Method and device for building executable file including security key

Abstract

Various embodiments of the present disclosure relate to a method and device for building an executable file for a source code including a security key. To this end, a build server may: receive, from a developer device, an executable file build request for a source code including a key identifier; build a first executable file including the key identifier on the basis of the source code; transmit the first executable file to a key management system; and receive, from the key management system, a second executable file including a decrypted key corresponding to the key identifier.

Description

Method for building an executable file including a security key and device

[0001] The present disclosure relates to a method and apparatus for building an executable file for source code containing a security key.

[0002] A security key (hereinafter referred to as "key") is information that must be shared exclusively between the sender and receiver in secure communication, and it can be used to encrypt and decrypt data to prevent it from being exposed externally. Keys must be securely protected and shared only when necessary. To this end, key management is required, such as regularly changing keys or managing access rights to them.

[0003] When developing key-based software, it is necessary to set key values ​​within the source code during the development phase. Traditionally, key values ​​were set in the source code by assigning them to variables (i.e., hardcoding the key values) or by reading them from a key file. In the hardcoded key method, access control management for the relevant source code is required to prevent external exposure of the key values, and there is a risk that the hardcoded key values ​​will be exposed if the source code repository is attacked. Even in the method where a separate key file exists, the key file must be stored securely, access control management is required, and there is a risk of the key file being leaked.

[0004] The present disclosure relates to a method and apparatus for building an executable file for source code containing a security key. Specifically, various embodiments of the present disclosure relate to a method, a build server, and a build system for generating a key to be used in source code and building an executable file by applying said generated key. The build system may include a developer device, said build server, a key management system (KMS), and a security module.

[0005] According to one embodiment of the present disclosure, in order to solve the technical problem described above, an electronic device may include: a communication interface communicating with a developer device and a key management server; a memory storing at least one instruction; and at least one processor electrically connected to the communication interface and the memory and executing the at least one instruction. The at least one processor may receive a request to build an executable file for source code containing a key identifier from the developer device, build a first executable file containing the key identifier based on the source code, transmit the first executable file to the key management server, and receive a second executable file containing a decrypted key corresponding to the key identifier from the key management server.

[0006] Additionally, according to one embodiment of the present disclosure, a method for building an executable file by an electronic device may include: receiving a request to build an executable file for source code containing a key identifier from a developer device; building a first executable file containing the key identifier based on the source code; transmitting the first executable file to a key management server; and receiving a second executable file containing a decrypted key corresponding to the key identifier from the key management server.

[0007] Additionally, according to one embodiment of the present disclosure, a computer-readable recording medium may be included on which a program for performing the method is recorded.

[0008] Additionally, according to one embodiment of the present disclosure, a system for building an executable file may include: a build server that, in response to a request to build an executable file for source code containing a key identifier from a developer device, builds a first executable file containing said key identifier and transmits it to a key management server, and receives a second executable file containing a decrypted key corresponding to said key identifier from the key management server; a key management server that, in response to receiving the first executable file containing said key identifier, receives a decrypted key corresponding to said key identifier from a security module and generates a second executable file in which the key identifier in the first executable file is replaced with said decrypted key; and a security module that transmits a key encrypted with a master key to the key management server in response to a key encryption request from the key management server, or transmits a key decrypted with said master key to the key management server in response to a key decryption request from the key management server.

[0009] According to various embodiments of the present disclosure, by dynamically generating an encrypted key and a decrypted key through a key management server and a hardware security module and including a key identifier corresponding to the encrypted key in the source code, the key is not directly exposed in the source code, and even if the source code repository is attacked, the actual key value is not exposed externally, thereby providing the effect of enabling enhanced key management.

[0010] Furthermore, according to various embodiments of the present disclosure, since the developer only requests the build of an executable file for source code containing a key identifier and does not know the decrypted key value corresponding to the key identifier, there is no need to separately manage keys or access rights to keys during the development phase.

[0011] The effects obtainable from the exemplary embodiments of the present disclosure are not limited to those mentioned above, and other unmentioned effects can be clearly derived and understood by those skilled in the art to which the exemplary embodiments of the present disclosure belong from the description below. That is, unintended effects resulting from the implementation of the exemplary embodiments of the present disclosure can also be derived by those skilled in the art from the exemplary embodiments of the present disclosure.

[0012] FIG. 1 is a flowchart illustrating a key generation method according to various embodiments of the present disclosure.

[0013] FIG. 2 is a flowchart illustrating a method for building an executable file including a key according to one embodiment of the present disclosure.

[0014] FIG. 3 is a flowchart illustrating a method for building an executable file including a key according to another embodiment of the present disclosure.

[0015] FIG. 4 is a schematic block diagram of an electronic device according to various embodiments of the present disclosure.

[0016] FIG. 5 is a flowchart of a method for building an executable file by an electronic device according to one embodiment of the present disclosure.

[0017] FIG. 6 is a flowchart of a method for building an executable file by an electronic device according to another embodiment of the present disclosure.

[0018] Hereinafter, embodiments of the present disclosure are described in detail with reference to the drawings so that those skilled in the art can easily practice them. However, the present disclosure may be embodied in various different forms and is not limited to the embodiments described herein. In relation to the description of the drawings, the same or similar reference numerals may be used for identical or similar components. Furthermore, in the drawings and related descriptions, descriptions of well-known functions and configurations may be omitted for clarity and brevity.

[0019] Various embodiments of the present disclosure relate to a method, a build server, and a build system for generating a key to be used in source code and building an executable file by applying said generated key. The build system may include a developer device, said build server, a key management server, and a security module.

[0020] According to various embodiments of the present disclosure, the developer device may request the key management server to generate a key in order to write source code containing a key, and receive a key identifier in response. The key management server may generate a key and the key identifier in response to receiving the key generation request from the developer device. The key management server may transmit a key encryption request for the generated key to a security module. The key management server may receive an encrypted key from the security module and transmit the key identifier corresponding to the encrypted key to the developer device.

[0021] According to various embodiments of the present disclosure, the developer device may write source code including the key identifier and request the build server to build an executable file (e.g., assembly, binary) for the source code.

[0022] According to various embodiments of the present disclosure, the build server may build (or generate) an executable file for source code containing the key identifier. Specifically, in response to a request from the developer device to build an executable file for source code containing the key identifier, the build server may build a first executable file containing the key identifier and transmit it to the key management server, and receive a second executable file from the key management server containing a decrypted key (i.e., an actual key) corresponding to the key identifier.

[0023] According to various embodiments of the present disclosure, the key management server is a device for managing keys, and can generate a key and a key identifier, and communicate with a security module for key encryption and decryption requests. Specifically, the key management server can receive a decrypted key corresponding to the key identifier from the security module in response to receiving the first executable file containing the key identifier, and can generate a second executable file in which the key identifier in the first executable file is replaced with the decrypted key.

[0024] According to various embodiments of the present disclosure, the security module may encrypt a key with a master key in response to a key encryption request from the key management server, or decrypt a key with the master key in response to a key decryption request from the key management server. The security module may be a hardware security module (HSM), but is not limited thereto. The security module may transmit the encrypted key to the key management server or transmit the decrypted key to the key management server.

[0025] FIG. 1 is a flowchart illustrating a key generation method according to various embodiments of the present disclosure. Some of the operations illustrated in FIG. 1 may be omitted, and operations not illustrated in FIG. 1 may be added.

[0026] In operation 151 according to one embodiment, the developer device (120) can send a key generation request to the key management server (130). The developer device (120) can send the key generation request to the key management server (130) during the development phase of writing source code that operates based on the key.

[0027] In operation 152 according to one embodiment, the key management server (130) may generate a key and a key identifier. It will be understood by those skilled in the art that the key and the key identifier may be generated in various combinations including numbers and characters, but the format of the key and the key identifier is not limited thereto. The generated key may be stored in the memory of the key management server (130).

[0028] In operation 153 according to one embodiment, the key management server (130) can send a key encryption request for the generated key to the security module (140).

[0029] In operation 154 according to one embodiment, the security module (140) may generate a key encrypted with a master key in response to the key encryption request. The master key may act as a wrapping key to protect the key and may be stored in various storage media within the security module (140). The security module (140) may transmit the encrypted key to a key management server (130).

[0030] In operation 155 according to one embodiment, the key management server (130) can receive the encrypted key from the security module (140).

[0031] In operation 156 according to one embodiment, the key management server (130) may transmit the key identifier corresponding to the encrypted key to the developer device (120).

[0032] According to one embodiment, the key management server (130) and the security module (140) can establish a secure communication connection. The secure communication connection may be established based on the Transport Layer Security (TLS) protocol, but will be understood by those skilled in the art that the secure communication connection may be established based on various protocols, not limited thereto. According to one embodiment, in operation 155, the key management server (130) can receive the encrypted key from the security module (140) through the secure communication connection.

[0033] FIG. 2 is a flowchart illustrating a method for building an executable file including a key according to an embodiment of the present disclosure. Some of the operations illustrated in FIG. 2 may be omitted, and operations not illustrated in FIG. 2 may be added.

[0034] According to one embodiment, a developer device (220) may send a request to build an executable file for source code containing a key identifier to a build server (210). The key identifier may be obtained from a key management server through the operations described above with reference to FIG. 1.

[0035] In operation 251 according to one embodiment, the build server (210) may receive a request to build the executable file for source code containing a key identifier from the developer device (220).

[0036] In operation 252 according to one embodiment, the build server (210) can build a first executable file containing the key identifier based on the source code.

[0037] In operation 253 according to one embodiment, the build server (210) can transmit the first executable file to the key management server (230).

[0038] In operation 254 according to one embodiment, the key management server (230) may send a key decryption request for an encrypted key corresponding to the key identifier to the security module (240) in response to receiving the first executable file containing the key identifier.

[0039] In operation 255 according to one embodiment, the security module (240) may generate a key decrypted with a master key in response to the key decryption request. The security module (240) may transmit the decrypted key to the key management server (230).

[0040] In operation 256 according to one embodiment, the key management server (230) may receive the decrypted key corresponding to the key identifier from the security module (240). The decrypted key may be stored in the memory of the key management server (230).

[0041] In operation 257 according to one embodiment, the key management server (230) may generate a second executable file in which the key identifier in the first executable file containing the key identifier is replaced with the decrypted key. The key management server (230) may transmit the second executable file to the build server (210).

[0042] In operation 258 according to one embodiment, the build server (210) may receive a second executable file containing a decrypted key corresponding to the key identifier from the key management server (230).

[0043] In operation 259 according to one embodiment, the build server (210) may transmit a result of the build request to the developer device (220). The result may include various status information such as a build success status, a build failure status, and a reason for the build failure, but is not limited thereto.

[0044] FIG. 3 is a flowchart illustrating a method for building an executable file including a key according to another embodiment of the present disclosure. Some of the operations illustrated in FIG. 3 may be omitted, and operations not illustrated in FIG. 3 may be added.

[0045] According to one embodiment, a developer device (320) may send a request to build an executable file for source code containing a key identifier to a build server (310). The key identifier may be obtained from a key management server through the operations described above with reference to FIG. 1.

[0046] In operation 351 according to one embodiment, the build server (310) may receive a request to build the executable file for source code including a key identifier from the developer device (320).

[0047] In operation 352 according to one embodiment, the build server (310) can send a key decryption request corresponding to the key identifier to the key management server (330).

[0048] In operation 353 according to one embodiment, the key management server (330) may send a key decryption request for an encrypted key corresponding to the key identifier to the security module (340).

[0049] In operation 354 according to one embodiment, the security module (340) may generate a key decrypted with a master key in response to the key decryption request. The security module (340) may transmit the decrypted key to the key management server (330).

[0050] In operation 355 according to one embodiment, the key management server (330) can receive the decrypted key corresponding to the key identifier from the security module (340).

[0051] In operation 356 according to one embodiment, the build server (310) may receive the decrypted key corresponding to the key identifier from the key management server (330). According to one embodiment, the build server (310) and the key management server (330) may establish a secure communication connection. It will be understood by those skilled in the art that the secure communication connection may be established based on the Transport Layer Security (TLS) protocol, but is not limited thereto and may be established based on various protocols. According to one embodiment, the build server (310) may receive the decrypted key from the key management server (330) through the secure communication connection.

[0052] In operation 357 according to one embodiment, the build server (310) can build a third executable file containing the decrypted key.

[0053] In operation 358 according to one embodiment, the build server (310) may transmit a result of the build request to the developer device (320). The result may include various status information such as a build success status, a build failure status, and a reason for the build failure, but is not limited thereto.

[0054] FIG. 4 is a schematic block diagram of an electronic device according to various embodiments of the present disclosure.

[0055] The electronic device of FIG. 4 may be an electronic device corresponding to the build server (210) of FIG. 2 and the build server (310) of FIG. 3. Referring to FIG. 4, the electronic device (400) may include a processor (410), memory (420), and a communication interface (430). The electronic device (400) may include additional components in addition to the illustrated components, or at least one of the illustrated components may be omitted.

[0056] According to one embodiment, the processor (410) can perform overall control operations of the electronic device (400). The processor (410) may be implemented as a digital signal processor (DSP) that processes digital signals, a microprocessor, or a time controller (TCON). However, it is not limited thereto, and may include or be defined by one or more of a central processing unit (CPU), a micro controller unit (MCU), a micro processing unit (MPU), a controller, an application processor (AP), a graphics processing unit (GPU), a communication processor (CP), or an ARM processor. Additionally, the processor (410) may be implemented as a system on chip (SoC) or large scale integration (LSI) with a built-in processing algorithm, or in the form of a field programmable gate array (FPGA). Furthermore, the processor (410) can perform various functions by executing computer executable instructions stored in memory (420). The processor (410) may be electrically connected to memory (420) and a communication interface (430).

[0057] According to one embodiment, the memory (420) may be implemented as internal memory such as ROM (e.g., EEPROM (electrically erasable programmable read-only memory)) or RAM included in the processor (410), or as memory separate from the processor (410). In this case, the memory (420) may be implemented in the form of memory embedded in the electronic device (400) or in the form of memory that can be attached to the electronic device (400) depending on the purpose of data storage. For example, data for operating the electronic device (400) may be stored in memory embedded in the electronic device (400), and data for the expansion function of the electronic device (400) may be stored in memory that can be attached to the electronic device (400).

[0058] In the case of memory embedded in the electronic device (400), it may be implemented as at least one of volatile memory (e.g., DRAM (dynamic RAM), SRAM (static RAM), or SDRAM (synchronous dynamic RAM), non-volatile memory (e.g., OTPROM (one time programmable ROM), PROM (programmable ROM), EPROM (erasable and programmable ROM), EEPROM (electrically erasable and programmable ROM), mask ROM, flash ROM, flash memory (e.g., NAND flash or NOR flash), hard drive, or solid state drive (SSD). In the case of memory that is detachable from the electronic device (400), it may be implemented in the form of a memory card (e.g., CF (compact flash), SD (secure digital), Micro-SD (micro secure digital), Mini-SD (mini secure digital), xD (extreme digital), MMC (multi-media card), etc.), external memory that can be connected to a USB port (e.g., USB memory).

[0059] According to one embodiment, the communication interface (430) can transmit and receive various data with the developer device (120, 220, 320) and the key management server (130, 230, 330). The communication interface (430) may include at least one of a wired communication interface, a wireless communication interface, and a short-range communication interface. It will be understood by those skilled in the art that the communication interface (430) may be added, deleted, and / or changed depending on the performance and structure of the electronic device (400). The wired communication interface may include at least one interface among HDMI (High Definition Multimedia Interface), MHL (Mobile High-Definition Link), USB (Universal Serial Bus), DP (Display Port), Thunderbolt, VGA (Video Graphics Array) port, RGB port, D-SUB (D-subminiature), and DVI (Digital Visual Interface). The wireless communication interface may include Wi-Fi, but is not limited thereto. The above wireless communication interface may support the IEEE wireless LAN standard (IEEE 802.11x). The above wireless communication interface may be wirelessly connected to an Access Point (AP) under the control of the processor (410). The above short-range communication interface may wirelessly communicate with an external device over a short range under the control of the processor (410). The above short-range communication may include, but is not limited to, Bluetooth, Bluetooth Low Energy, Infrared Data Association (IrDA), Ultra Wide Band (UWB), WiFi Direct, and Near Field Communication (NFC).It will be understood by those skilled in the art that the communication interface (430) can transmit and receive data with the developer device (120, 220, 320) and the key management server (130, 230, 330) using various protocols.

[0060] According to one embodiment of the present disclosure, a processor (410) may receive a request to build an executable file for source code containing a key identifier from a developer device (220). The processor (410) may build a first executable file containing the key identifier based on the source code. The processor (410) may transmit the first executable file containing the key identifier to a key management server (230). According to one embodiment, the key management server (230) may transmit a request for key decryption for an encrypted key corresponding to the key identifier to a security module (240) in response to receiving the first executable file containing the key identifier. The security module (240) may generate a key decrypted with a master key in response to the key decryption request. The security module (240) may transmit the decrypted key to the key management server (230). The key management server (230) may receive the decrypted key corresponding to the key identifier from the security module (240). The decrypted key may be stored in the memory of the key management server (230). The key management server (230) may generate a second executable file in which the key identifier in the first executable file containing the key identifier is replaced with the decrypted key. The key management server (230) may transmit the second executable file to the electronic device (400). According to one embodiment, the processor (410) may control the communication interface (430) to receive the second executable file containing the decrypted key corresponding to the key identifier from the key management server (230). The processor (410) may control the communication interface (430) to transmit the result of the build request to the developer device (220). The result may include various status information such as a build success status, a build failure status, and a reason for the build failure, but is not limited thereto.

[0061] According to another embodiment of the present disclosure, a processor (410) may receive a request to build the executable file for source code containing a key identifier from a developer device (320). The processor (410) may transmit a request for a decrypted key corresponding to the key identifier to a key management server (330). The key management server (330) may transmit a request for key decryption for an encrypted key corresponding to the key identifier to a security module (340). In response to the request for key decryption, the security module (340) may generate a key decrypted with a master key. The security module (340) may transmit the decrypted key to the key management server (330). The key management server (330) may receive the decrypted key corresponding to the key identifier from the security module (340). The processor (410) may control a communication interface (430) to receive the decrypted key corresponding to the key identifier from the key management server (330). According to one embodiment, the processor (410) may establish a secure communication connection with the key management server (330). It will be understood by those skilled in the art that the secure communication connection may be established based on the Transport Layer Security (TLS) protocol, but is not limited thereto and may be established based on various protocols. The processor (410) may control the communication interface (430) to receive the decrypted key from the key management server (330) through the secure communication connection. The processor (410) may build a third executable file containing the decrypted key. The processor (410) may control the communication interface (430) to transmit the result of the build request to the developer device (320). The result may include various status information, such as a build success status, a build failure status, and a reason for the build failure, but is not limited thereto.

[0062] FIG. 5 is a flowchart of a method for building an executable file by an electronic device according to one embodiment of the present disclosure.

[0063] The electronic device of FIG. 5 may be an electronic device corresponding to the build server (210) of FIG. 2 and the electronic device (400) of FIG. 4. In the operation of the electronic device described in FIG. 5, parts that overlap with those described in FIG. 2 and FIG. 4 may be omitted. Some of the operations shown in FIG. 5 may be omitted, and operations not shown in FIG. 5 may be added.

[0064] In operation 510 according to one embodiment, the electronic device (400) may receive a request from a developer device (220) to build an executable file for source code containing a key identifier.

[0065] In operation 520 according to one embodiment, the electronic device (400) can build a first executable file including the key identifier based on the source code.

[0066] In operation 530 according to one embodiment, the electronic device (400) can transmit the first executable file containing the key identifier to the key management server (230).

[0067] According to one embodiment, the key management server (230) may send a key decryption request for an encrypted key corresponding to the key identifier to the security module (240) in response to receiving the first executable file containing the key identifier. The security module (240) may generate a key decrypted with a master key in response to the key decryption request. The security module (240) may send the decrypted key to the key management server (230). The key management server (230) may receive the decrypted key corresponding to the key identifier from the security module (240). The decrypted key may be stored in the memory of the key management server (230). The key management server (230) may generate a second executable file in which the key identifier in the first executable file containing the key identifier is replaced with the decrypted key. The key management server (130) may send the second executable file to an electronic device (400).

[0068] In operation 540 according to one embodiment, the electronic device (400) may receive a second executable file containing a decrypted key corresponding to the key identifier from the key management server (230).

[0069] According to one embodiment, the electronic device (400) may transmit a result of the build request to the developer device (220). The result may include, but is not limited to, various status information such as a build success status, a build failure status, and a reason for the build failure.

[0070] FIG. 6 is a flowchart of a method for building an executable file by an electronic device according to another embodiment of the present disclosure.

[0071] The electronic device of FIG. 6 may be an electronic device corresponding to the build server (310) of FIG. 3 and the electronic device (400) of FIG. 4. In the operation of the electronic device described in FIG. 6, parts that overlap with those described in FIG. 3 and FIG. 4 may be omitted. Some of the operations shown in FIG. 6 may be omitted, and operations not shown in FIG. 6 may be added.

[0072] In operation 610 according to one embodiment, the electronic device (400) may receive a request to build the executable file for source code containing a key identifier from the developer device (320).

[0073] In operation 620 according to one embodiment, the electronic device (400) can transmit a decrypted key request corresponding to the key identifier to the key management server (330).

[0074] According to one embodiment, a key management server (330) may transmit a key decryption request for an encrypted key corresponding to the key identifier to a security module (340). In response to the key decryption request, the security module (340) may generate a key decrypted with a master key. The security module (340) may transmit the decrypted key to the key management server (330). The key management server (330) may receive the decrypted key corresponding to the key identifier from the security module (340).

[0075] In operation 630 according to one embodiment, the electronic device (400) may receive the decrypted key corresponding to the key identifier from the key management server (330). According to one embodiment, the electronic device (400) may establish a secure communication connection with the key management server (330). It will be understood by those skilled in the art that the secure communication connection may be established based on the Transport Layer Security (TLS) protocol, but is not limited thereto and may be established based on various protocols. The electronic device (400) may receive the decrypted key from the key management server (330) through the secure communication connection.

[0076] In operation 640 according to one embodiment, the electronic device (400) can build a third executable file containing the decrypted key.

[0077] According to one embodiment, the electronic device (400) may transmit a result of the build request to the developer device (320). The result may include various status information, such as a build success status, a build failure status, and a reason for the build failure, but is not limited thereto.

[0078] According to one embodiment of the present disclosure, an electronic device may include: a communication interface communicating with a developer device and a key management server; a memory storing at least one instruction; and at least one processor electrically connected to the communication interface and the memory and executing the at least one instruction. The at least one processor may receive a request from the developer device to build an executable file for source code containing a key identifier, build a first executable file containing the key identifier based on the source code, transmit the first executable file to the key management server, and receive a second executable file containing a decrypted key corresponding to the key identifier from the key management server.

[0079] According to one embodiment, the key management server may generate a key and a key identifier in response to receiving a key generation request from the developer device, transmit a key encryption request for the generated key to a security module, receive an encrypted key from the security module, and transmit the key identifier corresponding to the encrypted key to the developer device.

[0080] According to one embodiment, the security module may transmit a key encrypted with a master key to the key management server in response to the key encryption request.

[0081] According to one embodiment, the key management server may, in response to receiving the first executable file containing the key identifier, send a request for key decryption for an encrypted key corresponding to the key identifier to the security module, and receive a decrypted key corresponding to the key identifier from the security module.

[0082] According to one embodiment, the key management server may generate a second executable file in which the key identifier is replaced with the decrypted key in a first executable file containing the key identifier.

[0083] According to one embodiment, the generated key and the decrypted key may be stored in the memory of the key management server.

[0084] According to one embodiment, the at least one processor may receive a decrypted key corresponding to the key identifier from the key management server in response to receiving a request to build the executable file for source code including the key identifier from the developer device, and build a third executable file including the decrypted key.

[0085] According to one embodiment, the at least one processor can establish a secure communication connection with the key management server to receive a decrypted key corresponding to the key identifier from the key management server.

[0086] Additionally, according to one embodiment of the present disclosure, a method for building an executable file by an electronic device may include: receiving a request to build an executable file for source code containing a key identifier from a developer device; building a first executable file containing the key identifier based on the source code; transmitting the first executable file to a key management server; and receiving a second executable file containing a decrypted key corresponding to the key identifier from the key management server.

[0087] According to one embodiment, the method may further include: generating a key and the key identifier in response to receiving a key generation request from the developer device by the key management server; transmitting a key encryption request for the generated key to a security module; receiving an encrypted key from the security module; and transmitting the key identifier corresponding to the encrypted key to the developer device.

[0088] According to one embodiment, the method may further include the operation of transmitting a key encrypted with a master key to the key management server in response to the key encryption request by the security module.

[0089] According to one embodiment, the method may further include: the operation of transmitting a key decryption request for an encrypted key corresponding to the key identifier to the security module in response to the reception of the first executable file including the key identifier by the key management server; and the operation of receiving a decrypted key corresponding to the key identifier from the security module.

[0090] According to one embodiment, the method may further include the operation of generating a second executable file in which the key identifier is replaced with the decrypted key in a first executable file containing the key identifier by the key management server.

[0091] According to one embodiment, the generated key and the decrypted key may be stored in the memory of the key management server.

[0092] According to one embodiment, the method may further include: receiving a decrypted key corresponding to a key identifier from a key management server in response to receiving a request to build an executable file for source code including a key identifier from a developer device by the electronic device; and building a third executable file including the decrypted key.

[0093] According to one embodiment, the method may further include the operation of establishing a secure communication connection with the key management server to receive a decrypted key corresponding to the key identifier from the key management server by the electronic device.

[0094] Additionally, according to one embodiment of the present disclosure, a computer-readable recording medium may be included on which a program for performing the method is recorded.

[0095] Additionally, according to one embodiment of the present disclosure, a system for building an executable file may include: a build server that, in response to a request to build an executable file for source code containing a key identifier from a developer device, builds a first executable file containing said key identifier and transmits it to a key management server, and receives a second executable file containing a decrypted key corresponding to said key identifier from the key management server; a key management server that, in response to receiving the first executable file containing said key identifier, receives a decrypted key corresponding to said key identifier from a security module and generates a second executable file in which the key identifier in the first executable file is replaced with said decrypted key; and a security module that transmits a key encrypted with a master key to the key management server in response to a key encryption request from the key management server, or transmits a key decrypted with said master key to the key management server in response to a key decryption request from the key management server.

[0096] According to one embodiment, the key management server may generate a key and a key identifier in response to receiving a key generation request from the developer device, transmit a key encryption request for the generated key to the security module, receive an encrypted key from the security module, and transmit the key identifier corresponding to the encrypted key to the developer device.

[0097] The electronic device according to the various embodiments disclosed in this document may be of various forms. The electronic device may include, for example, a display device, a portable communication device (e.g., a smartphone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a consumer electronics device. The electronic device according to the embodiments of this document is not limited to the devices described above.

[0098] The various embodiments of this document and the terms used therein are not intended to limit the technical features described in this document to specific embodiments, and should be understood to include various modifications, equivalents, or substitutions of said embodiments. For example, a component expressed in the singular should be understood as a concept including a plural component unless the context clearly implies only the singular. It should be understood that the term "and / or" as used in this document encompasses any possible combination of one or more of the listed items. Terms such as "comprising," "having," and "consisting of" used in this disclosure are intended merely to indicate the existence of the features, components, parts, or combinations thereof described in this disclosure, and the use of such terms is not intended to exclude the existence or addition of one or more other features, components, parts, or combinations thereof. In this document, each of the phrases such as “A or B,” “at least one of A and B,” “at least one of A or B,” “A, B or C,” “at least one of A, B and C,” and “at least one of A, B, or C” may include any one of the items listed together in the corresponding phrase, or all possible combinations thereof. Terms such as “first,” “second,” or “first” or “second” may be used simply to distinguish a component from another component and do not limit the components in any other aspect (e.g., importance or order).

[0099] The terms “part” or “module” as used in the various embodiments of this document may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example. The “part” or “module” may be a component formed integrally, or a minimum unit of said component or a part thereof that performs one or more functions. For example, according to one embodiment, the “part” or “module” may be implemented in the form of an application-specific integrated circuit (ASIC).

[0100] In the various embodiments of this document, the term “in the case of” as used may be interpreted, depending on the context, to mean “when,” “at the time of,” or “in response to a decision,” or “in response to a detection.” Similarly, “in the case where it is determined,” or “in the case where it is detected,” may be interpreted, depending on the context, to mean “at the time of determination,” or “in response to a decision,” or “at the time of detection,” or “in response to a detection.”

[0101] The program executed by the electronic device (400), developer device (120, 220, 320), key management server (130, 230, 330), and security module (140, 240, 340) described in this document may be implemented as a hardware component, a software component, and / or a combination of a hardware component and a software component. The program may be executed by any system capable of executing computer-readable instructions.

[0102] Software may include computer programs, code, instructions, or a combination of one or more of these, and may configure a processing unit to operate as desired or command the processing unit independently or collectively. Software may be implemented as a computer program containing instructions stored on computer-readable storage media. Examples of computer-readable storage media include magnetic storage media (e.g., ROM (Read-Only Memory), RAM (Random-Access Memory), floppy disks, hard disks, etc.) and optical reading media (e.g., CD-ROMs, DVDs (Digital Versatile Discs)). Computer-readable storage media may be distributed across networked computer systems, allowing computer-readable code to be stored and executed in a distributed manner. Computer programs may be distributed online (e.g., download or upload) through an application store (e.g., Play Store™) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created on a device-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0103] According to various embodiments, each component (e.g., module or program) of the components described above may include a singular or multiple entities, and some of the multiple entities may be separated and placed in other components. According to various embodiments, one or more of the components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Generally or additionally, multiple components (e.g., module or program) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the multiple components in the same or similar manner as those performed by the corresponding component among the multiple components prior to integration. According to various embodiments, operations performed by the module, program, or other components may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

Claims

1. In an electronic device that builds an executable file, A communication interface that communicates with the developer device and the key management server; Memory for storing at least one instruction; and It includes at least one processor electrically connected to the communication interface and the memory and executing at least one instruction; The above-mentioned at least one processor is, Receiving a request to build an executable file for source code containing a key identifier from the above developer device, and Based on the source code above, build a first executable file including the key identifier, and The above first executable file is transmitted to the key management server, and An electronic device that receives a second executable file containing a decrypted key corresponding to the key identifier from the key management server.

2. In Paragraph 1, The above key management server is In response to receiving a key generation request from the above developer device, a key and the key identifier are generated, and Send a key encryption request for the above-mentioned generated key to the security module, and Receive an encrypted key from the above security module, and An electronic device that transmits the key identifier corresponding to the encrypted key to the developer device.

3. In Paragraph 2, The above security module is An electronic device that transmits a key encrypted with a master key to a key management server in response to the above key encryption request.

4. In Paragraph 2, The above key management server is In response to receiving the first executable file containing the key identifier, a request for key decryption for an encrypted key corresponding to the key identifier is sent to the security module, and An electronic device that receives a decrypted key corresponding to the key identifier from the security module.

5. In Paragraph 4, The above key management server is An electronic device that generates a second executable file in which the key identifier is replaced with the decrypted key in a first executable file containing the key identifier.

6. In Paragraph 4, An electronic device in which the generated key and the decrypted key are stored in the memory of the key management server.

7. In Paragraph 4, The above at least one processor is, In response to receiving a request to build the executable file for source code containing a key identifier from the developer device, a decrypted key corresponding to the key identifier is received from the key management server, and An electronic device that builds a third executable file containing the above decrypted key.

8. In Paragraph 7, The above at least one processor is, An electronic device that establishes a secure communication connection with the key management server to receive a decrypted key corresponding to the key identifier from the key management server.

9. In the method of building an executable file by an electronic device, Action of receiving a request to build an executable file for source code containing a key identifier from a developer device; The operation of building a first executable file including the key identifier based on the source code above; The operation of transmitting the above-mentioned first executable file to a key management server; and A method comprising the operation of receiving a second executable file containing a decrypted key corresponding to the key identifier from the key management server.

10. In Paragraph 9, By the above key management server An operation to generate a key and the key identifier in response to receiving a key generation request from the above developer device; The operation of sending a key encryption request for the above-mentioned generated key to a security module; The operation of receiving an encrypted key from the above security module; and A method further comprising the operation of transmitting the key identifier corresponding to the encrypted key to the developer device.

11. In Paragraph 10, By the above security module A method further comprising the operation of transmitting a key encrypted with a master key to the key management server in response to the above key encryption request.

12. In Paragraph 10, By the above key management server The operation of transmitting a key decryption request for an encrypted key corresponding to the key identifier to the security module in response to receiving the first executable file including the key identifier; and A method further comprising the operation of receiving a decrypted key corresponding to the key identifier from the security module.

13. In Paragraph 12, By the above key management server A method further comprising the operation of creating a second executable file in which the key identifier is replaced with the decrypted key in a first executable file containing the key identifier.

14. In the system that builds the executable file, A build server that, in response to a request from a developer device to build an executable file for source code containing a key identifier, builds a first executable file containing the key identifier and transmits it to a key management server, and receives a second executable file containing a decrypted key corresponding to the key identifier from the key management server; A key management server that, in response to receiving the first executable file containing the key identifier, receives a decrypted key corresponding to the key identifier from a security module and generates a second executable file in which the key identifier in the first executable file is replaced with the decrypted key; and A system comprising a security module that transmits a key encrypted with a master key to the key management server in response to a key encryption request from the key management server, or transmits a key decrypted with the master key to the key management server in response to a key decryption request from the key management server.

15. In Paragraph 14, The above key management server is In response to receiving a key generation request from the above developer device, a key and the key identifier are generated, and Sending the key encryption request for the generated key to the security module, and Receive an encrypted key from the above security module, and A system that transmits the key identifier corresponding to the encrypted key to the developer device.

Images