Method and apparatus for detecting tampered application

A method and an apparatus for detecting a tampered application are provided. The method of detecting a tampered application includes acquiring a package of an application, extracting and installing a first execution code from the acquired package of the application, extracting a second execution code from the package of the application when an execution command of the application is received after the first execution code is installed, and performing a preset operation when the second execution code differs from the first execution code.

PRIORITY

This application claims the benefit under 35 U.S.C. §119(a) of a Korean patent application filed on Feb. 24, 2012 in the Korean Intellectual Property Office and assigned Serial No. 10-2012-0019115, the entire disclosure of which is hereby incorporated by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a method and an apparatus for detecting a tampered application. More particularly, the present invention relates to a method for detecting a tampered application after installation of an application, and an apparatus thereof.

2. Description of the Related Art

In recent years, as a smart phone is supplied, use of various types of applications have actively increased in the smart phone. The application may be installed by a user or a device provider in a terminal such as a smart phone. The installed application may be executed according to an execution command of a user or other environments after this.

FIG. 1is a diagram illustrating a procedure of installing and executing an application by a terminal using an Android operating system according to the related art.

Referring toFIG. 1, a MediaHub.apk105package is installed in step140. A signature verification module110of the Android operating system verifies a signature of the MediaHub.apk105package. After the signature is verified, the terminal stores an optimized execution code115extracted from a corresponding application package in step150. In this case, the optimized executed code may be configured by an odex format.

After configuring the optimized executed code by the odex format, a user120inputs an execution command with respect to a Media Hub application125in step160. The execution command with respect to a Media Hub application125is transferred to a dalvik virtual machine130of Android in step170. The dalvik virtual machine130of the Android loads an execution code115of an odex format to execute the Media Hub application125in step180. In the foregoing way, the user may install an application and then execute the application.

Applications of the smart phone provide a convenient function to a user. However, a maliciously tampered application may download unwanted information to the smart phone and damage the phone or applications installed on it. An application providing contents such as music, images, or e-book uses Digital Rights Management (DRM) for protecting copyright. The maliciously tampered application may incapacitate a copyright protection function such as DRM.

To prevent execution of a tampered application in the smart phone, when installing the application, an Android operating system performs a signature verification procedure. However, after the application is installed, when the execution code115is tampered, there is a problem that detection of the tampered execution code or execution of the tampered execution code cannot be interrupted.

SUMMARY OF THE INVENTION

Aspects of the present invention are to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the present invention is to provide an apparatus for detecting a tampered application capable of detecting a tampered execution code after an application is installed and suitably processing the tampered execution code, and a method thereof.

In accordance with an aspect of the present invention, a method of detecting a tampered application is provided. The method includes acquiring a package of an application, extracting and installing a first execution code from the acquired package of the application, extracting a second execution code from the package of the application when an execution command of the application is received after the first execution code is installed, and performing a preset operation when the second execution code differs from the first execution code.

In accordance with another aspect of the present invention, an apparatus for detecting a tampered application is provided. The apparatus includes a memory for storing a package of an application, and a controller for extracting and installing a first execution code from the stored package of the application, for extracting a second execution code from the package of the application when an execution command of the application is received after the first execution code is installed, and for performing a preset operation when the second execution code differs from the first execution code.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

Hereinafter, an apparatus and a method for detecting a tampered application in a terminal according to an exemplary embodiment of the present invention will be described with reference to the accompanying drawings.

Before a description of the present invention, a pattern of an application tampering attack is described.

FIG. 2is a diagram illustrating a tampering attack pattern of an application according to the related art.

Referring toFIG. 2, in the same manner as inFIG. 1, a normal MediaHub.apk package105is installed in step140. When the package105is installed, a signature verifying procedure110is performed. After performing the signature verification procedure, the terminal extracts an optimized execution code115from the package105in step150. Next, an attacker112tampers with the installed execution code115in step155. An original execution code115is converted into a tampered execution code117according to a tampering attack of the attacker112. Next, the user120executes a corresponding application in the media hub125in step160and a dalvik virtual machine130is executed in step170. The dalvik virtual machine130does not detect that an execution code is tampered and loads and executes the tampered execution code117as is in step180.

A method capable of detecting or preventing an attack tampering an execution code after a package is installed is not known in the art.

FIG. 3is a block diagram illustrating an apparatus300for detecting a tampered application according to an exemplary embodiment of the present invention.

Referring toFIG. 3, the apparatus300for detecting a tampered application according to an exemplary embodiment of the present invention includes a communication unit310, an audio processor320, a display unit330, an input unit340, a memory350, and a controller360.

The communication unit310performs a transceiving function of corresponding data for wired communication or wireless communication of the apparatus300for detecting a tampered application. For example, the communication unit310may include an RF receiver for up-converting a frequency of a transmitted signal and amplifying the converted signal and an RF receiver for low-noise-amplifying a received signal and down-converting the amplified signal. The communication unit310may receive data through a wireless channel and output the received data to the controller360, and transmit data outputted from the controller360through the wireless channel.

More particularly, the communication unit310according to an exemplary embodiment of the present invention may transceive an application package file or data necessary for executing an application. If transceiving of image/voice or data is necessary, the communication unit310may be modified accordingly.

The audio processor320converts a digital audio signal into an analog audio signal through an audio CODEC and plays the analog audio signal through a speaker SPK. The audio processor320converts an analog audio signal inputted from the microphone MIC into a digital audio signal through the audio CODEC. The audio processor320may be configured by a CODEC. The CODEC may be configured by a data CODEC processing packet data and an audio CODEC processing an audio signal such as a voice. If a separate processing of the audio is not necessary, the audio processor320may be omitted.

The display unit330visually provides a menu of the apparatus300for detecting a tampered application, input data, function setting information and various other information to the user. The display unit330performs a function of outputting a booting screen, an idle screen, a menu screen, a call screen, and other application screens of the apparatus300for detecting a tampered application. When the apparatus300for detecting a tampered application supports an image call, the display unit330may display an image received from the other image call party.

The display unit330may be configured by a Liquid Crystal Display (LCD), an Organic Light Emitting Diode (OLED), an Active Matrix Organic Light Emitting Diode (AMOLED), and the like.

The input unit340receives a control input of a user and transfers the received control input of the user to the controller360. The input unit340may be implemented in the form of a touch sensor and/or a key pad.

The touch sensor detects a touch input of the user. The touch sensor may be configured by a touch sensor of a capacitive overlay, a resistive overlay type, an infrared beam type, a pressure sensor, and the like. In addition to the foregoing sensors, various types of sensor devices capable of detecting contact or pressure of an object may be configured as a touch sensor of the present exemplary embodiment. The touch sensor detects a touch input of the user and generates and transmits a detection signal to the controller360. The detection signal includes coordinate data which indicates where the user inputted a touch. When the user inputs a touch location moving operation, the touch sensor generates and transmits a detection signal including coordinate data of a touch location moving path.

A key pad receives a key operation of the user for controlling the apparatus300for detecting a tampered application, and generates and transfers an input signal to the controller360. The key pad may include numeric keys and arrow keys, and may be provided as a predetermined function key on a side of the apparatus300for detecting a tampered application.

The input unit340may include only a touch sensor or only a key pad. When a separate control input is unnecessary, the input unit340may be omitted.

The memory350stores programs and data necessary for an operation of the portable terminal100. The memory350may be divided into a program area and a data area. The program area may store a program controlling an overall operation of the apparatus300for detecting a tampered application, an operating system OS for booting the apparatus300for detecting a tampered application, an application program necessary for playing multi-media contents, and an application program necessary for other option functions of the apparatus300for detecting a tampered application, for example, a camera function, a voice playback function, an image or moving image playback function and the like. The data area is an area for storing data generated according to use of the apparatus300for detecting a tampered application, and may store images, moving images, phone-book, audio data, and the like. In particular, the memory350may store a package file of an application and an optimized execution code.

The controller360controls an overall operation of respective constituent elements of the apparatus300for detecting a tampered application.

More particularly, when receiving an application execution command as illustrated inFIGS. 4 to 6, the controller360may extract an execution code from a package file of a corresponding application and compare the extracted execution code with an original execution code stored in the memory350. When an execution code again extracted from the package file differs from the original execution code stored in the memory350in the comparison result, the controller360may perform a suitable operation of blocking an execution of a corresponding application or recording or storing information indicating that the application is tampered. A detail description of the controller360will be given with reference toFIGS. 4 to 6.

FIG. 4is a diagram illustrating a procedure of detecting a tampered application in a terminal according to an exemplary embodiment of the present invention.

First, a MediaHub.apk package105is installed in step140. A signature verification module110of an Android operating system verifies a signature of the MediaHub.apk package105. After verifying the signature, a terminal stores an optimized execution code115extracted from a corresponding application package in step150. In this case, the optimized execution code may be configured by an odex format. After the execution code115is stored, the attacker112tampers with the execution code115to generate a tampered execution code117in step155.

After generating the tampered execution code117in step115, the user120inputs an execution command with respect to a Media Hub application125in step160. The execution command with respect to a Media Hub application125is transferred to a dalvik virtual machine130of Android in step170. The dalvik virtual machine130of Android loads an execution code117of an odex format to execute a Media Hub application125in step180.

However, according to an exemplary embodiment of the present invention, when an execution command of a Media Hub application125is inputted, a tampering detector405reads an original package file from the MediaHub.apk package105to verify a signature in step410. In this case, if the signature is invalid, since the package file105is invalid, an execution of the application may stop. When the signature is valid, the tampering detector405newly extracts an execution code119from the MediaHub.apk package105in step420. Next, the tampering detector405compares a newly generated execution code119with the tampered execution code117in step430. In this case, since the execution code is tampered, the tampering detector450may report, at step440, that an execution code of a corresponding application is tampered to an Android operating system.

According to another exemplary embodiment of the present invention, when detecting tampering of the execution code, the tampering detector405may prevent execution of the corresponding application or store information indicating that the corresponding application is tampered. The stored information may help to prove a cause of a problem of the terminal afterwards. When the tampering detector405detects tampering of the execution code, a lower function for executing a corresponding application may be restricted. For example, when the tampering detector405detects that a moving image playback application is tampered, a function of a CODEC module necessary for executing the application may be restricted. Through this, execution of a corresponding tampered application may be substantially prevented.

According to this exemplary embodiment of the present invention, as a result determined by the tampering detector405, when the newly extracted execution code is the same as an originally stored execution code, the tampering detector405needs not to perform a separate operation and the Media Hub application125may be performed without problem.

In the exemplary embodiment ofFIG. 4, the user120may differ from or may be the attacker112. That is, because it is difficult for persons other than the user120to approach a corresponding terminal, the user120generally and intentionally tampers with an execution code of an application.

As described above, when the apparatus300for detecting the tampered application detects tampering of an execution code of the application, the apparatus stops execution of the tampered execution code or limits a lower function, thereby preventing a problem with the terminal and preventing the user from executing an application by bypassing a restricting function regarding copyright and other restrictions. According to another exemplary embodiment of the present invention, when the apparatus300for detecting a tampered application detects tampering of an execution code of an application and stores corresponding information, the stored information may help to prove a cause of a problem occurring in a terminal afterwards.

FIG. 5is a diagram illustrating a procedure of detecting a tampered application in a terminal according to another exemplary embodiment of the present invention. A case illustrated inFIG. 4is limited to the Android operating system but the exemplary embodiments of the present invention are applicable to a general case as illustrated inFIG. 5.

First, a signed object (application) package505is installed in step540. A signature verification module510of a system verifies a signature of a corresponding object package505. After the signature is verified, the terminal stores an optimized execution code (object)515extracted from a corresponding application package in step550. After the execution code515is stored, the attacker512tampers with the execution code515to generate a tampered execution code (object)517in step555.

After generating the tampered execution code, the user520inputs an execution command of the installed application in step560. The execution command of the application is transferred to an operating system530. The operating system530loads the execution code117so as to execute a corresponding application in step580.

However, according to this exemplary embodiment of the present invention, if an execution command with respect to the application is inputted, the tampering detector405reads an original package file (signed object)505of a corresponding application to verify a signature in step590. In this case, when the signature is invalid, since the package file505is also invalid, an execution of the application may stop. When the signature is valid, the tampering detector405newly extracts an optimized execution code (object)519from an original package505in step592. Next, the tampering detector405compares the newly generated execution code519with the tampered execution code517in step594. Since the execution code is tampered in this case, the tampering detector405may report that an execution code of a corresponding application is tampered to the system530in step596.

According to another exemplary embodiment of the present invention, if the tampering detector405detects tampering of the execution code, it may stop execution of a corresponding application or store information indicating that a corresponding application is tampered. The stored information may help to prove a cause of a problem of the terminal afterwards. If detecting tampering of an execution code, the tampering detector405may restrict a lower function for executing a corresponding application. For instance, when detecting that a moving image playback application is tampered, the tampering detector405may restrict a function of a CODEC module necessary for executing the application. Through this, an execution of a substantially tampered application may be prevented.

According to this exemplary embodiment of the present invention, as a result determined by the tampering detector405, if the newly extracted execution code is identical with an originally stored execution code, the tampering detector405needs not to perform a separate operation and the application may be performed without problem.

In the exemplary embodiment ofFIG. 5, the user520may be different from or identical to the attacker512. That is, because it is difficult for persons other than the user520to approach a corresponding terminal, the user520generally and intentionally tampers an execution code of an application.

As described above, when the apparatus300for detecting the tampered application detects tampering of an execution code of the application to stop execution of the tampered execution code or to limit a lower function, a problem of the terminal is previously prevented and the user may prevent execution of an application by bypassing a restricting function of copyright and other restrictions. According to another exemplary embodiment of the present invention, when the apparatus300for detecting a tampered application detects tampering of an execution code of an application and stores information indicating that a corresponding application is tampered, the stored information may help to prove a cause of a problem occurring in a terminal afterwards.

FIG. 6is a flowchart illustrating a method of detecting a tampered application in a terminal according to an exemplary embodiment of the present invention.

Before performing step610, it is assumed that an application package is downloaded or is acquired in another scheme and then installed. In this case, the first execution code is stored.

A controller360determines whether an application execution input is received in step610. If the application execution input is not received, the controller360repeats step610until the application execution input is received. When the application execution input is received, the process goes to step620. The controller360extracts a second execution code from a package in a run time, namely, after the application execution input is received in step620. In this case, verification of the signature may be also performed. The controller360determines whether a second execution code is identical with a first execution code stored when installing the package in step630. When the second execution code differs from the first execution code, the controller360may report an application tampering fact to other operating systems in step640. When the second execution code is identical with the first execution code, an application is executed according to a scheme of the related art without performing a separate specific procedure.

When a signature of the application is invalid or a newly extracted execution code differs from an execution code of an application stored before an execution input, the controller360performs a preset operation. An operation of the controller360when the signage of the application is invalid may be set to be identical with or different from an operation of the controller360when the newly extracted execution code differs from the execution code of an application stored before the execution input.

When the signature of the application is invalid, because an application operation due to tampering may be actually difficult, an execution of the application may stop. According to another exemplary embodiment of the present invention, when the signature of the application is invalid, the controller360may store information indicating that a signature of a corresponding application is invalid.

When the newly extracted execution code differs from the execution code of an application stored before the execution input according to execution input, the controller360determines that an execution code of the application is tampered. In this case, the controller360may store information indicating that an execution code of a corresponding application is tampered or report that an execution code of a corresponding application is tampered to other operating systems. According to another exemplary embodiment of the present invention, the controller360may prevent an execution of a corresponding application or prevent provision of a detailed function necessary to execute the corresponding application. For instance, when a moving image playback application is tampered, the controller360may prevent provision of a moving image CODEC function.

As described above, a case where an execution code is tampered after installation of the application by newly extracting and comparing an application execution code in a run time may be easily detected. When the application execution code is tampered, information indicating that an execution of the application is prevented or the application is tampered is stored so that a bad effect due to a tampered application execution code may be prevented or reduced.

An exemplary embodiment of the present invention may provide an apparatus and a method for detecting a tampered application which may detect and suitably process tampering of an execution code after installation of the application.

Since computer program instructions may be mounted in a processor of a universal computer, a special computer or other programmable data processing equipment, instructions performed through a processor of a computer or other programmable data processing equipment generates instructions for performing functions described in block(s) of the flowcharts. Since the computer program instructions may be stored in a computer available or computer readable memory capable of orienting a computer or other programmable data processing equipment to implement functions in a specific scheme, instructions stored in the computer available or computer readable memory may produce manufacturing articles involving the instructions executing the functions described in the block(s) of the flowcharts. Because the computer program instructions may be mounted on a computer or other programmable data processing equipment, a series of operation steps are performed in the computer or other programmable data processing equipment to create a process executed by the computer such that instructions performing the computer or other programmable data processing equipment may provide steps for executing functions described in the block(s) of the flowcharts.

Further, each block may indicate a part of a module, a segment, or a code including at least one executable instruction for executing specific logical function(s). It should be noticed that several execution examples may generate functions described in blocks and may be out of an order. For example, two continuously shown blocks may be simultaneously performed, and the blocks may be performed in a converse order according to corresponding functions.

As used in the exemplary embodiments of the present invention, the term “˜unit” refers to software or a hardware structural element such as FPGA or ASIC, and the term “˜unit” performs some roles. However, the “˜unit” is not limited to software or hardware. The term “˜unit” can be configured to be stored in an addressable storage medium and to play at least one process. Accordingly, for example, the term “˜unit” includes software structural elements, object-oriented software structural elements, class structural elements, task structural elements, processes, functions, attributes, procedures, subroutines, segments of a program code, drivers, firmware, microcode, circuit, data, database, data structures, tables, arrays, and variables. Functions provided in structural elements and the “˜units” may be engaged by the smaller number of structural elements and the “˜units”, may be divided by additional structural elements. Furthermore, the structural elements and the “˜units” may be implemented to play a device or at least one CPU in a security multimedia card.