WO2017115976A1

WO2017115976A1 - Method and device for blocking harmful site by using accessibility event

Info

Publication number: WO2017115976A1
Application number: PCT/KR2016/010208
Authority: WO
Inventors: 윤광호; 강경태
Original assignee: 주식회사 수산아이앤티
Priority date: 2015-12-28
Filing date: 2016-09-09
Publication date: 2017-07-06
Also published as: KR101808033B1; KR20170077503A

Abstract

Disclosed are a method and device for blocking a harmful site by using an accessibility event. A method for blocking a harmful site according to an embodiment of the present invention, with respect to a method for blocking a harmful site on a mobile device, comprises the steps of: using an accessibility function of an operating system (OS) and monitoring text input to a browser; determining whether a site address is included in the monitored text; when it is determined that the site address is included, determining whether a first site corresponding to the site address is a preset harmful site; and when the first site is determined as the harmful site, blocking access to the first site.

Description

Method and device for blocking harmful site using accessibility event

The present invention relates to a harmful site blocking technology, and more particularly, to a harmful site blocking method capable of blocking a harmful site input to a browser using an accessibility event of an operating system (OS) in a mobile device, for example, a smartphone; Relates to a device.

Typically, smartphones are called PDA phones, which combine a tiny computer with a cell phone. Smartphones can be used as phones, text messages, and portable mobile communication devices and portable computers that support mobile wireless Internet. Smartphone users can wirelessly access the Internet while on the go, and manage data information and fax transmissions such as Internet information search, e-mail, video, games, and music downloads, personal information management, LCD display, etc. You can use the electronic pen to enter text or send and receive picture information such as directions.

Smartphones can also send data over regular telephone lines with an optional data adapter.

Recently, various applications have been developed due to the great popularity of smart phones. "Application" means broadly any software that runs on top of an operating system. Thus, not only word processors, spreadsheets and web browsers, but also compilers and linkers are applications. Or in a narrow sense, it refers to software that the user directly uses on the operating system.

However, with the recent widespread use of smartphones, a large number of minors are using them. Because smartphones can easily connect to the Internet, minors are indiscriminately exposed to harmful applications or harmful Internet sites. There is also no control over this, which can adversely affect minors' emotions.

Embodiments of the present invention provide a harmful site blocking method and apparatus that can block a harmful site accessed by a mobile device using an accessibility event of an operating system.

Embodiments of the present invention provide a harmful site blocking method and apparatus capable of blocking a harmful site based on an accessibility function or blocking a harmful site based on a browser history monitoring according to an operating system version of a mobile device.

A harmful site blocking method according to an embodiment of the present invention includes a method for blocking a harmful site on a mobile device, the method comprising: monitoring text input to a browser using an accessibility function of an operating system (OS); Determining whether a site address is included in the monitored text; If it is determined that the site address is included, determining whether a first site corresponding to the site address is a preset harmful site; And blocking access to the first site if the first site is determined to be the harmful site.

Furthermore, the harmful site blocking method according to an embodiment of the present invention includes the steps of checking the version of the operating system; And determining whether a version of the operating system is greater than or equal to a preset reference version, and the monitoring may monitor the text using an accessibility function of the operating system when the version of the operating system is greater than or equal to the reference version.

Furthermore, the harmful site blocking method according to an embodiment of the present invention further includes the step of checking whether the accessibility function is activated when the version of the operating system is less than the reference version, and the monitoring step includes the accessibility function If this is activated, the text can be monitored using an accessibility function of the operating system.

Further, the harmful site blocking method according to an embodiment of the present invention comprises the steps of monitoring the site address input to the browser when the version of the operating system is less than the reference version; If the site address is input, determining whether a second site corresponding to the input site address is the harmful site by using a previously stored browser history; And blocking the access to the second site when the second site is determined to be the harmful site.

Furthermore, the harmful site blocking method according to an embodiment of the present invention further comprises the step of connecting to a predetermined specific site that can inform the reason for blocking access to the first site when the first site is determined as the harmful site. It may include.

An apparatus for blocking harmful sites according to an embodiment of the present invention, comprising: a monitoring unit for monitoring text input to a browser using an accessibility function of an operating system (OS); An address determining unit determining whether a site address is included in the monitored text; A determination unit for determining whether a first site corresponding to the site address is a preset harmful site when it is determined that the site address is included; And a blocking unit that blocks access to the first site when the first site is determined to be the harmful site.

Furthermore, the harmful site blocking device according to an embodiment of the present invention includes a version check unit for checking the version of the operating system; And a version determining unit that determines whether a version of the operating system is equal to or greater than a preset reference version, and the monitoring unit may monitor the text using an accessibility function of the operating system when the version of the operating system is greater than or equal to the reference version.

Furthermore, the harmful site blocking device according to an embodiment of the present invention further includes a function checking unit for checking whether the accessibility function is activated when the version of the operating system is less than the reference version, and the monitoring unit is configured to access the accessibility function. When activated, the text may be monitored using an accessibility function of the operating system.

The monitoring unit monitors a site address input to the browser when the version of the operating system is less than the reference version, and when the site address is input, the determining unit uses a prestored browser history to correspond to the input site address. It may be determined whether a site is the harmful site, and the blocking unit may block access to the second site when the second site is determined as the harmful site.

When the first site is determined to be the harmful site, the blocking unit may connect to a predetermined specific site that may inform the reason for blocking access to the first site.

According to embodiments of the present invention, a harmful site accessed by a mobile device may be blocked using an accessibility event of an operating system.

According to embodiments of the present invention, the harmful site may be blocked based on an accessibility function or the malicious site may be blocked based on a browser history monitoring based on an operating system version of the mobile device, and both accessibility based and history monitoring based may be used if necessary. To block harmful sites.

1 illustrates a conceptual configuration of a mobile device for explaining the present invention.

2 is a flowchart illustrating an operation of a harmful site blocking method according to an embodiment of the present invention.

FIG. 3 is a flowchart illustrating an embodiment of a process for blocking harmful sites based on accessibility function illustrated in FIG. 2.

4 is a flowchart illustrating an embodiment of a process for blocking harmful sites based on the history monitoring illustrated in FIG. 2.

Figure 5 shows the configuration of the harmful site blocking apparatus according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited or limited by the embodiments. Also, like reference numerals in the drawings denote like elements.

For mobile devices, for example, less than Android version 6.0 of the operating system (OS) of the smart phone can access the browser history database (DB), less than operating system version 6.0, access the browser history database to use the browser history You can block the site. However, if the operating system version 6.0 or later, the policy is changed to prevent access to the browser history database, it is difficult to block malicious sites using the history browser database.

The embodiments of the present invention do not use the browser history database by using an accessibility function or an event of the operating system when the version of the operating system is a reference version, for example, version 6.0 or higher, according to the version of the operating system due to the above-described policy change. The main idea is to provide a technology that can block harmful sites without having to do so.

Herein, the present invention registers an accessibility function of an operating system, for example, an accessibility event callback, thereby monitoring or receiving text input to a browser through an accessibility event callback, and information about a site address in text input to a browser. If the site address is included, the site address is extracted, and if the corresponding site corresponding to the extracted site address is determined to be a harmful site, the access to the site is blocked by using the accessibility function of the operating system. You can block harmful sites.

Of course, the method according to the embodiment of the present invention preferably installs a program related to the present invention on a mobile device, for example, and activates the accessibility function through user consent so that the installed application can use the accessibility function of the operating system. Do.

Operating system accessibility For example, Android accessibility is the ability to customize your Android device to suit your physical needs, such as captions, zoom in, large print, high contrast text, end call with power button, automatic screen switching, There may be accessibility setting items such as password speaking, accessibility shortcut, text-to-speech output, long press delay, color inversion, and color correction.

The accessibility function used in the present invention may include not only text input from a user in a browser, but also a site address that is changed or input through a link in the browser. It can be provided by the application of the present invention. Depending on the situation, the present invention is not limited to the text input in the above-described browser, it is also possible to receive the text input by any means that can access the site through the accessibility function.

Of course, the present invention blocks harmful sites using the accessibility function when the version of the operating system is greater than or equal to the preset reference version, but when the version of the operating system is less than the reference version, the harmful site is based on the conventional browser history monitoring based on whether the accessibility function is activated. The harmful site may be blocked by using at least one of a blocking method and an access function-based harmful site blocking method.

This invention will be described with reference to FIGS. 1 to 5.

As shown in FIG. 1, the technology according to the present invention determines whether a site to be accessed from a mobile device is harmful by using an accessibility event or an accessibility function in a mobile device such as a smartphone, and the site to be accessed is a harmful site. In the case of blocking the access to the site, it is possible to prevent blocking to harmful sites.

Here, the harmful site blocking device 100 to block a harmful site by using an accessibility function may be installed in a mobile device in the form of an application, and the operating system uses the accessibility function of the operating system to input text received or received by a browser into a harmful site. By providing the blocking device, that is, the corresponding application, it is possible to determine whether the corresponding site is harmful and block access to the corresponding site when it is determined as a harmful site.

The accessibility function used in the present invention is an accessibility function related to a browser, and may include an accessibility event callback function, and includes a site address changed in the browser by text or a link input from a user on a browser or a screen. May include any accessibility feature that may provide the text to a harmful site blocking device.

Hereinafter, it will be described in the present invention that the accessibility function provides information about a site address that is changed or input in a text input into a browser or an address bar of a browser to a harmful site blocking device.

Referring to FIG. 2, the harmful site blocking method according to an embodiment of the present invention checks an OS version of the mobile device and determines whether the confirmed OS version is greater than or equal to a predetermined reference version (S210, S220).

Here, the reference version of the operating system may be an operating system 6.0 blocked access to the browser history DB, the reference version may vary depending on whether access to the browser history DB. In the present invention, it is assumed that the operating system is Android and the reference version is 6.0 for convenience of description.

As a result of the determination in step S220, if it is determined that the Android version of the mobile device is Android 6.0 or higher, blocking harmful sites based on the accessibility function, and if it is determined that the Android version of the mobile device is less than Android 6.0, it is determined whether the accessibility function of the mobile device is activated. (S230, S240).

Here, the step (S230) of blocking the harmful site based on the accessibility function will be described in detail with reference to FIG. 3.

If the accessibility function is activated in step S240, the harmful site is blocked using at least one of the history monitoring base or the accessibility base, and the accessibility function is not activated, that is, if the accessibility function is deactivated. Blocks harmful sites based on history monitoring (S250, S260).

Here, the step (S260) of blocking the harmful site based on the history monitoring will be described in detail with reference to FIG. 4.

In the step S250, when the Android version is less than Android 6.0 and the accessibility function is activated, the harmful site may be blocked based on the browser history monitoring, the harmful site may be blocked based on the accessibility function, and the browser history monitoring base and the accessibility function may be used. You can also block harmful sites using both of the foundations. Of course, this setting may be determined by the operator providing the present invention or may be determined by the setting of the user who uses the mobile device.

Referring to FIG. 3, in operation S230 of blocking a harmful site based on an accessibility function, text input to a browser is monitored using an accessibility function of an operating system (OS) (S310).

Here, step S310 is an accessibility function related to the present invention, for example, the callback function is activated by the user's selection or the installation of the application related to the present invention, and thus, a text address, for example, a site address and a link input by the user to the browser. By monitoring the site address input in the browser address bar, such as the site address is changed by can be provided to the application of the present invention.

It is determined whether the text received by the monitoring of step S310 includes the site address, and if the site address is included, the corresponding site address is extracted, and whether the site of the extracted site address is a harmful site is determined (S320 to S340).

Here, in step S320, since the text input to the browser may include not only the site address but also a search keyword, it may determine whether the site address is included. Of course, when the accessibility function is set to receive only text input to the browser address bar, the processes for steps S320 and S330 may be omitted.

The process of determining whether or not the harmful site of step S340 is harmful to the site address extracted in step S330 by the harmful site determination engine mounted on the application or provided in a separate server, and whether harmful from the harmful site determination engine By receiving the result, it is possible to determine whether or not the corresponding site is a harmful site.

Of course, the harmful site determination engine may include a list of harmful sites, and the list for such harmful sites may be updated at regular intervals.

As a result of the determination in step S340, when the corresponding site is determined to be a harmful site, that is, when the information about the harmful site is received from the harmful site determination engine, access to the corresponding site is blocked, and a predetermined decision may be made to inform the reason of the access blocking site. By connecting to a specific site, the site that wants to access the browser screen displays information that is a harmful site, thereby providing the user with a reason for blocking access to the site (S350, S360).

Here, the specific site of step S360 may be the address of a specific server determined by the operator providing the corresponding application, or may be the address of a page provided by the corresponding application itself.

As such, when the Android version is Android 6.0 or higher, access to a harmful site may be blocked by using an accessibility function of the operating system, and thus, even if the browser history database cannot be accessed, the harmful site may be blocked.

FIG. 4 is a flowchart illustrating an example of a process for blocking harmful sites based on the history monitoring shown in FIG. 2, and illustrates an operation flowchart for blocking harmful sites when the Android version is less than 6.0 and the accessibility function is disabled. .

Referring to Figure 4, blocking the harmful site based on the history monitoring (S260) monitors the site address input to the browser, the browser history database when the site address is input to the browser address bar through the user input or link, as a result of the monitoring It is determined whether a site corresponding to the input site address is a harmful site by using the browser history stored in S410 and S420.

Here, the process of determining whether a harmful site is based on the browser history monitoring is obvious to those skilled in the art, so detailed description thereof will be omitted.

* As a result of the determination in step S420, if the site is determined to be a harmful site, the site that wants to access the browser screen by blocking access to the site and connecting to a predetermined site that can inform the reason for blocking the access to the site. Displays the information that the harmful site, thereby providing the user with a reason for blocking access to the site (S430, S440).

Here, the specific site of step S440 may be the address of a specific server determined by the provider providing the corresponding application, or may be an address of a page provided by the corresponding application itself.

As described above, the harmful site blocking method according to an exemplary embodiment of the present invention may block harmful sites accessed by the mobile device from an operating system version that cannot access the browser history database by using an accessibility event of the operating system.

In addition, in the embodiments of the present invention, the method may block harmful sites based on an accessibility function or block harmful sites based on a browser history monitoring according to an operating system version of a mobile device, and based on an accessibility function and a history monitoring based on a necessity. All can be used to block harmful sites.

FIG. 5 illustrates a configuration of an apparatus for blocking harmful sites according to an embodiment of the present invention, and illustrates a configuration of an apparatus corresponding to an application for performing the method of FIGS. 2 to 4.

Referring to FIG. 5, the harmful site blocking apparatus 100 may include a version checking unit 510, a version determining unit 520, a function checking unit 530, a monitoring unit 540, an address determining unit 550, and a determining unit. 560 and blocking portion 570.

The version checker 510 checks the operating system version of the mobile device.

The version determining unit 520 determines whether the checked operating system version is equal to or greater than a predetermined reference version. For example, the version determination unit 520 determines whether the checked Android version is Android 6.0 or higher.

The harmful site blocking device 100 of the present invention will be described by dividing the Android version into 1) Android 6.0 or more and 2) Android 6.0 or less.

1) For Android 6.0 or above

The monitoring unit 540 monitors text input to the browser by using an accessibility function of an operating system (OS).

At this time, the monitoring unit 540 is activated by the accessibility function related to the present invention by the user's selection or the installation of the application related to the present invention, the text to the browser, for example, by the site address, the link input by the user The site address input in the browser address bar, such as the changed site address, is monitored by the accessibility function of the operating system, and the monitored text may be provided to the corresponding application in a string form.

Of course, since the monitoring unit 540 may be performed by the operating system accessibility function of the mobile device, the harmful site blocking apparatus 100 of the present invention may receive only the text monitored by the monitoring unit 540.

The address determination unit 550 determines whether a site address is included in the monitored text.

If it is determined that the site address is included in the text, the determination unit 560 extracts the site address and determines whether the site corresponding to the extracted site address is a preset harmful site.

At this time, the determination unit 560 inquires about the harmfulness of the site address mounted on the device or extracted by the harmful site determination engine provided in a separate server, and receives a result of the harmfulness from the harmful site determination engine In addition, whether or not the corresponding site is a harmful site can be determined.

If the site is determined to be a harmful site, the blocker 570 blocks access to the site.

At this time, the blocker 570 blocks the access to the corresponding site when the information about the harmful site is received from the harmful site determination engine, and connects to a predetermined predetermined site that informs the reason for the access blocking to the corresponding site. The site that wants to access the screen is displayed as harmful site, and the user can be provided with a reason for blocking access to the site.

2) If you are under Android 6.0

The function check unit 530 checks whether the Android accessibility is activated.

If you're under Android 6.0, you can block malicious sites based on accessibility features or block harmful sites based on browser history monitoring, depending on whether you've enabled Android accessibility. In other words, if Android accessibility is disabled, harmful sites can be blocked based on browser history monitoring, if Android accessibility is enabled, harmful sites can be blocked based on accessibility features, or malicious sites can be blocked based on browser history monitoring. It can also block harmful sites using a combination of accessibility and browser history monitoring. Since the configuration of blocking harmful sites based on the accessibility function was described in 1), only the configuration of blocking harmful sites based on the browser history monitoring is described.

The monitoring unit 540 monitors the site address input to the browser.

The determination unit 560 determines whether the site corresponding to the input site address is a harmful site by using the browser history stored in the browser history database when the site address is input to the browser address bar through a user input or a link. .

Although Figure 5 includes all the configurations that can block the harmful site in the case of Android version 6.0 or more and less than, but depending on the situation, the device may be configured with only Android version 6.0 or more configuration.

The system or apparatus described above may be implemented with hardware components, software components, and / or combinations of hardware components and software components. For example, the systems, devices, and components described in the embodiments may include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable arrays (FPAs). ), A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. Or may be permanently or temporarily embodied in a signal wave to be transmitted. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The method according to the embodiments may be embodied in the form of program instructions that may be executed by various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

Claims

In the method of blocking harmful site on a mobile device,

Monitoring text entered into a browser using an accessibility function of an operating system (OS);

Determining whether a site address is included in the monitored text;

If it is determined that the site address is included, determining whether a first site corresponding to the site address is a preset harmful site; And

Blocking access to the first site when the first site is determined to be the harmful site

Harmful site blocking method comprising a.
The method of claim 1,

Checking a version of the operating system; And

Determining whether a version of the operating system is greater than or equal to a preset reference version

Including,

The monitoring step

If the version of the operating system is greater than the reference version harmful site blocking method characterized in that for monitoring the text using the accessibility function of the operating system.
The method of claim 2,

Checking whether the accessibility function is activated when the version of the operating system is less than the reference version

More,

The monitoring step

And if the accessibility function is activated, monitoring the text using the accessibility function of the operating system.
The method of claim 2,

Monitoring a site address input to the browser when the version of the operating system is less than the reference version;

If the site address is input, determining whether a second site corresponding to the input site address is the harmful site by using a previously stored browser history; And

Blocking access to the second site when the second site is determined to be the harmful site

Harmful site blocking method further comprising a.
The method of claim 1,

If it is determined that the first site is the harmful site, connecting to a predetermined specific site that can inform a reason for blocking access to the first site.

Harmful site blocking method further comprising a.
In the harmful site blocking device on a mobile device,

A monitoring unit monitoring text input to a browser using an accessibility function of an operating system (OS);

An address determining unit determining whether a site address is included in the monitored text;

A determination unit for determining whether a first site corresponding to the site address is a preset harmful site when it is determined that the site address is included; And

Blocking unit to block access to the first site when the first site is determined as the harmful site

Hazardous site blocking device comprising a.
The method of claim 6,

A version checking unit for checking a version of the operating system; And

A version determining unit that determines whether the version of the operating system is a preset reference version or more

More,

The monitoring unit

If the version of the operating system is greater than the reference version harmful site blocking device, characterized in that for monitoring the text using the accessibility function of the operating system.
The method of claim 7, wherein

A function check unit for checking whether the accessibility function is activated when the version of the operating system is less than the reference version

More,

The monitoring unit

When the accessibility function is activated, the harmful site blocking device, characterized in that for monitoring the text using the accessibility function of the operating system.
The method of claim 7, wherein

The monitoring unit

If the version of the operating system is less than the reference version monitors the site address entered into the browser,

The determining unit

When the site address is input, it is determined whether a second site corresponding to the input site address is the harmful site by using a previously stored browser history.

The blocking part

And if the second site is determined to be the harmful site, block access to the second site.
The method of claim 6,

The blocking part

And when the first site is determined to be the harmful site, connects to a predetermined specific site that can inform a reason for blocking access to the first site.