142), middleware (144), or an application (146).

[0029] The input module (150) can receive commands or data to be used in a component of the electronic device (101) (e.g., a processor (120)) from an external source (e.g., a user) of the electronic device (101). The input module (150) can include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).

[0030] The audio output module (155) can output audio signals to the outside of the electronic device (101). The audio output module (155) can include, for example, a speaker or a receiver. The speaker can be used for general purposes, such as multimedia playback or recording playback. The receiver can be used to receive incoming calls. According to one embodiment, the receiver can be implemented separately from the speaker or as part of the speaker.

[0031] The display module (160) can visually provide information to an external party (e.g., a user) of the electronic device (101). The display module (160) may include, for example, a display, a holographic device, or a projector and a control circuit for controlling the device. According to one embodiment, the display module (160) may include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of a force generated by the touch.

[0032] The audio module (170) can convert sound into an electrical signal, or vice versa, convert an electrical signal into sound. According to one embodiment, the audio module (170) can acquire sound through the input module (150), output sound through the sound output module (155), or an external electronic device (e.g., electronic device (102)) (e.g., speaker or headphone) directly or wirelessly connected to the electronic device (101).

[0033] The sensor module (176) can detect the operating status (e.g., power or temperature) of the electronic device (101) or the external environmental status (e.g., user status) and generate an electrical signal or data value corresponding to the detected status. According to one embodiment, the sensor module (176) can include, for example, a gesture sensor, a gyro sensor, a barometric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

[0034] The interface (177) may support one or more designated protocols that may be used to directly or wirelessly connect the electronic device (101) with an external electronic device (e.g., the electronic device (102)). In one embodiment, the interface (177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.

[0035] The connection terminal (178) may include a connector through which the electronic device (101) may be physically connected to an external electronic device (e.g., electronic device (102)). According to one embodiment, the connection terminal (178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

[0036] A haptic module (179) can convert electrical signals into mechanical stimuli (e.g., vibration or movement) or electrical stimuli that a user can perceive through tactile or kinesthetic sensations. According to one embodiment, the haptic module (179) can include, for example, a motor, a piezoelectric element, or an electrical stimulation device.

[0037] The camera module (180) can capture still images and videos. According to one embodiment, the camera module (180) may include one or more lenses, image sensors, image signal processors, or flashes.

[0038] The power management module (188) can manage power supplied to the electronic device (101). According to one embodiment, the power management module (188) can be implemented as, for example, at least a part of a power management integrated circuit (PMIC).

[0039] A battery (189) may power at least one component of the electronic device (101). In one embodiment, the battery (189) may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0040] The communication module (190) may support the establishment of a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device (101) and an external electronic device (e.g., electronic device (102), electronic device (104), or server (108)), and the performance of communication through the established communication channel. The communication module (190) may operate independently from the processor (120) (e.g., application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication module (190) may include a wireless communication module (192) (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module (194) (e.g., a local area network (LAN) communication module, or a power line communication module). Among these communication modules, the corresponding communication module can communicate with an external electronic device (104) via a first network (198) (e.g., a short-range communication network such as Bluetooth, wireless fidelity (WiFi) direct, or infrared data association (IrDA)) or a second network (199) (e.g., a long-range communication network such as a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)). These various types of communication modules can be integrated into a single component (e.g., a single chip) or implemented as multiple separate components (e.g., multiple chips). The wireless communication module (192) can verify or authenticate the electronic device (101) within a communication network such as the first network (198) or the second network (199) by using subscriber information (e.g., an international mobile subscriber identity (IMSI)) stored in the subscriber identification module (196).

[0041] The wireless communication module (192) can support 5G networks and next-generation communication technologies following the 4G network, such as NR access technology (new radio access technology). The NR access technology can support high-speed transmission of high-capacity data (eMBB (enhanced mobile broadband)), minimization of terminal power and connection of multiple terminals (mMTC (massive machine type communications)), or high reliability and low latency (URLLC (ultra-reliable and low-latency communications)). The wireless communication module (192) can support, for example, a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate. The wireless communication module (192) can support various technologies for securing performance in a high-frequency band, such as beamforming, massive multiple-input and multiple-output (MIMO), full dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large scale antenna. The wireless communication module (192) can support various requirements specified in the electronic device (101), an external electronic device (e.g., the electronic device (104)), or a network system (e.g., the second network (199)). According to one embodiment, the wireless communication module (192) may support a peak data rate (e.g., 20 Gbps or more) for eMBB realization, a loss coverage (e.g., 164 dB or less) for mMTC realization, or a U-plane latency (e.g., 0.5 ms or less for downlink (DL) and uplink (UL), or 1 ms or less for round trip) for URLLC realization.

[0042] The antenna module (197) can transmit or receive signals or power to or from an external device (e.g., an external electronic device). According to one embodiment, the antenna module (197) may include an antenna including a radiator formed of a conductor or a conductive pattern formed on a substrate (e.g., a PCB). According to one embodiment, the antenna module (197) may include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication method used in a communication network, such as the first network (198) or the second network (199), may be selected from the plurality of antennas, for example, by the communication module (190). A signal or power may be transmitted or received between the communication module (190) and an external electronic device via the selected at least one antenna. According to some embodiments, in addition to the radiator, another component (e.g., a radio frequency integrated circuit (RFIC)) may be additionally formed as a part of the antenna module (197).

[0043] In one embodiment, the antenna module (197) may form a mmWave antenna module. In one embodiment, the mmWave antenna module may include a printed circuit board, an RFIC disposed on or adjacent to a first side (e.g., a bottom side) of the printed circuit board and capable of supporting a designated high-frequency band (e.g., a mmWave band), and a plurality of antennas (e.g., an array antenna) disposed on or adjacent to a second side (e.g., a top side or a side side) of the printed circuit board and capable of transmitting or receiving signals in the designated high-frequency band.

[0044] At least some of the above components can be interconnected and exchange signals (e.g., commands or data) with each other via a communication method between peripheral devices (e.g., a bus, GPIO (general purpose input and output), SPI (serial peripheral interface), or MIPI (mobile industry processor interface)).

[0045] According to one embodiment, commands or data may be transmitted or received between the electronic device (101) and an external electronic device (104) via a server (108) connected to a second network (199). Each of the external electronic devices (102 or 104) may be the same or a different type of device as the electronic device (101). According to one embodiment, all or part of the operations executed in the electronic device (101) may be executed in one or more of the external electronic devices (102, 104, or 108). For example, when the electronic device (101) is to perform a certain function or service automatically or in response to a request from a user or another device, the electronic device (101) may, instead of or in addition to executing the function or service itself, request one or more external electronic devices to perform the function or at least a part of the service. One or more external electronic devices that receive the request may execute at least a portion of the requested function or service, or an additional function or service related to the request, and transmit the result of the execution to the electronic device (101). The electronic device (101) may process the result as is or additionally and provide it as at least a portion of a response to the request. For this purpose, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used, for example. The electronic device (101) may provide an ultra-low latency service by using distributed computing or mobile edge computing, for example. In another embodiment, the external electronic device (104) may include an Internet of Things (IoT) device. The server (108) may be an intelligent server utilizing machine learning and / or a neural network. According to one embodiment, the external electronic device (104) or the server (108) may be included in the second network (199).The electronic device (101) can be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.

[0046] Figure 2 is a block diagram of an electronic device according to one embodiment.

[0047] Referring to FIG. 2, an electronic device (201) according to an embodiment (e.g., the electronic device (101) of FIG. 1) may include a processor (220) and a memory (230). The electronic device (201) according to an embodiment is not limited to the processor (220) and the memory (230) and may further include at least one component (e.g., hardware). The electronic device (201) according to an embodiment may further include all or part of the electronic device (101) illustrated in FIG. 1.

[0048] The memory (230) according to one embodiment (e.g., (130) of FIG. 1) may include a volatile memory (e.g., (132) of FIG. 1) or a non-volatile memory (e.g., (134) of FIG. 1).

[0049] A memory (230) according to an embodiment may store a program (240) (e.g., instructions) executed by a processor (220) of an electronic device (201) and data (not shown) used by at least one component (e.g., the processor (220) or hardware (not shown)) of the electronic device (201). The program (240) according to an embodiment may include software of multiple permission levels having different permissions for using resources (e.g., a memory area, an I / O port, a designated instruction, and / or other resources of the electronic device) of the electronic device (201). The program (240) according to an embodiment may include first software (242) of a first permission level (e.g., EL1 or an operating system (OS)) and second software (244) of a second permission level (e.g., EL2 or a hypervisor), and may further include other software (e.g., EL0 or an application program) of at least one other permission level. For example, multiple different permission levels (e.g., EL (exception level) 0 to EL3) can be included, ranging from 0, the lowest permission, to n, the highest permission (e.g., n=3).

[0050] According to one embodiment, the memory (230) may be operated without distinction of hardware areas, or may be operated by dividing it into a normal area (e.g., normal area (or world)) and a secure area (e.g., secure area (or world)). When the memory (230) according to one embodiment is operated by dividing it into a normal area and a secure area, a plurality of softwares (EL0 to EL3) with different permission levels may operate in the normal area, and a plurality of softwares (EL0 to EL3) with different permission levels may also operate in the secure area independently of the normal area, and the permission levels of the softwares in the secure area may be higher than the permission levels of the softwares in the normal area.

[0051] A processor (220) according to an embodiment (e.g., processor (120) of FIG. 1) may include a central processing unit (CPU) and / or an application processor (AP). The processor (220) according to an embodiment may execute a program (240) (or instructions) stored in a memory (230) to control at least one other component (e.g., hardware or software component) of an electronic device (201) connected to the processor (220), and may perform processing or calculation of various data.

[0052] According to an embodiment, the processor (220) may use the first software (242) of the first authority level to identify (judge or confirm) whether the data of the first area of ​​the memory (230) satisfies a specified condition related to a security level when the data is to be used. According to an embodiment, the security level may be a first security level (e.g., the highest security level), a second security level lower than the first security level (e.g., a medium security level lower than the highest security level), or a third security level lower than the second security level (e.g., a general level lower than the medium security level). According to an embodiment, the processor (220) may identify a security level pre-specified for the data of the first area based on the importance and / or security maintenance time of the data of the first area when the data of the first area is to be used, or may identify (or determine or confirm) the importance and / or security maintenance time of the data of the first area and identify a security level corresponding to the first area based on the identified importance and / or security maintenance time. According to an embodiment, the processor (220) may identify (or determine) or classify, when data of a first area of ​​the memory (230) is to be used, the data of the first area as one of a first security level having the highest importance, a second security level having a middle level having lower importance than data of the second security level and higher importance than data of the third security level, or a third security level having a general level having lower importance than data of the second security level. The security level of the data according to an embodiment may be specified in the electronic device (201), specified (or determined) by a user (or a developer, or an algorithm or AI), specified (or determined) automatically through data analysis, specified (or determined) by a software (or application) provider, or specified (or determined) in any other manner.Criteria for determining the importance (degree of importance) of data according to an embodiment may include whether real-time security verification of the data is required and / or whether the storage time of the data is within a specified time, and other criteria for determining the importance of the data may be further included.

[0053] According to one embodiment, the processor (220) may identify (or classify or determine) the entire application requiring real-time security verification as data of the first security level. For example, data of the first security level may include banking applications or stock applications, and may further include other applications requiring high security. According to one embodiment, even if the application requires real-time security verification, the processor (220) may identify (or classify or determine) most of the data included in the application as data of the second security level or data of the third security level, and may also identify (or classify or determine) data of pages requiring authentication security within the application as data of the first security level. For example, the processor (220) may determine page data requiring user authentication in a banking application as data of the first security level, and may identify general information page data that does not require an authentication process such as a certificate or password in the banking application as data of the second security level. According to one embodiment, the processor (220) can identify (or classify or determine) DRM (Digital Right Management) data as data of the first security level. According to one embodiment, even if the DRM data is data of the first security level, if the time for which it is buffered or stored within the first area is shorter than a specified time (e.g., within several seconds) and thus there is no problem in maintaining security, it can be identified as data of the second security level.

[0054] According to an embodiment, the processor (220) may identify data of the first area as satisfying a specified condition related to a security level if the security level of data of the first area satisfies a specified security level among a plurality of security levels (e.g., a second security level lower than the first security level). Data of a specified security level according to an embodiment may include data of a specified type. For example, the processor (220) may identify a data type corresponding to a key value or a password value used for playing DRM content as data of a first security level, a data type corresponding to a page table value for address conversion by a memory management unit (MMU) or a value for sharing information between applications as data of a second security level, and may also identify (or determine) other data types designated as data of a second security level by a user (or developer or AI) as data of a second security level.

[0055] In one embodiment, the processor (220) may trap, if the data of the first region to be used through the first software of the first privilege level is data of the first security level that requires real-time (immediate) security verification, an operation to update the data of the first region may be performed by the second software of the second privilege level. For example, the trap may be an operation through a software interrupt. In one embodiment, the processor (220) may call, if the data of the first region to be used through the first software of the first privilege level is data of the first security level, the second software of the second privilege level may be called through a software interrupt and the second software may perform an operation to update the data of the first region. In one embodiment, the processor (220) may read data of a first area through first software of a first privilege level (e.g., read only), and then check the condition of data written (or to be written) to the first area. If the data written to the first area is data of the first security level, the processor (220) may call second software of a second privilege level through a trap and request the second software to write (e.g., update) data to the first area. In one embodiment, the processor (220) may check a security policy (e.g., policy) for data of the first area using the second software of the second privilege level according to the trap and write request, and may write (e.g., update, write) data to the first area using the second software of the second privilege level instead of the first software of the first privilege level.

[0056] This method of writing data of the first security level is such that whenever the processor (220) wants to write a value to a specific address through the first software (EL1) of the first privilege level, the processor (220) checks the security policy through the second software (EL2) of the second privilege level and writes using the second software (EL2) of the second privilege level instead of the first software (EL1) of the first privilege level, which may cause many transitions between EL1 and EL2 and consume more processor resources (e.g., CPU resources), which may result in greater time and power consumption. If data of the second security level lower than the first security level is processed in the same way as data of the first security level, processing of data of the first security level, which is data of a higher security level than data of the second security level, may be delayed.

[0057] According to an embodiment, the processor (220) may identify (judge or confirm) whether data to be used through the first software satisfies a specified condition related to a security level. According to an embodiment, if data of the first region to be used through the first software is data of a second security level lower than the first security level, the processor (220) may identify data of the first region as satisfying a specified condition related to the security level. For example, the processor (220) may identify data of a second security level that does not require real-time (immediate) security verification but requires security verification after a certain period of time. If the data to be used through the first software satisfies the second security level, the first value (e.g., value1), which is the initial value of the data, and the first address corresponding to the first value may be stored in the second region of the memory (230) using the second software of the second permission level higher than the first permission level. According to an embodiment, the processor (220) may, if the data to be used through the first software is data of the second security level, allocate a buffer of the second area to store a first value (e.g., value1) which is an initial value of the data of the first area and a first address corresponding to the first value in the memory (230), and allocate a buffer corresponding to the third area to perform data logging whenever the value of the data of the first area is updated. According to an embodiment, the processor (220) may, if the data to be used through the first software is data of the second security level, perform marking to store a first address which is an address of the first area and a first value stored at the first address in the second area, and store the first value in the third area.

[0058] For example, if the data of the second security level is a screen data address value where screen data decrypted from DRM content is stored, the first value may be the screen data address value, and the first address may be the address where the screen data address value is stored.

[0059] According to one embodiment, the processor (220) may use the value of data in the first area or update the value of data in the first area using the first software.

[0060] According to an embodiment, the processor (220) may perform data logging in the third region whenever the value of data in the first region is updated. For example, the processor (220) may sequentially store updated data values ​​whenever the value of data in the first region is updated, and this operation may be referred to as data logging. According to an embodiment, when the first address and the first value are stored in the second region, the processor (220) may store the first value, which is the initial value of data in the first region, in the third region, and may store at least one value (or values) updated in the updated order in the third region whenever the value of data in the first region is updated. For example, when the first address and the first value are stored in the second region, the processor (220) may store the first value in the third region, and when the first value in the first region is updated to the second value, the processor (220) may further store the second value (e.g., value2) updated from the first value in the third region. The processor (220) may further store a third value (e.g., value 3) updated from the second value in addition to the first value and the second value when the second value of the first region is updated to the third value. The number of updates and the updated values ​​may not be limited.

[0061] The processor (220) according to one embodiment may identify the occurrence of a designated event. The designated event according to one embodiment may be an event that triggers integrity verification (e.g., security verification) of data in the first area or the third area. The designated event according to one embodiment may occur based on the arrival of a designated time period using a timer. The designated event according to one embodiment may occur based on a wake-up. The wake-up according to one embodiment may refer to a state in which the electronic device (201) is released from a sleep mode. For example, the sleep mode may include a state in which the processor (220) is in a sleep mode (or a state in which the processor (220) is not operating). The designated event according to one embodiment may occur based on the remaining storage capacity size of the third area. The designated event according to one embodiment may occur based on a key input. A designated event according to one embodiment may occur based on a combination of at least one of the following events: reaching a designated time period using a timer, a designated event, a wake-up, the remaining storage capacity of a third region, and a key input.

[0062] According to one embodiment, the processor (220) may perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order through the second software of the second authority level when a specified time period using a timer is reached, when woken up, when the remaining storage capacity of the third area is less than (or equal to) the specified capacity, or when there is a specified key input.

[0063] In one embodiment, the processor (220) may compare the values ​​stored in the third region of the memory (230) with the values ​​updated in the first region during security verification. In one embodiment, the processor (220) may check the values ​​stored in the third region through the second software of the second authority level, and if there is no value updated in the first region among the values ​​stored in the third region, the processor may determine that the value updated in the first region is a value that has failed the integrity verification (or security verification), and control the first software to stop using the data in the first region. For example, if Value1->Value2->Value3 is logged (or recorded) in the update order in the third region and value4 is recorded in the first region by hacking rather than the first software, value4 will not be logged in the third region, and thus value4 in the first region may not exist in the third region. In one embodiment, the processor (220) may determine that value4 in the first region is a value that has been updated in an abnormal manner, and may stop using value4 in the first region.

[0064] In one embodiment, the processor (220) may, during security verification, input the values ​​(e.g., value1, value2, value3) stored in the third area in the order of update through the second software of the second authority level into an integrity verification formula (e.g., hash function) in the reverse order of update, and compare the calculated value1 value and address with the initial value and address of the second area that have been previously stored. In one embodiment, the processor (220) may determine that the integrity verification (or security verification) of the data in the first area has been successful (there is no hacking or security problem) if the calculated value1 value and address are the same as the initial value and address of the second area that have been previously stored. In one embodiment, the processor (220) may determine that the integrity verification (or security verification) of the data in the first area has failed if the calculated value1 value and address are not the same as the initial value and address of the second area that have been previously stored, and may stop the use of the data in the first area.

[0065] In one embodiment, the processor (220) may be reset to stop use of the data in the first region. In one embodiment, the processor (220) may be reset directly by the second software, or may be reset by the first software after a reset request is transmitted from the second software to the first software.

[0066] In one embodiment, the processor (220) may stop use of an application or program or menu that uses the first area (or data of the first area) to stop use of the data of the first area.

[0067] In the case where the processor (220) according to one embodiment operates the memory (230) as a normal area (e.g., normal area (or world)) without distinguishing the hardware area, the first software of the 1st privilege level may be an operating system (OS) (e.g., the first OS), and the second software of the 2nd privilege level may have a higher level of access to the memory (230) than the first OS and may include a first hypervisor that manages (or controls) the first OS. In the case where the processor (220) according to one embodiment operates the memory (230) by dividing it into a normal area and a secure area, the first software of the 1st privilege level may be an operating system (OS) (e.g., the first OS), and the second software of the 2nd privilege level may include a first hypervisor that operates in the normal area, or an application, a second OS, or a second hypervisor that operates in the secure area.

[0068] An electronic device (e.g., electronic device 101 of FIG. 1 or electronic device 201 of FIG. 2) according to an embodiment of the present disclosure may include a memory (e.g., memory 130 of FIG. 1 or memory 230 of FIG. 2) for storing commands and at least one processor (e.g., processor 120 of FIG. 1 or processor 220 of FIG. 2) operatively connected to the memory. The commands according to an embodiment may be configured to cause the electronic device, when executed by the at least one processor, to identify, using first software of a first privilege level, whether data in a first area of ​​the memory satisfies a specified condition related to a security level when the data is to be used. The commands according to an embodiment may be configured to cause the electronic device, when executed by the at least one processor, to store a first value, which is an initial value of the data, and a first address corresponding to the first value, in a second area of ​​the memory when the data satisfies the specified condition. The commands according to one embodiment may be configured, when executed by the at least one processor, to cause the electronic device to store, in a third area of ​​the memory, values ​​updated in the first area using the first software as the data in the first area is updated. The commands according to one embodiment may be configured, when executed by the at least one processor, to cause the electronic device to perform security verification by checking, in a reverse order of the updated order, values ​​stored in the third area using the second software when a specified event occurs.

[0069] The instructions according to one embodiment may be further configured to cause the electronic device, when executed by the at least one processor, to identify success of the security verification if a result of checking the values ​​stored in the third area in the reverse order of the updated order is the same as the first value stored in the second area.

[0070] The instructions according to one embodiment may be further configured to cause the electronic device, when executed by the at least one processor, to identify a failure of the security verification if the result of checking the values ​​stored in the third area in the reverse order of the updated order is not the same as the first value stored in the second area.

[0071] The instructions according to one embodiment may be further configured to cause the electronic device, when executed by the at least one processor, to compare the values ​​stored in the third area with the values ​​stored in the first area in a reverse order of the updated order, to identify success of the security verification if the value stored in the first area exists among the values ​​stored in the third area, and to identify failure of the security verification if the value stored in the first area does not exist among the values ​​stored in the third area.

[0072] The instructions according to one embodiment may further be configured to cause the electronic device, when executed by the at least one processor, to reset the electronic device to stop use of data in the first area upon failure of the security verification.

[0073] The instructions according to one embodiment may further be configured to cause the electronic device, when executed by the at least one processor, to reset the electronic device to stop use of the data in the first area.

[0074] The instructions according to one embodiment may further be configured to cause the electronic device, when executed by the at least one processor, to stop execution of an application or program or menu associated with the data in the first area to stop use of the data in the first area when the security verification fails.

[0075] The instructions according to one embodiment are further configured to cause the electronic device, when executed by the at least one processor, to identify the data of the first area as satisfying the specified condition if the data of the first area is data of a second security level lower than the first security level, and the data of the second security level may be data designated based on the importance and / or security maintenance time of the data.

[0076] According to an embodiment, the first software may include a judgment module configured to identify whether the data of the first area is data of the second security level, an update and logging module configured to store values ​​updated in the first area in the updated order as the data of the first area is updated, a first trigger module configured to provide a first trigger signal based on the specified condition, and a control module configured to control the update and logging unit and the mark unit of the second software to operate if the data is data of the second security level, and to transmit the first trigger signal to the second software.

[0077] The second software according to one embodiment may include the mark module configured to store the first value, which is the initial value of the data, and the first address corresponding to the first value in the second area, the second trigger module configured to periodically provide a second trigger signal when the first trigger signal is not received for a specified time, and the replay module configured to perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order when the specified event based on the first trigger signal or the second trigger signal occurs.

[0078] According to one embodiment, the first software may include a first OS, and the second software may include a hypervisor that manages the first OS.

[0079] According to one embodiment, the first software may include a first OS operating in a general domain, and the second software may include an application, a second OS, or a hypervisor operating in a secure domain.

[0080] According to one embodiment, the data of the second security level may include an address value where decrypted screen data from DRM content is stored, a key value used for playing DRM content, a page table value for address conversion by a memory management unit (MMU), a value for sharing information between applications, or a password value.

[0081] In an embodiment, when the data of the second security level is a screen data address value where screen data decrypted from DRM content is stored, the first value may be a screen data address value, and the first address may be an address where the screen data address value is stored.

[0082] The above-described event according to one embodiment may include at least one of a time reaching event using a timer, a wake-up event, an event based on the remaining storage area size of the third area, or a key input event.

[0083] The instructions according to one embodiment, when executed by the at least one processor, may be configured to cause the electronic device to allocate a buffer corresponding to the second area and a buffer corresponding to the third area in the memory using the first software.

[0084] FIG. 3 is a diagram showing a program stored in memory when the memory is operated without distinction between a general area and a secure area according to one embodiment.

[0085] Referring to FIG. 3, a program (340) stored in a memory (e.g., memory (230) of FIG. 2) according to one embodiment may include software (342) of an EL0 (exception level 0) permission level, software (344) of an EL1 (342) permission level, and software (346) of an EL2 permission level, which have different access rights to storage areas of the memory (230).

[0086] The software (342) of the ELO privilege level according to one embodiment may include at least one application. Each of the at least one application may be executed, controlled, and managed by the processor (230) through the software (344) of the EL1 privilege level. The software (344) of the EL1 privilege level according to one embodiment may include an operating system (OS). The OS may be controlled and managed by the processor (230) through the software (346) of the EL2 privilege level according to one embodiment. The software (346) of the EL2 privilege level according to one embodiment may include a hypervisor. The processor (230) may control or manage the OS through the hypervisor.

[0087] In FIG. 3, an example can be illustrated in which the OS, which is software (344) of the EL1 permission level, is the first software of the first permission level, and the Hypervisor, which is software (346) of the EL2 permission level, is the second software of the second permission level.

[0088] According to one embodiment, the OS (344) may include a determining module (350), a control module (MUR (mark, update, replay) control) (352), an update and logging module (update and logging) (354), and a first trigger module (trigger 1) (356). According to one embodiment, the hypervisor (346) may include a mark module (mark) (362), a replay module (replay) (364), and a second trigger module (trigger 2) (366).

[0089] According to an embodiment, the processor (220) can identify (judge or confirm) whether the data of the first area of ​​the memory (230) satisfies a specified condition related to a security level through the determining module (350) when the data should be used using the OS (344). According to an embodiment, the processor (220) can identify whether the data of the first area is data of the first security level, data of the second security level, or data of the third security level through the determining module (350). According to an embodiment, if the data of the first area is determined to be data of the second security level through the determining module (350), the processor (220) can identify that the data of the first area satisfies a specified condition related to a security level. According to an embodiment, the processor (220) may identify a security level assigned to the data in the first area based on the importance and / or security maintenance time of the data in the first area through the determination module (350) when the data in the first area of ​​the memory (230) must be used, or may identify (or determine or confirm) the importance and / or security maintenance time of the data in the first area and identify a security level corresponding to the first area based on the identified importance and / or security maintenance time. The security level of the data according to an embodiment may be specified in the electronic device (201), specified (or determined) by a user (or developer, or algorithm or AI), automatically specified (or determined) through data analysis, specified (or determined) by a software (or application) provider, or may be specified (or determined) in other ways. The criteria for determining the importance (degree of importance) of the data according to an embodiment may include whether real-time security verification of the data is required and / or whether the storage time of the data is within a specified time, and may further include other criteria for determining the importance of the data.

[0090] According to one embodiment, the processor (220) may identify (or classify or determine) the entire application requiring real-time security verification as data of the first security level through the judgment module (350). For example, data of the first security level may include banking applications or stock applications, and may further include other applications requiring high security. According to one embodiment, the processor (220) may identify (or classify or determine) most of the data included in the application as data of the second security level or data of the third security level even if the application requires real-time security verification through the judgment module (350), and may also identify (or classify or determine) data of pages requiring authentication security within the application as data of the first security level. For example, the processor (220) may determine, through the judgment module (350), page data requiring user authentication in a banking application as data of the first security level, and identify general information page data, such as certificates or passwords in a banking application, which do not require an authentication process, as data of the second security level. According to one embodiment, the processor (220) can identify (or classify or determine) DRM (Digital Right Management) data as data of the first security level through the judgment module (350). According to one embodiment, the processor (220) can identify, through the judgment module (350), even if the DRM data is data of the first security level, as data of the second security level if the time for which it is buffered or stored within the first area is shorter than a specified time (e.g., within several seconds) and thus there is no problem in maintaining security.

[0091] According to an embodiment, the processor (220) may identify, through the judgment module (350), that the data of the first area satisfies a specified condition related to the security level if the security level of the data of the first area satisfies a specified security level (e.g., a second security level lower than the first security level) among a plurality of security levels. Data of a specified security level according to an embodiment may include data of a specified type. For example, a data type corresponding to a key value or a password value used for playing DRM content may be identified as data of a first security level (e.g., a high security level), a data type corresponding to a page table value for address conversion by a memory management unit (MMU) or a value for sharing information between applications may be identified as data of a second security level, and in addition, another data type designated as data of a second security level by a user (or developer or AI) may be identified (or determined) as data of a second security level.

[0092] According to one embodiment, the processor (220) may, if the data of the first area is determined to be data of the second security level through the determination module (350), use the control module (MUR (mark, update, repaly) control) (352) to request the mark module (362) of the hypervisor (346) to mark the first value (e.g., value1) which is the initial value of the data of the first area and the first address corresponding to the first value.

[0093] According to one embodiment, a processor (220) may perform a marking operation of allocating a buffer of a second area using a mark module (362) and storing a first value (e.g., value1) which is an initial value of data of a first area and a first address corresponding to the first value in a second area of ​​a memory (230).

[0094] According to an embodiment, the processor (220) may use the OS (344) to utilize the value of data of the first region, and when an update of the data of the first region is required, the control module (352) may be used to control the update and logging module (354) to update the value of data of the first region and store the updated value in the third region. The update and logging module (354) according to an embodiment may perform data logging in the third region every time the value of data of the first region is updated based on the control of the control module (352). According to an embodiment, the processor (220) may use the update and logging module (354) to store a first value, which is an initial value of data of the first region, in the third region when a first address and a first value are stored in the second region, and perform a data logging operation of storing at least one value updated in the update order in the third region every time the value of data of the first region is updated. For example, when a first address and a first value are stored in a second area, the processor (220) may store the first value in a third area using the update and logging module (354), and when the first value in the first area is updated to a second value, the processor (220) may further store a second value (e.g., value2) updated from the first value in the third area. For example, when the second value in the first area is updated to a third value, the processor (220) may further store a third value (e.g., value 3) updated from the second value in addition to the first and second values ​​using the update and logging module (354). The number of updates and the updated values ​​may not be limited.

[0095] According to an embodiment, the processor (220) may identify the occurrence of a specified event (or trigger signal) through the first trigger module (356) or the second trigger module (366). The specified event according to an embodiment may be an event that triggers integrity verification (e.g., security verification) of data in the first region. The specified event according to an embodiment may occur based on the arrival of a specified time period using a timer, based on a wake-up, based on the remaining storage capacity size of the third region, or based on a key input. According to an embodiment, the processor (220) may identify the occurrence of a trigger signal through the first trigger module (356) when the remaining storage capacity size of the third region is equal to or less than a specified size upon wake-up, or when a key input is received, and may identify the occurrence of a trigger signal at specified time intervals using a timer when the trigger signal through the first trigger module (356) is not generated for a specified time.

[0096] According to one embodiment, the processor (220) can perform an integrity check (e.g., security verification) by checking the values ​​stored in the third area in the reverse order of the updated order through the replay module (364) when the occurrence of a specified event (or trigger signal) is identified through the first trigger module (356) or the second trigger module (366).

[0097] According to an embodiment, the processor (220) may replay (or verify) the values ​​stored in the third area of ​​the memory (230) in the reverse order of the update order during security verification through the replay module (364) and compare them with the values ​​updated in the first area. According to an embodiment, if there is no value updated in the first area among the values ​​stored in the third area as a result of the replay through the replay module (replay) (364), the processor (220) may determine that the value updated in the first area is a value that has failed the integrity verification, and control the OS (344) to stop using the data in the first area (e.g., the value updated in the first area). For example, assuming that Value1->Value2->Value3 is logged (or recorded) in the update order in the third area and Value4 is recorded in the first area by hacking rather than the first software, Value4 will not be logged in the third area, and thus Value4 in the first area may not exist in the third area. According to one embodiment, the processor (220) may determine that value4 of the first region is an abnormally updated value if value4 of the first region does not exist in the third region, and may stop using value4 of the first region.

[0098] In one embodiment, the processor (220) may, when verifying security through the replay module (364), input the values ​​(e.g., value1, value2, value3) stored in the third area in the order of update into an integrity verification formula (e.g., hash function) in the reverse order of update through the second software of the second authority level, calculate the last value, value1, and compare the value1 value and address with the initial value and address of the second area that were previously stored. In one embodiment, the processor (220) may determine that the integrity verification (e.g., security verification) of the data in the first area is successful (there is no hacking or security problem) if the calculated value1 value and address are the same as the initial value and address of the second area that were previously stored. In one embodiment, the processor (220) may determine that the integrity verification (e.g., security verification) of the data in the first area is successful if the calculated value1 value and address are not the same as the initial value and address of the second area that were previously stored, and may stop the use of the data in the first area.

[0099] In one embodiment, the processor (220) may be reset to stop use of the data in the first region. In one embodiment, the processor (220) may be reset directly by the second software, or may be reset by the first software after a reset request is transmitted from the second software to the first software.

[0100] In one embodiment, the processor (220) may stop use of an application or program or menu that uses the first area (or data of the first area) to stop use of the data of the first area.

[0101] FIG. 4 is a diagram showing a program stored in memory when the memory is operated by dividing it into a general area and a secure area according to one embodiment.

[0102] Referring to FIG. 4, a program (440) stored in a memory (e.g., memory (230) of FIG. 2) according to an embodiment may include software (442, 444, 446) operating in a general area (401) and software (492, 494, 496, 499) operating in a secure area (402). The software (442, 444, 446) operating in the general area (401) according to an embodiment may include software (442) of an EL0 permission level, software (444) of an EL1 permission level, and software (446) of an EL2 permission level, which have different access rights to storage areas of the general area (401) of the memory (230). Software (492, 494, 496, 499) operating in the secure area (402) according to one embodiment may include software (492) of an EL0' permission level, software (494) of an EL1' permission level, software (496) of an EL2' permission level, and software (499) of an EL3 permission level, which have different access rights to storage areas of the secure area (402) of the memory (230).

[0103] In FIG. 4, an example can be illustrated in which the first OS, which is software (444) of the EL1 permission level in the general area (401), is the first software of the first permission level, and the second OS, which is software (494) of the EL1' permission level in the secure area (402), is the second software of the second permission level.

[0104] According to one embodiment, the first OS (444) of the general area (401) may include a determining module (450), a control module (MUR (mark, update, repaly) control) (452), an update and logging module (update and logging) (454), and a first trigger module (trigger 1) (456), and the second OS (494) of the secure area (402) may include a mark module (mark) (462), a replay module (replay) (464), and a second trigger module (trigger 2) (466).

[0105] According to an embodiment, the processor (220) may use the first OS (444) to identify (judge or confirm) whether the data of the first area of ​​the memory (230) satisfies a specified condition related to a security level through the determining module (450) when the data is to be used. According to an embodiment, the processor (220) may use the determining module (450) to identify whether the data of the first area is data of the first security level, data of the second security level, or data of the third security level. According to an embodiment, if the data of the first area is determined to be data of the second security level through the determining module (450), the processor (220) may identify that the data of the first area satisfies a specified condition related to a security level. According to an embodiment, the processor (220) may identify a security level assigned to the data in the first area based on the importance and / or security maintenance time of the data in the first area through the determination module (450) when the data in the first area of ​​the memory (230) must be used, or may identify (or determine or confirm) the importance and / or security maintenance time of the data in the first area and identify a security level corresponding to the first area based on the identified importance and / or security maintenance time. The security level of the data according to an embodiment may be specified in the electronic device (201), specified (or determined) by a user (or developer, or algorithm or AI), automatically specified (or determined) through data analysis, specified (or determined) by a software (or application) provider, or may be specified (or determined) in other ways. The criteria for determining the importance (degree of importance) of the data according to an embodiment may include whether real-time security verification of the data is required and / or whether the storage time of the data is within a specified time, and may further include other criteria for determining the importance of the data.

[0106] According to one embodiment, the processor (220) may identify (or classify or determine) the entire application requiring real-time security verification as data of the first security level through the judgment module (450). For example, data of the first security level may include banking applications or stock applications, and may further include other applications requiring high security. According to one embodiment, the processor (220) may identify (or classify or determine) most of the data included in the application as data of the second security level or data of the third security level even if the application requires real-time security verification through the judgment module (450), and may also identify (or classify or determine) data of pages requiring authentication security within the application as data of the first security level. For example, the processor (220) may determine, through the judgment module (450), page data requiring user authentication in a banking application as data of the first security level, and identify general information page data, such as certificates or passwords, which do not require an authentication process in the banking application, as data of the second security level. According to one embodiment, the processor (220) can identify (or classify or determine) DRM (Digital Right Management) data as data of the first security level through the judgment module (450). According to one embodiment, the processor (220) can identify, through the judgment module (450), even if the DRM data is data of the first security level, as data of the second security level if the time for which it is buffered or stored within the first area is shorter than a specified time (e.g., within several seconds) and thus there is no problem in maintaining security.

[0107] According to one embodiment, the processor (220) may identify, through the judgment module (450), that the data of the first area satisfies a specified condition related to the security level if the security level of the data of the first area satisfies a specified security level (e.g., a second security level lower than the first security level) among a plurality of security levels. Data of a specified security level according to one embodiment may include data of a specified type. For example, a data type corresponding to a key value or a password value used for playing DRM content may be identified as data of a first security level (e.g., a high security level), a data type corresponding to a page table value for address conversion by a memory management unit (MMU) or a value for sharing information between applications may be identified as data of a second security level, and in addition, another data type designated as data of a second security level by a user (or developer or AI) may be identified (or determined) as data of a second security level.

[0108] According to one embodiment, the processor (220) may use the control module (MUR (mark, update, repaly) control) (452) to request the mark module (462) of the second OS (494) to mark the first value (e.g., value1) which is the initial value of the data of the first area and the first address corresponding to the first value when the data of the first area is determined to be data of the second security level through the judgment module (450).

[0109] According to one embodiment, a processor (220) may perform a marking operation of allocating a buffer of a second area using a mark module (462) and storing a first value (e.g., value1) which is an initial value of data of a first area and a first address corresponding to the first value in a second area of ​​a memory (230).

[0110] According to an embodiment, the processor (220) may use the first OS (444) to use the value of data of the first region, and when an update of the data of the first region is required, the control module (452) may be used to control the update and logging module (454) to update the value of data of the first region and store the updated value in the third region. The update and logging module (454) according to an embodiment may perform data logging in the third region every time the value of data of the first region is updated based on the control of the control module (452). According to an embodiment, the processor (220) may use the update and logging module (454) to store the first value, which is the initial value of data of the first region, in the third region when the first address and the first value are stored in the second region, and perform a data logging operation of storing at least one value updated in the update order in the third region every time the value of data of the first region is updated. For example, when a first address and a first value are stored in a second area, the processor (220) may store the first value in a third area using the update and logging module (454), and when the first value in the first area is updated to a second value, the processor (220) may further store a second value (e.g., value2) updated from the first value in the third area. For example, when the second value in the first area is updated to a third value, the processor (220) may further store a third value (e.g., value 3) updated from the second value in addition to the first and second values ​​using the update and logging module (454). The number of updates and the updated values ​​may not be limited.

[0111] According to an embodiment, the processor (220) may identify the occurrence of a specified event (or trigger signal) through the first trigger module (456) or the second trigger module (466). The specified event according to an embodiment may be an event that triggers integrity verification (e.g., security verification) of data in the first region. The specified event according to an embodiment may occur based on reaching a specified time period using a timer, based on a wake-up, based on the remaining storage capacity size of the third region, or based on a key input. According to an embodiment, the processor (220) may identify the occurrence of a trigger signal through the first trigger module (456) when the remaining storage capacity size of the third region is equal to or less than a specified size upon wake-up, or when a key input is received, and may identify the occurrence of a trigger signal at specified time intervals using a timer when the trigger signal through the first trigger module (456) is not generated for a specified time.

[0112] According to one embodiment, the processor (220) can perform integrity verification (e.g., security verification) by replaying (or verifying) values ​​stored in the third area of ​​the memory (230) in the reverse order of the update order through the replay module (464) of the second OS (494) of the security area (402) when the occurrence of a specified event (or trigger signal) is identified through the first trigger module (456) or the second trigger module (466).

[0113] According to an embodiment, the processor (220) may, when performing security verification through the replay module (464), replay (or verify) the values ​​stored in the third area of ​​the memory (230) in the reverse order of the update order and compare them with the values ​​updated in the first area. According to an embodiment, if the processor (220) determines that the values ​​updated in the first area do not exist among the values ​​stored in the third area as a result of the replay through the replay module (replay) (464), the processor may determine that the values ​​updated in the first area are values ​​that have failed the integrity verification, and control the first OS (444) to stop using the data in the first area (e.g., the values ​​updated in the first area). For example, assuming that Value1->Value2->Value3 are logged (or recorded) in the update order in the third area and Value4 is recorded in the first area by hacking rather than the first software, Value4 will not be logged in the third area, and thus Value4 in the first area may not exist in the third area. According to one embodiment, the processor (220) may determine that value4 of the first region is an abnormally updated value if value4 of the first region does not exist in the third region, and may stop using value4 of the first region.

[0114] In one embodiment, the processor (220) may, when verifying security through the replay module (464), input the values ​​(e.g., value1, value2, value3) stored in the third area in the order of update into an integrity verification formula (e.g., hash function) in the reverse order of update through the second software of the second authority level, calculate the last value, value1, and compare the value1 value and address with the initial value and address of the second area that have been previously stored. In one embodiment, the processor (220) may determine that the integrity of the data in the first area has been successfully verified (there is no hacking or security issue) if the calculated value1 value and address are the same as the initial value and address of the second area that have been previously stored. In one embodiment, the processor (220) may determine that the integrity of the data in the first area has been successfully verified if the calculated value1 value and address are not the same as the initial value and address of the second area that have been previously stored, and may stop the use of the data in the first area.

[0115] In one embodiment, the processor (220) may be reset to stop use of the data in the first region. In one embodiment, the processor (220) may be reset directly by the second software, or may be reset by the first software after a reset request is transmitted from the second software to the first software.

[0116] In one embodiment, the processor (220) may stop use of an application or program or menu that uses the first area (or data of the first area) to stop use of the data of the first area.

[0117] FIG. 5 is a diagram illustrating a data integrity verification operation in an electronic device according to one embodiment.

[0118] Referring to FIG. 5, a processor (e.g., processor (120) of FIG. 1 or processor (220) of FIG. 2) of an electronic device (e.g., electronic device (101) of FIG. 1 or electronic device (201) of FIG. 2) according to one embodiment may perform at least one of operations 510 to 540.

[0119] In operation 510, the processor (220) according to one embodiment may use the first software of the first permission level (e.g., the first software (242) of the first permission level of FIG. 2) to identify (judge or confirm) whether the data of the first area of ​​the memory (230) satisfies a specified condition related to a security level when the data is to be used. The processor (220) according to one embodiment may identify whether the data of the first area is data of the first security level, data of the second security level, or data of the third security level. The processor (220) according to one embodiment may identify that the data of the first area satisfies a specified condition related to a security level when the data of the first area is determined to be data of the second security level. In an embodiment, the processor (220) may identify a security level assigned to the data in the first area based on the importance and / or security maintenance time of the data in the first area when the data in the first area of ​​the memory (230) is to be used, or may identify (or determine or confirm) the importance and / or security maintenance time of the data in the first area and identify a security level corresponding to the first area based on the identified importance and / or security maintenance time. The security level of the data in an embodiment may be designated by the electronic device (201), designated (or determined) by a user (or a developer, or an algorithm or AI), automatically designated (or determined) through data analysis, designated (or determined) by a software (or application) provider, or may be designated (or determined) in any other manner. The criteria for determining the importance (high or low importance) of the data in an embodiment may include whether real-time security verification of the data is required and / or whether the storage time of the data is within a designated time, and may further include other criteria for determining the high or low importance of the data.

[0120] According to one embodiment, the processor (220) may identify (or classify or determine) the entire application requiring real-time security verification as data of the first security level. For example, data of the first security level may include banking applications or stock applications, and may further include other applications requiring high security. According to one embodiment, even if the application requires real-time security verification, the processor (220) may identify (or classify or determine) most of the data included in the application as data of the second security level or data of the third security level, and may also identify (or classify or determine) data of pages requiring authentication security within the application as data of the first security level. For example, the processor (220) may determine page data requiring user authentication in a banking application as data of the first security level, and identify general information page data, such as certificates or passwords in a banking application, that do not require an authentication process as data of the second security level. According to one embodiment, the processor (220) can identify (or classify or determine) DRM (Digital Right Management) data as data of the first security level. According to one embodiment, even if the DRM data is data of the first security level, if the time for which it is buffered or stored within the first area is shorter than a specified time (e.g., within several seconds) and thus there is no problem in maintaining security, the processor (220) can identify it as data of the second security level.

[0121] According to an embodiment, the processor (220) may identify data of the first area as satisfying a specified condition related to a security level if the security level of data of the first area satisfies a specified security level (e.g., a second security level lower than the first security level) among a plurality of security levels. Data of a specified security level according to an embodiment may include data of a specified type. For example, data types corresponding to key values ​​and password values ​​used for playing DRM content may be identified as data of a first security level (e.g., a high security level), data types corresponding to page table values ​​for address conversion by a memory management unit (MMU) and values ​​for sharing information between applications may be identified as data of a second security level, and other data types designated as data of a second security level by a user (or developer or AI) may be identified (or determined) as data of a second security level.

[0122] In one embodiment, the processor (220) may trap, if the data of the first area to be used through the first software of the first privilege level is data of the first security level, to perform processing using the data of the first area in the second software of the second privilege level. For example, the trap may be an operation through a software interrupt. In one embodiment, the processor (220) may call the second software of the second privilege level through a software interrupt, if the data of the first area to be used through the first software of the first privilege level is data of the first security level, and may cause the second software to perform an operation of updating the data of the first area. In one embodiment, the processor (220) may read the data of the first area through the first software of the first privilege level (e.g., read only), and then check the condition of the data written (or to be written) to the first area. If the data written to the first area is data of the first security level, the processor may call the second software of the second privilege level through a trap and request the second software to write (e.g., update) the data in the first area through the second software. In one embodiment, the processor (220) may verify a security policy for data in the first area using second software of a second privilege level in response to a trap and write request and write (e.g., update) data to the first area instead of the first software of the first privilege level.

[0123] In operation 520, the processor (220) according to one embodiment may, if the data to be used through the first software is data of the second security level, use second software of the second privilege level higher than the first privilege level to store a first value (e.g., value1) which is an initial value of the data and a first address corresponding to the first value in a second area of ​​the memory (230). If the data to be used through the first software is data of the second security level, the processor (220) according to one embodiment may, if the data to be used through the first software is data of the second security level, allocate a buffer in a second area to store a first value (e.g., value1) which is an initial value of the data of the first area and a first address corresponding to the first value in the memory (230), and allocate a buffer corresponding to a third area to perform data logging whenever the value of the data of the first area is updated. According to an embodiment, the processor (220) may perform marking to store a first address, which is an address of the first area, and a first value stored in the first address in the second area if the data to be used through the first software is data of the second security level, and store the first value in the third area. According to an embodiment, the processor (220) may use the value of the data of the first area or update the value of the data of the first area using the first software. For example, if the data of the second security level is a screen data address value where screen data decrypted from DRM content is stored, the first value may be the screen data address value, and the first address may be an address where the screen data address value is stored.

[0124] In operation 530, the processor (220) according to one embodiment may store the updated value in the third area whenever the value of the data in the first area is updated. The processor (220) according to one embodiment may perform data logging in the third area when the value of the data in the first area is updated. For example, the processor (220) may sequentially store the updated data values ​​whenever the value of the data in the first area is updated, and this operation may be referred to as data logging. The processor (220) according to one embodiment may store the first value, which is the initial value of the data in the first area, in the third area when the first address and the first value are stored in the second area, and may accumulate and store at least one value updated in the update order whenever the value of the data in the first area is updated in the third area. For example, the processor (220) may store the first value in the third area when the first address and the first value are stored in the second area, and may further store the second value (e.g., value2) updated from the first value in the third area when the first value in the first area is updated to the second value. The processor (220) may further store a third value (e.g., value 3) updated from the second value in addition to the first value and the second value when the second value of the first region is updated to the third value. The number of updates and the updated values ​​may not be limited.

[0125] In operation 540, the processor (220) according to one embodiment can perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order using the second software based on the occurrence of a specified event.

[0126] A processor (220) according to an embodiment may identify the occurrence of a designated event. The designated event according to an embodiment may be an event that triggers an integrity check (e.g., security verification) on data in the first region. The designated event according to an embodiment may occur based on reaching a designated time period using a timer, based on a wake-up, based on the remaining storage capacity of the third region, or based on a key input. The processor (220) according to an embodiment may perform security verification by checking the values ​​stored in the third region of the memory (230) in the reverse order of the updated order when a designated time period using a timer is reached, when a wake-up occurs, when the remaining storage capacity of the third region is equal to (or less than) the designated capacity, or when a designated key input is present.

[0127] According to an embodiment, the processor (220) may compare the values ​​stored in the third area with the values ​​updated in the first area during security verification. According to an embodiment, the processor (220) may check the values ​​stored in the third area through the second software, and if there is no value updated in the first area among the values ​​stored in the third area, the processor may determine that the value updated in the first area is a value that has failed integrity verification (e.g., security verification), and control the first software to stop using the data in the first area. For example, if Value1->Value2->Value3 is logged (or recorded) in the update order in the third area and value4 is recorded in the first area by hacking rather than the first software, Value4 will not be logged in the third area, and thus value4 in the first area may not exist in the third area. If value4 in the first area does not exist in the third area, the processor (220) may determine that value4 in the first area is a value that has been updated in an abnormal manner, and may stop using value4 in the first area.

[0128] In one embodiment, the processor (220) may, during security verification, input the values ​​(e.g., value1, value2, value3) stored in the third region in the order of update through the second software of the second authority level into an integrity verification formula (e.g., hash function) in the reverse order of update, and compare the calculated value1 value and address with the initial value and address of the second region that have been previously stored. In one embodiment, the processor (220) may determine that the integrity verification (e.g., security verification) of the data in the first region has been successful (there is no hacking or security problem) if the calculated value1 value and address are the same as the initial value and address of the second region that have been previously stored. In one embodiment, the processor (220) may determine that the integrity verification (e.g., security verification) of the data in the first region has failed if the calculated value1 value and address are not the same as the initial value and address of the second region that have been previously stored, and may stop the use of the data in the first region.

[0129] In one embodiment, the processor (220) may be reset to stop use of the data in the first region. In one embodiment, the processor (220) may be reset directly by the second software, or may be reset by the first software after a reset request is transmitted from the second software to the first software.

[0130] In one embodiment, the processor (220) may stop use of an application or program or menu that uses the first area (or data of the first area) to stop use of the data of the first area.

[0131] According to an embodiment of the present disclosure, a method for verifying the integrity of data in an electronic device (e.g., the electronic device (101) of FIG. 1 or the electronic device (201) of FIG. 2) may include an operation of identifying, by using first software of a first authority level, whether data in a first area of ​​a memory (130, 230) of the electronic device satisfies a specified condition related to a security level when the data is to be used. According to an embodiment, the method may include an operation of storing, in a second area of ​​the memory, a first value, which is an initial value of the data, and a first address corresponding to the first value, when the data satisfies the specified condition. According to an embodiment, the method may include an operation of storing, by using the first software, values ​​updated in the first area in a third area of ​​the memory as the data in the first area is updated. According to an embodiment, the method may include an operation of performing security verification by using the second software to check, in a reverse order of the updated order, values ​​stored in the third area when a specified event occurs.

[0132] The method according to one embodiment may further include an operation of identifying success of the security verification if the result of checking the values ​​stored in the third area in the reverse order of the updated order is the same as the first value stored in the second area.

[0133] The method according to one embodiment may further include an operation of identifying a failure of the security verification if the result of checking the values ​​stored in the third area in the reverse order of the updated order is not the same as the first value stored in the second area.

[0134] The method according to one embodiment may further include resetting the electronic device to stop use of the data in the first area when the security verification fails.

[0135] The method according to one embodiment may further include an action of stopping execution of an application or program or menu associated with the data in the first area to stop use of the data in the first area when the security verification fails.

[0136] The method according to one embodiment may further include an operation of identifying that the data satisfies the specified condition if the data is data of a second security level lower than the first security level.

[0137] In the method according to one embodiment, the data of the second security level may be data designated based on the importance of the data and / or the security maintenance time.

[0138] According to one embodiment, the method may further include an operation of identifying whether the data of the first area is data of the second security level using a judgment module of the first software, an operation of storing values ​​updated in the first area in the updated order as the first value and the data of the first area are updated using an update and logging module of the first software, an operation of providing a first trigger signal based on the specified condition using a first trigger module of the first software, and an operation of controlling the update and logging unit and the mark unit of the second software to operate if the data is data of the second security level using a control module of the first software, and transmitting the first trigger signal to the second software.

[0139] According to one embodiment, the method may further include an operation of storing the first value, which is the initial value of the data, and the first address corresponding to the first value in the second area using the mark module of the second software, an operation of periodically providing a second trigger signal when the first trigger signal is not received for a specified time using the second trigger module of the second software, and an operation of performing security verification by checking the values ​​stored in the third area in the reverse order of the updated order when the specified event based on the first trigger signal or the second trigger signal occurs using the replay module of the second software.

[0140] In the method according to one embodiment, the first software may include a first OS, and the second software may include a hypervisor that manages the first OS.

[0141] In the method according to one embodiment, the first software may include a first OS operating in a general area, and the second software may include an application, a second OS, or a hypervisor operating in a secure area.

[0142] In the method according to one embodiment, the data of the second security level may include an address value where decrypted screen data from DRM content is stored, a key value used for playing the DRM content, a page table value for address conversion by a memory management unit (MMU), a value for sharing information between applications, or a password value.

[0143] In the method according to one embodiment, if the data of the second security level is a screen data address value where screen data decrypted from DRM content is stored, the first value may be a screen data address value, and the first address may be an address where the screen data address value is stored.

[0144] In the method according to one embodiment, the specified event may include at least one of a specified time arrival event using a timer, a wake-up event, an event based on the remaining storage area size of the third area, or a key input event.

[0145] FIG. 6 is a diagram showing a storage area of ​​a memory according to one embodiment.

[0146] Referring to FIG. 6, if the data of the first area (610) to be used through the first software of the first authority level is a data of a specified type, the processor (220) according to one embodiment allocates a buffer of the second area (620) to store (or mark) a first value (e.g., value1) which is the initial value of the data of the first area (610) and a first address corresponding to the first value in the memory (230), and stores the first address and the first value (value1) together (pair) as the value of the second area (620).

[0147] According to one embodiment, the processor (220) may allocate a buffer corresponding to the third area (630) to perform data logging whenever the value of data in the first area (610) is updated, and may accumulate at least one value updated in the update order and store it in the third area (630) whenever the value of data in the first area (610) is updated. For example, when a first address (address) and a first value (value1) are stored in the second area (620), the processor (220) may store the first value (value1) in the third area (630), and when the first value (value1) in the first area (610) is updated to a second value (value2), the processor may further store the second value (value2) updated from the first value (value1) in the third area (630). When the second value (value2) of the first area (610) is updated to a third value (value3), the processor (220) may additionally store a third value (value3) updated from the second value (value2) in addition to the first value (value1) and the second value (value2). The number of updates and the updated values ​​may not be limited.

[0148] FIG. 7A is a flowchart illustrating the operation of a processor when data of a first area to be used through a first software of a first authority level is data of a first security level according to an embodiment.

[0149] Referring to FIG. 7A, a processor (720) (e.g., processor (120) of FIG. 1 or processor (220) of FIG. 2) of an electronic device (e.g., electronic device (101) of FIG. 1 or electronic device (201) of FIG. 2) according to one embodiment may perform at least one of operations 712 to 718.

[0150] In operation 712, the processor (720) according to one embodiment can identify that the data of the first area to be used through the first software (EL1) (744) of the first privilege level (e.g., the first software (242) of the first privilege level in FIG. 2) is set (or designated) as read only data (e.g., readable only through the first software (EL1) (744) of the first privilege level and writable by the second software (EL2) (746) of the second privilege level (e.g., the first software (242) of the first privilege level in FIG. 2)) when the data of the first area to be used through the first software (EL1) (744) of the first privilege level is not data of the second security level but data of the first security level.

[0151] In operation 714, the processor (720) according to one embodiment may control the operation of the first software (EL1) (744) of the first privilege level to be trapped when updating the value of data in the first area (or when writing (or storing) the value in the first area) and control the operation of the second software (EL2) (746) of the second privilege level to update the value of data in the first area.

[0152] In operation 716, the processor (720) according to one embodiment may check the update security policy through the second software (EL2) (746) of the second authority level when updating the value of data in the first area using the second software (EL2) (746) of the second authority level.

[0153] In operation 718, the processor (720) according to one embodiment may write the value of data to the first area instead of the second software (EL1) (744) of the first privilege level based on the checked security policy.

[0154] The operations of the processor (720) as shown in FIG. 7a above may cause many transitions between EL1 (744) and EL2 (746) to consume a lot of resources (e.g., CPU resources), time, and power of the processor (720) by checking the security policy in EL2 (746) and performing the write instead of EL1 (744) whenever a value is written to a specific address, and other operations that must be processed with higher authority, such as EL2 (746), may have to wait until the previous operations are completed. Data of the first security level may perform operations as shown in FIG. 7a with security as a priority, but for data of the second security level (e.g., data of a specified security level) that has a relatively lower security level than data of the first security level, a method may be needed to reduce the transitions between EL1 (744) and EL2 (746).

[0155] Accordingly, in the present disclosure, data of a second security level having a lower security level than data of a first security level can be determined, and when the processor (720) processes data of the second security level, an operation as in FIG. 7b can be performed.

[0156] FIG. 7b is a flowchart illustrating the operation of a processor when data in a first area to be used through a first software of a first authority level is data of a second security level according to an embodiment.

[0157] Referring to FIG. 7b, a processor (720) (e.g., processor (120) of FIG. 1 or processor (220) of FIG. 2) of an electronic device (e.g., electronic device (101) of FIG. 1 or electronic device (201) of FIG. 2) according to one embodiment may perform at least one of operations 722 to 728.

[0158] In operation 722, the processor (720) according to one embodiment may trap data of the first area to be used through the first software (EL1) (744) of the first authority level (e.g., the first software (242) of the first authority level in FIG. 2) if the data is of the second security level, and store the initial value and address of the data of the first area in the second area of ​​the memory through the EL2 (746).

[0159] In operation 724, the processor (720) according to one embodiment may update the value of data in the first area through EL1 (744) when the value of data in the first area is updated and log the updated value in the third area.

[0160] In operation 726, the processor (720) according to one embodiment may request EL2 (746) to replay updated values ​​in the third region through EL1 (744) based on the occurrence of a specified event.

[0161] In operation 728, the processor (720) according to one embodiment can perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order through replay of EL2 (746).

[0162] According to an embodiment, the processor (720) may check (check log) whether an updated value exists in the first area among the values ​​stored in the third area during security verification. If an updated value does not exist in the first area among the values ​​stored in the third area, the processor (720) may determine that the updated value in the first area is a value that has failed integrity verification (e.g., security verification) and control EL1 (744) to stop using the data in the first area. For example, if Value1->Value2->Value3 is logged (or recorded) in the update order in the third area and value4 is recorded in the first area by hacking rather than the first software, Value4 will not be logged in the third area, and thus value4 in the first area may not exist in the third area. If value4 in the first area does not exist in the third area, the processor (720) may determine that value4 in the first area is a value that has been updated in an abnormal manner and stop using value4 in the first area.

[0163] In one embodiment, the processor (720) may, during security verification, input the values ​​(e.g., value1, value2, value3) stored in the update order in the third region (e.g., value1, value2, value3) into an integrity verification formula (e.g., hash function) in the reverse order of the update through replay of EL2 (746) and calculate the last value, value1, and compare the value and address with the initial value and address of the second region that have been previously stored. In one embodiment, the processor (720) may determine that the integrity verification (e.g., security verification) of the data in the first region has been successful (there is no hacking or security issue) if the calculated value1 value and address are the same as the initial value and address of the second region that have been previously stored. In one embodiment, the processor (720) may determine that the integrity verification (e.g., security verification) of the data in the first region has failed if the calculated value1 value and address are not the same as the initial value and address of the second region that have been previously stored, and may stop the use of the data in the first region.

[0164] According to one embodiment of the present disclosure, by not generating traps for data having a security level designated as relatively less important data in an electronic device, the number of times software with a high privilege level is used is reduced, thereby maintaining data security while reducing data processing time and power consumption.

[0165] Electronic devices according to various embodiments disclosed in this document may take various forms. Electronic devices may include, for example, portable communication devices (e.g., smartphones), computer devices, portable multimedia devices, portable medical devices, cameras, wearable devices, or home appliances. Electronic devices according to embodiments of the present disclosure are not limited to the aforementioned devices.

[0166] The various embodiments of the present disclosure and the terminology used therein are not intended to limit the technical features described in this document to specific embodiments, but should be understood to include various modifications, equivalents, or substitutes of the embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar or related components. The singular form of a noun corresponding to an item may include one or more of the items, unless the context clearly indicates otherwise. In this document, each of the phrases "A or B," "at least one of A and B," "at least one of A or B," "A, B, or C," "at least one of A, B, and C," and "at least one of A, B, or C" can include any one of the items listed together in the corresponding phrase among those phrases, or all possible combinations thereof. Terms such as "first," "second," or "first" or "second" may be used merely to distinguish one component from another, and do not limit the components in any other respect (e.g., importance or order). When a component (e.g., a first component) is referred to as "coupled" or "connected" to another (e.g., a second component), with or without the terms "functionally" or "communicatively," it means that the component can be connected to the other component directly (e.g., wired), wirelessly, or through a third component.

[0167] The term "module" as used herein may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit. A module may be an integral component, or a minimum unit or part of such a component that performs one or more functions. For example, according to one embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0168] Various embodiments of the present disclosure may be implemented as software (e.g., a program (140)) including one or more commands stored in a storage medium (e.g., an internal memory (136) or an external memory (138)) readable by a machine (e.g., an electronic device (101)). For example, a processor (e.g., a processor (120)) of the machine (e.g., an electronic device (101)) may call at least one command among the one or more commands stored from the storage medium and execute it. This enables the machine to operate to perform at least one function according to the at least one command called. The one or more commands may include code generated by a compiler or code executable by an interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' simply means that the storage medium is a tangible device and does not contain signals (e.g., electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently or temporarily on the storage medium.

[0169] According to one embodiment, the method according to the various embodiments disclosed in the present document may be provided as included in a computer program product. The computer program product may be traded as a product between a seller and a buyer. The computer program product may be distributed in the form of a machine-readable storage medium (e.g., compact disc read only memory (CD-ROM)), or may be distributed online (e.g., downloaded or uploaded) via an application store (e.g., Play Store™) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily generated in a machine-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or an intermediary server.

[0170] According to various embodiments, each component (e.g., a module or a program) of the above-described components may include a single or multiple entities. According to various embodiments, one or more components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (e.g., a module or a program) may be integrated into a single component. In such a case, the integrated component may perform one or more functions of each of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. According to various embodiments, the operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

[0171] According to one embodiment, a non-volatile storage medium storing commands is provided, wherein the commands are configured to cause the electronic device to perform at least one operation when executed by the electronic device, wherein the at least one operation may include: using first software of a first authority level, identifying whether data of a first area of ​​a memory (130, 230) of the electronic device is data of a medium security level lower than a high security level when the data of the first area is to be used; storing a first value, which is an initial value of the data, and a first address corresponding to the first value, in a second area of ​​the memory when the data of the first area satisfies the specified condition; using the first software, storing updated values ​​in the first area in a third area of ​​the memory as the data of the first area is updated; and using the second software, performing security verification by checking the values ​​stored in the third area in a reverse order of the updated order when a specified event occurs.

[0172] And the embodiments of the present invention disclosed in this specification and drawings are merely specific examples presented to easily explain the technical contents according to the embodiments of the present invention and to help understand the embodiments of the present invention, and are not intended to limit the scope of the embodiments of the present invention. Therefore, the scope of the various embodiments of the present invention should be interpreted as including all changes or modified forms derived based on the technical idea of ​​the various embodiments of the present invention in addition to the embodiments invented herein.

Claims

1. In an electronic device (101, 201), Memory (130, 230) for storing commands; and comprising at least one processor (120, 220) operatively connected to said memory; The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: Using the first software of the first authority level, when the data of the first area of ​​the memory is to be used, it is identified whether the data of the first area satisfies a specified condition related to the security level, If the above data satisfies the above specified condition, the first value, which is the initial value of the data, and the first address corresponding to the first value are stored in the second area of ​​the memory, As the data of the first area is updated, the values ​​updated in the first area are stored in the third area of ​​the memory using the first software, and An electronic device set to perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order when a specified event occurs using the second software.

2. In paragraph 1, The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: If the values ​​stored in the third area are checked in the reverse order of the updated order and the value is the same as the first value stored in the second area, the security verification is identified as successful, and An electronic device that identifies a failure of the security verification if the result of checking the values ​​stored in the third area in the reverse order of the updated order is not the same as the first value stored in the second area.

3. In paragraph 1, The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: Compare the values ​​stored in the third area with the values ​​stored in the first area in the reverse order of the updated order, If a value stored in the first area exists among the values ​​stored in the third area, the success of the security verification is identified, and An electronic device that identifies a failure of the security verification when a value stored in the first area does not exist among the values ​​stored in the third area.

4. In any one of paragraphs 1 to 3, The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: An electronic device that resets the electronic device to stop use of the data in the first area when the security verification fails.

5. In any one of paragraphs 1 to 3, The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: An electronic device that stops execution of an application or program or menu associated with the data of the first area to stop use of the data of the first area when the security verification fails.

6. In any one of paragraphs 1 to 5, The above instructions, when individually or collectively executed by the at least one processor, cause the electronic device to: If the data of the first area is data of a second security level lower than the first security level, the data of the first area is identified as satisfying the specified condition, An electronic device in which the data of the second security level is designated based on the importance of the data and / or the security maintenance time of the data.

7. In any one of paragraphs 1 to 6, The above first software, A judgment module set to identify whether the data of the first area is data of the second security level; An update and logging module set to store values ​​updated in the first area in the third area in the updated order as the data in the first area is updated; A first trigger module providing a first trigger signal based on the above specified condition; and A control module configured to control the update and logging unit and the mark unit of the second software to operate if the data is data of the second security level, and to transmit the first trigger signal to the second software; The above second software, The mark module set to store the first value, which is the initial value of the data, and the first address corresponding to the first value in the second area; A second trigger module that provides a second trigger signal periodically if the first trigger signal is not received for a specified time; and An electronic device including a replay module configured to perform security verification by checking the values ​​stored in the third area in the reverse order of the updated order when the designated event occurs based on the first trigger signal or the second trigger signal.

8. In any one of paragraphs 1 to 7, The first software includes a first OS, and the second software includes a hypervisor that manages the first OS, or An electronic device wherein the first software includes a first OS operating in a general domain, and the second software includes an application, a second OS, or a hypervisor operating in a secure domain.

9. In any one of paragraphs 1 to 8, The data of the second security level includes an address value where decrypted screen data from the DRM content is stored, a key value used for playing the DRM content, a page table value for address conversion by a memory management unit (MMU), a value for sharing information between applications, or a password value. An electronic device in which the first value is a screen data address value where the screen data decrypted from the DRM content is stored, and the first address is an address where the screen data address value is stored.

10. In any one of paragraphs 1 to 9, An electronic device wherein the above-mentioned specified event comprises at least one of a specified time reaching event using a timer, a wake-up event, an event based on the remaining storage area size of the third area, or a key input event.

11. In a method for verifying the integrity of data in an electronic device (101, 201), An operation of identifying whether data of a first area of ​​a memory (130, 230) of the electronic device satisfies a specified condition related to a security level when the data of the first area is to be used, using a first software of a first authority level; An operation of storing a first value, which is an initial value of the data, and a first address corresponding to the first value in a second area of ​​the memory when the data satisfies the specified condition; As the data of the first area is updated, an operation of storing the values ​​updated in the first area in the third area of ​​the memory using the first software; and A method including an action of performing security verification by checking the values ​​stored in the third area in the reverse order of the updated order using the second software when a specified event occurs.

12. In paragraph 11, An operation for identifying the success of the security verification if the result of checking the values ​​stored in the third area in the reverse order of the updated order is the same as the first value stored in the second area; and A method further comprising an action of identifying a failure of the security verification if the result of checking the values ​​stored in the third area in the reverse order of the updated order is not the same as the first value stored in the second area.

13. In paragraph 11, An operation of comparing the values ​​stored in the third area with the values ​​stored in the first area in the reverse order of the updated order; An operation for identifying the success of the security verification if a value stored in the first area exists among the values ​​stored in the third area; and A method further comprising an action of identifying a failure of the security verification if a value stored in the first area does not exist among the values ​​stored in the third area.

14. In any one of paragraphs 11 to 13, A method further comprising the action of resetting the electronic device to stop use of the data in the first area if the security verification fails.

15. In a nonvolatile storage medium storing commands, The above commands, when executed by the electronic device, are configured to cause the electronic device to perform at least one operation, wherein the at least one operation comprises: An operation of identifying whether data of a first area of ​​a memory (130, 230) of the electronic device satisfies a specified condition related to a security level when the data of the first area is to be used, using a first software of a first authority level; An operation of storing a first value, which is an initial value of the data, and a first address corresponding to the first value in a second area of ​​the memory when the data satisfies the specified condition; As the data of the first area is updated, an operation of storing the updated values ​​of the first area in the third area of ​​the memory using the first software; and A storage medium including an operation for performing security verification by checking the values ​​stored in the third area in the reverse order of the updated order using the second software when a specified event occurs.

Images