WO2015188447A1

WO2015188447A1 - Communication terminal and security management method and device thereof, and computer readable storage medium

Info

Publication number: WO2015188447A1
Application number: PCT/CN2014/084822
Authority: WO
Inventors: 杨飞
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-06-09
Filing date: 2014-08-20
Publication date: 2015-12-17
Also published as: CN105227521A

Abstract

Disclosed are a communication terminal and a security management method and device thereof, and a computer readable storage medium. The method comprises: after it is detected that a communication terminal prepares to establish a USB connection with an external terminal, judging whether security access authentication is currently set for the communication terminal; if yes, conducting security access authentication on the communication terminal, and only if the authentication has passed, permitting the communication terminal to establish the USB connection with the external terminal; otherwise, not permitting to establish the USB connection.

Description

Communication terminal and security management method thereof, device and computer readable storage medium

The present invention relates to the field of communications, and in particular, to a communication terminal, a security management method thereof, a device, and a computer readable storage medium. Background technique

A smart phone or terminal is a portable mobile communication device with a touch screen as a basic input and output device. Its mainstream operating systems are Android, Mac-OS and WP7/WP8. Among them, the Android system has the largest number of manufacturers and the largest market share because of the open platform. The following is an example of the Android system.

At present, the software version of the Android system smartphone or terminal is mainly ICS4.0 and above, and it provides a graphic and personal identification number (PIN) in the lock screen mode of the security setting, and the lock screen security mode of the password, the user Personal information on your phone or terminal can be protected by setting a lock screen security method. With the increasing popularity of mobile payments, more and more important and sensitive information is stored in smartphones or terminals, such as personal payment accounts, mailboxes, passwords, files, photos, etc., and users' awareness of security is gradually increasing. The more users start to enable the graphics and PIN code and password security methods provided by the smartphone system to protect personal information. For convenience, most smartphone users will keep "USB Debugging" in the On mode so that they can manage their phones at any time with a third-party smartphone management software on their computer via a USB cable. The default security method of the current smart phone or terminal system is that as long as "USB debugging" is turned on on the mobile phone, the user can directly obtain the information on the mobile phone through the data line regardless of whether the user uses the lock screen security mode. The default security method of this smart phone system is inconsistent with the original intention of the user to enable the lock screen security mode. It is equivalent to connecting the USB data cable and the computer, bypassing the user's security line for reading the personal information inside the mobile phone, the user's hand. Once the machine or terminal is lost or out of control, the user's personal information data will be stolen through this route. Summary of the invention

In order to solve the existing technical problems, embodiments of the present invention provide a communication terminal, a security management method, apparatus, and computer readable storage medium.

The embodiment of the invention provides a communication terminal security management method, including:

After detecting that the communication terminal and the external terminal are ready to establish a USB connection, determining whether the communication terminal currently sets the security access authentication;

If so, secure access authentication is performed on the communication terminal, such as authentication, allowing the communication terminal to establish a USB connection with the external terminal.

In an embodiment of the present invention, performing security access authentication on the communication terminal includes: displaying a security authentication interface on the communication terminal prompting a user to input a security authentication key; and inputting a security authentication key and a user input The security authentication keys stored in advance in the communication terminal are compared, and if the two are matched, the authentication is successful.

In an embodiment of the invention, the secure access authentication includes at least one of PIN authentication, graphic authentication, and password authentication.

In an embodiment of the invention, the communication terminal is an Android system communication terminal.

In an embodiment of the present invention, when the authentication fails, the communication terminal is prohibited from establishing a USB connection with the external terminal.

The embodiment of the invention further provides a communication terminal security management device, comprising: a USB connection detection module, a security management module, a security authentication module, and a USB connection execution module;

The USB connection detecting module is configured to: after detecting that the communication terminal and the external terminal are ready to establish a USB connection, send a USB connection preparation notification to the security management module;

The security management module is configured to: after receiving the USB connection preparation notification, determine whether the communication terminal currently sets a security access authentication, and if yes, send a security authentication notification to the security authentication module; After receiving the security authentication notification, the security authentication module performs security access authentication on the communication terminal, and sends an authentication success notification to the USB connection execution module when the authentication is passed;

The USB connection execution module, after receiving the authentication success notification, allows the communication terminal to establish a USB connection with the external terminal.

In an embodiment of the present invention, the security authentication module includes a key receiving submodule and a matching submodule;

The key receiving submodule is configured to receive a security authentication key input by a user through a security authentication interface;

The matching submodule is configured to compare the security authentication key with a security authentication key pre-stored in the communication terminal, and if the two are matched, the authentication succeeds.

An embodiment of the present invention further provides a communication terminal, including a processor, a memory, a USB interface, and a display;

The memory is configured to store at least one program module;

The processor is configured to perform the following process according to at least one program module in the memory:

After detecting, by the USB interface, that the communication terminal and the external terminal are ready to establish a USB connection, determining whether the communication terminal is currently set with secure access authentication; if yes, performing secure access authentication, such as authentication, allowing the communication terminal to be The external terminal establishes a USB connection;

The display is configured to display respective status interfaces of the communication terminal.

In an embodiment of the invention, the communication terminal is a communication terminal of an Android system. In an embodiment of the present invention, the processor prohibits the communication terminal from establishing a USB connection with the external terminal according to the failure of the program module authentication.

The embodiment of the invention further provides a computer readable storage medium, the storage medium comprising a set of computer executable instructions, the instructions being used to execute the communication terminal security tube of the above embodiment Method.

The communication terminal and the security management method and device thereof and the computer readable storage medium provided by the embodiment of the present invention detect that the communication terminal and the external terminal are ready to establish a USB connection, and determine whether the communication terminal currently sets the security access authentication; , the security access authentication is performed on the communication terminal, and only the authentication is passed, the communication terminal is allowed to establish a USB connection with the external terminal; otherwise, the USB connection is not allowed to be established. It can be seen that, according to the solution provided by the present invention, before the communication terminal establishes an effective USB connection with the external terminal, if the communication terminal itself has a secure access authentication (for example, a power-on key or a lock screen key is set), the communication must be performed. The security access authentication is completed on the terminal. After the authentication is successful, an effective USB connection can be established. At this time, the user can access the content stored in the communication terminal through the USB terminal through the external terminal. Otherwise, the USB connection is prohibited; When the communication terminal with the secure access authentication is lost or not within the scope of the user control, other users may steal the data in the communication terminal through the USB connection, which may improve the security of the communication terminal; thereby improving the satisfaction of the user experience. DRAWINGS

1 is a schematic flowchart of a communication terminal security management method according to an embodiment of the present invention; FIG. 2 is a schematic structural diagram 1 of a communication terminal security management apparatus according to an embodiment of the present invention; FIG. 3 is a schematic diagram of a communication terminal security management apparatus according to an embodiment of the present invention; FIG. 4 is a schematic structural diagram of a communication terminal according to an embodiment of the present invention;

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings.

Embodiment 1:

The communication terminal security management method provided in this embodiment is mainly for performing security management when a communication terminal establishes a USB connection with an external terminal; for example, when a mobile phone and a computer are connected by USB, Mobile phone for security management. Referring to FIG. 1, the communication terminal security management method in this embodiment includes:

Step 101: It is detected that the communication terminal and the external terminal are ready to establish a USB connection.

The preparation of the USB connection here means that the communication terminal has detected that the physical connection has been established with the external terminal through the USB interface, but the USB connection process of the communication terminal has not been called to establish an effective USB communication link connection; the external part in this embodiment The terminal mainly refers to various PC terminals such as desktop computers and notebooks; of course, it is not excluded that it can be various tablet computers or even various mobile phone smart terminals.

Step 102: It is judged whether the communication terminal currently sets the security access authentication. If yes, go to step 103; otherwise, go to step 105.

The security access authentication here refers to the security authentication settings that need to be performed when accessing the communication terminal, for example, it can be a power-on password (for example, by setting a PIN (PIN: Personal Identification Number), a password, etc.) or a lock screen password (specifically Implemented by pattern, password or PIN).

Step 103: Perform secure access authentication on the communication terminal.

Step 104: Determine whether the security authentication is passed, and if yes, go to step 105; otherwise, go to step 106.

Step 105: Allow the communication terminal to establish a USB connection with the external terminal.

Step 106: Prevent the communication terminal from establishing a USB connection with the external terminal.

In the foregoing step 103, the security access authentication process on the communication terminal includes: displaying a security authentication interface on the communication terminal, prompting the user to input a security authentication key; and inputting the security authentication key input by the user and the security authentication pre-stored in the communication terminal The key (that is, the security authentication key set by the user before) is compared. If the two are matched, the authentication succeeds. According to the above analysis, the secure access authentication in this embodiment may include at least one of PIN authentication, graphics authentication, and password authentication. For example, if the user sets the lock screen graphically on the communication terminal, the security of the lock screen is displayed on the communication terminal during security authentication. In this case, the interface is a graphical input interface, and the user can input the corresponding graphic to complete the authentication on the interface. If the user sets the lock screen by means of a digital password on the communication terminal, the corresponding lock screen authentication interface is displayed on the communication terminal, and the interface is a digital input interface at this time, and the user can input the corresponding number on the interface. The password completes the authentication.

It should be understood that the above several ways of secure access authentication are merely illustrative. The solution provided by the embodiment of the present invention is not limited to the foregoing several types of security authentication.

In this embodiment, for a communication terminal (such as an AUX system communication terminal) having a "USB debugging" function in the system, if "USB debugging" is not turned on, the system prohibits the communication terminal from establishing a USB connection with an external terminal by default. Therefore, in this embodiment, after detecting that the communication terminal and the external terminal are ready to establish a USB connection, before determining whether the communication terminal currently sets the security access authentication, the method further includes:

It is judged whether the "USB debugging" of the communication terminal is turned on; if it is not turned on, the establishment of the USB connection is directly prohibited; if there is an open, the subsequent judgment process is performed.

It can be seen that, in the solution provided by the embodiment, before the communication terminal establishes an effective USB connection with the external terminal, if the communication terminal itself has a secure access authentication (for example, a power-on key or a lock screen key, etc.), The secure access authentication is completed on the communication terminal. After the authentication is successful, an effective USB connection can be established. At this time, the user can access the content stored in the communication terminal through the USB terminal through the external terminal. Otherwise, the USB connection is prohibited; When the communication terminal with the secure access authentication is lost or not within the control range of the user, other users may steal the data in the communication terminal through the USB connection, thereby improving the security of the communication terminal; thereby improving the satisfaction of the user experience.

Embodiment 2:

Referring to FIG. 2, the embodiment provides a communication terminal security management apparatus, including: a USB connection detection module 11, a security management module 12, a security authentication module 13, and a USB connection execution module 14, wherein:

The USB connection detecting module 11 is configured to detect that the communication terminal and the external terminal are ready to be established. After the USB connection, the USB connection preparation notification is sent to the security management module 12 to notify the security management module 12 to perform subsequent management and control;

The security management module 12 is configured to: after receiving the USB connection preparation notification, determine whether the communication terminal currently sets the security access authentication, and if yes, send the security authentication notification to the security authentication module 13; the security authentication module 13 receives the security authentication notification. After that, the security access authentication is performed on the communication terminal, and the authentication success notification is sent to the USB connection execution module 14;

The USB connection execution module 14 allows the communication terminal to establish a USB connection with the external terminal after receiving the authentication success notification; and completes the USB connection between the communication terminal and the external terminal.

The security authentication module 13 in this embodiment specifically includes a key receiving submodule and a matching submodule, where:

The key receiving submodule is configured to receive a security authentication key input by the user through a security authentication interface of the communication terminal;

The matching submodule is configured to compare the security authentication key input by the user with a security authentication key pre-stored in the communication terminal (that is, a security authentication key set by the user before), if the graphic authentication and the password authentication are performed. At least one. For example, if the user sets the lock screen graphically on the communication terminal, when the security authentication is performed, the screen lock authentication interface is displayed on the communication terminal, and the interface is a graphic input interface, and the user can input on the interface. The corresponding graphic completes the authentication. If the user sets the lock screen by means of a digital password on the communication terminal, the corresponding lock screen authentication interface is displayed on the communication terminal, and the interface is a digital input interface at this time, and the user can input the corresponding number on the interface. The password completes the authentication.

The communication terminal in this embodiment may specifically be an Android system communication terminal; as shown in FIG. 3, the communication terminal security management apparatus may further include a USB status monitoring module 15 for detecting the communication terminal and the external at the USB connection detection module 11 After the terminal is ready to establish a USB connection, the security management module 12 determines whether the "USB debugging" of the communication terminal is turned on before determining whether the communication terminal currently sets the security access authentication; if not, the system directly prohibits the USB connection by default. Established; if there is an open, the security management module 12 performs the subsequent determination process.

It is to be noted that when the communication terminal security management device in this embodiment is implemented by software, each module of the device can be implemented completely on the side of the communication terminal, for example, the USB connection detection module 11 and the security management module described above. 12. The security authentication module 13, the USB connection execution module 14, and the USB status monitoring module 15 may be configured by a central processing unit (CPU) of a communication terminal, a processor (MPU, Micro Processing Unit), and a digital signal processor (DSP). , Digital Signal Processor or FPGA (Field-Programmable Gate Array) implementation; or part of the implementation of the communication terminal (for example, part of the secure access authentication is implemented on the side of the communication terminal, the security management module 12, The security authentication module 13 is implemented by the CPU, MPU, DSP or FPGA of the communication terminal, and other parts are implemented on the external terminal side (for example, the USB connection detection module 11, the USB connection execution module 14, and the USB status monitoring module 15 are external terminals). CPU, MPU, DSP or FPGA implementation).

Embodiment 3:

Referring to FIG. 4, the communication terminal (which may be various smart phones, IPAD or payment terminal, etc.) provided by the embodiment of the present invention includes a processor 23, a memory 22, a USB interface 21, and a display 24;

The memory 22 is configured to store at least one program module; the program module may include a program module for implementing security management in the foregoing embodiments;

The processor 23 is configured to perform the following process according to at least one program module in the memory: after detecting that the communication terminal and the external terminal are ready to establish a USB connection by using the USB interface 21 of the communication terminal, determining whether the communication terminal currently sets the security access authentication; If yes, perform security access authentication, such as authentication, to allow the communication terminal to establish a USB connection with the external terminal; otherwise, the communication terminal is prohibited from establishing a USB connection by the external terminal;

The display 24 is configured to display various status interfaces of the communication terminal; for example, display various security authentication interfaces. The processor includes the following processes when it completes the security certification:

Displaying a security authentication interface on the communication terminal prompting the user to input a security authentication key; The security authentication key input by the user is compared with the security authentication key (that is, the security authentication key set by the user beforehand) stored in the communication terminal. If the two are matched, the authentication succeeds. According to the above analysis, the secure access authentication in this embodiment may include at least one of PIN authentication, graphics authentication, and password authentication. For example, if the user sets the lock screen graphically on the communication terminal, when the security authentication is performed, the screen lock authentication interface is displayed on the communication terminal, and the interface is a graphic input interface, and the user can input on the interface. The corresponding graphic completes the authentication. If the user sets the lock screen by means of a digital password on the communication terminal, the corresponding lock screen authentication interface is displayed on the communication terminal, and the interface is a digital input interface at this time, and the user can input the corresponding number on the interface. The password completes the authentication.

It should be understood that the above several ways of secure access authentication are merely illustrative. In the embodiment of the present invention, for a communication terminal (such as an Android system communication terminal) having a "USB debugging" function in the system, if "USB debugging" is not started, the system prohibits the communication terminal from establishing a USB connection with the external terminal by default. . Therefore, in this embodiment, after the processor detects that the communication terminal and the external terminal are ready to establish a USB connection, and determines whether the communication terminal currently sets the security access authentication, the processor further includes: determining the communication terminal. USB debugging "is turned on; if it is not turned on, the establishment of the USB connection is directly prohibited; if it is turned on, the subsequent judgment process is performed.

Embodiment 4:

In order to better understand the present invention, the mobile terminal is an Android mobile phone, and the external terminal is a computer as an example for further exemplary description. See Figure 5, including:

Step 501: The phone is powered on for initialization.

During the initialization process, the USB daemon of the phone reads the "USB Debug" configuration item to determine whether to invoke the USB connection process; the Local Security Monitor daemon initiates and reads the system security encryption configuration item).

Step 502: Set the status of the "USB Debugging" of the mobile phone to ON, and set a security Encryption methods, such as graphics, PIN, password, etc.

Step 503: It is detected that the mobile phone and the computer are ready for USB connection; at this time, the USB connection process of the mobile phone is not yet called.

Step 504: It is judged whether the "USB debugging" of the mobile phone is turned on, and if so, the process goes to step 505, otherwise, the process goes to step 510.

Step 505: Determine whether the mobile phone is set to secure access authentication; if yes, go to step 506; otherwise, go to step 508.

In this step, the USB listening process of the mobile phone is called, the mobile phone system service management software module (Service Manager) is started, and the USB connection process of the mobile phone is not yet called.

Step 506: Determine that the mobile phone has set the security access authentication, and then complete the authentication by receiving the security authentication key input by the user through the corresponding authentication interface.

This step can call the loc_security_manage() function of the mobile phone; the loc_security_manage() function calls Service Manager, and establishes communication with the System Security Manager and Terminal UI through the Socket Service; the Socket Service is responsible for calling the daemon such as real-time monitoring. Terminal communication is responsible for the display of each interface on the mobile phone. System Security Manager is responsible for the original security status monitoring of the mobile phone system and the verification management of graphics, PIN, password, etc. Step 507: Determine whether the authentication is successful, if yes, go to Step 508; otherwise, go to the step

510.

Step 508: Allow the mobile phone to establish a USB connection with the computer.

In this step, the loc_USB-connect() function of the mobile phone controls the Service Manager, allowing it to call the USB connection process, completing the USB interface enumeration and establishing a communication connection with the computer; after the USB interface enumeration is completed, loc_security_ manage The () function calls the Terminal UI and outputs the message "USB successfully connected to the computer" on the screen of the mobile phone, prompting the user to complete the connection.

Step 509: It is detected that the USB connection is dialed out and the USB connection is disconnected.

When the USB cable is unplugged, the USB listener sends this state parameter to the loc_security_manage() function; the loc_security_manage() function calls Service Manager. Inform the USB connection process to disconnect the USB interface.

Step 510: Prevent the mobile phone from establishing a USB connection with the computer terminal. At this time, the loc_USB_connectO function of the mobile phone notifies the Service Manager that it is not allowed to call the USB connection process, and USB communication is prohibited.

The embodiment of the present invention further provides a computer readable storage medium, the storage medium comprising a set of computer executable instructions for performing a communication terminal security management method according to an embodiment of the present invention.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of a hardware embodiment, a software embodiment, or an embodiment of a combination of software and hardware. Moreover, the invention can be embodied in the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart and/or block diagrams, and combinations of flow and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device processor to produce a machine such that a flow or a block diagram of a flow or a block diagram or A device that has multiple functions specified in the box.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce a computer implemented The processing, such as instructions executed on a computer or other programmable device, provides the steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

The above is a further detailed description of the present invention in connection with the specific embodiments, and the specific embodiments of the present invention are not limited to the description. It is to be understood by those skilled in the art that the present invention may be practiced without departing from the spirit and scope of the invention.

Claims

Claim

1. A communication terminal security management method, comprising:

After detecting that the communication terminal and the external terminal are ready to establish a USB connection, it is determined whether the communication terminal currently sets the security access authentication;

2. The communication terminal security management method according to claim 1, wherein performing security access authentication on the communication terminal comprises:

Displaying a security authentication interface on the communication terminal to prompt the user to input a security authentication key; comparing the security authentication key input by the user with a security authentication key pre-stored in the communication terminal, if the two match , the authentication is successful.

3. The communication terminal security management method according to claim 1, wherein the security access authentication comprises at least one of PIN authentication, graphics authentication, and password authentication.

The communication terminal security management method according to any one of claims 1 to 3, wherein the communication terminal is an Android system communication terminal.

The communication terminal security management method according to any one of claims 1 to 3, wherein, if the authentication fails, the communication terminal is prohibited from establishing a USB connection with the external terminal.

6. A communication terminal security management device, comprising: a USB connection detection module, a security management module, a security authentication module, and a USB connection execution module;

The USB connection detecting module is configured to: after detecting that the communication terminal and the external terminal are ready to establish a USB connection, send a USB connection preparation notification to the security management module; the security management module is configured to receive the USB connection After the notification is prepared, it is determined whether the communication terminal currently sets the security access authentication, and if yes, sends a security authentication notification to the security authentication module;

Receiving, by the security authentication module, after the security authentication notification, on the communication terminal Performing secure access authentication, and sending an authentication success notification to the USB connection execution module when the authentication is passed;

The communication terminal security management device according to claim 6, wherein the security authentication module comprises a key receiving submodule and a matching submodule;

The matching sub-module is configured to compare the security authentication key with a pre-stored security authentication key in the communication terminal, and if the two are matched, the authentication succeeds.

The communication terminal security management device according to claim 6 or 7, wherein the communication terminal is an Android system communication terminal.

A communication terminal, comprising: a processor, a memory, a USB interface, and a display; the memory configured to store at least one program module;

The processor is configured to perform the following processes according to at least one program module in the memory:

After detecting, by the USB interface, that the communication terminal and the external terminal are ready to establish a USB connection, determining whether the communication terminal is currently set with secure access authentication; if yes, performing secure access authentication, such as authentication, allowing the communication terminal to be The external terminal establishes a USB connection; the display is configured to display each state interface of the communication terminal.

The communication terminal according to claim 9, wherein the communication terminal is a communication terminal of an Android system.

The communication terminal according to claim 9 or 10, wherein the processor prohibits the communication terminal from establishing a USB connection with the external terminal when the authentication of the program module fails.

12. A computer readable storage medium, the storage medium comprising a set of computer executable A line instruction for performing the communication terminal security management method according to any one of claims 1-5.