System-on-a-chip malicious code detection apparatus for a mobile device

System-on-chip (SoC)-based apparatus for detecting malicious code in portable terminal is provided. SoC-based apparatus includes SoC including central processing unit (CPU) configured to generally control respective units of SoC for SoC-based malicious code detection, SoC memory-based firewall configured to classify packets input from outside through network interface unit, perform filtering operation, such as allowing operation and dropping operation, on the classified packets according to a predetermined setting, and output the result of the filtering operation to an application memory or an anti-malware engine, the SoC memory-based anti-malware engine configured to detect malicious code by performing a pattern-matching operation between a code pattern in a file input from the firewall and a pattern of malicious code registered in a malware signature database (DB) of a mobile device application unit, and an SoC memory-based control module configured to control operation of the firewall and the anti-malware engine in connection with the CPU.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to and the benefit of Korean Patent Application No. 10-2009-0030669, filed on Apr. 9, 2009, the disclosure of which is incorporated herein by reference in its entirety.

BACKGROUND

A firewall and an anti-malware engine are constructed on the basis of a memory of an SoC in consideration of resources and performance improvement of the portable terminal to detect malicious code introduced into the portable terminal.

2. Description of the Related Art

As their widespread proliferation continues, portable terminals such as smartphones, personal digital assistants (PDAs), wireless broadband (WiBro) terminals, etc. are becoming necessities of modern life. Countless people use portable terminals (mobile devices) to communicate with one another, to exchange information, and also to exchange important business information through voice and data communication.

However, as the hardware functions of portable terminals expand and improve, application programs executed in the portable terminals become more diverse and complicated. This increases the likelihood of existing malicious codes that have attacked computers causing serious damage to portable terminals also. In particular, the widespread proliferation of wireless portable Internet services such as WiBro has led to the advent of mobile malicious code (mobile malware) that attacks vulnerabilities in application programs and services for portable terminals such as Bluetooth, multimedia messaging system (MMS), etc., in addition to malicious code that attacks vulnerabilities in existing computer application programs.

Examples of mobile malicious code include the Timofonica worm, whose name is a modification of Telefonica, I-mode malicious code, and viruses (Phage, Vapor, and Liberty) operating in a short message service (SMS) and Palm operating system (OS).

Various types of malicious code may cause portable terminals to malfunction and may also cause serious problems such as deletion of data and leakage of personal information. Thus, countermeasures are required to effectively protect portable terminals from various malicious codes.

Anti-malware solutions applied to existing portable terminals are based on software, and the way in which they operate is as follows. A software-based vaccine program basically involves an anti-malware engine and a signature matching unit, and has a structure in which a virus signature database (DB) is periodically updated.

When scanning files in such a structure, anti-virus software searches for files that match signatures in the database to check whether or not the files are infected with a virus or to detect abnormal files. Also, firewalls applied to existing portable terminals block all network access attempts from the outside or network connection with a specific external program according to whether or not a policy has been established.

In this way, the anti-malware solutions applied to existing portable terminals are constructed on the basis of software and used in mobile devices without modification. However, mobile devices have relatively many limitations with respect to resources such as a central processing unit (CPU) and a battery. Thus, when the existing model is used as is, performance deterioration makes it inconvenient for a user to perform any operation other than malicious code detection.

Furthermore, when using a software-based virus vaccine solution for existing portable terminals, performance deterioration makes it difficult to monitor all packets received via a network.

SUMMARY OF THE INVENTION

The present invention is directed to providing an apparatus for detecting malicious code introduced into a portable terminal by constructing a firewall and an anti-malware engine on the basis of a memory of a system-on-chip (SoC) and changing a virus signature database (DB) to reflect region, in order to fundamentally solve performance deterioration of a software-based virus vaccine solution and overcome the limitations of a narrow malware signature (malicious code signature) DB based on a software scheme.

According to an aspect of the present invention, there is provided an apparatus for detecting malicious code in a portable terminal including an SoC. The SoC includes: a central processing unit (CPU) configured to generally control respective units of the SoC for SoC-based malicious code detection; an SoC memory-based firewall configured to classify packets input from the outside through a network interface unit, perform a filtering operation, such as an allowing operation and a dropping operation, on the classified packets according to a predetermined setting, and output the result of the filtering operation to an application memory or an anti-malware engine; the SoC memory-based anti-malware engine configured to detect malicious code by performing a pattern-matching operation between a code pattern in a file input from the firewall and a pattern of malicious code registered in a malware signature DB of a mobile device application unit; and an SoC memory-based control module configured to control operation of the firewall and the anti-malware engine in connection with the CPU.

The mobile device application unit interoperating with the SoC may be constructed in the application memory to update a vaccine version, and select a connection method according to a network used by a server.

DESCRIPTION OF MAJOR SYMBOLS IN THE ABOVE FIGURES

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

Exemplary embodiments of the present invention will be described in detail below with reference to the accompanying drawings. While the present invention is shown and described in connection with exemplary embodiments thereof, it will be apparent to those skilled in the art that various modifications can be made without departing from the spirit and scope of the invention.

FIG. 1is a block diagram of a system-on-chip (SoC)-based apparatus for detecting malicious code in a portable terminal according to an exemplary embodiment of the present invention. As shown in the drawing, the SoC-based apparatus includes a central processing unit (CPU)110, a network interface unit120, an SoC memory130, an input/output (I/O) interface unit140, a memory interface unit150, and a peripheral device160constructed on an SoC100, and a mobile device application unit210on an application memory200connected with the SoC100through the memory interface unit150to interoperate with the SoC100.

The SoC100is installed on a main printed circuit board (PCB) of the portable terminal, and interoperates with the mobile device application unit210constructed on the application memory200. The SoC100operates in an autonomous monitoring mode programmed in advance according to normal operation state regulations for I/O data flow, and a mode in which input and output channels are disabled when a current state departs from the requirements of the normal state.

The CPU110serves to generally control operation of the respective components constructed on the SoC100, that is, the network interface unit120, the SoC memory130, the I/O interface unit140, the memory interface unit150, and the peripheral device160. Also, the CPU110serves to control a firewall131, an anti-malware engine132, and a control module133based on the SoC memory130to detect malicious code, as will be described later, in a proper cycle or at a proper point in time in consideration of battery power consumption.

The network interface unit120serves to transfer packets that are newly received from the outside and will be stored the application memory200to the SoC memory130under the control of the CPU110.

As an area in which components (code) that can be corrected or complemented later and detect malicious code are constructed, the SoC memory130includes the firewall131including a packet identification unit131A and a packet filtering unit131B, the anti-malware engine132, and the control module133.

In the firewall of the SoC memory130, the packet identification unit131A classifies input packets and outputs the classified packets to the packet filtering unit131B. At this time, the packet filtering unit131B performs a filtering operation, such as an allowing operation and a dropping operation, on the input packets according to a setting of the application memory200.

Under the control of the CPU110and the control module133, the packets filtered by the packet filtering unit131B are stored in the application memory200through an internal bus and the memory interface unit150, or transferred to the anti-malware engine132through the internal bus. In the application memory200, an operating system (OS) and various kinds of programs used in a mobile device are loaded.

The anti-malware engine132performs a malware detection operation on a packet-filtered file output from the packet filtering unit131B and a file newly input from the I/O interface unit140. A malware signature database (DB)212C is constructed on a DB information unit212of the mobile device application unit210, and the anti-malware engine132performs a pattern matching operation between patterns of malicious code registered in the malware signature DB212C and a code pattern in a file input through the route to detect malicious code.

The control module133controls operation of the firewall131and the anti-malware engine132in connection with the CPU110, so that the firewall131and the anti-malware engine132operate as described above.

The SoC100operating as described above is updated when firewall code, code of the anti-malware engine132, etc. is changed or modified via a network.

FIG. 2shows a constitution of the mobile device application unit210constructed on the application memory200and interoperating with the SoC100. As shown in the drawing, the mobile device application unit210schematically includes an application module211and the DB information unit212.

The application module211includes a version sync module211A, an update module211B, and a center connection module211C, and the DB information unit212includes a center uniform resource locator (URL) information unit212A, a device information unit212B, and the malware signature DB212C.

The version sync module211A compares a vaccine version of a server with that of the portable terminal at predetermined periods, and operates the update module211B to update a vaccine of the portable terminal with the latest version of the server when the vaccine versions of the server and the portable terminal differ. Also, the version sync module211A operates the update module211B to update the vaccine version of the portable terminal when a malware signature DB of the server needs to be updated.

In this way, the vaccine version needs to be frequently updated on the basis of continuously occurring vulnerabilities, so that a security policy is kept effective.

The version sync module211A also operates the update module211B to update the vaccine of the portable terminal with the latest version when the malware signature DB of the server needs to be updated.

When several connection methods are given to a user, the center connection module211C prioritizes the connection methods and selects a connection method according to a network used by the server. For example, when wireless fidelity (WiFi) can be used, the center connection module211C enables access to a center URL by use of WiFi instead of selecting a mobile communication company. At this time, the center URL information unit212A is used to connect the portable terminal with the network of the server through the network interface unit120using the selected connection method, for example, a wireless local area network (LAN) (e.g., WiFi) or a mobile communication company.

The device information unit212B serves to maintain pieces of information required by the corresponding device.

An exemplary embodiment of the present invention is configured on an SoC on the basis of a memory in the SoC to detect malicious code introduced into a portable terminal, thereby improving virus scanning and matching performance. Thus, it is possible to perform a virus vaccine service while performing another operation on a mobile device.

Also, since all packets can be monitored through a firewall configured on the basis of the memory in the SoC, the mobile device can be maintained in a safe state from a mobile virus.

SEQUENCE LIST FREE TEXT