Dynamic security module server device and method of operating same

• US 10,867,048 B2
• Filed: 09/12/2017
• Issued: 12/15/2020
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: EverSpin Corp.
• Original Assignee: EverSpin Corp.
• Inventors: Ha, Young Bin
• Primary Examiner(s): Li, Meng
• Application Number:
  US15/701,726
• Publication Number:
  US 20180007082A1
• Time in Patent Office: 1,190 Days
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

Disclosed herein are a dynamic security module server device for transmitting a dynamic security module to a user terminal and receiving a security management event from the user terminal, and a method of operating the dynamic security module server device. The dynamic security module server device includes a communication unit configured to transmit and receive a security management event over a network, and a processor configured to control the communication unit. The processor is configured to create a security session with the security client of a user terminal, and to transmit a dynamic security module to the security client of the user terminal so that part or all of code performing security management in the security client of the user terminal in which the security session has been created has a predetermined valid period.

Claims

1. A dynamic security module server device comprising:

a transmitter to transmit a dynamic security module to a user terminal over a network;

a receiver to receive a security management event from the user terminal over the network; and

a processor configured to;

create a security session with a security client of the user terminal;

designate a first set of parameters for the dynamic security module to be used during the security session;

change a code of the dynamic security module based on the first set of parameters;

transmit, to the security client of the user terminal, the dynamic security module to be used during the security session;

store the first set of parameters for the dynamic security module transmitted to the security client while the security session is being maintained;

receive the security management event from the user terminal, wherein the security management event includes a second set of parameters of the dynamic security module that is running on the security client of the user terminal;

verify whether the second set of parameters of the dynamic security module that is running on the security client of the user terminal match with the first set of parameters that are stored for the security session; and

in response to detecting that the second set of parameters is different from the first set of parameters, cause the user terminal to stop running of an application program,

wherein the first and second sets of parameters include at least one of a function name, a variable that designates an algorithm to be executed, a protocol field, a variable that designates a protocol sequence, a variable that designates a compile level, or a variable that designates an executable code obfuscation method, and

wherein the security session has a predetermined valid period after which part or all of the code of the dynamic security module is changed.

2. The dynamic security module server device of claim 1, wherein the processor is further configured to:

receive security management results from the dynamic security module transmitted to the security client;

examine the received security management results; and

transmit a security management examination result to the dynamic security module of the security client.

3. The dynamic security module server device of claim 2, wherein the security management examination result comprises details of the security management that has been performed by the dynamic security module in the user terminal.

4. The dynamic security module server device of claim 1, wherein the processor is further configured to transmit a stop command to stop running of the application program of the user terminal to the dynamic security module of the security client when a security problem has occurred in the user terminal other than expiration of the predetermined valid period.

5. The dynamic security module server device of claim 1, wherein the processor is configured to create the security session by generating and storing a session ID as a security session ID and then transmitting the session ID to the security client so that the security client stores the session ID.

6. The dynamic security module server device of claim 5, further comprising a storage configured to store the dynamic security module to be transmitted to the security client of the user terminal, the session ID to be used as the security session ID, and the first set of parameters of the dynamic security module.

7. The dynamic security module server device of claim 1, wherein the security session is created with the security client of the user terminal which has been authenticated.

8. The dynamic security module server device of claim 1, wherein use of the part or all of the code is blocked when the predetermined valid period expires.

9. The dynamic security module server device of claim 1, wherein the processor is further configured to transmit a verification token proving that the dynamic security module has normally operated to an application program management server of the user terminal.

10. The dynamic security module server device of claim 1, wherein the part or all of the code is deleted when the predetermined valid period expires.

11. A method of operating a dynamic security module server device, the method comprising:

creating, with a processor, a security session with a security client of a user terminal;

designating, by the processor, a first set of parameters for a dynamic security module to be used during the security session;

changing, by the processor, a code of the dynamic security module based on the first set of parameters;

transmitting, to the security client of the user terminal, the dynamic security module to be used during the security session;

storing, by the processor, the first set of parameters for the dynamic security module transmitted to the security client while the security session is being maintained;

receiving, from the user terminal, a security management event, wherein the security management event includes a second set of parameters of the dynamic security module that is running on the security client of the user terminal;

verifying, by the processor, whether the second set of parameters of the dynamic security module that is running on the security client of the user terminal match with the first set of parameters that are stored for the security session; and

in response to detecting that the second set of parameters is different from the first set of parameters, causing the user terminal to stop running of an application program,

wherein the first and second sets of parameters include at least one of a function name, a variable that designates an algorithm to be executed, a protocol field, a variable that designates a protocol sequence, a variable that designates a compile level, or a variable that designates an executable code obfuscation method, and

wherein the security session has a predetermined valid period after which part or all of the code of the dynamic security module is changed.

12. The method of claim 11, further comprising:

receiving by the processor security management results from the dynamic security module transmitted to the security client;

examining by the processor the received security management results; and

transmitting by the processor a security management examination result to the dynamic security module of the security client.

13. The method of claim 12, wherein the security management examination result value comprises details of the security management that has been performed by the dynamic security module in the terminal device.

14. The method of claim 11, further comprising transmitting by the processor a stop command to stop running of the application program of the user terminal to the dynamic security module of the security client when a security problem has occurred in the user terminal other than expiration of the predetermined valid period.

15. The method of claim 11, wherein the security session is created by generating and storing a session ID as a security session ID and then transmitting the session ID to the security client so that the security client stores the session ID.

16. The method of claim 11, further comprising deleting by the processor the part or all of the code when the predetermined valid period expires.

17. The method of claim 11, further comprising blocking by the processor use of the part or all of the code when the predetermined valid period expires.