Electronic device and control method of electronic device

Abstract

The present invention provides an electronic device and a control method thereof. This electronic device: when a malicious application is recognized among a plurality of applications executed in a first application area, recognizes a hardware resource used by the recognized malicious application while being executed in the first application area; generates a logical resource on the basis of execution of a management application for managing the malicious application; generates a second application area on the basis of the recognized hardware resource and the generated logical resource; and if the malicious application is in a sleep state, moves the malicious application to the second application area, so that the malicious application is isolated in the second application area.

Description

Electronic device and method of controlling the same

[0001] The disclosed invention relates to an electronic device for isolating an application recognized as malware (or malicious software) and a method for controlling the same.

[0002] Recent advancements in mobile communication technology have led to the evolution of electronic devices into portable devices that can freely connect to wired and wireless networks. In particular, so-called smartphones can contain a wealth of personal information, including address books, public certificates, USIM data, and location information, making them targets for hacking and smishing.

[0003] Malicious software, also known as malware, is affecting a significant number of electronic devices worldwide. Malware, in its many forms—viruses, worms, rootkits, and spyware—poses a serious threat to millions of electronic device users, leaving them vulnerable to data and sensitive information loss, identity theft, and productivity loss, among other threats.

[0004] In line with this, the development of security systems or security software for electronic devices is continuously taking place.

[0005] Security software on electronic devices can be used to detect malware that may be infecting a user's electronic device, and additionally to remove or stop such malware from running.

[0006] Security software on electronic devices cannot adequately respond to malware attacks until application files are deleted. Furthermore, if a legitimate application is identified as infected with malware and the infected application is deleted, the data from the application prior to infection will also be deleted, making it unrecoverable through conventional means.

[0007] Additionally, there is a problem that the malware cannot perform normal, unintended actions because the infected application is deleted.

[0008] One aspect of the disclosed invention provides an electronic device and a control method thereof for controlling the isolation of an application recognized as malware and controlling the recovery of the isolated application as needed.

[0009] An electronic device according to one aspect of the disclosed invention includes a memory for storing a plurality of applications; and a processor for executing the plurality of applications stored in the memory. According to one aspect, the processor of the electronic device, when a malicious application is recognized among a plurality of applications running in a first application area, recognizes hardware resources used by the recognized malicious application while running in the first application area, creates logical resources based on the execution of a management application for managing the malicious application, creates a second application area based on the recognized hardware resources and the created logical resources, and isolates the malicious application in the second application area.

[0010] The processor of the electronic device according to one aspect recognizes the processor usage and memory usage used by the malicious application and recognizes hardware resources based on the recognized processor usage and memory usage.

[0011] A processor of an electronic device according to one aspect recognizes process information, file information, and network information of a malicious application, and transmits the recognized process information, file information, and network information to a second application area.

[0012] An electronic device management application according to one aspect is an electronic device that copies file information of a malicious application and transmits it to a second application area, recognizes data to be transmitted through a network based on network information of the malicious application, and creates a pipeline for transmitting the recognized data.

[0013] The processor of the electronic device according to one aspect changes the namespace assigned to each thread running in the malicious application to a new namespace and moves the malicious application having the thread assigned to the new namespace to a second application area.

[0014] A second application area of ​​an electronic device according to one aspect includes one or more cores among a plurality of cores provided in a processor.

[0015] The processor of the electronic device according to one aspect moves the malicious application to a second application area when the malicious application is in a sleep state.

[0016] The processor of the electronic device according to one aspect finally recognizes whether the malicious application is malware through the management application, and if the malicious application is finally recognized as malware, deletes the malicious application and the secondary application area.

[0017] The processor of the electronic device according to one aspect controls the output device to output deletion notification information for deletion of the malicious application when the malicious application is finally recognized as malware.

[0018] The processor of the electronic device, according to one aspect, restores the malicious application to the primary application area if the malicious application is recognized as not malware.

[0019] The processor of the electronic device according to one aspect deletes the second application area and disconnects from the management application when the recovery of the malicious application is completed.

[0020] According to one aspect, the processor of the electronic device, when it recognizes that the malicious application is not malware, changes the new namespace assigned to each thread running in the malicious application to the existing namespace and restores the malicious application having the thread assigned to the existing namespace to the first application area.

[0021] A processor of an electronic device according to one aspect links a parent process of a first application area with a malicious application so that the malicious application is managed by the parent process of the first application area.

[0022] According to another aspect, a method for controlling an electronic device includes a processor that executes a plurality of applications stored in a memory, wherein when a malicious application is recognized among a plurality of applications running in a first application area, hardware resources used by the recognized malicious application while running in the first application area are recognized, logical resources are created based on the execution of a management application for managing the malicious application, a second application area is created based on the recognized hardware resources and the created logical resources, and when the malicious application is in a sleep state, the malicious application is moved to the second application area so that the malicious application is isolated in the second application area.

[0023] Recognizing hardware resources involves recognizing the processor usage and memory usage used by the malicious application and recognizing the hardware resources based on the recognized processor usage and memory usage.

[0024] Creating a logical resource includes copying file information of the malicious application and transferring it to a second application area, recognizing data to be transmitted over a network based on network information of the malicious application, and creating a pipeline for transmitting the recognized data.

[0025] The method of controlling an electronic device further includes changing the namespace assigned to each thread executed by the malicious application to a new namespace, and moving the malicious application having the thread assigned the new namespace to a second application area.

[0026] The method for controlling an electronic device further includes controlling an output device to finally recognize whether a malicious application is malware through a management application, delete the malicious application and a second application area when the malicious application is finally recognized as malware, and output deletion notification information regarding the deletion of the malicious application.

[0027] The method for controlling an electronic device further includes restoring the malicious application to a first application area when the malicious application is recognized as not malware, deleting the second application area when the restoration of the malicious application is complete, disconnecting the management application from the malicious application, and connecting the malicious application with a parent process of the first application area so that the malicious application is managed by the parent process of the first application area.

[0028] Restoring a malicious application to the primary application space involves changing the new namespace assigned to each thread running in the malicious application to the original namespace, and restoring the malicious application with threads assigned to the original namespace to the primary application space, once the malicious application is finally recognized as not malware.

[0029] According to the disclosed invention, the disclosed invention can prevent the execution of malware and improve the utilization of resources by dynamically isolating an application suspected of being malware into a logically isolated container.

[0030] Resource utilization can be improved by dynamically isolating malware in virtualized containers, thereby allowing access to critical resources.

[0031] The disclosed invention can dynamically restore an isolated application when the isolated application is recognized as a normal application.

[0032] The disclosed invention can efficiently block a processor (or central processing unit: CPU) hang of an electronic device by blocking a suspicious application while minimizing the impact on the electronic device, thereby safely protecting the electronic device.

[0033] The present invention can improve the marketability of electronic devices and secure competitiveness of electronic devices.

[0034] Figure 1 is an example diagram of communication between an electronic device and a server according to an embodiment.

[0035] FIG. 2 is an exemplary diagram of the architecture of an operating system (OS) of an electronic device according to an embodiment.

[0036] FIGS. 3a, 3b, 3c and 3d are control flowcharts of an electronic device according to an embodiment.

[0037] FIG. 4 is a block diagram of the architecture of an operating system for isolating, executing, managing, and recovering malicious applications among the configurations of an electronic device according to an embodiment.

[0038] Figure 5 is an example of isolation of a malicious application of an electronic device according to an embodiment.

[0039] Figure 6 is an example of recovery of a malicious application of an electronic device according to an embodiment.

[0040] Figure 7 is a configuration diagram of an isolation library of an electronic device according to an embodiment.

[0041] Figure 8 is an example diagram of resource limitations of an electronic device according to an embodiment.

[0042] Figure 9 is a flowchart of isolation control of a malicious application of an electronic device according to an embodiment.

[0043] Figure 10 is a recovery control flowchart of a malicious application of an electronic device according to an embodiment.

[0044] It should be understood that the various embodiments and terms used in this document are not intended to limit the technical features described in this document to specific embodiments, but rather to include various modifications, equivalents, or substitutes of the embodiments.

[0045] In connection with the description of the drawings, similar reference numerals may be used for similar or related components.

[0046] The singular form of a noun corresponding to an item may include one or more items, unless the context clearly indicates otherwise.

[0047] In this document, each of the phrases "A or B", "at least one of A and B", "at least one of A or B", "A, B, or C", "at least one of A, B, and C", and "at least one of A, B, or C" may include any one of the items listed together in that phrase, or all possible combinations thereof.

[0048] Terms such as "first," "second," or "first" or "second" may be used simply to distinguish one component from another and do not limit the components in any other respect (e.g., importance or order).

[0049] When a component (e.g., a first component) is referred to as being "coupled" or "connected" to another component (e.g., a second component), with or without the terms "functionally" or "communicatively," it means that the component can be connected to the other component directly (e.g., wired), wirelessly, or through a third component.

[0050] The terms "include" or "have" are intended to specify the presence of a feature, number, step, operation, component, part or combination thereof described in this document, but do not preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts or combinations thereof.

[0051] When a component is said to be “connected,” “coupled,” “supported,” or “in contact with” another component, this includes not only cases where the components are directly connected, coupled, supported, or in contact, but also cases where the components are indirectly connected, coupled, supported, or in contact through a third component.

[0052] When we say that a component is "on" another component, this includes not only cases where the component is in contact with the other component, but also cases where there is another component between the two components.

[0053] The term "and / or" includes any combination of a plurality of related described elements or any one of a plurality of related described elements.

[0054] The operating principle and embodiments of the present invention will be described with reference to the attached drawings below.

[0055] Figure 1 is an example diagram of communication between an electronic device and a server according to an embodiment.

[0056] Electronic devices (1) may include televisions, home appliances, and user devices.

[0057] A user device is a device carried by a user or placed in the user's home or office, etc., and the user device includes a terminal, a portable telephone, a smart phone, a handheld device, a wearable device, and may include, but is not limited to, a personal computer such as a table PC, a desktop, and a laptop.

[0058] An electronic device (1) may include a communication module (10) capable of communicating with a server (2) and other electronic devices, at least one processor (20) capable of processing data received from another server (2) and other electronic devices, and at least one memory (30) capable of storing a program for processing data or processed data.

[0059] The communication module (10) may include a wired communication module and a wireless communication module.

[0060] The processor (20) processes data and executes a program stored in memory (30).

[0061] The processor (20) may include at least one of a central processing unit (CPU), a graphic processing unit (GPU), a neural network processing unit (NPU), and a digital signal processor (DSP).

[0062] The processor (20) may also include at least one of a data processing unit (DPU), a tensor processing unit (TPU), a quantum processing unit (QPU), and a microcontroller (MCU).

[0063] The processor (20) may include an accelerator for image processing such as a codec, image quality processing, and scaling. Here, the codec may include a video decoder, a video encoder, an audio decoder, and an audio encoder.

[0064] The processor (20) may include multiple cores for selectively managing multiple applications.

[0065] The memory (30) stores a program and can be operated by execution of the processor (20).

[0066] The memory (30) can store multiple application programs (i.e., applications).

[0067] Memory (30) is a main memory device and may include non-volatile memory elements such as cache, DROM (Data Read Only Memory), ROM (Read Only Memory), PROM (Programmable ROM), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), and flash memory, or volatile memory elements such as RAM (Random Access Memory).

[0068] An electronic device (1) can communicate with other electronic devices and a server (2) through a communication module (10).

[0069] The server (2) may include a communication module capable of communicating with other servers and electronic devices (1), at least one processor capable of processing data received from other servers and electronic devices (1), and at least one memory capable of storing a program for processing data or processed data.

[0070] These servers (2) can be implemented as various computing devices such as workstations, clouds, data drives, and data stations.

[0071] The server (2) can be implemented as one or more servers that are physically or logically separated based on function, detailed configuration of function, or data, etc., and can transmit and receive data and process the transmitted and received data through communication between each server.

[0072] The server (2) can perform functions such as managing user accounts, registering electronic devices (1) by linking them to user accounts, and managing or controlling registered electronic devices (1).

[0073] For example, a user can access a server (2) via an electronic device (1) and create a user account. The user account can be identified by an ID and password set by the user.

[0074] The server (2) can register an electronic device (1) to a user account according to a set procedure. For example, the server (2) can register, manage, and control the electronic device (1) by linking identification information (e.g., serial number or MAC address) of the electronic device (1) to a user account.

[0075] The memory of the electronic device (1) may store a program, i.e., an application, for controlling the electronic device (1) and other electronic devices. The application may be sold installed on the electronic device (1) or downloaded and installed from a server (2).

[0076] A user can access a server (2) by executing an application installed on an electronic device (1), create a user account, and communicate with the server (2) based on the logged-in user account to register other electronic devices.

[0077] A user can control other electronic devices using an application installed on the electronic device (1). For example, when a user logs into a user account using an application installed on other electronic devices, other electronic devices registered to the user account are displayed, and when a control command for the other electronic devices is entered, the control command can be transmitted to the other electronic devices via the server (2) or directly to the other electronic devices.

[0078] A communications module can include both wired and wireless networks. Wired networks include cable networks or telephone networks, while wireless networks can include any network that transmits and receives signals via radio waves. Wired and wireless networks can be interconnected.

[0079] A network may include a wide area network (WAN) such as the Internet, a local area network (LAN) formed around an access point (AP), and a short-range wireless network that does not use an access point (AP).

[0080] Short-range wireless networks may include, but are not limited to, Bluetooth™ (IEEE 802.15.1), Zigbee (IEEE 802.15.4), Wi-Fi Direct, Near Field Communication (NFC), and Z-Wave.

[0081] An access point (AP) can connect an electronic device (1) to a wide area network (WAN) to which a server (2) is connected. The electronic device (1) can be connected to the server (2) via the wide area network (WAN).

[0082] The access point (AP) can communicate with an electronic device (1) using wireless communication such as Wi-Fi (Wi-Fi™, IEEE 802.11), Bluetooth (Bluetooth™, IEEE 802.15.1), Zigbee (IEEE 802.15.4), and can connect to a wide area network (WAN) using wired communication, but is not limited thereto.

[0083] According to various embodiments, the electronic device (1) may be directly connected to another electronic device or server (2) without going through an access point (AP).

[0084] An electronic device (1) can be connected to another electronic device or server (2) via a long-range wireless network or a short-range wireless network.

[0085] For example, the electronic device (1) can be connected to another electronic device via a short-range wireless network (e.g., Wi-Fi Direct).

[0086] As another example, an electronic device (1) may be connected to another electronic device or server (2) via a wide area network (WAN) using a long-range wireless network (e.g., a cellular communication module).

[0087] As another example, an electronic device (1) may connect to a wide area network (WAN) using wired communication and be connected to another electronic device or server (2) through the wide area network (WAN).

[0088] If the electronic device (1) can connect to a wide area network (WAN) using wired communication, it may also function as an access relay. Accordingly, the electronic device (1) can connect other electronic devices to the wide area network (WAN) to which the server (2) is connected.

[0089] Additionally, other electronic devices may connect the electronic device (1) to a wide area network (WAN) to which the server (2) is connected.

[0090] An electronic device (1) can transmit information about its operation or status to another electronic device or server (2) via a network. For example, the electronic device (1) can transmit information about its operation or status to another electronic device or server (2) when a request is received from the server (2), when a specific event occurs in the electronic device (2), or periodically or in real time.

[0091] When information about the operation or status is received from the electronic device (1), the server (2) can update the information about the operation or status of the electronic device (1) that has been stored therein, and transmit the updated information about the operation and status of the electronic device (1) to the electronic device (1) via a network.

[0092] Here, updating information may include various actions that change existing information, such as adding new information to existing information or replacing existing information with new information.

[0093] An electronic device (1) can acquire various information from other electronic devices or servers and provide the acquired information to a user. For example, the electronic device (1) can acquire information related to the function of the electronic device and various environmental information from a server (2) and output the acquired information through a user interface.

[0094] The electronic device (1) can operate according to a control command received from another electronic device or a server (2). For example, if the electronic device (1) has obtained prior approval from the user to operate according to the control command of the server (2) even without user input, the electronic device (1) can operate according to the control command received from the server (2).

[0095] Here, the control command received from the server (2) may include, but is not limited to, a control command input by the user through the electronic device (1) or a control command based on preset conditions.

[0096] An electronic device (1) can transmit information about a user to another electronic device or server (2) via a communication module.

[0097] For example, the electronic device (1) may transmit information related to the use of the electronic device (1), such as the user's location information, the user's identification information, the user's schedule, etc., to the server (2). The electronic device (1) may transmit information about the user to the server (2) with the user's prior consent.

[0098] The electronic device (1) or server (2) can determine a control command using technology such as artificial intelligence. For example, the server (2) can receive information regarding the operation or status of the electronic device (1), process it using technology such as artificial intelligence, and transmit the processing result or control command to the electronic device (1) based on the processing result.

[0099] FIG. 2 is an exemplary diagram of the architecture of an operating system (OS) of an electronic device according to an embodiment.

[0100] The operating system (OS) of the electronic device (1) may include, but is not limited to, Tizen or Android. This embodiment describes Tizen as an example.

[0101] The architecture (100) of the operating system may include a kernel layer (110), a framework layer (120), and an application layer (130).

[0102] The kernel layer (110), framework layer (120), and application layer (130) may be components executed and controlled by the processor (20).

[0103] The kernel layer (110) is the core of the operating system and may be a layer that manages physical resources and abstract resources.

[0104] The kernel layer (110) may include a Linux kernel.

[0105] The Linux kernel may be provided in the memory (30) of the electronic device and may be software that transmits commands to the processor (20) of the electronic device.

[0106] The Linux kernel can manage and control various hardware provided in the hardware layer (101).

[0107] Various hardware provided in the hardware layer (101) may include a communication module (10), a processor (20), and a memory (30), and may further include an input device (not shown) and an output device (not shown).

[0108] The Linux kernel of the kernel layer (110) may include a hardware resource management module (111) that provides a physical resource, a processor (20), as an abstract resource, a task, and a physical resource, a memory (30), as an abstract resource, a page or segment, a file abstraction module (112) that provides a physical resource, a disk, as an abstract resource, a file, a network module (113) that provides a physical resource, a network device, as an abstract resource, a socket, and may further include a device driver management module that allows access to various external devices.

[0109] The Linux kernel of the kernel layer (110) may further include a process isolation module (114) that manages data and information of applications recognized as malware and isolates applications recognized as malware.

[0110] The framework layer (120) may be a layer that provides a common development environment for applications when building applications. For example, the framework layer (120) may provide screen implementations required for development, database integration, and common information for development environments.

[0111] The framework layer (120) may include a first framework (121) and a second framework (122).

[0112] The first framework (121) may include at least one of a core framework, a web framework, and a native framework.

[0113] The core framework provides basic functionality commonly required by web frameworks and native frameworks.

[0114] A web framework can be a framework for web applications.

[0115] For example, a web framework can support standards defined by W3C and various standardization organizations such as HTML5 API, video, audio, forms, 2D canvas, WebGL, CSS3, WebSocket, Web Worker, etc., provide various device APIs such as Bluetooth, NFC, alarm, messaging, etc., and provide a Web Runtime that is responsible for executing web applications, managing life cycle, access control, etc., but is not limited to these.

[0116] Native frameworks are frameworks for developing native applications.

[0117] Native frameworks support various functions required by native applications, including but not limited to Base, IO, App, Security, Graphics, UI, Net, Messaging, Social, Locations, Web and background services, image and face recognition, TTS / STT, etc.

[0118] The second framework (122) is an isolation framework that can monitor one or more applications running within the application layer (130).

[0119] The second framework (122) can create an isolation area to isolate applications recognized as malware, manage the created isolation area, and delete the created isolation area when the application recognized as malware no longer exists. Here, the isolation area may be a dynamic isolation area, provided in the application layer.

[0120] Below, applications recognized as malware are listed as malicious applications.

[0121] The application layer (130) may include multiple applications (app1, app2, app3, app-i, app-m).

[0122] The application layer (130) may be an area where one or more applications are executed.

[0123] Each of one or more applications (or apps) is an application program that runs on the operating system and performs a specific, predetermined function based on user input.

[0124] For example, the multiple applications may include an application for audio, an application for video / audio, an application for internet broadcasting, an application for gaming, an application for online video service (OTT: Over-The-Top), an application for office work, an application for photography, an application for shopping, and an application for social media.

[0125] The application layer (130) may include a first application area (131) in which applications recognized as normal software among a plurality of applications (app1, app2, app3) are executed, and a second application area (132) for isolating and managing malicious applications (app-i) among a plurality of applications.

[0126] The first application area (131) may be a normal area where normal applications are executed. Each application within the first application area (131) may be executed by the processor (20).

[0127] Among the applications in the first application area (131), applications recognized as malware may be moved to the second application area (132). Here, the second application area (132) may be an isolation area where applications recognized as malware are isolated.

[0128] The first application area (131) may further include a surveillance application for recognizing malicious applications among multiple applications.

[0129] The monitoring application monitors messages transmitted from a certain application, uses the message monitoring results to determine whether the monitored message is a malicious message, and if the monitored message is determined to be a malicious message, it can recognize a certain application as malware.

[0130] Methods for determining whether a monitored message is a malicious message may include, but are not limited to, comparing a pattern of a malicious message stored in an internal memory of an electronic device with a pattern of a monitored message, analyzing a pattern of data corresponding to an input / output request, or determining whether an input / output request is a malicious application by identifying whether the request attempts to access or tamper with a trap file.

[0131] The second application area (132) can be created or deleted by the processor (20).

[0132] The second application area (132) can be created, managed, or deleted by the second framework (122).

[0133] The second application area (132) may be an area that is disconnected from the first application area (131) and where malicious applications are independently executed.

[0134] Malicious applications in the second application area (132) can be isolated, managed, and recovered by the processor (20).

[0135] A malicious application in the second application area (132) can be executed in the second application area (132).

[0136] If the malicious application in the second application area (132) is recognized as a normal application, the malicious application in the second application area (132) can be restored. That is, when the malicious application is restored, the malicious application in the second application area (132) can be moved to the first application area (131) and executed within the first application area (131).

[0137] When the second application area (132) is created, a management application (app-m) can also be created, and the created management application (app-m) can be executed in the second application area (132).

[0138] The management application (app-m) can be created or deleted by the processor (20).

[0139] The management application (app-m) is created within the second application area (132) by the second framework (122), is executed and managed by the second framework (122), and can be deleted by the second framework (122).

[0140] The second application area (132) may be an area where malicious applications (app-i) and management applications (app-m) are executed.

[0141] Figures 3a, 3b, 3c, and 3d are control flowcharts of an electronic device according to an embodiment. The following describes the control flow of an electronic device for isolating and managing malicious applications.

[0142] The processor (20) of the electronic device analyzes a plurality of applications running in the first application area (131) of the application layer (130) and, based on the analysis information, recognizes whether malware exists among the plurality of applications. That is, the processor (20) of the electronic device can recognize whether malware exists in the first application area (131) of the application layer. In this case, a surveillance application for recognizing malware can be executed in the first application area (131).

[0143] As illustrated in FIG. 3a, if the processor (20) of the electronic device recognizes that malware exists in the first application area (131) of the application layer, it controls the isolation of the application recognized as malware. The application recognized as malware is described as a malicious application.

[0144] In this case, the first application area (131) of the application layer can transmit isolation request information to the second framework (122) (201). The first application area (131) may be an area operated by the processor (20).

[0145] As illustrated in FIG. 3b, the processor (20) of the electronic device creates a second application area (132) in the application layer (130) to isolate malicious applications. That is, when the second framework (122) receives isolation request information from the first application area (131), the second framework (122) can create a second application area (132) in the application layer (130) (202). The second framework (122) may be a framework operated by the processor (20).

[0146] The processor (20) of the electronic device can allocate hardware resources necessary for the execution of the malicious application (app-i) so that the malicious application (app-i) can be executed, recognize resources that the malicious application (app-i) has dependencies on, and create virtual resources based on the recognized resources, thereby making the second application area (132) a logical virtual environment for the execution of the malicious application (app-i).

[0147] As illustrated in FIG. 3c, the processor (20) of the electronic device can create a management application (app-m) for managing a malicious application (app-i) in the second application area (132) (203). The management application (app-m) can perform parental and manager functions for the malicious application (app-i).

[0148] As illustrated in FIG. 3d, the processor (20) of the electronic device can isolate the malicious application (app-i) to the second application area (132) by moving the malicious application (app-i) to the second application area (132) (204).

[0149] Here, the creation of the second application area (132) and the creation of the management application (app-m) can be performed by the second framework (122) among the architectures of the operating system.

[0150] The configuration of the architecture of the operating system for isolating, executing, managing and recovering malicious applications may be executed on some of the multiple cores provided in the processor (20).

[0151] The specific configuration of the architecture of the operating system for isolating, executing, managing and recovering malicious applications is described with reference to FIGS. 4 to 8.

[0152] FIG. 4 is a configuration diagram of an architecture of an operating system for isolating, executing, managing, and recovering a malicious application among the configurations of an electronic device according to an embodiment, FIG. 5 is an example diagram of isolating a malicious application of an electronic device according to an embodiment, FIG. 6 is an example diagram of recovering a malicious application of an electronic device according to an embodiment, FIG. 7 is a configuration diagram of an isolation library of an electronic device according to an embodiment, and FIG. 8 is an example diagram of resource limitations of an electronic device according to an embodiment.

[0153] As illustrated in FIG. 4, the kernel layer (110) may include a hardware resource management module (111), a file abstraction module (112), a network module (113), and a process isolation module (114).

[0154] The hardware resource management module (111) can allocate hardware resources corresponding to the second application area (132) based on the creation of the second application area (i.e., isolation area, 132) of the application layer, and delete the second application area (132) based on the deletion of a malicious application.

[0155] The hardware resource management module (111) can invalidate allocated hardware resources based on the deletion of the second application area (132).

[0156] The file abstraction module (112) can change the description of a file accessed by a malicious application to a new description, copy the file with the changed description, and transmit it to the second application area (132).

[0157] The file abstraction module (112) can delete files whose descriptions have been changed in the second application area (132) based on the deletion of a malicious application in the second application area (132).

[0158] The network module (113) can monitor data transmitted externally from the kernel layer (110) and change the external destination to the management application of the second application (132).

[0159] In this case, the management application of the second application (132) can prevent problems that may arise from data transmission over the network.

[0160] The process isolation module (114) may be a module that manages data within the kernel layer (110) and actually performs isolation of malicious applications.

[0161] The process isolation module (114) can move an application recognized as malware from the first application area (131) to the second application area (132).

[0162] The process isolation module (114) can change the internal structure and data of an application recognized as malware (i.e., a malicious application), and move the malicious application with the changed structure and changed data to the second application area (132).

[0163] The process isolation module (114) can move a malicious application in the first application area (131) to the second application area (132) at the time when the operating system's scheduler enters a sleep state.

[0164] As illustrated in FIG. 5, the process isolation module (114) can change the namespace when moving a malicious application.

[0165] Here, namespace is a function that separates or limits the logical resources of the system when executing a process.

[0166] The process isolation module (114) can change the namespace assigned to the malicious application to a new namespace, and can also change the namespace assigned to each thread executed by the malicious application to the new namespace.

[0167] All threads running in a malicious application have unique information and can be managed in the kernel layer (110). The unique information may reference a namespace.

[0168] The process isolation module (114) can limit the resources available to the second application area (132).

[0169] As the malicious application moves to the second application area (132), the malicious application may occupy a portion of the processor (20). In this case, when the processor (20) is in an operating state, the malicious application may be executed in the second application area (132) based on a new namespace.

[0170] The process isolation module (114) can recover a malicious application. In this case, the malicious application isolated in the second application area (132) can be moved to the first application area (131).

[0171] The process isolation module (114) can change the namespace of the malicious application again when moving the malicious application to the first application area (131).

[0172] The process isolation module (114) can change the new namespace assigned to the malicious application to the existing namespace, but can also change all new namespaces assigned to each thread executed by the malicious application to the existing namespace.

[0173] As illustrated in FIG. 6, the process isolation module (114) can remove the parent-child relationship connection between the malicious application (app-i) and the management application (app-m) in the second application area (132).

[0174] The process isolation module (114) can register a parent-child relationship between a process preset in the first application area (131) and a malicious application (app-i) that has been released from isolation and recovered.

[0175] The process preset in the first application area (131) may be a process of an application that performs the parent function of multiple applications in the first application area.

[0176] The second framework (122) can control the isolation of applications recognized as malware (malicious applications).

[0177] The second framework (122) can create a second application area (132) and delete the second application area (132) based on the recovery of the malicious application.

[0178] As illustrated in FIG. 4, the second framework (122) of the framework layer (120) may include an isolation daemon process (122a) and an isolation library (122b).

[0179] The isolation daemon process (122a) can recognize and monitor information of malicious applications and transmit creation request information requesting creation of a second application area (132) to the process isolation module (114) of the kernel layer (110).

[0180] The isolation daemon process (122a) can transmit deletion request information requesting deletion of the second application area (132) to the process isolation module (114) of the kernel layer (110).

[0181] The life cycle of the isolation daemon process (122a) may be from the start of booting of the processor (20) of the electronic device to the end of booting.

[0182] The isolation library (122b) may include a library containing functions required for the operation of the isolation daemon process (122a) and functions required for isolation control of malicious applications.

[0183] As illustrated in FIG. 7, the isolation library (122b) may include a monitoring module (b1), a user interaction module (b2), an isolation module (b3), an information module (b4), and a setting module (b5).

[0184] The monitoring module (b1) can monitor the usage of the processor (20), the usage of the memory (30), and the battery consumption due to the execution of each of the multiple applications in the first application area (131), and record and store the monitored information.

[0185] That is, the monitoring module (b1) can collect and store resource usage information for each application, and can collect and store battery consumption information for each application.

[0186] The monitoring module (b1) can recognize the usage of the processor (20), the usage of the memory (30), and the battery consumption due to the execution of the malicious application, and can recognize the resource information required in the second application area (132) based on the usage of the processor (20), the usage of the memory (30), and the battery consumption of the recognized malicious application.

[0187] The user interaction module (b2) can output information corresponding to the execution of each application and notification information about the status of each application, and provide feedback based on user input.

[0188] The user interaction module (b2) can output information about a malicious application, output request information for deleting a malicious application, or receive a command to delete a malicious application or a command to maintain a malicious application.

[0189] The user interaction module (b2) may be a module that is disabled in a headless environment where the Tizen operating system does not have a graphical user interface.

[0190] The isolation module (b3) can isolate a malicious application to a second application area (132) when it receives isolation request information for a malicious application from the first application area (131) of the application layer. The isolation module (b3) can move a malicious application existing in the first application area (131) to the second application area (132).

[0191] When the isolation module (b3) receives recovery request information for a malicious application from the management application of the second application area (132), it can move the malicious application existing in the second application area (132) to the first application area (131).

[0192] The isolation module (b3) can manage the physical and logical resources of a malicious application required for isolation and recovery control of the malicious application, and perform resource binding functions.

[0193] The information module (b4) can manage and store information of the monitoring module (b1), user interaction module (b2), isolation module (b3), information module (b4), and setting module (b5).

[0194] The information module (b4) can record information in a database (DB) or delete and modify information in the database.

[0195] The information module (b4) can collect information from multiple applications. The information module (b4) can manage and store the collected information from multiple applications.

[0196] The configuration module (b5) manages the settings applied to the interface environment between the user and the electronic device.

[0197] The setting module (b5) can set the environment of the second application area (132).

[0198] The settings module (b5) can set and manage the types of hardware resources (processors and memory, etc.) to be restricted and the restriction ratio.

[0199] As illustrated in FIG. 8, the isolation daemon process (122a) can utilize the function of the control group provided by the kernel layer (110) to limit the resources of a malicious application.

[0200] Here, the control group (c-group) can allocate resources by application area and operate them within the allocated amount. That is, the control group can create groups for resources such as processors (20) and memory (30), designate allocation amounts for each group, and apply allocation amounts by including specific processes in the group. The control group may be one of the functions provided by the kernel layer (110).

[0201] The isolation daemon process (122a) can obtain resource limitation information, such as the type and limitation ratio of hardware resources (processor and memory, etc.) to be limited, from the configuration module (b5).

[0202] The isolation daemon process (122a) can store the acquired resource limitation information in memory (20).

[0203] The isolation daemon process (122a) can request resource limitation to the kernel layer (110) based on the acquired resource limitation information.

[0204] The control group (c-group) of the kernel layer can register resources of malicious applications and also resources of management applications.

[0205] The control group (c-group) of the kernel layer can register the resources of malicious applications and the resources of management applications in the list of configuration-restricted tasks and then manage the list of registered configuration-restricted tasks.

[0206] The second application area of ​​the application layer (130) may include malicious applications (app-i) and management applications (app-m).

[0207] The second application area (132) may be an isolation area where malicious applications are isolated.

[0208] The second application area (132) can be created, managed, or deleted by the second framework (122).

[0209] The second application area (132) may be an area that is disconnected from the first application area (131) and where malicious applications are independently executed.

[0210] The management application (app-m) is created within the second application area (132) by the second framework (122), is managed by the second framework (122), and can be deleted by the second framework (122).

[0211] The management application (app-m) can perform parental functions for malicious applications. The management application (app-m) can manage and monitor malicious applications (app-i).

[0212] The management application (app-m) can recognize whether a malicious application (app-i) is malware, and if it recognizes that the malicious application (app-i) is malware, it can isolate the malicious application (app-i), and if it recognizes that the malicious application (app-i) is not malware, it can request recovery of the malicious application (app-i).

[0213] The management application (app-m) can transmit recovery request information of the malicious application (app-i) to the isolation daemon process (122a) of the second framework.

[0214] The management application (app-m) can control an output device (not shown) to output warning information when a malicious application (app-i) is recognized as malware.

[0215] The management application (app-m) can control an output device (not shown) to output normal information about the malicious application when the malicious application (app-i) is recognized as not being malware, and can maintain the provision of services through the malicious application.

[0216] The output device may include at least one of a display and a speaker.

[0217] The management application (app-m) can control the deletion of a malicious application (app-i) when a deletion command is received via an input device (not shown).

[0218] The management application (app-m) can control the isolation maintenance of a malicious application (app-i) when a maintenance command is received via an input device (not shown).

[0219] An input device may be a device that receives user input.

[0220] The input device may include at least one of a key, a button, a touchpad, a lever, a keyboard, a switch, and a touch screen.

[0221] At least one component may be added or deleted to correspond to the performance of the components of the electronic devices illustrated in FIGS. 1, 2, 4, and 7. Furthermore, it will be readily apparent to those skilled in the art that the relative positions of the components may be changed to correspond to the performance or structure of the system.

[0222] Meanwhile, each component illustrated in FIGS. 1, 2, 4, and 7 represents software and / or hardware components such as Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuit (ASIC).

[0223] Figure 9 is a flowchart illustrating a method for controlling the isolation of a malicious application in an electronic device according to an embodiment. The isolation of a malicious application in an electronic device may be performed by a processor provided in the electronic device.

[0224] The electronic device can recognize whether malware exists among multiple applications running in the first application area of ​​the application layer (301).

[0225] If an electronic device detects the presence of malware, it can isolate the application identified as malware. In this case, the first application area (131) of the application layer can transmit isolation request information to the second framework (122) of the framework layer. The second framework (122) of the framework layer can isolate the application identified as malware. Hereinafter, applications identified as malware will be described as malicious applications.

[0226] The electronic device can collect information about malicious applications and store the collected information about malicious applications in a database (302).

[0227] Information about the malicious application here may include process information, file information, and network information.

[0228] Process information may include unique information about the malicious application, package identification (ID), application identification (ID), and thread-specific namespace information. Process information may be necessary for recovery after isolation.

[0229] Unique information may include PID (Process ID), which is identification information for distinguishing processes in the operating system, PPID (Patent Process ID), which is identification information for the parent process that created the process, and GID (Group ID), which is identification information for distinguishing user groups.

[0230] The file information may include information about files used by the malicious application in the first application area (131) prior to isolation of the malicious application. This file information may not be referenced in the second application area.

[0231] Network information includes information about network operations previously performed by malicious applications.

[0232] When an electronic device is communicating internally with an open network file descriptor, it can collect network information such as the items of the application being communicated with.

[0233] When storing information about a malicious application, the electronic device may further store information about whether it is currently quarantined and whether it is a malicious application.

[0234] The electronic device creates a second application area in the application layer based on the collected malicious application information (303). In this case, the second application area can be created in the application layer based on the collected malicious application information in the second framework of the frame layer.

[0235] Let's explain the creation configuration of the second application area in more detail.

[0236] The electronic device can recognize the resources of the malicious application used when executing the malicious application in the first application area to create a second application area (303a).

[0237] More specifically, the electronic device can detect the maximum processor usage, maximum memory usage, and disk usage while the malicious application is running.

[0238] The electronic device obtains minimum resource information that must be secured in the second application area based on the maximum usage of the recognized processor, maximum usage of the memory, and maximum usage of the disk.

[0239] The electronic device can secure hardware resources based on the acquired resource information (303b). For example, the electronic device can secure resources of the processor (20) and memory (30) of the second application area, and also secure resources of auxiliary memory (not shown).

[0240] Securing resources of a processor (20) includes determining a core to be used in a second application area (132) among the cores of the processor of the electronic device, and securing core resources to be used in the second application area (132) for the determined core. Only malicious applications can be executed on the core resources of the secured processor.

[0241] Securing the memory (30) resource includes securing the memory resource to be used in the second application area (132) among the entire system memory of the electronic device. The secured memory resource cannot be used in the first application area.

[0242] Securing the resources of the auxiliary memory includes securing the resources of the auxiliary memory to be used in the second application area (132) among the auxiliary memories of the entire system of the electronic device.

[0243] By securing resources of the processor (20) and memory (30), the resources used by malicious applications can be limited.

[0244] The electronic device may reserve resources in the secondary memory based on the size of the files accessed by the malicious application and all files present in the installation area of ​​the malicious application.

[0245] Electronic devices can create management applications to manage malicious applications, and register management applications and malicious applications in control groups created by the kernel layer.

[0246] The electronic device can execute a management application in the second application area (132) and create a logical resource through execution of the management application (303c).

[0247] Electronic devices can create logical resources to allow malicious applications to run in a second application space.

[0248] Logical resource creation involves creating files and network resources. This means that the electronic device can create files and network environments used by malicious applications.

[0249] Electronic devices can create virtual networks and files and connect the created virtual networks and files to management applications.

[0250] In this case, if the malicious application is transmitting specific data to the outside, a pipeline can be created with the management application so that the data to be transmitted can be analyzed by the management application, and the data to be transmitted can be transmitted to the management application through the created pipeline.

[0251] The management application can analyze the received data to determine whether the data can be transmitted externally. If it determines that the data can be transmitted externally, it can transmit the data externally. If it determines that the data should not be transmitted externally, it can block the transmission of the data.

[0252] The electronic device may copy the file being accessed by the malicious application and move it to the second application area (132). In this case, the management application may perform mapping with the input and output devices to enable continuous use of the copied file.

[0253] The electronic device recognizes whether the malicious application is in a sleeping state (304).

[0254] When the electronic device recognizes that the malicious application is in a sleep state, it moves the malicious application to a second application area (306).

[0255] After the malicious application goes through the process of allocating and releasing processor (20) resources, it can move to the second application area when it enters a sleep state.

[0256] Let's describe in more detail the configuration that moves the malicious application to the second application area.

[0257] The electronic device can change the namespace assigned to the malicious application to a new namespace, but can also change the namespace assigned to each thread executed by the malicious application to the new namespace (305a).

[0258] The electronic device can move a malicious application with a changed namespace to a second application area.

[0259] The electronic device can register a malicious application as a subprocess of the management application (305b).

[0260] The electronic device can perform hardware resource mapping and logical resource mapping (305c).

[0261] Hardware resource mapping involves dumping the memory used by the first application area and mapping it to the memory space used by the second application area.

[0262] Logical resource mapping involves connecting the pipeline connected to the management application and the network being used, and mapping the descriptors for the files being accessed to files in the second application area.

[0263] The electronic device can move a malicious application from a sleeping state to an assigned core. In other words, the electronic device can cause the malicious application to run on the assigned core.

[0264] The electronic device can perform updates of data and information stored in the processor's multiple cores and memory upon completion of the movement of the malicious application to the second application area (306).

[0265] The electronic device can update information about multiple applications in the first application area and malicious applications in the second application area based on the movement of the malicious application.

[0266] Figure 10 is a recovery control flowchart of a malicious application of an electronic device according to an embodiment.

[0267] The electronic device can recognize whether the malicious application isolated in the second application area is malware (401). In this case, the electronic device can use the management application in the second application area to recognize whether the malicious application isolated in the second application area is malware.

[0268] When the electronic device finally recognizes that the malicious application is malware, it can terminate the execution of the malicious application, delete the malicious application, and delete the second application area (402).

[0269] The electronic device can output deletion notification information corresponding to the deletion of a malicious application through an output device (403).

[0270] The electronic device can also output information about the malicious application through an output device and then delete the malicious application when a deletion command is received through an input device.

[0271] The electronic device can also output information about the malicious application through an output device and then maintain the storage of the malicious application in a second application area when a maintenance command is received through an input device.

[0272] The electronic device can delete the second application area based on the deletion of the malicious application, and can update information stored in the memory and database based on the deletion of the malicious application (404).

[0273] The electronic device can recover the isolated malicious application in the second application area if the isolated malicious application is ultimately recognized as not malware (405).

[0274] Recovery of a malicious application involves moving the malicious application to the primary application area.

[0275] Let's explain the recovery configuration of a malicious application in more detail.

[0276] The electronic device recognizes whether a malicious application shares files with other applications, and if it determines that a shared file exists, it copies the shared file.

[0277] Here, the other application may be an application recognized as normal, as an application in the first application area.

[0278] The electronic device can move the copied file along with the malicious application to the primary application area.

[0279] The electronic device can remap the descriptor of the copied file to the malicious application and move it to the primary application area.

[0280] The electronic device can change the control group to a control group corresponding to the first application area (405a).

[0281] The resources that a malicious application can allocate and use from the operating system are limited by the control group corresponding to the second application area.

[0282] Accordingly, the malicious application's resources can be prevented from being restricted by changing the control group from which the malicious application allocates resources from the operating system to the control group responsible for the first application area.

[0283] Control groups (c-groups) can be assigned to each application area.

[0284] Each control group can allocate resources to the application area it is responsible for and operate the resources within the quota. That is, a control group can create groups for resources such as processors (20) or memory (30), designate quotas for each group, and apply quotas by including specific processes in the group.

[0285] The electronic device can change the existing namespace to a new namespace for each thread of the malicious application (405b).

[0286] After disconnecting the parent-child relationship between the management application and the malicious application, the electronic device can reconnect and register the parent-child relationship between the parent process of the first application area and the malicious application (405c).

[0287] The electronic device can cause the malicious application to run in the first application area by allocating hardware resources of the first application area to the malicious application.

[0288] The malicious application can be executed in the first application area when the mapping of hardware resources and logical resources is completed and the transition from sleep state to wake state is completed.

[0289] The electronic device may delete the second application area and also delete the management application once the recovery of the malicious application is complete (406).

[0290] The electronic device can update information stored in the memory and database based on deletion of the second application area and deletion of the management application (407).

[0291] Meanwhile, the disclosed embodiments may be implemented in the form of a recording medium storing computer-executable instructions. The instructions may be stored in the form of program code, and when executed by a processor, may generate program modules to perform the operations of the disclosed embodiments. The recording medium may be implemented as a computer-readable recording medium.

[0292] Computer-readable storage media include all types of storage media that store instructions that can be deciphered by a computer. Examples include read-only memory (ROM), random access memory (RAM), magnetic tape, magnetic disks, flash memory, and optical data storage devices.

[0293] The disclosed embodiments have been described with reference to the attached drawings as described above. Those skilled in the art will understand that the present invention can be implemented in forms other than the disclosed embodiments without altering the technical spirit or essential characteristics of the present invention. The disclosed embodiments are illustrative and should not be construed as limiting.

Claims

1. Memory for storing multiple applications; and A processor that executes multiple applications stored in the above memory, An electronic device in which the processor, when a malicious application is recognized among a plurality of applications running in a first application area, recognizes hardware resources used by the recognized malicious application while running in the first application area, creates logical resources based on the execution of a management application for managing the malicious application, creates a second application area based on the recognized hardware resources and the created logical resources, and isolates the malicious application in the second application area.

2. In the first paragraph, the processor, An electronic device that recognizes the usage of the processor and the usage of the memory used by the malicious application and recognizes the hardware resources based on the recognized usage of the processor and the usage of the memory.

3. In paragraph 1, The processor recognizes process information, file information, and network information of the malicious application, and transmits the recognized process information, file information, and network information to the second application area. The management application is an electronic device that copies file information of the malicious application and transmits it to the second application area, recognizes data to be transmitted through a network based on network information of the malicious application, and creates a pipeline for transmitting the recognized data.

4. In the first paragraph, the processor, An electronic device that changes the namespace assigned to each thread running in the malicious application to a new namespace and moves the malicious application having the thread assigned the new namespace to the second application area.

5. In the first paragraph, the second application area is An electronic device comprising one or more cores among a plurality of cores provided in the above processor.

6. In the first paragraph, the processor, An electronic device that moves the malicious application to the second application area when the malicious application is in a sleep state.

7. In the first paragraph, the processor, Through the above management application, it is finally recognized that the malicious application is malware, and if the malicious application is finally recognized as malware, the malicious application and the second application area are deleted. If the malicious application is finally recognized as malware, the output device is controlled to output deletion notification information for the deletion of the malicious application. If the malicious application is recognized as not malware, the malicious application is restored to the first application area, An electronic device that deletes the second application area and disconnects from the management application when the recovery of the malicious application is completed.

8. In the 7th paragraph, the processor, If the malicious application is recognized as not malware, the new namespace assigned to each thread running in the malicious application is changed to the existing namespace, and the malicious application having the thread assigned to the existing namespace is restored to the first application area. An electronic device that connects the parent process of the first application area with the malicious application so that the malicious application is managed by the parent process of the first application area.

9. A method for controlling an electronic device including a processor that executes multiple applications stored in a memory, When a malicious application is recognized among multiple applications running in the first application area, the hardware resources used by the recognized malicious application while running in the first application area are recognized, Create a logical resource based on the execution of a management application for managing the above malicious application, Create a second application area based on the recognized hardware resources and the generated logical resources, A control method of an electronic device for moving the malicious application to the second application area when the malicious application is in a sleep state, thereby isolating the malicious application in the second application area.

10. In paragraph 9, recognizing the hardware resource, A control method of an electronic device, comprising recognizing the usage of the processor and the usage of the memory used by the malicious application and recognizing the hardware resources based on the recognized usage of the processor and the usage of the memory.

11. In paragraph 9, creating the logical resource comprises: Copy the file information of the above malicious application and transfer it to the second application area, Recognize data transmitted through the network based on the network information of the above malicious application, A method of controlling an electronic device, comprising creating a pipeline for transmitting the above recognized data.

12. In paragraph 9, Change the namespace assigned to each thread running in the above malicious application to a new namespace, A method of controlling an electronic device further comprising moving a malicious application having a thread allocated to the new namespace to the second application area.

13. In paragraph 9, Through the above management application, it is finally recognized that the above malicious application is malware, If the malicious application is finally recognized as malware, the malicious application and the second application area are deleted. A control method of an electronic device further comprising controlling an output device to output deletion notification information for deletion of the malicious application.

14. In paragraph 13, If the malicious application is recognized as not malware, the malicious application is restored to the first application area, Once the recovery of the above malicious application is complete, delete the second application area, Disconnect the above management application from the above malicious application, A control method of an electronic device further comprising linking the parent process of the first application area with the malicious application so that the malicious application is managed by the parent process of the first application area.

15. In paragraph 14, restoring the malicious application to the first application area comprises: If the malicious application is finally recognized as not being malware, the new namespace assigned to each thread running in the malicious application is changed to the existing namespace. A control method of an electronic device, comprising restoring a malicious application having a thread allocated to the existing namespace to the first application area.

Images