WO2015184891A1

WO2015184891A1 - Security management and control method, apparatus, and system for android system

Info

Publication number: WO2015184891A1
Application number: PCT/CN2015/074647
Authority: WO
Inventors: 张敏; 何剑; 罗志云
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-20
Filing date: 2015-03-19
Publication date: 2015-12-10
Also published as: CN105656860A

Abstract

A security management and control method, apparatus, and system for an Android system. The method comprises: receiving a security management and control policy adjusting instruction or a terminal software version upgrade instruction; and dynamically sending a corresponding security management and control policy file or a corresponding terminal software version upgrade file to a target terminal device according to the security management and control policy adjusting instruction or the terminal software version upgrade instruction. In the security management and control method provided by the technical solution of the present invention, a complete and firm chain of trust is formed from the hardware root of trust to the center of the digital certificate of a security management and control server, and by means of reliable interaction processes between the modules, the present invention, compared with the related art, achieves the effect that the software in an Android terminal cannot be cracked, and can flexibly adjust the terminal security policy, improves reliable upgrade of the terminal software version, ensures security management and control and meanwhile improves the user experience, and reduces the subsequent upgrade and maintenance cost.

Description

Android system security management method, device and system thereof

Technical field

The invention relates to the technical field of security management and control of an Android system, and in particular to a security management and control method, device and system thereof for an Android system.

Background technique

At present, the smart terminal device adopting the Android system not only exhibits explosive growth in the number of terminals, but also has various types of terminals involved. For example, the Android system is not only applied to smart phone devices, but also can be applied to a television set top box. Terminal devices such as car navigation devices and wearable devices.

Android is an open source mobile operating system based on Linux platform announced by Google (Google Inc.) on November 5, 2007. The platform consists of operating system, middleware, user interface and application software. It adopts the architecture of Software Stack (aka Software Stack), which is mainly divided into three parts. The underlying layer is based on the work of the Linux kernel. It is developed by the C language and provides only basic functions. The middle layer includes the library and the virtual machine Virtual Machine, which are usually developed in C++. The top layer is a variety of application software, including call programs, SMS programs, etc., the application software is developed by each company, usually with Java as part of the program.

However, in practical applications, due to the excessive opening of the Android system, the system's maximum authority (ROOT) can be arbitrarily obtained, so that the background virus sneak privacy, advertising charges and other malware behaviors are repeatedly prohibited.

In order to improve the security of the system, the related art 1 discloses a security monitoring system for an Android system, the system comprising: a configuration management unit configured to configure a security policy; and a centralized management unit configured to be secure A policy to perform security detection; and a plurality of detection units, each of the detection units being configured to detect, by the centralized management unit, whether the application to be executed is secure, wherein the plurality of detection units are located at different levels in the Android system. The technical solution can effectively prevent unauthorized non-secure acquisition of resources, data and access behavior of the Android system, and greatly improve the security of the Android system. However, its disadvantage is that the technical solution is only The local and local hardening of the kernel and the system will make the software system of the entire terminal tend to be solidified, and it is impossible to perform a trusted upgrade of the software version function or dynamically adjust the security policy.

Related Art 2 discloses a security access control method based on an Android terminal, the method comprising: first setting a security policy publisher on a primary server side, and setting a security policy loader on an Android terminal; the security policy loader adopting an air interface protocol And the HTTP protocol communicates with the security policy publisher, receives the message pushed by the security policy publisher; secondly configures the global security policy in the Android terminal; finally, the primary server issues an instruction to the Android terminal, and the Android terminal receives and executes the instruction issued by the primary server, The method does not require the participation of Android terminal users, and automatically loads the global security policy when booting to ensure the minimum security target of the system.

The related art 2 prevents the tampering by writing the security policy loader to the kernel on the Android terminal, and then receives the message pushed by the security policy publisher, and then deploys the security policy. However, its shortcomings are: First, it does not achieve more in-depth research on the anti-tampering of the terminal system, and can not avoid the risk of cracking caused by the entire software kernel being completely brushed; secondly, there is no solution between the security policy issuer and the security policy issuer. The network communication security problem, the so-called security policy publisher may be forged; in addition, the technical solution does not mention how the security policy loader is upgraded with the kernel.

Related Art 3 discloses a smart device having a mobile terminal operating system and a desktop operating system. In this technical solution, a desktop operating system and a mobile terminal operating system interactive verification operation mode are introduced, and the disadvantage thereof is that it cannot Solve the problem of safe startup of the terminal device after the network is disconnected, and the security of the terminal is greatly reduced when the terminal is operated independently.

Summary of the invention

In order to solve at least one of the above technical problems, an object of the embodiments of the present invention is to provide a security management and control method and apparatus for an Android system and a system thereof.

In order to solve the above technical problems, the following technical solutions are adopted:

A security management method for an Android system for security management of a server, including:

Receiving security management policy adjustment instructions;

Dynamically transmitting the corresponding security management policy file according to the security management policy adjustment instruction to Target Android terminal.

Optionally, the security management policy refers to a trusted operation behavior applied to the Android system and the KERNEL kernel included in the Android terminal.

Optionally, the security management policy includes one or more of the following: installing a trusted application, forcibly uninstalling an illegal application, and modifying the SELinux permission rule of the KERNEL kernel and the iptables network firewall rule to improve security purposes. Monitor the illegal cracking behavior of the Android terminal and alarm, scan the peripherals of the Android terminal for viruses, trigger the Android terminal to upgrade the trusted software version.

Optionally, before the step of dynamically sending the corresponding security management policy file to the target Android terminal according to the security management policy adjustment instruction, the method further includes:

Determining whether the security management policy file is modified to a trusted kernel of the target Android terminal or a protected file of the Android system;

The step of dynamically transmitting the corresponding security management policy file to the target Android terminal according to the security management policy adjustment instruction includes:

If the security management policy file does not modify the trusted kernel of the target Android terminal, and does not need to modify the key file protected by the trusted kernel in the Android system, the security management policy file is directly delivered to the security management policy file. The security management agent module of the target Android terminal;

Optionally, the method further includes: if the security management policy file is modified to a trusted kernel of the target Android terminal and/or a protected portion of the Android system, calculating a kernel digital summary after implementing the security management policy And the Android system file monitoring credentials, and the new kernel digital summary and Android system file monitoring credentials are encrypted with a private password, and the digital certificate of the server certificate is digitally signed, and then the core digital summary and Android system file monitoring will be encrypted after the signature. The credential is sent to the security management agent module of the target Android terminal.

Receiving terminal software version upgrade instructions;

And dynamically sending the corresponding terminal software version upgrade file to the target Android terminal according to the terminal software version upgrade instruction.

Optionally, the terminal software version upgrade file includes: a new trusted kernel, a new Android version of the IMA file verification policy, and a new trusted kernel.

Optionally, the method further includes

Calculate the digital summary information of the new version of the trusted kernel, encrypt the digital summary information with a private password, sign the certificate with the security management server, and send the security management agent module to the Android terminal through SSL encryption. .

A security management method for an Android system for an Android terminal, including:

Dynamically receive security management policy files and implement corresponding security management policies accordingly;

The current security management status information is reported in real time.

Optionally, the security management policy refers to a trusted operation behavior applied to an Android system and a KERNEL kernel that are at least included in the Android terminal.

Optionally, the method further includes:

The file is executed after receiving the security management policy file delivered by the security management server.

Optionally, the method further includes:

After receiving the encrypted digital signature and the Android system file monitoring credential issued by the security management server, the new kernel digital digest is injected into the trusted BOOT of the Android terminal, and the new Android system file monitoring credentials are injected. Go to the trusted kernel of the Android terminal;

The trusted BOOT and trusted kernel of the Android terminal decrypt and trust the new digital digest and file monitoring credentials by a private password.

Optionally, before performing the above steps, the step of guiding the verification is further included:

After the Android terminal is powered on, the hardware trust root performs digital digest verification on the trusted BOOT of the Android terminal, and the trusted BOOT of the Android terminal verifies the trusted kernel, and the trusted kernel of the Android terminal Timed or on-demand file integrity verification of the security management agent part and the Android regular framework.

Optionally, when an abnormality occurs in the Android terminal boot verification process, the hardware trust root controls the conventional hardware to perform a power-off operation or prevents the Android terminal from continuing the boot-up operation on the software.

Dynamically receiving the terminal software version upgrade file, and performing the corresponding version upgrade accordingly;

The current security management status information is reported in real time.

Optionally, the method further includes:

After receiving the software version upgrade file, the security management agent module of the Android terminal acquires an upgrade license of the Android terminal;

After the Android terminal is licensed, the security management agent module of the Android terminal injects a new trusted kernel digital digest into the trusted BOOT of the Android terminal, decrypts by a private password, and from the hardware trust root of the Android terminal. Obtain a certificate and verify the new kernel;

The Android terminal downloads a new kernel version, an Android version, and a new security management agent module to the peripheral device of the Android terminal through a website downloading manner, and performs a system on the Android terminal through a website-directed brush operation. upgrade;

After the Android terminal is flashed, the new trusted kernel is successfully started by the trusted BOOT, and the Android terminal also loads a new Android version and a new terminal security management agent module.

An Android terminal includes: a network management protocol terminal module, a security management agent module, a trusted boot device BOOT, and a hardware trust root, wherein

The network management protocol terminal module is configured to: collect the terminal information and the security management server Communication interaction;

The security management agent module is configured to: receive and execute a security management policy issued by the security management server, and feed back the security control status of the terminal to the security management server;

The hardware trust root is configured to: store the unique identity information of the terminal and the issuing root certificate of the security management server digital certificate.

Optionally, if the trusted boot BOOT is confirmed to be secure, the hardware trust root is the trusted BOOT.

Optionally, the terminal further includes a trusted boot device BOOT and a trusted kernel, where

The hardware trust root is further configured to: store digital summary information of the trusted BOOT;

The trusted BOOT is configured to: store digital summary information of the trusted kernel;

The trusted kernel is configured to verify the integrity of the Android system file and the integrity of the security management agent module.

Compared with the related art, the security management and control method of the technical solution of the present invention forms a complete and firm trust chain from the hardware trust root to the digital certificate center of the security management server, through a trusted interaction process between modules, and Compared with related technologies, it not only achieves the unbreakable effect of the Android terminal on the software, but also achieves the flexibility of flexibly adjusting the terminal security policy and the trusted upgrade terminal software version, ensuring the security management and control while improving the user experience and reducing the follow-up. The cost of upgrading maintenance.

BRIEF abstract

1 is a schematic structural diagram of a module of an Android terminal device according to an embodiment of the present invention;

2 is a schematic structural diagram of a module of a server in an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for performing secure boot verification in an Android terminal device booting startup process and implementing security monitoring in continuous operation according to an embodiment of the present invention; FIG.

FIG. 4 is a diagram of the security management and control policy on the terminal that needs to be initiated on the server in the embodiment of the present invention. Or initiating a software version update of the terminal, and a schematic diagram of the implemented method flow;

5 is a specific embodiment of the security management method provided by the present invention. After ensuring that the trusted terminal of the Android terminal is started, a security management policy is implemented, that is, a schematic diagram of an implementation process of installing a trusted application store;

FIG. 6 is a schematic diagram of another implementation manner of the security management method provided by the present invention. After the trusted boot of the old version of the Android terminal is ensured, the implementation process of triggering the upgrade of the trusted software is performed on the entire terminal.

The implementation, functional features and excellent effects of the object of the present invention will be further described below in conjunction with the specific embodiments and the accompanying drawings.

Preferred embodiment of the invention

The technical solutions of the present invention are further described in detail below with reference to the accompanying drawings and specific embodiments, but the embodiments are not intended to limit the invention.

In order to overcome the security risk problem that the Android system can be cracked in the related art and the defect that the related protection policy is too rigid, the embodiment of the present invention provides a trusted dynamic interaction between the hardware root of the terminal device and the remote security management server. Method and system for safety control. Therefore, while the hardware-based terminal Android software system is unbreakable, the security status of the terminal can be reported in real time, and the security management policy of the terminal is dynamically adjusted through the remote server, and the terminal device is allowed to perform the function upgrade of the trusted software version. .

In the embodiment of the present invention, the hardware trust root of the terminal device forms a complete trust chain between the digital certificate center of the remote control server, and the security management policy of the terminal device can be flexibly and credibly adjusted remotely; The method of issuing the private password after the encryption process can modify the digest credentials from the hardware to the kernel integrity check when the terminal device starts, so that the terminal device can trust the new version/new function modification and implement the version/function upgrade.

Optionally, the embodiment of the present invention adopts the following technical solutions:

The security management system of the embodiment of the present invention includes a terminal part of the Android system and a security management server part. The two are connected through a network, and the security management server can simultaneously manage and maintain multiple Android system terminals. The specific module structure is as follows:

Referring to FIG. 1 , an Android system terminal device according to an embodiment of the present invention includes:

The conventional Android framework software system 101, as well as conventional hardware 102, for example, includes a CPU, a memory unit, a wireless module, and the like.

In addition, the Android system terminal device further includes:

The network management protocol terminal module 103 is configured to: collect terminal device information and perform communication interaction with the network management protocol server module of the security management server. In an embodiment, the network management protocol terminal module 103 optionally implements interaction with the management server by using a terminal of the TR069 network management protocol system.

The security management agent module 104 is configured to: receive and execute a security management policy delivered by the security management server, and feed back the security management status of the terminal to the security management server.

The security management policy refers to trusted operation behaviors applied to other components such as the Android system and the KERNEL kernel, including but not limited to: installing trusted applications, forcibly uninstalling illegal applications, SELinux permission rules for the kernel, and iptables network firewall rules. Make beneficial modifications to improve security purposes, monitor terminal illegal cracking behaviors and alarms, scan peripherals for viruses, and trigger terminals to upgrade trusted software versions.

The hardware trust root 105 is configured to: store the unique identity information of the terminal, manage the issuing root certificate of the server digital certificate, and the digital summary information of the trusted boot (BOOT) 106 used to verify the BOOT.

Optionally, the hardware trust root 105 stores the above content using a trusted chip or card peripheral provided by the hardware. The hardware trust root 105 can store these contents in the form of fingerprints or irises.

Trusted Bootstrap (BOOT) 106: A digital digest complete check of the Trusted Bootstrap (BOOT) 106 by the hardware trust root 105 is therefore trusted. At the same time, the trusted boot (BOOT) 106 contains digital summary information of the trusted kernel, which can be used to verify the kernel when the system boots.

Alternatively, if in some embodiments the trusted boot (BOOT) 106 has been considered sufficiently secure, the functionality of the hardware trust root 105 can be integrated into the trusted boot (BOOT) 106, The Bootable Boot (BOOT) 106 is considered to be a trusted root and does not need to be verified. The Trusted Bootstrap (BOOT) 106 can directly carry the signed root certificate of the security management server digital certificate and the unique identity information of the terminal.

The trusted KERNEL kernel 107, which has been digitally verified by the trusted boot (BOOT) 106, is therefore a trusted kernel. It is configured to perform timing verification or access verification on the integrity of the Android system file and the integrity of the security management proxy module 104. In one embodiment, the verification mechanism optionally adopts an IMA (integrity measurement architecture) technology. Provides integrity measurement and verification of system critical files/directories and block devices, including the security management agent module 104.

Referring to FIG. 2, the security management server end of the embodiment of the present invention includes: a security management server and a secure digital authentication center 205, wherein:

The security management server includes a network management protocol server module 201, a security policy management module 202, a terminal general management module 203, and a background database module 204, wherein

The network management protocol server module 201 can implement the network management protocol for coordinated management of multiple terminal devices on the server side. In an embodiment, the network management protocol server module 201 can adopt the implementation of the TR069 protocol on the server side, and can support the management of the status of a large number of Android terminals (for example, up to hundreds of thousands of terminals).

The security policy management module 202 analyzes and processes the security policy requirements, arranges an execution plan, and collects feedback results.

The terminal general management module 203 is configured to: collect information, manage classification, online status, log collection management, and the like on the basic state of the terminal device.

The background database module 204 is configured to: provide a database service such as a storage query to the security management server.

The secure digital certificate center 205 is configured to: store and maintain digital certificates, private keys, private passwords, etc. of the security management server, and unify the digital certificate revocation and release of the terminal device. Optionally, the digital certificate authority can be properly isolated from the security management server to ensure its security.

In the Android terminal device, the network management protocol terminal module 103 is connected to the security management proxy module 104 to provide the capability of interacting with the security management server, and the Android terminal device can read the digital certificate information from the hardware trust root 105. And thus the SSL encryption connection process The identity of the security management server is verified, and the hardware trust root 105 is also accessed, and the terminal identity information in the hardware trust root 105 is managed by the security management server.

The hardware trust root 105 performs a digital digest check on the trusted boot (BOOT) 106, the trusted boot (BOOT) 106 in turn verifies the trusted KERNEL kernel 107, and the trusted KERNEL kernel 107 re-administers the security management proxy module 104. , and the Android regular framework for timing or on-demand file integrity verification.

The hardware trust root 105 and the conventional hardware 102 are also associated, and the power can be turned off in time when a security exception occurs.

The function of the security management agent module 104 has a core meaning in the embodiment of the present invention. On the one hand, it can access other modules of the terminal, and applies specific security management policies. On the other hand, it can also be obtained from the security management server. A new version of the integrity check credential that has been privately signed by the private password and the server (integrity check credentials include BOOT's digital digest, kernel's digital digest, and digital summary information for Android system files), and the signed new The version integrity check credentials are injected into the hardware trust root 105, the trusted boot BOOT 106, and the trusted KERNEL kernel 107, respectively, so that the new version is accepted.

In the security management server, the background database module 204 and the secure digital certificate center 205 are located in the background, and provide services for the security policy management module 202 and the terminal general management module 203. The two management modules of the backend database module 204 and the secure digital certificate center 205 are While providing the user with an operation interface, the network management protocol server module 201 is also used to obtain contact with the Android terminal device. The above server-side architecture is only for explaining the basic principle structure of the present invention. In a specific embodiment, the server has many additional functions, such as a web service, a remote access service, a file download service, etc., and the actual interaction between these modules is also It will be more complicated, and these are extensions of specific implementations, and those skilled in the art can implement the extension based on the invention and common general knowledge of the present invention, and details are not described herein again.

With reference to FIG. 3 and the previous FIGS. 1 and 2, with the security management method disclosed in the embodiment of the present invention, when the Android terminal device is powered on, the boot verification process includes the following steps:

Step 301: The terminal device is powered on, and the hardware trust root 105 and the conventional hardware 102 start to operate.

Alternatively, in one embodiment, if the trusted boot (BOOT) is considered to be sufficiently secure and does not require verification, then the hardware trust root does not have to be started immediately upon power up.

Step 302: The hardware trust root 105 calculates and compares the integrity of the trusted director BOOT according to the trusted director (BOOT) digital digest value.

Step 303: If the hardware trust root 105 finds that the trusted director BOOT 106 has been tampered with, the conventional hardware 102 is contacted to turn off the power supply, and the boot process is interrupted, and the process proceeds to step 305. If the trusted boot BOOT 106 has not been tampered with, then go to step 304.

Step 304: The trusted KERNEL kernel 107 is normally loaded, the trusted boot BOOT 106 starts and starts to boot the trusted KERNEL kernel 107, and the trusted boot BOOT 106 calculates and compares the integrity of the kernel with the digital digest value of the trusted KERNEL kernel. Sex.

Step 305: Terminate the system loading process.

Step 306: Determine whether the trusted KERNEL kernel 107 has been tampered with. If the trusted boot device BOOT 106 finds that the trusted KERNEL kernel 107 has been tampered with, then go to step 305, restart the device or lock the system to pop up a user prompting alarm; if the trusted KERNEL If the kernel 107 has not been tampered with, then go to step 307.

Step 307: After the trusted KERNEL kernel 107 is loaded, the security management agent module 104 of the Android and Android terminals continues to be loaded.

Step 308: The terminal security management agent module 104 starts, reads the digital certificate information from the hardware trust root, and obtains the SSL authentication encryption link with the security management server by using the TR069 network management protocol.

Step 309: The trusted KERNEL kernel 107 initiates a file integrity verification mechanism. Optionally, the IMA monitoring mechanism may be used, and the Android system key file and the security management agent module 104 may be monitored for tampering by timing monitoring or by access.

Step 310: Determine whether the key file of the Android system has been tampered with, and if yes, perform steps 311-312; otherwise, go to step 313.

Step 311: If the key file of the Android system is found to have been tampered with, the file tampering information is encrypted by the security management agent module 104 through the private password and SSL, and then sent to the security management server to confirm whether it is a false alarm.

Step 312: If the security management server is not available for a certain period of time or the security management server does not exempt the modification, the trusted KERNEL kernel 107 issues an alarm to the user or locks the system. In other application scenarios, the server may also be pre- The sent security policy selects the log or does not process it for the time being.

Step 313: Determine whether the security management proxy module 104 has been tampered with. If yes, the trusted KERNEL kernel 107 is required to immediately issue an alarm to the user or immediately lock the system. If the security management server exempts the Android system file modification, Then continue normal operation, go to step 314.

Step 314: If the security management agent module 104 itself has not been tampered with, and the Android system key files have not been tampered with or falsified by the security management server, the Android system maintains a normal running state.

Referring to FIG. 4, when the security management and control policy on the terminal device needs to be changed by using the security management and control method according to the embodiment of the present invention, the following implementation steps are adopted:

Step 400: When the security management server detects that the security management policy of the terminal needs to be adjusted, it determines that the target scope of the terminal needs to be executed, and starts to actively access the specified terminal device.

Step 401: Determine whether the new security management policy will be modified to the kernel or the protected file of the Android system. If yes, go to step 403. Otherwise, go to step 402.

Step 402: If the new security management policy does not modify the trusted kernel of the terminal, and does not need to modify the key files protected by the trusted kernel of the Android system. Then, the security management server directly issues the management policy to the security management agent module, and the security management agent module executes the implementation after receiving the process, and the process ends.

Step 403: If the new security management policy is modified to the KERNEL kernel, or the protected portion of the Android system, the security management server calculates the kernel digital digest and the Android system file monitoring credentials after implementing the security policy in advance.

Step 404: The security management server side monitors the new kernel digital digest and the system file (the system file monitoring credential in the embodiment may be a digital digest information of a series of monitored files maintained by the IMA file monitoring system), and these Encrypt with a private password and use the server license The private key of the book is digitally signed.

Step 405: The security management server sends the above calculation result to the security management agent module of the terminal through the SSL secure channel.

Step 406: The security management agent module injects a new kernel digital digest into the trusted director BOOT. Inject new Android system file monitoring credentials into the KERNEL kernel.

Step 407: The terminal BOOT and KERNEL kernel of the terminal decrypt and trust the new digital digest and file monitoring credentials by the above private password.

At this point, the feedback to the security management server is successful.

Step 408: The security management server sends a new terminal security management policy, modifies the KERNEL kernel and the Android file, and modifies the KERNEL kernel and the Android file, that is, the method of directly modifying the security control proxy module, and also allows the terminal user to After downloading the new version of the software on a specific website, it can be updated and modified by other means by brushing into the terminal device. At the time of the next device reboot and file security verification, new summaries and credentials will be adopted, so no falsification of false positives will occur.

When the software version is upgraded on the terminal device, the method shown in FIG. 4 may also be used, and the description will be omitted. Alternatively, the control method in the software version upgrade may also adopt the method as shown in FIG. 6 .

It is necessary to ensure that the Android terminal is safely and reliably booted, and also needs to load and install a new application mall application (you can safely download other applications through the application mall), and the application mall needs a digital certificate to be installed. In the kernel, when the other applications downloaded in the mall are checked, referring to FIG. 5, the specific implementation steps of the embodiment are as follows:

Step 501: Referring to the process of FIG. 1, the terminal starts according to the level-by-level integrity verification from the hardware trust root to the kernel, and the trusted kernel starts to use the IMA to continuously monitor the integrity of the terminal Android system file, and the security management agent module passes the network management protocol server. The module makes SSL connections to the management server.

Step 502: The security management server side calculates the file monitoring credentials of the application store in advance, and the kernel digital summary after installing the digital certificate, to obtain a calculation result.

Step 503: Encrypt the calculation result with a private password, and simultaneously use the certificate of the management server. Line signature. The security management agent module delivered to the terminal through SSL encryption.

Step 504: The security management agent module of the terminal sends the application store file summary information to the kernel IMA file monitoring system, and sends the kernel digital summary after the application of the digital certificate to the boot device BOOT.

Step 505: The IMA and the BOOT decrypt the private password and obtain the root certificate of the server-side certificate from the hardware trust root, verify the information of the application store file, and also use the kernel after installing the new mall certificate.

Step 506: After the security management server confirms that the terminal has received the information, the security management agent module of the terminal downloads and implements installing a new application store and modifying the kernel injection application to verify the digital certificate.

Step 507: After the modification, the new kernel has been adopted by BOOT, and can be correctly booted, and the new application store can also operate normally, because it also incorporates the integrity protection of the new kernel IMA file monitoring system.

The method can be applied to the security management and control method when the security management policy is changed, that is, the method described in FIG. 4, and can also be applied to the security management and control method in the software version upgrade, that is, the method described in FIG. 6, and details are not described herein again. .

When the software version of the terminal device needs to be upgraded and updated, the following implementation steps are adopted:

In this embodiment, it is required to ensure that the old version of the Android terminal is safely and reliably booted, and the management server end triggers a trusted upgrade of the software version of the entire terminal, that is, the software modules except the BOOT in this embodiment are all Need to be replaced. It is worth noting that the general system upgrade does not need to modify the upgrade BOOT.

Referring to FIG. 6, the specific implementation steps of this embodiment are as follows:

Step 601: Referring to the process of FIG. 1, the terminal starts according to the level-by-level integrity verification from the hardware trust root to the kernel, and the trusted kernel starts to use the IMA to continuously monitor the integrity of the terminal Android system file, and the security management agent module passes the network management protocol server. The module makes SSL connections to the management server.

Step 602: The security management server prepares a new trusted kernel in advance, and the new Android version of the IMA file verification policy is to be merged into the new trusted kernel.

Step 603: The security management server calculates the digital summary information of the new version of the trusted kernel, encrypts the calculation result with a private password, and simultaneously signs the certificate of the management server. The security management agent module delivered to the terminal through SSL encryption.

Step 604: The security management agent module of the terminal knows that the entire system is about to be updated, and obtains an upgrade license of the terminal user through a pop-up interface.

Step 605: After the user permits, the security management agent module of the terminal injects a new trusted kernel digital digest into the BOOT, decrypts the private password and obtains the certificate from the hardware trust root, and verifies the new kernel.

Step 606: The user downloads the new kernel version, the Android version, and the new security management agent module to the peripherals such as the U disk and the TF card through the website downloading manner, and performs system upgrade through the website-driven brush operation.

Step 607: After the machine is flashed, the new trusted kernel is picked up by the BOOT and started normally. At the same time, the new Android version and the security management agent module of the terminal are also loaded. The new trusted kernel normally performs IMA tamper-proof monitoring on the new Android file system and the terminal security management agent module.

The embodiment of the invention discloses a security management and control method for an Android system, including:

Receiving an adjustment instruction of a security management policy or a terminal software version upgrade instruction;

And dynamically transmitting the security management policy file or the terminal software version upgrade file corresponding to the instruction to the target terminal device according to the adjustment instruction of the security management policy or the terminal software version upgrade instruction.

Optionally, the security management policy refers to a trusted operation behavior applied to the Android system and the KERNEL kernel that are included in the terminal device.

Optionally, the security management policy includes: installing a trusted application, forcibly uninstalling an illegal application, modifying the SELinux permission rule of the KERNEL kernel, and modifying the security rule of the iptables network firewall rule, monitoring the illegal cracking behavior of the terminal device, and alerting Scan the peripherals of the terminal device for viruses, trigger the terminal device to upgrade the trusted software version.

The embodiment of the invention also discloses a computer program, comprising program instructions, when the program instruction is executed by a computer, enabling the computer to perform the security control of any of the above Android systems. method. The embodiment of the invention also discloses a carrier carrying the computer program.

The embodiment of the invention also discloses a security management device for an Android system, comprising an instruction receiving unit and a processing unit, wherein:

The instruction receiving unit is configured to: receive an adjustment instruction of a security management policy or a terminal software version upgrade instruction;

The processing unit is configured to dynamically send the security management policy file or the terminal software version upgrade file corresponding to the instruction to the target terminal device according to the adjustment instruction of the security management policy or the terminal software version upgrade instruction.

The embodiment of the invention also discloses a server, which comprises the security management device of any Android system described above.

The embodiment of the invention also discloses a security management and control method for the Android system, including:

Dynamically receive the security management policy file or the terminal software version upgrade file, and perform the security management policy or terminal software version upgrade corresponding to the file;

The current security management status information is reported in real time.

Optionally, the security management policy refers to that the terminal device includes at least a trusted operation behavior applied to the Android system and the KERNEL kernel.

Optionally, before performing the foregoing step of dynamically receiving the security management policy file or the terminal software version upgrade file, the method further includes:

Perform the following boot verification steps:

After the terminal device is powered on, the hardware trust root performs digital digest verification on the trusted boot device BOOT, the trusted boot device BOOT verifies the KERNEL kernel, and the KERNEL kernel performs regular or on-demand security management agent and Android regular framework. File integrity check.

Optionally, the method further includes:

When it is determined during the boot verification process that an exception occurs, the hardware trust root controls the conventional hardware to perform a power down operation or to prevent the device from continuing to boot the boot operation.

The embodiment of the invention further discloses a computer program, comprising program instructions, which when executed by the computer, enable the computer to execute the security management method of any of the above Android systems. The embodiment of the invention also discloses a carrier carrying the computer program.

The embodiment of the invention further discloses a security management device for an Android system, comprising a file receiving unit and a reporting unit, wherein

The file receiving unit is configured to: dynamically receive a security management policy file or a terminal software version upgrade file, and perform a security management policy or a terminal software version upgrade corresponding to the file;

The reporting unit is configured to: report current security management status information in real time.

Optionally, the device further includes a verification unit, wherein

The verification unit is configured to: after the terminal device is powered on, the hardware trust root performs digital digest verification on the trusted boot device BOOT, the trusted boot device BOOT verifies the KERNEL kernel, and the KERNEL kernel re-administers the security control proxy portion. And the Android regular framework for timing or on-demand file integrity verification.

Optionally, the device further includes a security execution unit, wherein

The security execution unit is configured to notify the hardware trust root to control the conventional hardware to perform the power-off operation when it is determined that an abnormality occurs during the boot verification process.

The embodiment of the invention further discloses a terminal device, which comprises the security management device of any Android system described above.

The embodiment of the invention also discloses a security management system for an Android system, comprising a server and a terminal device, wherein:

The server is configured to: receive a security management policy adjustment instruction or a terminal software version upgrade instruction, and dynamically send a security management policy file or a terminal software version upgrade corresponding to the instruction according to the security management policy adjustment instruction or the terminal software version upgrade instruction. File to target terminal device;

The terminal device is configured to: dynamically receive the security management policy file or the terminal software version upgrade file, and perform the security management policy or the terminal software version upgrade corresponding to the file, and report the current security management state information in real time.

The above is only an alternative embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the invention and the drawings are directly or indirectly applied to other related The technical fields are all included in the scope of patent protection of the present invention.

Industrial applicability

The security management and control method of the technical solution of the present invention forms a complete and firm trust chain from the hardware trust root to the digital certificate center of the security management server, and through the trusted interaction process between the modules, compared with related technologies, It not only achieves the unbreakable effect of the Android terminal on the software, but also achieves the flexibility of flexibly adjusting the terminal security policy and the trusted upgrade terminal software version, ensuring the security management and control while improving the user experience and reducing the cost of subsequent upgrade maintenance. Therefore, the present invention has strong industrial applicability.

Claims

A security management method for an Android system for security management of a server, including:

Receiving security management policy adjustment instructions;

And dynamically sending the corresponding security management policy file to the target Android terminal according to the security management policy adjustment instruction.
The security management and control method of the Android system according to claim 1, wherein the security management policy refers to a trusted operation behavior applied to the Android system and the KERNEL kernel included in the Android terminal.
The security management method of the Android system according to claim 2, wherein the security management policy comprises one or more of the following: installing a trusted application, forcibly uninstalling an illegal application, and SELinux permission rules for the KERNEL kernel. And the iptables network firewall rules to improve the security purpose of the beneficial modification, monitor the Android terminal illegal cracking behavior and alarm, scan the Android terminal peripherals for viruses, trigger Android terminals to upgrade the trusted software version.
The security management method of the Android system of claim 1, wherein the method further comprises: before the step of dynamically transmitting the corresponding security management policy file to the target Android terminal according to the security management policy adjustment instruction, the method further comprises:

Determining whether the security management policy file is modified to a trusted kernel of the target Android terminal or a protected file of the Android system;

The step of dynamically transmitting the corresponding security management policy file to the target Android terminal according to the security management policy adjustment instruction includes:

If the security management policy file does not modify the trusted kernel of the target Android terminal, and does not need to modify the key file protected by the trusted kernel in the Android system, the security management policy file is directly delivered to the security management policy file. The security management agent module of the target Android terminal.
The security management method of the Android system according to claim 4, further comprising calculating if the security management policy file is modified to a trusted kernel of the target Android terminal and/or a protected portion of the Android system Implement the kernel digital summary and Android system file monitoring credentials after implementing the security management policy, and encrypt the new kernel digital digest and Android system file monitoring credentials with a private password, and digitally sign the private key of the server certificate, and then encrypt it. After signing, the kernel digital summary and Android system file monitoring credentials are sent to the target. The security management agent module of the Android terminal.
A security management method for an Android system for security management of a server, including:

Receiving terminal software version upgrade instructions;

And dynamically sending the corresponding terminal software version upgrade file to the target Android terminal according to the terminal software version upgrade instruction.
The security management method of the Android system according to claim 6, wherein the terminal software version upgrade file comprises: a new trusted kernel, a new Android version of the IMA file verification policy, and a new trusted kernel.
The security management method of the Android system according to claim 6, further comprising:

Calculate the digital summary information of the new version of the trusted kernel, encrypt the digital summary information with a private password, sign the certificate with the security management server, and send the security management agent module to the Android terminal through SSL encryption. .
A security management method for an Android system for an Android terminal, including:

Dynamically receive security management policy files and implement corresponding security management policies accordingly;

The current security management status information is reported in real time.
The security management method of the Android system according to claim 9, wherein the security management policy refers to a trusted operation behavior applied to an Android system and a KERNEL kernel that are at least included in the Android terminal.
The security management and control method of the Android system according to claim 10, wherein the security management policy comprises one or more of the following: installing a trusted application, forcibly uninstalling an illegal application, and SELinux permission rules for the KERNEL kernel. And the iptables network firewall rules to improve the security purpose of the beneficial modification, monitor the Android terminal illegal cracking behavior and alarm, scan the Android terminal peripherals for viruses, trigger Android terminals to upgrade the trusted software version.
The security management method for the Android system of claim 9, the method further comprising:

The file is executed after receiving the security management policy file delivered by the security management server.
The security management method for the Android system of claim 9, the method further comprising:

After receiving the encrypted digital signature and the Android system file monitoring credential issued by the security management server, the new kernel digital digest is injected into the trusted BOOT of the Android terminal, and the new Android system file monitoring credentials are injected. Go to the trusted kernel of the Android terminal;

The trusted BOOT and trusted kernel of the Android terminal decrypt and trust the new digital digest and file monitoring credentials by a private password.
The security management method of the Android system according to claim 9, wherein before performing the above steps, the method further includes a boot verification step:

After the Android terminal is powered on, the hardware trust root performs digital digest verification on the trusted BOOT of the Android terminal, and the trusted BOOT of the Android terminal verifies the trusted kernel, and the trusted kernel of the Android terminal Timed or on-demand file integrity verification of the security management agent part and the Android regular framework.
The security management method of the Android system according to claim 9, wherein the hardware trust root controls the conventional hardware to perform a power-off operation or prevents the Android terminal from continuing on the software when an abnormality occurs in the Android terminal boot verification process The boot-start operation.
A security management method for an Android system for an Android terminal, including:

Dynamically receiving the terminal software version upgrade file, and performing the corresponding version upgrade accordingly;

The current security management status information is reported in real time.
The security management method of the Android system according to claim 16, further comprising:

After receiving the software version upgrade file, the security management agent module of the Android terminal acquires an upgrade license of the Android terminal;

After the Android terminal is licensed, the security management agent module of the Android terminal injects a new trusted kernel digital digest into the trusted BOOT of the Android terminal, decrypts by a private password, and from the hardware trust root of the Android terminal. Obtain a certificate and verify the new kernel;

The Android terminal downloads a new kernel version, an Android version, and a new security management agent module to the peripheral device of the Android terminal through a website downloading manner, and performs a system on the Android terminal through a website-directed brush operation. upgrade;

After the Android terminal is flashed, the new trusted kernel is accepted by the trusted BOOT, which is normal. Booting, while the Android terminal also loads a new Android version and a new terminal security management agent module.
An Android terminal includes: a network management protocol terminal module, a security management agent module, a trusted boot device BOOT, and a hardware trust root, wherein

The network management protocol terminal module is configured to: collect the terminal information and perform communication interaction with the security management server;

The security management agent module is configured to: receive and execute a security management policy issued by the security management server, and feed back the security control status of the terminal to the security management server;

The hardware trust root is configured to: store the unique identity information of the terminal and the issuing root certificate of the security management server digital certificate.
The Android terminal according to claim 18, wherein, in the case where the trusted director BOOT is confirmed to be secure, the hardware trust root is the trusted BOOT.
The Android terminal of claim 18, further comprising a trusted booter BOOT and a trusted kernel, wherein

The hardware trust root is further configured to: store digital summary information of the trusted BOOT;

The trusted BOOT is configured to: store digital summary information of the trusted kernel;

The trusted kernel is configured to verify the integrity of the Android system file and the integrity of the security management agent module.