METHOD AND APPARATUS FOR GENERATING DYNAMIC SECURITY MODULE

• US 20180004940A1
• Filed: 09/12/2017
• Published: 01/04/2018
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: EverSpin Corp.
• Original Assignee: EverSpin Corp.
• Inventors: Ha, Young Bin
• Granted Patent: US 10,867,050 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

Disclosed herein are a method and apparatus for generating a dynamic security module which is allocated to a user terminal so that code configured to be executed on the user terminal for security varies with execution time. The method includes allocating a predetermined value to at least one of variables as which parts or all of variable portions of code constituting a dynamic security module have been designated. Part or all of the code constituting the dynamic security module transmitted to a user terminal has a predetermined valid period.

Claims

1. A method of generating a dynamic security module which is allocated to a user terminal so that code configured to be executed on the user terminal for security varies with execution time, the method comprising:

allocating a predetermined value to at least one of variables as which parts or all of variable portions of code constituting a dynamic security module have been designated,

wherein part or all of the code constituting the dynamic security module transmitted to a user terminal has a predetermined valid period.

2. The method of claim 1, wherein each of the variable portions of the dynamic security module is a code capable of varying at least one element selected from the group consisting of a function name of the code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable designating a compile level, and a variable designating an executable code obfuscation method.

3. The method of claim 1, wherein the predetermined valid period is configured to delete the part or all of the code or block use of the part or all of the code when the predetermined valid period expires.

4. The method of claim 1, further comprising:

creating a security session with a security client of the user terminal; and

transmitting the dynamic security module to the security client of the user terminal in which the security session has been created.

5. The method of claim 4, further comprising receiving security management results from the dynamic security module transmitted to the security client, examining the received security management results, and transmitting a security management examination result value to the dynamic security module of the security client.

6. The method of claim 4, further comprising transmitting a stop command to stop running of an application program of the user terminal to the dynamic security module of the security client when a security problem has occurred in the user terminal.

7. The method of claim 4, wherein the security session is created by generating a session ID as a security session ID and then transmitting the session ID to the security client so that the security client stores the session ID.

8. The method of claim 4, further comprising storing parameters of the dynamic security module transmitted to the security client while the security session has been maintained.

9. The method of claim 8, further comprising verifying whether details transmitted from the security client are identical to a configuration of parameters of the dynamic security module.

19. A computer-readable storage medium having stored thereon a computer program that, when executed by a processor, causes the processor to execute the method of claim 1.

10. An apparatus for generating a dynamic security module which is allocated to a user terminal so that code configured to be executed on the user terminal for security varies with execution time, the apparatus comprising:

a communication unit configured to transmit and receive a security management event over a network; and

a processor configured to control the communication unit,

wherein the processor allocates a predetermined value to at least one of variables as which parts or all of variable portions of code constituting a dynamic security module have been designated, and part or all of the code constituting the dynamic security module transmitted to the user terminal has a predetermined valid period.

11. The apparatus of claim 10, wherein each of the variable portions of the dynamic security module is a code capable of varying at least one element selected from the group consisting of a function name of the code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable designating a compile level, and a variable designating an executable code obfuscation method.

12. The apparatus of claim 10, wherein the processor is further configured to:

create a security session with a security client of the user terminal; and

transmit the dynamic security module to the security client of the user terminal in which the security session has been created.

13. The apparatus of claim 12, wherein the processor is further configured to:

receive security management results from the dynamic security module transmitted to the security client;

examine the received security management results; and

transmit a security management examination result value to the dynamic security module of the security client.

14. The apparatus of claim 12, wherein the processor is further configured to transmit a stop command to stop running of an application program of the user terminal to the dynamic security module of the security client when a security problem has occurred in the user terminal.

15. The apparatus of claim 12, wherein the processor is configured to create the security session by generating a session ID as a security session ID and then transmitting the session ID to the security client so that the security client stores the session ID.

16. The apparatus of claim 12, wherein the processor is further configured to store parameters of the dynamic security module transmitted to the security client while the security session has been maintained.

17. The apparatus of claim 12, wherein the processor is further configured to verify whether details transmitted from the security client are identical to a configuration of the parameters of the dynamic security module.

18. The apparatus of claim 10, further comprising storage configured to store the dynamic security module to be transmitted to the security client of the user terminal, the session ID to be used as the security session ID, and the parameters of the dynamic security module.