Electronic device, method, and non-transitory computer-readable storage medium for identifying integrity of stored data

Abstract

According to one embodiment, an electronic device is provided. The electronic device comprises a memory storing instructions and including one or more storage media, and at least one processor including processing circuitry and coupled to the memory . The instructions, when executed by the at least one processor, control the electronic device to: identify an event for verifying first security data written to a first storage area; read, from a second storage area by using a kernel, information indicating an address of the first storage area to which the first security data was written and second security data; read the first security data from the first storage area by using the kernel; compare the second security data with the first security data to verify the first security data; and, on the basis of identifying that the first security data differs from the second security data according to the comparison, provide a notification indicating an abnormal state of the first security data.

Description

Electronic device, method, and non-transient computer-readable storage medium for identifying the integrity of stored data

[0001] The disclosure relates to an electronic device, a method, and a non-transitory computer-readable storage medium for identifying the integrity of stored data.

[0002] An electronic device can execute user programs using user mode. An electronic device can execute kernel functions using kernel mode. An electronic device can enter kernel mode in response to a system call invoked in user mode. An electronic device can execute a process within the kernel in response to an event invoking a process within the kernel.

[0003] The information described above is provided for background purposes only to aid in understanding the present disclosure. No claim or determination is made as to whether any of the foregoing may be applied as prior art related to the present disclosure.

[0004] One aspect of the present invention aims to solve the aforementioned problems and / or disadvantages and to provide the advantages described below. Accordingly, one aspect of the present invention provides an electronic device, a method, and a non-transient computer-readable storage medium for identifying the integrity of stored data.

[0005] Additional aspects will be presented in part in the following description, and in part, will be apparent in the description or will be known through the practice of the presented embodiments.

[0006] According to one aspect of the present disclosure, an electronic device is provided. The electronic device may include a memory that stores instructions and includes one or more storage media, and at least one processor that includes a processing circuit and is communicately connected to the memory. The instructions may cause the electronic device to identify an event for verifying first security data written to a first storage area when executed individually or collectively by the at least one processor. The first storage area may be accessible to a kernel for reading and writing. The instructions may cause the electronic device to use the kernel to read, based on the event, second security data from a second storage area, which is information indicating the address of the first storage area where the first security data was written and reference data for verifying the first security data, when executed individually or collectively by the at least one processor. The second storage area may be accessible to the kernel for reading and inaccessible for writing. When the above instructions are executed individually or collectively by the at least one processor, the first security data from the first storage area can be read using the kernel based on the address indicated by the information. When the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to provide a notification indicating an abnormal state of the first security data based on comparing the first security data with the second security data for the verification of the first security data and identifying the first security data that is different from the second security data according to the comparison.

[0007] According to another aspect of the present disclosure, an electronic device is provided. The electronic device may include a memory and a processing circuit comprising one or more storage media for storing instructions and may include at least one processor communicately connected to the memory. The instructions may cause the electronic device to identify an event for writing security data when executed individually or collectively by the at least one processor. The instructions may cause the electronic device to write the security data to a first storage area accessible to the kernel for reading and writing, based on the event, when executed individually or collectively by the at least one processor. The instructions may cause the electronic device to identify information indicating the address of the first storage area where the security data is written, using the kernel, when executed individually or collectively by the at least one processor. When the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to write the security data and the information to a second storage area, which is accessible to the kernel for reading and inaccessible to the kernel for writing, using security software that is accessible to the second storage area for reading and writing, in order to verify the security data written to the first storage area.

[0008] According to another aspect of the present disclosure, a non-transient computer-readable storage medium is provided for storing one or more computer programs comprising computer-executable instructions that cause the electronic device to perform operations when executed individually or collectively by one or more processors of the electronic device. The operations may include an operation of identifying an event for verifying first security data written to a first storage area. The first storage area may be accessible to the kernel for reading and writing. The operations may include, using the kernel, an operation of reading from a second storage area based on the event, information indicating the address of the first storage area where the first security data was written and second security data which is reference data for verifying the first security data. The second storage area may be accessible to the kernel for reading but not for writing. The above operations may include an operation to read the first security data from the first storage area using the kernel based on the address indicated by the information, an operation to compare the first security data with the second security data for verification of the first security data, and an operation to provide a notification indicating an abnormal state of the first security data based on identifying the first security data that is different from the second security data according to the comparison.

[0009] According to another aspect of the present disclosure, a non-transient computer-readable storage medium is provided for storing one or more computer programs comprising computer-executable instructions that cause the electronic device to perform operations when executed individually or collectively by one or more processors of the electronic device. The operations may include an operation of identifying an event for writing security data; an operation of writing the security data to a first storage area accessible to the kernel for reading and writing based on the event, using the kernel; an operation of identifying information indicating the address of the first storage area where the security data is written, using the kernel; and an operation of writing the security data and the information to a second storage area accessible to the kernel for reading and inaccessible to the kernel for writing, using security software accessible to the second storage area for reading and writing, in order to verify the security data written to the first storage area.

[0010] According to another aspect of the present disclosure, a method performed by an electronic device is provided. The method may include an operation of identifying an event for verifying first security data written to a first storage area. The first storage area may be accessible to a kernel for reading and writing. The method may include, based on the event, an operation of reading from a second storage area using the kernel information representing the address of the first storage area where the first security data is written, and second security data which is reference data for verifying the first security data. The second storage area may be accessible to the kernel for reading but not for writing. The method may include an operation of reading the first security data from the first storage area using the kernel based on the address represented by the information. The method may include an operation of comparing the second security data with the first security data for the verification of the first security data. The above method may include an operation of providing a notification indicating an abnormal state of the first security data based on identifying the first security data different from the second security data according to the comparison.

[0011] According to another aspect of the present disclosure, a method performed by an electronic device is provided. The method may include an operation of identifying an event for writing security data. The method may include an operation of writing the security data to a first storage area accessible to the kernel for reading and writing, using the kernel, based on the event. The method may include an operation of identifying information indicating the address of the first storage area where the security data is written, using the kernel. The method may include an operation of writing the security data and the information to a second storage area accessible to the kernel for reading and inaccessible to the kernel for writing, using security software accessible to the second storage area for reading and writing, in order to verify the security data written to the first storage area.

[0012] Other aspects, advantages, and key features of the present disclosure will be clearly understood by those skilled in the art through the following detailed description combined with the accompanying drawings, and the detailed description describes various embodiments of the present disclosure.

[0013] The above and other aspects, features, and advantages of specific embodiments of the present disclosure will become more apparent from the following description combined with the accompanying drawings.

[0014] FIG. 1 illustrates a method for identifying the integrity of first security data according to an embodiment of the present disclosure.

[0015] FIG. 2 is a schematic diagram of an electronic device according to an embodiment of the present disclosure.

[0016] FIG. 3 is a flowchart illustrating an operation to verify first security data according to an embodiment of the present disclosure.

[0017] FIG. 4 illustrates a method for allocating memory pages that are inaccessible to the kernel for writing using a hypervisor according to an embodiment of the present disclosure.

[0018] FIG. 5 illustrates a flowchart of an operation for writing information to identify the integrity of security data according to an embodiment of the present disclosure.

[0019] FIG. 6 illustrates an event for writing secure data according to an embodiment of the present disclosure.

[0020] FIG. 7 is a flowchart illustrating an operation for identifying an abnormal state of first security data according to an embodiment of the present disclosure.

[0021] FIG. 8 is a flowchart illustrating an operation to identify the integrity of security data based on a system call according to an embodiment of the present disclosure.

[0022] FIG. 9 is a flowchart illustrating an operation to identify the integrity of security data based on an event requesting a process within the kernel, according to an embodiment of the present disclosure.

[0023] FIG. 10 illustrates a visual object displayed to indicate an abnormal state of first security data according to an embodiment of the present disclosure.

[0024] FIG. 11 is a block diagram of an electronic device in a network environment according to an embodiment of the present disclosure.

[0025] It should be noted that throughout the above drawings, the same reference numbers are used to denote identical or similar elements, features, and structures.

[0026] The following description, with reference to the accompanying drawings, is provided to aid in a comprehensive understanding of the various embodiments of the present invention as defined in the claims and their equivalents. While various specific details are included to aid understanding, they should be considered merely illustrative. Accordingly, those skilled in the art will understand that the various embodiments described herein may be varied and modified without departing from the scope and spirit of the invention. Additionally, descriptions of well-known functions and structures may be omitted for clarity and brevity. Furthermore, in the drawings and related descriptions, descriptions of well-known functions and configurations may be omitted for clarity and brevity.

[0027] The terms and words used in the description and claims below are not limited to their literary meanings but are used merely by the inventor to facilitate a clear and consistent understanding of the invention. Accordingly, those skilled in the art will clearly understand that the following description of various embodiments of the invention is provided for illustrative purposes only and should not be interpreted as limiting the scope of the invention as defined by the appended claims and their equivalents.

[0028] Unless explicitly indicated otherwise in the context, the singular forms "a," "an," and "the" should be understood to include plural referents. Thus, for example, a reference to "component surfaces" includes one or more such surfaces.

[0029] It must be understood that the blocks of each flowchart and combinations of flowcharts can be executed by one or more computer programs containing computer-executable instructions. One or more computer programs may be stored in a single memory device, or one or more computer programs may be divided into multiple parts and stored in several different memory devices.

[0030] The functions or operations described in this specification may be processed by a single processor or a combination of processors. The single processor or combination of processors is a circuit that performs processing and includes an application processor (AP, e.g., a central processing unit (CPU)), a communication processor (CP, e.g., a modem)), a graphics processing unit (GPU), a neural processing unit (NPU) (e.g., an artificial intelligence (AI) chip), a wireless communication (Wi-Fi) chip, a Bluetooth™ chip, a GPS chip, an NFC chip, a connectivity chip, a sensor controller, a touch controller, a fingerprint sensor controller, a display driver integrated circuit (IC), an audio codec chip, a USB controller, a camera controller, an image processing IC, a microprocessor unit (MPU), a system-on-chip (SoC), an IC, etc.

[0031] FIG. 1 illustrates a method for identifying the integrity of first security data according to an embodiment of the present disclosure.

[0032] Referring to FIG. 1, the memory (150) of an electronic device (100) may include a first storage area (130) accessible to the kernel (110) for reading and writing, and a second storage area (140) accessible to the kernel for reading but not accessible for writing. A hypervisor (120) may be accessible to the second storage area (140) for reading and writing. The hypervisor (120) may have higher authority than the kernel (110). For example, at least one processor of the electronic device (100) (e.g., at least one processor (210) of FIG. 2) may use the hypervisor (120) to allocate a storage area accessible to the kernel (110). For example, the at least one processor may use the hypervisor (120) to write secure data to the second storage area not accessible to the kernel (110) for writing. For example, the above at least one processor may allocate a first storage area (130) and a second storage area (140) using a hypervisor (120). A method for allocating the second storage area (140) using the hypervisor (120) will be described later with reference to FIG. 4.

[0033] For example, the at least one processor may identify an event for writing the first security data (131). Based on the event, the at least one processor may use a kernel to write the first security data (131) to the first storage area. The at least one processor may identify information indicating the address of the first storage area (130) where the first security data (131) is written. The event for writing the first security data (131) will be described later with reference to FIG. 6.

[0034] For example, the first security data (131) may include policy information. Policy information may be described as rules that define how a subject can access an object within the system. As an example, policy information may include information related to SELinux (security-enhanced linux). SELinux may be described as a technology related to the security and control of a Linux system.

[0035] For example, the above-mentioned at least one processor may use a hypervisor (120) to write information (142) representing the address of the first storage area (130) in which the first security data (131) is written, and the second security data (141) corresponding to the first security data (131), to the second storage area (140). For example, the information (142) representing the address may include information about the starting address of the first security data (131) stored in the first storage area (130) and information about the size of the first security data (131). For example, information about the starting address of the first security data (131) stored in the first storage area (130) may be expressed as “0xffff8812340000”. For example, information about the size of the first security data (131) having a size of 8 bytes may be expressed as “0x08”. The operation of writing to the second storage area (140) using the hypervisor (120) will be described later with reference to FIG. 5.

[0036] For example, the at least one processor may identify an event for verifying the first security data (131). Based on the event for verification, the at least one processor may use the kernel (110) to read information (142) indicating the address of the first storage area (130) where the second security data (141) and the first security data (131) are written from the second storage area (140). For example, the information (142) indicating the address may include information about the starting address of the first security data (131) stored in the first storage area (130) and information about the size of the first security data (131). Based on the address indicated by the information (142) indicating the address, the at least one processor may use the kernel (110) to read the first security data (131) from the first storage area (130). At least one processor can identify the integrity of the first security data (131) by comparing the first security data (131) and the second security data (141). A method for identifying the integrity of the first security data (131) will be described later with reference to FIGS. 7 through 9.

[0037] For example, the at least one processor may identify the second security data (141) and the first security data (131) which are different. Based on the identification, the at least one processor may provide a notification indicating an abnormal state of the first security data (131). A method for providing a notification indicating an abnormal state of the first security data (131) will be described later with reference to FIG. 10.

[0038] FIG. 2 is a schematic diagram of an electronic device according to an embodiment of the present disclosure.

[0039] Referring to FIG. 2, the electronic device (100) may include at least one processor (210), a display (220), and a memory (150). Some of the components of the electronic device (100) shown in FIG. 2 (e.g., at least one processor (210), a display (220), and a memory (150)) may be omitted from the electronic device (100). For example, the display (220) may be omitted from the electronic device (100).

[0040] For example, at least one processor (210) may be operatively coupled with or connected with the display (220) and / or memory (150). That at least one processor (210) is operatively coupled with or connected with the display (220) and / or memory (150) may mean that at least one processor (210) can control the display (220) and / or memory (150). For example, the display (220) and / or memory (150) may be controlled by at least one processor (210).

[0041] For example, at least one processor (210) may include at least a part of the processor (1120) of FIG. 11 or correspond to at least a part of the processor (1120). For example, at least one processor (210) may include one or more processors including an application processor (AP) and / or a communication processor (CP). For example, at least one processor (210) may be implemented as a single chip, such as a system on chip (SoC), or as multiple chips. For example, at least one processor (210) may be implemented as a single integrated circuit. For example, at least one processor (210) may include a first integrated circuit and a second integrated circuit. For example, at least one processor (210) may be distributed within an electronic device (100). For example, a part of at least one processor (210) may be physically separated from another part of at least one processor (210). As a non-limiting example, the other part of at least one processor (210) is spaced apart from the part of at least one processor (210), but the other part of at least one processor (210) may be connected to the part of at least one processor (210) through an interface circuit.

[0042] At least one processor (210) can execute instructions stored in memory (150) to cause the electronic device (100) to perform operations described with reference to FIGS. 3 through 10.

[0043] The display (220) may include at least a part of the display module (1160) of FIG. 11 or correspond to at least a part of the display module (1160). The display (220) of the electronic device (100) may output visualized information (e.g., a screen) to a user. For example, the display (220) may output visualized information under the control of a controller such as a GPU (graphic processing unit) (e.g., included in at least one processor (210)). The display (220) may include a liquid crystal display (LCD), a plasma display panel (PDP), and / or a light emitting diode (LED) display. The LED display may include an organic LED display. The display (220) may be at least partially bendable or deformable. The deformable display (220) may include a flexible display.

[0044] The memory (150) of the electronic device (100) may include a circuit and / or a storage medium for storing data and / or instructions that are input and / or output to at least one processor (210). The memory (150) may include, for example, volatile memory such as random-access memory (RAM) and / or non-volatile memory such as read-only memory (ROM). Non-volatile memory may be referred to as storage. Volatile memory may include, for example, at least one of dynamic RAM (DRAM), static RAM (SRAM), cache RAM, and pseudo SRAM (PSRAM). Non-volatile memory may include, for example, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, hard disk, compact disk, solid state drive (SSD), and embedded multi-media-card (eMMC).

[0045] The memory (150) may include at least a portion of the memory (1130) of FIG. 11 or correspond to at least a portion of the memory (1130). For example, the memory (150) may be implemented as a single chip or as a plurality of chips. For example, the memory (150) may be implemented as a single integrated circuit or as a plurality of integrated circuits (e.g., including a first integrated circuit and a second integrated circuit). For example, the memory (150) may be distributedly arranged within an electronic device (100).

[0046] The memory (150) may store one or more programs configured to be executed individually or collectively by at least one processor (210). The one or more programs may include at least some of instructions that cause an electronic device (100) to perform operations described with reference to FIGS. 3 through 10 when executed individually or collectively by at least one processor (210).

[0047] FIG. 3 is a flowchart illustrating an operation for verifying first security data according to an embodiment of the present disclosure. In the following embodiments of the present disclosure, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0048] Referring to FIG. 3, in operation 301, at least one processor (210) can write first security data (131) to a first storage area (130). At least one processor (210) can write second security data (141) to a second storage area (140). The first storage area may be accessible to the kernel (110) for reading and writing. The second storage area may be accessible to the kernel for reading but not for writing. For example, the second storage area may be accessible to security software for reading and writing. For example, the second security data may be described as reference data for verifying the first security data.

[0049] For example, the first storage area (130) and the second storage area (140) may be distinguished. For example, the first storage area (130) may be included within a memory area accessible to the kernel (110) for reading and writing. For example, the second storage area (140) may be included within a memory area inaccessible to the kernel (110) for writing. For example, the second storage area (140) may be included within a memory area accessible to the hypervisor (120) for reading and writing.

[0050] For example, the security software may have higher privileges than the kernel. The security software may be referred to as a hypervisor and / or a secure monitor. For example, a secure monitor may be described as security software having higher privileges than the hypervisor. If the security software is a secure monitor, at least one processor (210) may use a trust zone through the secure monitor. For example, at least one processor (210) may distinguish between a normal world and a secure world by using the trust zone. The first storage area may correspond to the normal world. The second storage area may correspond to the secure world. For example, the normal world and the secure world may be separated at the hardware level. For example, code running in the secure world may be inaccessible from the normal world. For example, at least one processor (210) may switch from the secure world to the normal world using the secure monitor. At least one processor (210) can switch from a normal world to a secure world using a secure monitor.

[0051] The term “hypervisor” as used in this disclosure may refer to the security software. For example, the hypervisor may be described as a software component used for the security of an electronic device (100) having higher authority than that of the kernel.

[0052] For example, at least one processor (210) can write the first security data to the first storage area using a kernel. For example, at least one processor (210) can write the second security data corresponding to the first security data and information indicating the address of the first storage area where the first security data is written to the second storage area using a hypervisor. For example, the information indicating the address (142) may include information about the starting address of the first security data (131) stored in the first storage area (130) and information about the size of the first security data (131). For example, before using the hypervisor, at least one processor (210) may attempt to write the second security data corresponding to the first security data and information indicating the address of the first storage area where the first security data is written to the second storage area using a kernel. A method of attempting to write to the second storage area using a kernel will be described later with reference to FIG. 5.

[0053] In operation 302, at least one processor (210) can identify the integrity of the first security data by comparing the first security data and the second security data using a kernel.

[0054] For example, at least one processor (210) can use a kernel to read information indicating the address of the first storage area where the second security data and the first security data are written from the second storage area. At least one processor (210) can use a kernel to read the first security data from the first storage area based on the address indicated by the information.

[0055] For example, at least one processor (210) can compare the second security data and the first security data to verify the first security data. For example, at least one processor (210) can identify the integrity of the first security data using a kernel. A method of identifying the integrity of the first security data by comparing the second security data and the first security data may correspond to the method described in FIG. 7.

[0056] As described above, according to the operation described in FIG. 3, at least one processor (210) can write second security data, which is reference data for verifying first security data, to a second storage area using security software (e.g., the hypervisor (120) of FIG. 1). At least one processor (210) can identify the integrity of the first security data by comparing the first security data and the second security data using a kernel.

[0057] FIG. 4 illustrates a method for allocating memory pages that are inaccessible to the kernel for writing using a hypervisor according to an embodiment of the present disclosure.

[0058] Referring to FIG. 4, the memory (150) may include instructions for a security zone setter (401), a security data store (402), and a security data verifier (403). For example, the security zone setter (401) may be referred to as SecMonlnit. The security data store (402) may be referred to as SecMonStore. The security data verifier (403) may be referred to as SecMonWatch.

[0059] For example, at least one processor (210) can allocate a second storage area (140) through the hypervisor (120) using a security area setter (401). At least one processor (210) can cause the hypervisor (120) to allocate the second storage area (140) using a security area setter (401). For example, the second storage area (140) can be configured to be accessible to the hypervisor (120) for reading and writing. The second storage area (140) can be configured to be accessible to the kernel (110) for reading but inaccessible for writing. For example, the second storage area (140) can be a memory page. For example, at least one processor (210) can set an attribute related to access to the second storage area (140), which is a memory page. For example, at least one processor (210) can allocate a second storage area (140) having read-only attributes using a hypervisor (120).

[0060] For example, at least one processor (210) can identify a memory page operating in kernel mode. The memory page operating in kernel mode may be accessible to the kernel for reading and writing. At least one processor (210) can change the memory page into a read-only memory page using a hypervisor (120). The read-only memory page may correspond to a second storage area (140).

[0061] For example, the second storage area (140) may be included within the read-only memory area (410) allocated by the hypervisor (120). For example, the read-only memory area (410) allocated by the hypervisor (120) may be included within the memory (150). For example, the first storage area (130) of FIG. 1 may be distinguished from the read-only memory area (410) allocated by the hypervisor.

[0062] For example, at least one processor (210) can identify information representing the address of the second storage area (140) using a security area setter (401). For example, at least one processor (210) can provide information representing the address of the second storage area (140) to a security data storage unit (402) and a security data verifier (403) using a security area setter (401).

[0063] For example, at least one processor (210) can identify an event for writing the first security data (131) using the security data storage (402). For example, at least one processor (210) can write the first security data (131) to the first storage area (130) through the kernel using the security data storage (402). At least one processor (210) can write the second security data (141) to the second storage area (140) and information (142) indicating the address of the first storage area (130) where the first security data (131) is written, through the hypervisor (120) using the security data storage (402).

[0064] For example, at least one processor (210) can identify an event for verifying the first security data (131) using a security data verifier (403). For example, at least one processor (210) can read information (142) indicating the address of the first storage area (130) where the second security data (141) written to the second storage area (140) and the first security data (131) written to the second storage area (140) using a security data verifier (403). At least one processor (210) can read the first security data (131) written to the first storage area (130) based on the address indicated by the information (142) indicating the address using a security data verifier (403). At least one processor (210) can compare the first security data (131) and the second security data (141) using a security data verifier (403). At least one processor (210) can identify the integrity of the first security data (131) based on the comparison using a security data verifier (403).

[0065] FIG. 5 illustrates a flowchart of an operation for writing information to identify the integrity of security data according to an embodiment of the present disclosure. In the following embodiments of the present disclosure, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0066] Referring to FIG. 5, in operation 501, at least one processor (210) can identify an event for writing the first security data using the kernel (110). For example, the first security data (131) may include information and / or policy information related to components loaded at boot time (e.g., UEFI (unified extensible firmware interface), OS (operating system) bootloader). Policy information may be described as rules defining how a subject can access an object within the system. For example, policy information may include information related to SELinux. SELinux may be described as a technology related to the security and control of a Linux system.

[0067] For example, an event for writing the first security data may occur during the booting process of the electronic device (100), immediately before the booting of the electronic device (100), or immediately after the completion of the booting of the electronic device (100). For example, an event for writing the first security data may occur after booting. An embodiment in which the event for writing the first security data occurs immediately after booting in accordance with setting policy information related to SELinux will be described later with reference to FIG. 6.

[0068] In operation 502, at least one processor (210) can use the kernel (110) to write the first security data to the first storage area (130). The first storage area may be accessible to the kernel for reading and writing. For example, the first storage area (130) may be contained in memory (150). For example, the first storage area (130) may be allocated by the hypervisor (120) of at least one processor (210).

[0069] In operation 503, at least one processor (210) may attempt to write the first security data (131) to the first storage area (130) using the kernel (110), and then write the second security data (141) and information (142) indicating the address of the first storage area (130) where the first security data (131) was written to the second storage area (140) using the kernel (110). For example, the information (142) indicating the address of the first storage area (130) where the first security data (131) was written may include information about the starting address of the first security data (131) and information about the size of the first security data (131).

[0070] For example, the first security data and the second security data may be represented as “0xffff80abcd0000”. For example, information regarding the starting address may be represented as “0xffff8812340000”. For example, information regarding the size of the first security data (131) having a size of 8 bytes may be represented as “0x08”. For example, at least one processor (210) may write information about the size of the first security data (131) to the second storage area (140), write information about the starting address of the first security data (131) to the second storage area (140) based on writing information about the size of the first security data (131) to the second storage area (140), and write the second security data (141) to the second storage area (140) based on writing information about the starting address of the first security data (131) to the second storage area (140). For example, at least one processor (210) may write “0x08ffff8812340000ffff80abcd0000” to the second storage area (140). The “0x” corresponding to the prefix of “0x08ffff8812340000ffff80abcd0000” may indicate that part of “0x08ffff8812340000ffff80abcd0000” following “0x” (e.g., “08ffff8812340000ffff80abcd0000”) is expressed in hexadecimal.

[0071] For example, since the second storage area (140) is inaccessible to the kernel (110) for writing, at least one processor (210) may fail to write the second security data (141) and information (142) indicating an address to the second storage area (140) using the kernel (110) according to the above attempt.

[0072] In operation 504, a page fault may occur based on the failure to write the second security data (141) and address information (142) to the second storage area (140) according to the attempt in operation 503. For example, at least one processor (210) may cause the page fault by using a memory management unit (MMU) (e.g., including circuitry). The MMU may be included within a central processing unit (CPU) (e.g., including processing circuitry). For example, the MMU may be described as a hardware module responsible for memory access control. For example, the page fault may be trapped by a hypervisor (120). For example, at least one processor (210) may identify the page fault by using a hypervisor (120).

[0073] For example, at least one processor (210) may request the hypervisor (120) to write the second security data (141) and address information (142) to the second storage area (140) using the hypervisor (120) based on the failure to write the second security data (141) and address information (142) to the second storage area (140).

[0074] For example, because a page fault has occurred, the control flow may be transferred, changed, switched, or adjusted from the kernel (110) to the hypervisor (120). For example, the control flow may be described as code or the execution order of the system. For example, at least one processor (210) may transfer the control flow from the kernel (110) to the hypervisor (120) based on the occurrence of a page fault.

[0075] For example, at least one processor (210) may call a hypervisor call (HVC) based on failing to write information (142) representing the address of the first storage area (130) where the second security data (141) and the first security data (131) are written to the second storage area (140) using the kernel (110). For example, at least one processor (210) may request the hypervisor (120) to write information (142) representing the address of the first storage area (130) where the second security data (141) and the first security data (131) are written to the second storage area (140) by calling the HVC.

[0076] In operation 505, at least one processor (210) can identify the page fault using the hypervisor (120). For example, the page fault can be trapped by the hypervisor (120). For example, at least one processor (210) can identify the cause and / or type of the page fault using the hypervisor (120). For example, at least one processor (210) can identify the address where the page fault occurred using the hypervisor (120).

[0077] In operation 506, at least one processor (210) can use a hypervisor (120) to write information (142) representing the address of the first storage area (130) where the second security data (141) and the first security data (131) are written to the second storage area (140), based on identifying the cause of the page fault, the type of the page fault, and / or the address where the page fault occurred. Since the hypervisor (120) can access the second storage area (140) for reading and writing, the second security data (141) and the information (142) can be written to the second storage area without the occurrence of a page fault.

[0078] According to an embodiment of the present disclosure, at least one processor (210) may, using a hypervisor (120), write information (142) indicating the address of the first storage area (130) where the first security data (131) was written to the second storage area (140) after the first security data (131) was written to the first storage area (130), based on refraining from writing to the second storage area (140) using the kernel (110). For example, since no attempt was made to write information (142) indicating the address of the first storage area (130) where the second security data and the first security data (131) were written to the second storage area using the kernel (110), operations 503, 504, and / or 505 may be omitted. For example, at least one processor (210) may perform operation 506 without performing operation 503, operation 504, and operation 505 based on performing operation 502.

[0079] In operation 507, at least one processor (210) can transfer the control flow from the hypervisor to the kernel. For example, after the control flow is transferred from the hypervisor to the kernel, at least one processor (210) can execute the code and / or process within the kernel (110) that was running immediately before the event to write secure data occurs.

[0080] As described above, according to the operation described in FIG. 5, at least one processor (210) can write information (142) representing the address of the first storage area (130) where the second security data (141) and the first security data (131) are written to the second storage area (140). According to the above-described embodiment, a security system including a kernel and a hypervisor having higher privileges than the kernel can be maintained.

[0081] FIG. 6 illustrates an event for writing secure data according to an embodiment of the present disclosure.

[0082] Referring to FIG. 6, the use of the sel_write_load function (610), the use of the selinux_policy_commit function (620), the use of the selinux_notify_policy_change function (640), and the use of the secmem_store function (650) may correspond to an event for writing the first security data (131). For example, at least one processor (210) may write a new SELinux policy in user mode (601) by using the sel_write_load function (610). For example, SELinux (security-enhanced linux) may be described as a security module of the Linux kernel for applying security policies to a Linux system. For example, an SELinux policy may include information related to the mapping between a process within the kernel and the kernel's actual resources. For example, at least one processor (210) can transfer the control flow from user mode (601) to kernel mode (602) using the sel_write_load function (610). For example, at least one processor (210) can identify the validity of a new SELinux policy using the selinux_policy_commit function (620). For example, at least one processor (210) can apply the policy to a Linux system based on the validity of the new SELinux policy using the selinux_policy_commit function (620).

[0083] For example, at least one processor (210) can use the selinux_notify_policy_change function (640) to provide information indicating that a policy has been changed to SELinux internal or other kernel components. For example, at least one processor (210) can use the function (640) to identify an event for writing the first security data (131). For example, at least one processor (210) can use the secmem_store function (650) to store data related to the SELinux security policy in a secure memory. For example, the secure memory may include a secure world in a trust zone and / or memory managed by a hypervisor (e.g., the hypervisor (120) of FIG. 1).

[0084] For example, at least one processor (210) may write the first security data (131) to the first storage area (130) using the security data storage unit (402) based on a call to the function (650). At least one processor (210) may write the second security data (141) and information (142) indicating the address of the first storage area (130) where the first security data (131) is written, to the second storage area (140) using the security data storage unit (402) based on a call to the function (650).

[0085] FIG. 7 is a flowchart illustrating an operation for identifying an abnormal state of first security data according to an embodiment of the present disclosure. In the following embodiments of the present disclosure, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0086] Referring to FIG. 7, in operation 701, at least one processor (210) can read information (142) indicating the address of the first storage area (130) where the second security data (141) and the first security data (131) are written, from the second storage area (140) using the kernel (110). For example, at least one processor (210) can read information (142) indicating the address of the second security data (141) and the first security data (131) written, from the second storage area (140) based on identifying an event for verifying the first security data (131). An event for verifying the first security data (131) will be described later with reference to FIG. 10.

[0087] In operation 702, at least one processor (210) can read the first security data (131) written to the first storage area (130) using an address indicated by the address-indicating information (142). For example, the address-indicating information (142) may include information about the starting address of the first security data (131) and information about the size of the first security data (131). For example, at least one processor (210) can read the first security data (131) by reading the first storage area (130) by the size of the first security data (131) from the starting address of the first security data (131).

[0088] In operation 703, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same. For example, at least one processor (210) can verify the first security data (131). For example, the kernel (110) and / or the first storage area (130) may be hacked. For example, as the kernel (110) and / or the first storage area (130) is hacked, the first security data (131) may be forged or tampered. For example, at least one processor (210) can identify, based on the forged first security data, that the forged or tampered first security data is different from the second security data (141). For example, at least one processor (210) can verify the first security data (131) by identifying the integrity of the first security data (131). For example, at least one processor (210) can verify the first security data (131) by authenticating the first security data (131).

[0089] For example, at least one processor (210) can identify that the first security data (131) and the second security data (141) are different. For example, the first security data (131) written to the first storage area (130) can be tampered with. For example, the first security data (131) written to the first storage area (130) can be forged. For example, the kernel (110) can be hacked (or cracked).

[0090] For example, a first storage area (130) accessible to the kernel (110) for reading and writing can be hacked. For example, the first storage area (130) can be hacked due to a memory error (e.g., stack overflow). For example, if a malignant kernel module (or loadable kernel module) and / or a rootkit is inserted into the kernel, the first storage area (130) can be hacked.

[0091] For example, a system call table that maps the number of system calls and the function of the kernel (110) can be tampered with. If the system call table is tampered with, the first storage area (130) can be hacked.

[0092] For example, if the first storage area (130) is hacked, the first security data (131) may be forged or tampered with. At least one processor (210) can identify the first security data (131) which is different from the second security data (141) based on the forged or tampered first security data (131).

[0093] In operation 704, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) based on identifying the second security data (141) and the first security data (131) which are different. For example, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) by providing a notification indicating that the electronic device (100) has been hacked. For example, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) by providing a notification indicating that the security data has been altered by unauthorized access.

[0094] For example, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) by displaying a visual object indicating an abnormal state of the first security data (131) through a display (220). A method for displaying the visual object will be described later with reference to FIG. 10.

[0095] For example, at least one processor (210) can identify the first security data (141) and the second security data (131) and the first security data that is different based on the forged first security data. For example, at least one processor (210) can erase the first security data (131) written to the first storage area (130) based on identifying the first security data (131) and the second security data (141). For example, at least one processor (210) can initialize the first security data (131) based on identifying the first security data (131) and the second security data (141). At least one processor (210) can write the third security data corresponding to the second security data (141) to the first storage area using the kernel (110). At least one processor (210) can identify information indicating the address of a first storage area where the third security data is written using the kernel (110). At least one processor (210) can write information indicating the address of the first storage area where the third security data is written to the second storage area (140) so as to be associated with the second security data (141). For example, at least one processor (210) can update the security data written to the second storage area and the information indicating the address based on writing the third security data to the first storage area.

[0096] In operation 705, at least one processor (210) may execute a function of the kernel (110) and / or a process within the kernel (110) based on identifying the first security data (131) corresponding to the second security data (141). For example, a function of the kernel (110) may be executed based on a system call described in FIG. 8. A method of executing a function of the kernel (110) based on a system call called by a user-level program to request a function of the kernel (110) will be described later with reference to FIG. 8. For example, a process within the kernel (110) may be executed based on an event requesting a process within the kernel (110) described in FIG. 9. A method of executing a process within the kernel (110) will be described later with reference to FIG. 9.

[0097] As described above, according to the operation described in FIG. 7, at least one processor (210) can enhance the security level of the electronic device (100) by verifying the first security data (131) before executing the functions of the kernel and / or processes within the kernel. At least one processor (210) can verify the first security data (131) more quickly by comparing the first security data (131) and the second security data (141) using the kernel (110).

[0098] FIG. 8 is a flowchart illustrating an operation to identify the integrity of security data based on a system call according to an embodiment of the present disclosure. In the following embodiments of the present disclosure, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0099] Referring to FIG. 8, in operation 801, at least one processor (210) may call a system call which is an event for verifying the first security data (131). For example, at least one processor (210) may call the system call by a user-level program (810). For example, the system call may be called to request a function of the kernel (110). For example, at least one processor (210) may enter kernel mode based on the system call. For example, entering kernel mode from a user-level program (810) may be described as a system call entry.

[0100] According to an embodiment of the present disclosure, the kernel may be described as software that performs core functions of an operating system. The kernel mode may be described as an operating privilege state of the CPU. For example, at least one processor (210) may use the kernel to manage resources and handle interrupts. At least one processor (210) may enter kernel mode from user mode in response to a system call.

[0101] In operation 802, at least one processor (210) can use the kernel (110) to identify a system call called from a user-level program (810). For example, at least one processor (210) can identify the number of the system call. For example, at least one processor (210) can identify the function of the kernel (110) corresponding to the number of the system call. For example, at least one processor (210) can transfer a control flow from the user-level program (810) to the kernel (110) in response to the system call.

[0102] In operation 803, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are identical. According to one embodiment of the present disclosure, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are identical based on the number of system calls. For example, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are identical based on system calls being called a reference number of times in a user-level program (810). For example, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are identical whenever a reference number of system calls are called in a user-level program (810). At least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same according to a reference number of system calls.

[0103] For example, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same based on identifying that the number of system calls called in the user-level program (810) exceeds a reference number (e.g., 9 times). For example, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same based on the 10th system call, the 20th system call, and the 30th system call in response to the 35th system call.

[0104] For example, at least one processor (210) can read information (142) from the second storage area (140) that indicates the address of the first storage area (130) where the second security data (141) and the first security data (131) are written. At least one processor (210) can read the first security data (131) from the first storage area (130) using the address indicated by the information (142). For example, at least one processor (210) can identify the first security data (131) corresponding to the second security data (141). For example, at least one processor (210) can identify the first security data (131) that is different from the second security data (141). Operation 803 may correspond to operation 703 described in FIG. 7.

[0105] In operation 804, at least one processor (210) can execute a function of the kernel (110) corresponding to a system call called by a user-level program (810). For example, at least one processor (210) can identify a system call number and a system call table. For example, at least one processor (210) can use the system call table to identify a function within the kernel corresponding to the system call number. For example, the system call table can be described as a table that maps a system call number to a function of the kernel.

[0106] In operation 805, at least one processor (210) may block the execution of at least one function in kernel mode based on identifying the second security data (141) and the first security data (131) which are different. For example, at least one processor (210) may perform a reboot of the electronic device (100) based on identifying the second security data (141) and the first security data (131) which are different. For example, at least one processor (210) may initialize the first security data by performing a reboot of the electronic device (100).

[0107] In operation 806, at least one processor (210) can determine whether the first security data (131) and the second security data (141) are the same after executing a kernel function corresponding to a system call and before exiting kernel mode. For example, at least one processor (210) can read information (142) indicating the address of the first storage area (130) where the second security data (141) and the first security data (131) are written from the second storage area (140) before exiting kernel mode. At least one processor (210) can read the first security data (131) from the first storage area (130) using the address indicated by the information (142). At least one processor (210) can compare the first security data (131) and the second security data (141). The above operation 806 may correspond to the above operation 803.

[0108] In operation 807, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) based on identifying the second security data (141) and the first security data (131) which are different. Operation 807 may correspond to operation 704 of FIG. 7.

[0109] For example, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) based on blocking the execution of at least one function within kernel mode. A method for providing a notification indicating an abnormal state of the first security data (131) will be described later with reference to FIG. 10.

[0110] In operation 808, at least one processor (210) can transfer the control flow from the kernel (110) to the user-level program (810) after identifying the integrity of the first security data (131). For example, the transfer of the control flow from the kernel (110) to the user-level program (810) can be described as a system call exit. For example, at least one processor (210) can execute the user-level program (810) that was executed before the system call was invoked in response to the transfer of the control flow from the kernel (110) to the user-level program (810).

[0111] According to the operation described in FIG. 8 as described above, at least one processor (210) can perform verification of the first security data (131) twice based on a system call. At least one processor (210) can identify the integrity of the first security data (131) based on entering kernel mode. At least one processor (210) can enhance the security level of the electronic device (100) by verifying the first security data (131) based on a system call.

[0112] FIG. 9 is a flowchart illustrating an operation to identify the integrity of security data based on an event requesting a process within the kernel, according to an embodiment of the present disclosure. In the following embodiments of the present disclosure, each operation may be performed sequentially, but is not necessarily performed sequentially. For example, the order of each operation may be changed, and at least two operations may be performed in parallel.

[0113] Referring to FIG. 9, in operation 901, at least one processor (210) can identify an event requesting a process within the kernel (110). An event requesting a process within the kernel (110) may include an interrupt generated by hardware and / or software. For example, in response to identifying the interrupt, at least one processor (210) may interrupt the running process and handle the interrupt using an interrupt handler (or interrupt service routine). For example, an interrupt handler may be described as a function within the kernel for responding immediately to the interrupt. For example, the interrupt generated by the hardware may include keyboard input. For example, the interrupt generated by the software may include an expiration event of a timer defined by the software.

[0114] In operation 902, at least one processor (210) can identify whether the first security data (131) is used for the execution of a process within the kernel (110). For example, at least one processor (210) can identify whether the first security data (131) is used for the execution of a process within the kernel (110) based on the kernel source code. For example, at least one processor (210) can identify whether the first security data (131) is used for the execution of a process within the kernel (110) by analyzing the kernel source code. For example, at least one processor (210) can identify whether the first security data (131) is used for the execution of a process within the kernel (110) by generating an interrupt when accessing the memory address where the first security data (131) is stored, immediately before the first security data (131) is used. For example, an interrupt that occurs when accessing the memory address where the first security data (131) is stored immediately before the first security data (131) is used may correspond to an event requesting a process within the kernel (110) described in operation 901.

[0115] In operation 903, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same. For example, at least one processor (210) can read information (142) from the second storage area (140) that indicates the address of the first storage area (130) where the second security data (141) and the first security data (131) are written. At least one processor (210) can read the first security data (131) from the first storage area (130) using the address indicated by the information (142). At least one processor (210) can compare the first security data (131) and the second security data (141).

[0116] For example, at least one processor (210) can identify, based on the comparison, that the second security data (141) is different from the first security data (131). For example, at least one processor (210) can identify, based on the comparison, that the second security data (141) is the same as the first security data (131). Operation 903 may correspond to operation 703 described in FIG. 7.

[0117] In operation 904, at least one processor (210) may execute a process within the kernel (110) based on identifying the first security data (131) corresponding to the second security data (141). For example, at least one processor (210) may use the first security data (131) while executing a process within the kernel (110) based on the identification. At least one processor (210) may execute a process within the kernel (110) using the first security data (131) which has the same value as the second security data (141), which is reference data for verifying the first security data (131).

[0118] In operation 905, at least one processor (210) may block the execution of a process within the kernel (110) based on identifying the first security data (131) which is different from the second security data (141). For example, based on said identification, at least one processor (210) may execute a process that was executed before an event requesting a process within the kernel (110) occurred. At least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) based on identifying the first security data (131) which is different from the second security data (141). Operation 905 may correspond to operation 805 and / or operation 807 described in FIG. 8.

[0119] As described above, according to the operation described in FIG. 9, at least one processor (210) can identify the integrity of the first security data (131) based on an event requesting a process within the kernel (110) regardless of the invocation of a system call. At least one processor (210) can enhance the security level of the electronic device (100) by verifying the first security data (131) based on an event requesting a process within the kernel (110).

[0120] FIG. 10 illustrates a visual object displayed to indicate an abnormal state of first security data according to an embodiment of the present disclosure.

[0121] Referring to FIG. 10, at least one processor (210) can provide a notification indicating an abnormal state of the first security data (131) based on identifying an event for verifying the first security data (131) (e.g., user input for application execution (1012), user input for keyboard input (1022), or user input for camera shooting (1033)).

[0122] For example, at least one processor (210) may enter kernel mode (602) from user mode (601) based on an event for verifying the first security data (131). For example, a system call may be invoked from a user-level program (810) based on an event for verifying the first security data (131). At least one processor (210) may verify the first security data (131) based on entering kernel mode or a system call. For example, at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) based on identifying the first security data (131) as different from the second security data (141).

[0123] For example, at least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same based on user input (1012) for application execution. For example, the user input (1012) can be described as a touch input to a UI object (1011) displayed through a display. For example, at least one processor (210) can change the state of the electronic device (100) from state (1010) to state (1040) based on identifying the first security data (131) which is different from the second security data (141).

[0124] For example, at least one processor (210) may display an interface (1021) for keyboard input through a display. For example, at least one processor (210) may identify whether the first security data (131) and the second security data (141) are the same based on user input (1022) for keyboard input. For example, at least one processor (210) may change the state of the electronic device (100) from state (1020) to state (1040) based on identifying the first security data (131) which is different from the second security data (141).

[0125] For example, at least one processor (210) can execute an application for a camera. At least one processor (210) can display an execution screen (1031) of the application for a camera through a display (220). At least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same based on user input (1033) for camera shooting. For example, user input (1033) can be described as a touch input to a UI object (1032) for camera shooting. For example, at least one processor (210) can change the state of the electronic device (100) from state (1030) to state (1040) based on identifying the first security data (131) which is different from the second security data (141).

[0126] For example, a system call called in a user-level program (e.g., the user-level program (810) of FIG. 8 or an application for a camera) may be called based on a reference time period regardless of user input. For example, the system call may be called when using hardware resources (camera, touch screen). For example, at least one processor (210) may call the system call based on accessing a first storage area (130) contained within memory (150) for writing and / or reading. For example, the system call may be described as an event for verifying the first security data (131).

[0127] In state (1040), at least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) by displaying a visual object (1041) indicating an abnormal state of the first security data (131) through a display (220). For example, while displaying the visual object (1041), at least one processor (210) may block the execution of a function of the kernel (110) and / or a process within the kernel (110) related to an event for verifying the first security data (131).

[0128] For example, in state (1030), at least one processor (210) can capture a scene outside the electronic device (100) in response to user input (1033) for capturing. For example, an application for a camera, which is a user-level program (e.g., user-level program (810) of FIG. 8), can enter kernel mode to use the camera, which is hardware. For example, a system call can be invoked from the user-level program to enter kernel mode. At least one processor (210) can identify whether the first security data (131) and the second security data (141) are the same based on identifying the system call.

[0129] For example, at least one processor (210) can capture a scene outside of the electronic device (100) in an application for a camera using a hardware camera based on identifying the first security data (131) corresponding to the second security data (141).

[0130] For example, at least one processor (210) may block the use of a hardware camera and the capturing of a scene outside the electronic device (100) based on identifying the second security data (141) and the first security data (131) which are different. At least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) by displaying a visual object (1041) indicating an abnormal state of the first security data (131) through a display (220) based on identifying the second security data (141) and the first security data (131) which are different.

[0131] For example, at least one processor (210) may display a visual object (1041) including a first UI object (1042) and a second UI object (1043) through a display (220). For example, while the visual object (1041) is displayed, at least one processor (210) may receive user input regarding the first UI object (1042) among the first UI object (1042) and the second UI object (1043). At least one processor (210) may perform a reboot of the electronic device (100) in response to user input regarding the first UI object (1042).

[0132] For example, at least one processor (210) may receive user input regarding a second UI object (1043) while a visual object (1041) is displayed. At least one processor (210) may refrain from rebooting the electronic device (100) in response to user input regarding the second UI object (1043). At least one processor (210) may skip rebooting the electronic device (100) in response to user input regarding the second UI object (1043). For example, at least one processor (210) may delay rebooting the electronic device (100) in response to user input regarding the second UI object (1043).

[0133] For example, at least one processor (210) may stop displaying the visual object (1041) in response to user input to the second UI object (1043). At least one processor (210) may provide a notification indicating an abnormal state of the first security data (131) after a reference time (e.g., 1 minute) in response to user input to the second UI object (1043). For example, at least one processor (210) may perform a reboot of the electronic device (100) based on identifying that the number of user inputs to the second UI object (1043) exceeds a reference number (e.g., 10 times).

[0134] For example, at least one processor (210) can initialize the first storage area (130), the second storage area (140), the first security data (131), the second security data (141), and the information (142) representing the address of the first storage area (130) where the first security data (131) is written, by performing a reboot of the electronic device (100).

[0135] For example, at least one processor (210) can erase the first security data (131) written to the first storage area (130) in response to user input for the second UI object (1043). For example, at least one processor (210) can initialize the first security data (131) in response to user input for the second UI object (1043). At least one processor (210) can write the third security data corresponding to the second security data (141) to the first storage area using the kernel (110). At least one processor (210) can identify information indicating the address of the first storage area where the third security data is written using the kernel (110). At least one processor (210) can write information indicating the address of the first storage area where the third security data is written to the second storage area (140) so as to be associated with the second security data (141). For example, at least one processor (210) can update information indicating the security data and address written to the second storage area based on writing the third security data to the first storage area.

[0136] FIG. 11 is a block diagram of an electronic device in a network environment according to an embodiment of the present disclosure.

[0137] Referring to FIG. 11, in a network environment (1100), an electronic device (1101) may communicate with an external electronic device (1102) through a first network (1198) (e.g., a short-range wireless communication network) or with at least one of an electronic device (1104) or a server (1108) through a second network (1199) (e.g., a long-range wireless communication network). According to one embodiment of the present disclosure, the electronic device (1101) may communicate with the electronic device (1104) through the server (1108). According to one embodiment of the present disclosure, an electronic device (1101) may include a processor (1120), memory (1130), input module (1150), sound output module (1155), display module (1160), audio module (1170), sensor module (1176), interface (1177), connection terminal (1178), haptic module (1179), camera module (1180), power management module (1188), battery (1189), communication module (1190), subscriber identification module (1196), or antenna module (1197). In some embodiments, at least one of these components (e.g., connection terminal (1178)) may be omitted from the electronic device (1101), or one or more other components may be added. In some embodiments, some of these components (e.g., sensor module (1176), camera module (1180), or antenna module (1197)) may be integrated into a single component (e.g., display module (1160)).

[0138] The processor (1120) can, for example, execute software (e.g., program (1140)) to control at least one other component (e.g., hardware or software component) of the electronic device (1101) connected to the processor (1120) and can perform various data processing or operations. According to one embodiment of the present disclosure, as at least part of the data processing or operations, the processor (1120) can store commands or data received from other components (e.g., sensor module (1176) or communication module (1190)) in volatile memory (1132), process the commands or data stored in volatile memory (1132), and store the resulting data in non-volatile memory (1134). According to one embodiment of the present disclosure, the processor (1120) may include a main processor (1121) (e.g., a central processing unit or an application processor) or an auxiliary processor (1123) that can be operated independently or together with it (e.g., a graphics processing unit, a neural processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor). For example, if the electronic device (1101) includes a main processor (1121) and an auxiliary processor (1123), the auxiliary processor (1123) may be configured to use less power than the main processor (1121) or to be specialized for a designated function. The auxiliary processor (1123) may be implemented separately from the main processor (1121) or as part thereof.

[0139] The auxiliary processor (1123) may control at least some of the functions or states associated with at least one component of the electronic device (1101) (e.g., display module (1160), sensor module (1176), or communication module (1190)) on behalf of the main processor (1121) while the main processor (1121) is in an inactive (e.g., sleep) state, or together with the main processor (1121) while the main processor (1121) is in an active (e.g., application execution) state. According to one embodiment of the present disclosure, the auxiliary processor (1123) (e.g., image signal processor or communication processor) may be implemented as part of another functionally related component (e.g., camera module (1180) or communication module (1190)). According to one embodiment of the present disclosure, the auxiliary processor (1123) (e.g., neural network processing unit) may include a hardware structure specialized for processing an artificial intelligence model. The artificial intelligence model may be generated through machine learning. Such learning may be performed, for example, on the electronic device (1101) itself where the artificial intelligence model is executed, or through a separate server (e.g., server (1108)). The learning algorithm may include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the examples described above. The artificial intelligence model may include a plurality of artificial neural network layers.An artificial neural network may be a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more of the above, but is not limited to the examples described above. In addition to the hardware structure, the artificial intelligence model may include a software structure, either additionally or substantially.

[0140] The memory (1130) can store various data used by at least one component of the electronic device (1101) (e.g., processor (1120) or sensor module (1176)). The data may include, for example, input data or output data for software (e.g., program (1140)) and related commands. The memory (1130) may include volatile memory (1132) or non-volatile memory (1134).

[0141] The program (1140) may be stored as software in memory (1130) and may include, for example, an operating system (1142), middleware (1144), or an application (1146).

[0142] The input module (1150) can receive commands or data to be used for a component of the electronic device (1101) (e.g., processor (1120)) from outside the electronic device (1101) (e.g., user). The input module (1150) may include, for example, a microphone, a mouse, a keyboard, a key (e.g., a button), or a digital pen (e.g., a stylus pen).

[0143] The sound output module (1155) can output a sound signal to the outside of the electronic device (1101). The sound output module (1155) may include, for example, a speaker or a receiver. The speaker may be used for general purposes, such as multimedia playback or recording playback. The receiver may be used to receive incoming calls. According to one embodiment of the present disclosure, the receiver may be implemented separately from the speaker or as part thereof.

[0144] The display module (1160) can visually provide information to an external (e.g., user) of the electronic device (1101). The display module (1160) may include, for example, a display, a holographic device, or a projector and a control circuit for controlling said device. According to one embodiment of the present disclosure, the display module (1160) may include a touch sensor configured to detect a touch, or a pressure sensor configured to measure the intensity of the force generated by said touch.

[0145] The audio module (1170) can convert sound into an electrical signal or, conversely, convert an electrical signal into sound. According to one embodiment of the present disclosure, the audio module (1170) can acquire sound through an input module (1150) or output sound through an audio output module (1155) or an external electronic device (e.g., external electronic device (1102)) (e.g., a speaker or headphones) that is directly or wirelessly connected to the electronic device (1101).

[0146] The sensor module (1176) can detect the operating state of the electronic device (1101) (e.g., power or temperature) or the external environmental state (e.g., user state) and generate an electrical signal or data value corresponding to the detected state. According to one embodiment of the present disclosure, the sensor module (1176) may include, for example, a gesture sensor, a gyroscope sensor, a barometric pressure sensor, a magnetic sensor, an accelerometer sensor, a grip sensor, a proximity sensor, a color sensor, an IR (infrared) sensor, a biosensor, a temperature sensor, a humidity sensor, or an illuminance sensor.

[0147] The interface (1177) may support one or more specified protocols that can be used for the electronic device (1101) to be connected directly or wirelessly to an external electronic device (e.g., external electronic device (1102)). According to one embodiment of the present disclosure, the interface (1177) may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.

[0148] The connection terminal (1178) may include a connector through which the electronic device (1101) can be physically connected to an external electronic device (e.g., external electronic device (1102)). According to one embodiment of the present disclosure, the connection terminal (1178) may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

[0149] The haptic module (1179) can convert an electrical signal into a mechanical stimulus (e.g., vibration or movement) or an electrical stimulus that can be perceived by the user through tactile or kinesthetic senses. According to one embodiment of the present disclosure, the haptic module (1179) may include, for example, a motor, a piezoelectric element, or an electric stimulation device.

[0150] The camera module (1180) can capture still images and video. According to one embodiment of the present disclosure, the camera module (1180) may include one or more lenses, image sensors, image signal processors, or flashes.

[0151] The power management module (1188) can manage power supplied to the electronic device (1101). According to one embodiment of the present disclosure, the power management module (1188) may be implemented, for example, as at least part of a power management integrated circuit (PMIC).

[0152] The battery (1189) can supply power to at least one component of the electronic device (1101). According to one embodiment of the present disclosure, the battery (1189) may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0153] A communication module (1190) can support the establishment of a direct (e.g., wired) communication channel or a wireless communication channel between an electronic device (1101) and an external electronic device (e.g., external electronic device (1102), electronic device (1104), or server (1108)), and the performance of communication through the established communication channel. The communication module (1190) may include one or more communication processors that operate independently of a processor (1120) (e.g., application processor) and support direct (e.g., wired) communication or wireless communication. According to one embodiment of the present disclosure, the communication module (1190) may include a wireless communication module (1192) (e.g., cellular communication module, short-range wireless communication module, or GNSS (global navigation satellite system) communication module) or a wired communication module (1194) (e.g., LAN (local area network) communication module, or power line communication module). The corresponding communication module among these communication modules can communicate with an external electronic device (1104) through a first network (1198) (e.g., a short-range communication network such as Bluetooth, WiFi (wireless fidelity) direct, or IrDA (infrared data association)) or a second network (1199) (e.g., a legacy cellular network, a 5G network, a next-generation communication network, the Internet, or a computer network (e.g., a LAN or WAN)). These various types of communication modules may be integrated into a single component (e.g., a single chip) or implemented as multiple separate components (e.g., multiple chips). The wireless communication module (1192) can identify or authenticate the electronic device (1101) within a communication network such as the first network (1198) or the second network (1199) using subscriber information (e.g., International Mobile Subscriber Identifier (IMSI)) stored in the subscriber identification module (1196).

[0154] The wireless communication module (1192) can support 5G networks and next-generation communication technologies following 4G networks, for example, new radio access technology. NR access technology can support high-speed transmission of high-capacity data (enhanced mobile broadband (eMBB)), minimization of terminal power and connection of multiple terminals (massive machine type communications (mMTC)), or high reliability and low latency (ultra-reliable and low-latency communications (URLLC)). The wireless communication module (1192) can support a high-frequency band (e.g., mmWave band) to achieve a high data transmission rate, for example. The wireless communication module (1192) can support various technologies for securing performance in the high-frequency band, such as beamforming, massive MIMO (multiple-input and multiple-output), full-dimensional MIMO (FD-MIMO), array antenna, analog beam-forming, or large-scale antenna. The wireless communication module (1192) can support various requirements specified in the electronic device (1101), external electronic device (e.g., electronic device (1104)), or network system (e.g., second network (1199)). According to one embodiment of the present disclosure, a wireless communication module (1192) can support a Peak data rate (e.g., 20 Gbps or more) for realizing eMBB, loss coverage (e.g., 164 dB or less) for realizing mMTC, or U-plane (user plane) latency (e.g., downlink (DL) and uplink (UL) each 0.5 ms or less, or round trip 1 ms or less) for realizing URLLC.

[0155] An antenna module (1197) can transmit a signal or power to or from an external source (e.g., an external electronic device). According to one embodiment of the present disclosure, the antenna module (1197) may include an antenna comprising a radiator made of a conductor or a conductive pattern formed on a substrate (e.g., a PCB). According to one embodiment of the present disclosure, the antenna module (1197) may include a plurality of antennas (e.g., an array antenna). In this case, at least one antenna suitable for a communication method used in a communication network, such as a first network (1198) or a second network (1199), may be selected from the plurality of antennas, for example, by a communication module (1190). A signal or power may be transmitted or received between the communication module (1190) and an external electronic device through the selected at least one antenna. According to some embodiments, in addition to the radiator, other components (e.g., a radio frequency integrated circuit (RFIC)) may be additionally formed as part of the antenna module (1197).

[0156] According to various embodiments, the antenna module (1197) may form a mmWave antenna module. According to one embodiment of the present disclosure, the mmWave antenna module may include a printed circuit board, an RFIC disposed on or adjacent to a first surface (e.g., bottom surface) of the printed circuit board and capable of supporting a specified high frequency band (e.g., mmWave band), and a plurality of antennas (e.g., array antennas) disposed on or adjacent to a second surface (e.g., top surface or side surface) of the printed circuit board and capable of transmitting or receiving a signal of the specified high frequency band.

[0157] At least some of the above components can be connected to each other via a communication method between peripheral devices (e.g., bus, GPIO (general purpose input and output), SPI (serial peripheral interface), or MIPI (mobile industry processor interface)) and exchange signals (e.g., commands or data) with each other.

[0158] According to one embodiment of the present disclosure, commands or data may be transmitted or received between an electronic device (1101) and an external electronic device (1104) through a server (1108) connected to a second network (1199). Each of the external electronic devices (1102, or 1104) may be the same or different type of device as the electronic device (1101). According to one embodiment of the present disclosure, all or part of the operations performed on the electronic device (1101) may be performed on one or more of the external electronic devices (1102, 1104, or 1108). For example, if the electronic device (1101) needs to perform a function or service automatically or in response to a request from a user or another device, the electronic device (1101) may request one or more external electronic devices to perform at least part of the function or service instead of performing the function or service itself or additionally. One or more external electronic devices that receive the above request may execute at least part of the requested function or service, or additional function or service related to the request, and transmit the result of the execution to the electronic device (1101). The electronic device (1101) may provide the result as is or additionally processed as at least part of the response to the request. For this purpose, for example, cloud computing, distributed computing, mobile edge computing (MEC), or client-server computing technology may be used. The electronic device (1101) may provide ultra-low latency services using, for example, distributed computing or mobile edge computing. In another embodiment, the external electronic device (1104) may include an Internet of Things (IoT) device. The server (1108) may be an intelligent server using machine learning and / or neural networks.According to one embodiment of the present disclosure, an external electronic device (1104) or server (1108) may be included within a second network (1199). The electronic device (1101) may be applied to intelligent services (e.g., smart home, smart city, smart car, or healthcare) based on 5G communication technology and IoT-related technology.

[0159] According to one embodiment of the present disclosure, an electronic device (e.g., the electronic device (100) of FIG. 1) is provided. The electronic device may include at least one processor (e.g., the processor (210) of FIG. 2) comprising a processing circuit. The electronic device may include a memory (e.g., the memory (150) of FIG. 1) that stores instructions and includes one or more storage media. The instructions may cause the electronic device to identify an event for verifying first security data (e.g., the first security data (131) of FIG. 1) written to a first storage area (e.g., the first storage area (130) of FIG. 1) when executed individually or collectively by the at least one processor. The first storage area may be accessible to a kernel (e.g., the kernel (110) of FIG. 1) for reading and writing.

[0160] For example, when the instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to use the kernel to read, based on the event, information indicating the address of the first storage area where the first security data is written (e.g., information indicating the address of FIG. 1 (142)) and second security data (e.g., second security data of FIG. 1 (141)) which is reference data for verifying the first security data from the second storage area (e.g., second storage area of ​​FIG. 1 (140)) from the second storage area (e.g., second storage area of ​​FIG. 1 (140)). The second storage area may be accessible to the kernel for reading and inaccessible for writing.

[0161] For example, when the above instructions are executed individually or collectively by the at least one processor, the first security data from the first storage area can be read using the kernel based on the address indicated by the information.

[0162] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to compare the second security data with the first security data for the verification of the first security data.

[0163] For example, the above instructions may cause the electronic device to provide a notification indicating an abnormal state of the first security data based on identifying the first security data different from the second security data according to the comparison, when executed individually or collectively by the at least one processor.

[0164] For example, the event for the above verification may include a system call called by a user-level program to request a function of the kernel and / or an event requesting a process within the kernel.

[0165] For example, the above instructions may cause the electronic device to read the information and the second security data from the second storage area for the verification of the first security data that can be used within the kernel mode, in response to entering kernel mode based on the system call called to request the function of the kernel when executed individually or collectively by the at least one processor.

[0166] For example, when the above instructions are executed individually or collectively by the at least one processor, they may cause the electronic device to read the first security data from the first storage area using the address.

[0167] For example, the above instructions may cause the electronic device to compare the second security data with the first security data when executed individually or collectively by the at least one processor.

[0168] For example, the above instructions may cause the electronic device to execute at least one function within the kernel mode based on identifying the first security data corresponding to the second security data according to the comparison, when executed individually or collectively by the at least one processor.

[0169] For example, when the above instructions are executed individually or collectively by the at least one processor, based on identifying the first security data different from the second security data according to the comparison, the electronic device may block the execution of at least one function within the kernel mode and provide the notification.

[0170] For example, the above instructions may cause the electronic device to read the information and the second security data from the second storage area for the verification of the first security data before exiting the kernel mode entered based on the system call called to request the function of the kernel when executed individually or collectively by the at least one processor.

[0171] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to read the first security data from the first storage area using the address.

[0172] For example, the above instructions may cause the electronic device to compare the second security data and the first security data when executed individually or collectively by the at least one processor.

[0173] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to terminate the kernel mode based on identifying the first security data corresponding to the second security data according to the comparison.

[0174] For example, the above instructions may cause the electronic device to provide the notification based on identifying the first security data different from the second security data according to the comparison, when executed individually or collectively by the at least one processor.

[0175] For example, the above instructions may cause the electronic device to identify that the first security data written to the first storage area before the process is executed is used for the execution of the process, based on the event requesting the process within the kernel when executed individually or collectively by the at least one processor.

[0176] For example, the above instructions may cause the electronic device to use the kernel to read the information indicating the address of the first storage area and the second security data for verifying the first security data from the second storage area for the verification of the first security data, based on identifying that the first security data is used in the execution of the process when executed individually or collectively by the at least one processor.

[0177] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to read the first security data from the first storage area using the kernel, based on the address indicated by the information.

[0178] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to compare the second security data with the first security data for the verification of the first security data.

[0179] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may cause the process within the kernel to execute based on identifying the first security data corresponding to the second security data according to the comparison.

[0180] For example, when the above instructions are executed individually or collectively by the at least one processor, they may cause the electronic device to block the execution of the process within the kernel based on identifying the first security data different from the second security data according to the comparison, and to provide a notification indicating the abnormal state of the first security data.

[0181] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may cause the first security data written to the first storage area to be erased based on identifying the first security data different from the second security data according to the comparison.

[0182] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to write third security data corresponding to second security data to the first storage area using the kernel.

[0183] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to identify, using the kernel, information representing the address of the first storage area where the third security data is written.

[0184] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to write the information indicating the address of the first storage area where the third security data is written to the second storage area so as to be associated with the second security data.

[0185] For example, when the above instructions are executed individually or collectively by the at least one processor, they may cause the electronic device to perform a reboot of the electronic device based on identifying the first security data different from the second security data according to the comparison.

[0186] For example, the electronic device may further include a display. The instructions may cause the electronic device to provide the notification by displaying, through the display, a visual object indicating the abnormal state of the first security data, based on identifying the first security data different from the second security data according to the comparison, when executed individually or collectively by the at least one processor.

[0187] For example, the visual object may include a first UI (user interface) object and a second UI object. When the instructions are executed individually or collectively by the at least one processor, they may cause the electronic device to perform a reboot of the electronic device based on user input received in relation to the first UI object among the first UI object and the second UI object while the visual object is displayed.

[0188] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to refrain from performing the reboot based on user input received in relation to the second UI object among the first UI object and the second UI object while the visual object is displayed.

[0189] For example, the verification may include identifying the integrity of the first security data and / or authenticating the first security data.

[0190] For example, the information indicating the address of the first storage area where the first security data is written may include information about the starting address of the first security data written within the first storage area and information about the size of the first security data.

[0191] For example, the above instructions may cause the electronic device to identify an event for writing the first security data when executed individually or collectively by the at least one processor.

[0192] For example, when the above instructions are executed individually or collectively by the at least one processor, they may cause the electronic device to write the first security data to the first storage area using the kernel based on the event for writing the first security data.

[0193] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to identify the information representing the address of the first storage area where the first security data is written using the kernel.

[0194] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to write the information indicating the address of the first storage area where the second security data and the first security data are written to the second storage area using security software that is accessible for reading and writing.

[0195] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to identify the event for the verification of the first security data after the first security data is written to the first storage area and the second security data and the information are written to the second storage area.

[0196] For example, the above security software may be a hypervisor.

[0197] According to one embodiment of the present disclosure, an electronic device is provided. The electronic device may include at least one processor comprising a processing circuit. The electronic device may include a memory that stores instructions and includes one or more storage media. The instructions may cause the electronic device to identify an event for writing secure data when executed individually or collectively by the at least one processor.

[0198] For example, when the above instructions are executed individually or collectively by the at least one processor, based on the event, the electronic device may be caused to write the security data to a first storage area accessible to the kernel for reading and writing, using the kernel.

[0199] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to identify, using the kernel, information representing the address of the first storage area where the security data is written.

[0200] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to write the security data and the information to a second storage area, which is accessible to the kernel for reading and inaccessible to the kernel for writing, using security software that is accessible to the second storage area for reading and writing, in order to verify the security data written to the first storage area.

[0201] For example, the above instructions may cause the electronic device to request the security software to write the security data and the information to the second storage area, based on the failure to write the security data and the information to the second storage area in accordance with the attempt, when executed individually or collectively by the at least one processor.

[0202] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to write the security data and the information to the second storage area using the security software to verify the security data written to the first storage area based on the request.

[0203] For example, the security data written to the first storage area may be the first security data, and the security data written to the second storage area may be the second security data.

[0204] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to identify an event for verifying the first security data based on the second security data written to the second storage area and the information.

[0205] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to read the second security data and the information from the second storage area using the kernel based on the event for verification.

[0206] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to read the first security data from the first storage area using the kernel based on the address indicated by the information.

[0207] For example, when the above instructions are executed individually or collectively by the at least one processor, the electronic device may be caused to compare the second security data and the first security data to verify the first security data.

[0208] For example, the above instructions may cause the electronic device to provide a notification indicating an abnormal state of the first security data based on identifying the first security data different from the second security data according to the comparison, when executed individually or collectively by the at least one processor.

[0209] According to one embodiment of the present disclosure, a non-transient computer-readable storage medium is provided for storing one or more programs. The one or more programs may include instructions that cause the electronic device to identify an event for verifying first security data written to a first storage area when executed by at least one processor of the electronic device. The first storage area may be accessible to the kernel for reading and writing.

[0210] For example, the above one or more programs may include instructions that, when executed by the at least one processor, cause the electronic device to read, using the kernel, information indicating the address of the first storage area where the first security data is written and second security data which is reference data for verifying the first security data, from the second storage area based on the event. The second storage area may be accessible to the kernel for reading and inaccessible for writing.

[0211] For example, the above one or more programs may include instructions that cause the electronic device to read the first security data from the first storage area using the kernel, based on the address indicated by the information, when executed by the at least one processor.

[0212] For example, the above one or more programs may include instructions that cause the electronic device to compare the second security data with the first security data for the verification of the first security data when executed by the at least one processor.

[0213] For example, the above one or more programs may include instructions that cause the electronic device to provide a notification indicating an abnormal state of the first security data based on identifying the first security data different from the second security data according to the comparison when executed by the at least one processor.

[0214] According to one embodiment of the present disclosure, a non-transient computer-readable storage medium is provided for storing one or more programs. The one or more programs may include instructions that cause the electronic device to identify an event for writing security data when executed by at least one processor of the electronic device. The one or more programs may include instructions that cause the electronic device to write the security data to a first storage area accessible to the kernel for reading and writing, using the kernel, based on the event when executed by the at least one processor.

[0215] For example, the above one or more programs may include instructions that cause the electronic device to identify, using the kernel, information representing the address of the first storage area where the security data is written, when executed by the above at least one processor.

[0216] For example, the above one or more programs may include instructions that cause the electronic device to write the security data and the information to a second storage area, which is accessible to the kernel for reading and inaccessible to the kernel for writing, using security software that is accessible to the second storage area for reading and writing, in order to verify the security data written to the first storage area when executed by the at least one processor.

[0217] For example, the event for the above verification may include a system call called by a user-level program to request a function of the kernel and / or an event requesting a process within the kernel.

[0218] For example, the above one or more programs may include instructions that cause the electronic device to read the information and the second security data from the second storage area for the verification of the first security data that can be used within the kernel mode, in response to entering kernel mode based on the system call called to request the function of the kernel when executed by the at least one processor.

[0219] For example, the above one or more programs may include instructions that cause the electronic device to read the first security data from the first storage area using the address when executed by the above at least one processor.

[0220] For example, the above one or more programs may include instructions that cause the electronic device to compare the second security data and the first security data when executed by the at least one processor.

[0221] For example, the above one or more programs may include instructions that cause the electronic device to execute at least one function in the kernel mode based on identifying the first security data corresponding to the second security data according to the comparison when executed by the at least one processor.

[0222] For example, the above one or more programs may include instructions that cause the electronic device to block the execution of at least one function within the kernel mode and provide the notification, based on identifying the first security data different from the second security data according to the comparison when executed by the at least one processor.

[0223] For example, the above one or more programs may include instructions that cause the electronic device to read the information and the second security data from the second storage area for the verification of the first security data before exiting the kernel mode entered based on the system call called to request the function of the kernel when executed by the at least one processor.

[0224] For example, the above one or more programs may include instructions that cause the electronic device to read the first security data from the first storage area using the address when executed by the above at least one processor.

[0225] For example, the above one or more programs may include instructions that cause the electronic device to compare the second security data and the first security data when executed by the at least one processor.

[0226] For example, the above one or more programs may include instructions that cause the electronic device to terminate the kernel mode based on identifying the first security data corresponding to the second security data according to the comparison when executed by the at least one processor.

[0227] For example, the above one or more programs may include instructions that cause the electronic device to provide the notification based on identifying the first security data different from the second security data according to the comparison when executed by the at least one processor.

[0228] According to one embodiment of the present disclosure, a method performed by an electronic device is provided. The method may include an operation of identifying an event for verifying first security data written to a first storage area. The first storage area may be accessible to a kernel for reading and writing.

[0229] For example, the above method may include, based on the above event, an operation of reading from a second storage area using the kernel information indicating the address of the first storage area where the first security data is written, and second security data which is reference data for verifying the first security data. The second storage area may be accessible to the kernel for reading but inaccessible for writing.

[0230] For example, the above method may include an operation of reading the first security data from the first storage area using the kernel, based on the address indicated by the above information.

[0231] For example, the above method may include an operation of comparing the second security data with the first security data for the verification of the first security data.

[0232] For example, the above method may include an operation of providing a notification indicating an abnormal state of the first security data based on identifying the first security data different from the second security data according to the comparison.

[0233] According to one embodiment of the present disclosure, a method performed by an electronic device is provided. The method may include an operation of identifying an event for writing secure data.

[0234] For example, the above method may include an operation of writing the security data to a first storage area accessible to the kernel for reading and writing based on the above event, using the kernel.

[0235] For example, the above method may include an operation of identifying information representing the address of the first storage area where the security data is written, using the kernel.

[0236] For example, the above method may include an operation of writing the security data and the information to a second storage area, which is accessible to the kernel for reading and inaccessible to the kernel for writing, using security software that is accessible to the second storage area for reading and writing, in order to verify the security data written to the first storage area.

[0237] The electronic device according to the embodiments disclosed in this document may be of various forms. The electronic device may include, for example, a portable communication device (e.g., a smartphone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a consumer electronics device. The electronic device according to the embodiments of this document is not limited to the devices described above.

[0238] The embodiments of this document and the terms used therein are not intended to limit the technical features described in this document to specific embodiments, and should be understood to include various modifications, equivalents, or substitutions of said embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar or related components. The singular form of a noun corresponding to an item may include one or more of said items unless the relevant context clearly indicates otherwise. In this document, each of phrases such as "A or B," "at least one of A and B," "at least one of A or B," "A, B or C," "at least one of A, B and C," and "at least one of A, B, or C" may include any one of the items listed together in the corresponding phrase, or all possible combinations thereof. Terms such as "first," "second," or "first" or "second" may be used simply to distinguish a component from another component and do not limit the components in any other aspect (e.g., importance or order). Where any component (e.g., the first) is referred to as "coupled" or "connected" to another component (e.g., the second), with or without the terms "functionally" or "communicationally," it means that said component may be connected to said other component directly (e.g., via a wire), wirelessly, or through a third component.

[0239] In one embodiment of this document, the term “module” used may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example. A module may be a component formed integrally, or a minimum unit of said component or a part thereof that performs one or more functions. For example, according to one embodiment of this disclosure, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0240] One embodiment of the present document may be implemented as software (e.g., program (1140)) comprising one or more instructions stored in a storage medium (e.g., internal memory (1136) or external memory (1138)) readable by a machine (e.g., electronic device (100) of FIG. 1). For example, a processor (e.g., processor (1120)) of a machine (e.g., electronic device (1101)) may call at least one of the one or more instructions stored from the storage medium and execute it. This enables the machine to be operated to perform at least one function according to the at least one called instruction. The one or more instructions may include code generated by a compiler or code that can be executed by an interpreter. The storage medium readable by the machine may be provided in the form of a non-transitory storage medium. Here, 'non-temporary' simply means that the storage medium is a tangible device and does not contain a signal (e.g., electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently and cases where it is stored temporarily.

[0241] According to one embodiment of the present disclosure, the method according to the embodiments disclosed herein may be provided by being included in a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., CD-ROM (compact disc read-only memory)), or distributed online (e.g., download or upload) through an application store (e.g., Play Store™) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created in a device-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0242] According to one embodiment, each component (e.g., module or program) of the components described above may include a singular or multiple entities, and some of the multiple entities may be separated and placed in other components. According to one embodiment, one or more of the components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Generally or additionally, multiple components (e.g., module or program) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the multiple components in the same or similar manner as those performed by the corresponding component among the multiple components prior to integration. According to one embodiment, operations performed by the module, program, or other components may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

[0243] It should be understood that various embodiments of the present disclosure according to the claims and descriptions set forth in this specification may be implemented in the form of hardware, software, or a combination of hardware and software.

[0244] Such software may be stored on a non-transient computer-readable storage medium. A non-transient computer-readable storage medium stores one or more computer programs (software modules), and the one or more computer programs include computer-executable instructions that, when executed by one or more processors of an electronic device, cause the electronic device to perform the method disclosed herein.

[0245] Such software may be stored on a volatile or non-volatile storage device, such as a storage device (regardless of whether it is erasable or rewritable), such as, for example, read-only memory (ROM), or on a memory, such as, for example, random access memory (RAM), a memory chip, a device, or an integrated circuit, or on an optically or magnetically readable medium, such as, for example, a compact disc (CD), a digital multi-purpose disc (DVD), a magnetic disc, or a magnetic tape. It should be understood that such storage devices and storage media are various embodiments of non-volatile machine-readable storage devices suitable for storing computer programs or programs that include instructions that implement various embodiments of this specification at runtime. Accordingly, various embodiments provide a program that includes code implementing a device or method according to any one of the claims of this specification, and a non-volatile machine-readable storage device that stores such a program.

Claims

In electronic devices, Memory that stores instructions and includes one or more storage media and It includes a processing circuit and at least one processor communicatively coupled to the memory, When the above instructions are executed individually or collectively by the at least one processor, Identify an event for verifying first security data written to a first storage area, - said first storage area is accessible to the kernel for reading and writing -; Based on the above event, using the kernel, read from the second storage area information indicating the address of the first storage area where the first security data is written and second security data which is reference data for verifying the first security data, -the second storage area is accessible to the kernel for reading but not for writing-; Based on the address indicated by the above information, the first security data from the first storage area is read using the kernel; To verify the first security data, the second security data and the first security data are compared; and Based on identifying the first security data different from the second security data according to the above comparison, causing the electronic device to provide a notification indicating an abnormal state of the first security data, Electronic device. In claim 1, The above event for the above verification is, A system call called by a user-level program to request a function of the kernel and / or an event requesting a process within the kernel, comprising Electronic device. In claim 2, when the instructions are executed individually or collectively by the at least one processor, Based on the system call invoked to request the function of the kernel, in response to entering kernel mode, the information and the second security data are read from the second storage area for the verification of the first security data that can be used within the kernel mode, and Using the above address, read the first security data from the first storage area, and Compare the above second security data and the above first security data, and Based on identifying the first security data corresponding to the second security data according to the above comparison, at least one function is executed within the kernel mode, and Based on identifying the first security data different from the second security data according to the above comparison, blocking the execution of at least one function within the kernel mode and causing the electronic device to provide the notification, Electronic device. In claim 2, when the instructions are executed individually or collectively by the at least one processor, Before exiting the kernel mode entered based on the system call invoked to request the function of the kernel, the information and the second security data are read from the second storage area for the verification of the first security data, and Using the above address, read the first security data from the first storage area, and Compare the above second security data and the above first security data, and Based on identifying the first security data corresponding to the second security data according to the above comparison, the kernel mode is terminated, and Based on identifying the first security data different from the second security data according to the above comparison, the electronic device further causes to provide the notification, Electronic device. In claim 2, when the instructions are executed individually or collectively by the at least one processor, Based on the event requesting the process within the kernel, identifying that the first security data written to the first storage area before the process is executed is used for the execution of the process, and Based on identifying that the first security data is used in the execution of the process, for the verification of the first security data, the information representing the address of the first storage area and the second security data for verifying the first security data are read from the second storage area using the kernel, and Based on the address indicated by the above information, the first security data from the first storage area is read using the kernel, and To verify the first security data, the second security data and the first security data are compared, and Based on identifying the first security data corresponding to the second security data according to the above comparison, the process within the kernel is executed, and Based on the above comparison, the electronic device further causes blocking the execution of the process within the kernel and providing a notification indicating the abnormal state of the first security data, based on identifying the first security data different from the second security data. Electronic device. In claim 1, when the instructions are executed individually or collectively by the at least one processor, Based on identifying the first security data different from the second security data according to the above comparison, the first security data written to the first storage area is erased, Writing third security data corresponding to second security data to the first storage area using the kernel, and Identifying information representing the address of the first storage area where the third security data is written, using the kernel, and The electronic device further causes the information indicating the address of the first storage area where the third security data is written to be written to the second storage area so as to be linked with the second security data. Electronic device. In claim 1, when the instructions are executed individually or collectively by the at least one processor, Based on identifying the first security data different from the second security data according to the above comparison, causing the electronic device to perform a reboot of the electronic device, Electronic device. In claim 1, Includes more displays, When the above instructions are executed individually or collectively by the at least one processor, Based on identifying the first security data different from the second security data according to the above comparison, the electronic device further causes the notification by displaying a visual object indicating the abnormal state of the first security data through the display. Electronic device. In claim 8, The above visual object includes a first UI (user interface) object and a second UI object, and When the above instructions are executed individually or collectively by the at least one processor, While the above visual object is displayed, the electronic device is further caused to perform a reboot of the electronic device based on user input received in relation to the first UI object among the first UI object and the second UI object, and While the above visual object is displayed, the electronic device causes to refrain from performing the reboot based on user input received in relation to the second UI object among the first UI object and the second UI object. Electronic device. In claim 1, the verification is, including identification of the integrity of the first security data and / or authentication of the first security data, Electronic device. In claim 1, the information indicating the address of the first storage area where the first security data is written is, Information regarding the starting address of the first security data written within the first storage area and information regarding the size of the first security data, Electronic device. In claim 1, when the instructions are executed individually or collectively by the at least one processor, Identifying an event for writing the above-mentioned first security data, and Based on the event for writing the first security data, the first security data is written to the first storage area using the kernel, and Identifying the information representing the address of the first storage area where the first security data is written, using the kernel, and Using security software capable of accessing the second storage area for reading and writing, the information representing the address of the first storage area where the second security data and the first security data are written is written to the second storage area, and After the first security data is written to the first storage area and the second security data and the information are written to the second storage area, the electronic device further causes to identify the event for the verification of the first security data. Electronic device. In claim 12, the security software is, hypervisor, Electronic device. In electronic devices, Memory storing instructions and comprising one or more storage media, and It includes a processing circuit and at least one processor that is communicationally connected to the memory, and When the above instructions are executed individually or collectively by the at least one processor, Identify events for writing secure data, and Based on the above event, the kernel writes the security data to a first storage area accessible for reading and writing using the kernel, and Identifying information representing the address of the first storage area where the above security data is written, using the kernel, and To verify the security data written to the first storage area, the electronic device causes the security data and the information to be written to a second storage area, which is accessible to the kernel for reading and inaccessible to the kernel for writing, using security software that is accessible to the second storage area for reading and writing. Electronic device. In claim 14, when the instructions are executed individually or collectively by the at least one processor, Using the kernel above, attempt to write the security data and the information to the second storage area, and based on the failure to write the security data and the information to the second storage area according to the attempt, request to write the security data and the information to the second storage area using the security software, and Based on the above request, to verify the security data written to the first storage area, using the security software, the electronic device further causes the security data and the information to be written to the second storage area, Electronic device.

Images