WO2016019793A1

WO2016019793A1 - Information monitoring method and apparatus and mobile terminal

Info

Publication number: WO2016019793A1
Application number: PCT/CN2015/084307
Authority: WO
Inventors: 唐虹刚
Original assignee: 阿里巴巴集团控股有限公司; 唐虹刚
Priority date: 2014-08-07
Filing date: 2015-07-17
Publication date: 2016-02-11
Also published as: HK1221846A1; CN105451223B; CN105451223A

Abstract

Disclosed are an information monitoring method and apparatus and a mobile terminal. The information monitoring method comprises: receiving a notification about an information change; reading information separately from an information database and a backup database, and comparing the information from the information database with the information from the backup database to identify deleted or modified information; and if it is determined that the deleted or modified information comes from a trusted source, sending prompt information indicating that information is deleted or modified and/or restoring the deleted or modified information. According to the information monitoring method and apparatus and the mobile terminal in embodiments of the present invention, information in the information database is compared with information in the backup database to identify deleted or modified information, and the information is restored when it is determined that the information comes from a trusted source, so the problem that information is maliciously deleted or modified is solved, the security of information in the mobile terminal is improved, and property loss is prevented.

Description

Information monitoring method, device and mobile terminal

Technical field

The present invention relates to the field of information security technologies, and in particular, to a method, an apparatus, and a mobile terminal for monitoring information.

Background technique

With the rapid development of technology, the functions of smart phones are becoming more and more powerful, and more and more users choose to manage their own text messages through some application software in smart phones. When the user receives a short message, the application software can scan and securely verify the short message to intercept the short message.

However, if the phone is poisoned, or the application software is set up, some key SMS messages are maliciously intercepted, which may cause loss or modification of key SMS messages. The security is low, and the user cannot know the content of the key SMS, which brings a lot of users. Inconvenience, even property damage, leads to poor user experience.

Summary of the invention

The present invention aims to solve at least one of the technical problems in the related art to some extent. To this end, it is an object of the present invention to provide a method of monitoring information. The method can solve the problem that the information is maliciously deleted and modified, and improve the security of the information in the mobile terminal.

A second object of the present invention is to provide an information monitoring apparatus.

A third object of the present invention is to provide a mobile terminal.

In order to achieve the above object, a method for monitoring information according to an embodiment of the present invention includes: receiving a notification of a change in information; reading information from the information database and the backup database, respectively, and extracting information from the information database with the source The information in the backup database is compared to identify the deleted or modified information; and if it is determined that the deleted or modified information is from a trusted source, the prompt information or/and the information is deleted or modified. Restore deleted or modified information.

The method for monitoring information in the embodiment of the present invention identifies the deleted or modified information by comparing the information in the information database with the information in the backup database, and prompts the user or directly when the information is determined to be from the trusted source. Restoring the information solves the problem that the information is maliciously deleted and modified, improves the security of the information in the mobile terminal, and avoids property loss.

In order to achieve the above object, the information monitoring apparatus of the second aspect of the present invention includes: a processing module, configured to send a notification of the information change to the monitoring module; and the monitoring module is configured to separately receive the notification after receiving the notification Reading information from the information database and the backup database, and comparing the information from the information database with information from the backup database to identify deleted or modified information; and a warning reminder module for determining Said The deleted or modified information identified by the monitoring module is from a trusted source, and the prompt information that the information is deleted or modified is issued or/and the information deleted or modified is restored.

The information monitoring apparatus of the embodiment of the present invention identifies the deleted or modified information by comparing the information in the information database with the information in the backup database, and prompts the user or directly when the information is determined to be from the trusted source. Restoring the information solves the problem that the information is maliciously deleted and modified, improves the security of the information in the mobile terminal, and avoids property loss.

The embodiment of the present invention provides a mobile terminal, which includes a casing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside a space enclosed by the casing, and the processing And the memory are disposed on the circuit board; the power circuit is configured to supply power to each circuit or device of the mobile terminal; the memory is configured to store executable program code; and the processor reads by Executing program code stored in the memory to execute a program corresponding to the executable program code for performing the steps of: receiving a notification of a change in information; reading information from the information database and the backup database, respectively, and Information from the information database is compared with information from the backup database to identify deleted or modified information; and if it is determined that the deleted or modified information is from a trusted source, the information is sent Deleted or modified prompt information or / and restore deleted or modified information.

The mobile terminal of the information in the embodiment of the present invention identifies the deleted or modified information by comparing the information in the information database with the information in the backup database, and prompts the user or directly when the information is determined to be from the trusted source. Restoring the information solves the problem that the information is maliciously deleted and modified, improves the security of the information in the mobile terminal, and avoids property loss.

DRAWINGS

1 is a flow chart of a method of monitoring information according to an embodiment of the present invention.

2 is a flow chart of a method of monitoring information according to an embodiment of the present invention.

FIG. 3 is a schematic structural diagram of an information monitoring apparatus according to an embodiment of the present invention.

FIG. 4 is a schematic structural diagram of an apparatus for monitoring information according to another embodiment of the present invention.

detailed description

The embodiments of the present invention are described in detail below, and the examples of the embodiments are illustrated in the drawings, wherein the same or similar reference numerals are used to refer to the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the drawings are intended to be illustrative of the invention and are not to be construed as limiting.

The method, device, and mobile terminal for monitoring information of an embodiment of the present invention are described below with reference to the accompanying drawings.

As shown in Figure 1, the monitoring method of information includes:

S101. Receive a notification of a change in information.

In an embodiment of the invention, the mobile terminal has an information database and a backup database. After the mobile terminal receives the information, the mobile terminal can save the received information to the information database. At the same time, the received information is also saved to the backup database. It should be noted that in order to improve security, the mobile terminal can directly obtain information from the RIL (radio interface layer). In this way, information can be obtained before the information is maliciously intercepted, and saved to the backup database. . That is to say, the information stored in the backup database is the original information, and once the information is maliciously intercepted, it can be restored through the backup database. The mobile terminal can then update the information database based on the operation of the information by the user or a third party application. If the information in the information database changes, the mobile terminal can receive a notification of the change in the information. The above information may be short message, referred to as short message.

S102: Read information from the information database and the backup database, respectively, and compare the information from the information database with the information from the backup database to identify the deleted or modified information.

In an embodiment of the present invention, after receiving the notification of the information change, the mobile terminal can read all the information from the information database and the backup database, respectively, and compare the information from the information database with the information from the backup database. , identifying the deleted or modified information. For example, when a mobile phone receives a text message, if there is no malicious virus or application software interception, the information database and the backup database in the mobile phone are consistent, but when a malicious virus malicious interception or mobile application software error intercepts or modifies the short message, The information database and the backup database will be inconsistent. Compare all the SMS messages in the mobile phone information database and the backup database, and finally get the deleted or modified SMS.

S103. If it is determined that the deleted or modified information is from a trusted source, the prompt information that the information is deleted or modified is issued or/and the information deleted or modified is restored.

In an embodiment of the present invention, the mobile terminal may have a trusted source database for storing a trusted short message sender number, such as an Alipay, a bank, or the like, or may have an untrusted source database. After identifying the deleted or modified information, if it is determined that the deleted or modified information is from a trusted source, the mobile terminal may issue a prompt message that the information is deleted or modified, and may also be deleted or modified. information. Specifically, the mobile terminal can check whether the sender number of the deleted or modified information is located in the trusted source database. If located in a trusted source database, it can be determined that the deleted or modified information is from a trusted source. The mobile terminal can also check if the sender number of the deleted or modified information is in the untrusted source database. If not, it can be determined that the deleted or modified information is from a trusted source.

Specifically, the deleted or modified short message may be read from the backup database and restored to the information database, or the corresponding short message may be read from the backup database, and restored to the information database, and the prompt information is sent, and based on the user basis The operation performed by the prompt information displays the corresponding short message.

Of course, the information database supports displaying text messages by means of a short message list. For example, after the deleted or modified information is restored, a prompt message is sent, and then the user can view the short message through the short message list to obtain the content.

The method for monitoring information in the embodiment of the present invention identifies the deleted or modified information by comparing the information in the information database with the information in the backup database, and restores the information when it is determined that the information is from a trusted source. The problem that the information is maliciously deleted and modified is solved, the security of the information in the mobile terminal is improved, and property loss is avoided.

As shown in Figure 2, the monitoring method of information includes:

S201, monitoring SMS data changes.

Specifically, the mobile phone has a short message database and a backup database. After the mobile phone receives the short message, the mobile phone can save the received information to the short message database and the backup database. At this time, when the short message in the short message database is found to change, such as malicious virus interception or modification, it indicates that the mobile phone text message has changed.

S202: Obtain a deleted or modified short message by comparing the backup database.

After receiving the notification that the short message has changed, all the short messages in the short message database can be compared with all the short messages in the backup database to obtain the deleted or modified short message.

S203. Determine whether the source is from a trusted source. If the short message is from a trusted source, go to step S204. If the message comes from an untrusted source, it ends.

After obtaining the deleted or modified short message, it can be judged according to the trusted source library whether the short message is from a trusted source. The trusted source database is used to store trusted sender number, such as Alipay, bank and other SMS senders.

S204, reminding the user and restoring the deleted or modified short message.

After determining that the deleted or modified short message is from a trusted source, the user may be reminded that the short message from the trusted source is deleted or modified, and then the deleted or modified short message is restored.

The method for monitoring information in the embodiment of the present invention obtains a deleted or modified short message by monitoring the change of the short message data. When determining that the short message is from a trusted source, the user is reminded and the short message is restored, and the short message is maliciously solved. The problem of deletion and modification improves the security of the personal information of the user in the mobile phone, effectively protects the privacy of the user and avoids property loss.

In order to implement the above embodiments, the present invention also proposes an information monitoring apparatus.

As shown in FIG. 3, the information monitoring device includes: a processing module 110, a monitoring module 120, and a warning reminding module 130.

The processing module 110 is configured to send a notification of the information change to the monitoring module 120.

In an embodiment of the invention, the mobile terminal has an information database and a backup database. The processing module 110 is configured to update the information database according to the operation of the information by the user or the third party application. When the information in the information database changes, the processing module 110 can send a notification of the information change to the monitoring module 120. The above information can be short message, Jane Called SMS.

The monitoring module 120 is configured to read information from the information database and the backup database respectively after receiving the notification, and compare the information from the information database with the information from the backup database to identify the deleted or modified information.

The warning reminding module 130 is configured to, when determining that the deleted or modified information identified by the monitoring module 120 is from a trusted source, issue prompt information that the information is deleted or modified or/and restore the deleted or modified information. In particular, the alert reminder module 130 can check if the sender number of the deleted or modified information is in the trusted source database. If located in a trusted source database, it can be determined that the deleted or modified information is from a trusted source. The alert reminder module 130 can also check if the sender number of the deleted or modified information is in the untrusted source database. If not, it can be determined that the deleted or modified information is from a trusted source.

After determining that the deleted or modified information is from a trusted source, the alert reminder module 130 may issue a prompt message in which the information was deleted or modified, and may also restore the deleted or modified information. Specifically, the deleted or modified short message may be read from the backup database and restored to the information database, or the corresponding short message may be read from the backup database, and restored to the information database, and the prompt information is sent, and based on the user basis The operation performed by the prompt information displays the corresponding short message.

In addition, the monitoring device for information of the embodiment may further include a receiving module 140.

The receiving module 140 is configured to send a backup instruction to the monitoring module 120 and an update instruction to the processing module 110 after receiving the information.

After receiving the backup instruction sent by the receiving module 140, the monitoring module 120 can receive information from the wireless interface layer RIL according to the backup instruction, and save the information to the backup database.

After receiving the update instruction sent by the receiving module 140, the processing module 110 may save the received information to the information database according to the update instruction.

In the embodiment of the present invention, FIG. 4 is a schematic structural diagram of an information monitoring apparatus according to another embodiment of the present invention. As shown in FIG. 4, it may include:

S401. The bottom layer of the phone receives the short message and then transmits it to the RIL. The bottom layer of the phone and the RIL are located in the receiving module 140.

S402: The RIL notifies the short message monitoring process that the short message is received. The short message monitoring process is located in the monitoring module 120.

S403. The short message monitoring process backs up the received short message to the backup database.

S404. The RIL notifies the short message processing framework to receive the short message. The short message processing framework is in the processing module 110.

S405. The short message processed by the short message processing framework is saved to the short message database.

S406: When a short message is maliciously intercepted or modified, the short message processing framework sends a notification of the information change to the short message monitoring process.

S407. The short message monitoring process reads all the short messages in the short message database.

S408. The short message monitoring process reads all the short messages in the backup database.

S409: The short message monitoring process compares all the short messages in the short message database with all the short messages in the backup database, and identifies the deleted or modified short messages.

S410. The short message monitoring process reads the number of the trusted sender from the trusted source database, and identifies that the deleted or modified short message is from the trusted source.

S411. The warning reminding module 130 reminds the user that the short message from the trusted source is deleted or modified, and restores the deleted or modified short message.

The information monitoring apparatus of the embodiment of the present invention identifies the deleted or modified short message by comparing the short message in the short message database with the short message in the backup database, and restores the short message when the short message is determined to be from the trusted source. The problem that the short message is maliciously deleted and modified is solved, the security of the information in the mobile terminal is improved, and property loss is avoided.

In order to achieve the above embodiment, the present invention further provides a mobile terminal including a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside a space enclosed by the housing, The processor and the memory are disposed on the circuit board; the power circuit is configured to supply power to each circuit or device of the mobile terminal; the memory is configured to store executable program code; and the processor reads the memory stored in the memory by reading The executable program code runs a program corresponding to the above executable program code for performing the following steps:

S101', receiving a notification of a change in information.

In an embodiment of the invention, the mobile terminal has an information database and a backup database. After the mobile terminal receives the information, the mobile terminal can save the received information to the information database. At the same time, the received information is also saved to the backup database. It should be noted that the mobile terminal can obtain information directly from the RIL. The mobile terminal can then update the information database based on the operation of the information by the user or a third party application. If the information in the information database changes, the mobile terminal can receive a notification of the change in the information. The above information may be short message, referred to as short message.

S102', reading information from the information database and the backup database, respectively, and comparing the information from the information database with the information from the backup database to identify the deleted or modified information.

In an embodiment of the present invention, after receiving the notification of the information change, the mobile terminal can read all the information from the information database and the backup database, respectively, and compare the information from the information database with the information from the backup database. , identifying the deleted or modified information. For example, when a mobile phone receives a text message, if there is no malicious virus or application software interception, the information database and the backup database in the mobile phone are consistent, but when a malicious virus malicious interception or mobile application software error intercepts or modifies the short message, The information database and the backup database will be inconsistent. Compare all the text messages in the mobile phone information database and the backup database, and finally get the short deleted or modified. letter.

S103', if it is determined that the deleted or modified information is from a trusted source, the prompt information that the information is deleted or modified is issued or/and the information deleted or modified is restored.

After determining that the deleted or modified information is from a trusted source, the deleted or modified short message may be read from the backup database and restored to the information database, or the corresponding short message may be read from the backup database and restored to The information database is issued with prompt information, and the corresponding short message is displayed based on the operation performed by the user according to the prompt information.

The mobile terminal in the embodiment of the present invention identifies the deleted or modified information by comparing the information in the information database with the information in the backup database, and when the information is determined to be from the trusted source, the information is restored, and the information is solved. The problem that information is maliciously deleted and modified improves the security of information in the mobile terminal and avoids property loss.

In the description of the present specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means a specific feature described in connection with the embodiment or example. A structure, material or feature is included in at least one embodiment or example of the invention. In the present specification, the schematic representation of the above terms is not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. In addition, various embodiments or examples described in the specification, as well as features of various embodiments or examples, may be combined and combined.

Moreover, the terms "first" and "second" are used for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, features defining "first" or "second" may include at least one of the features, either explicitly or implicitly. In the description of the present invention, the meaning of "a plurality" is at least two, such as two, three, etc., unless specifically defined otherwise.

Any process or method description in the flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a particular logical function or process. , And the scope of the preferred embodiments of the invention includes additional implementations, in which the functions may be performed in a substantially simultaneous manner or in the reverse order, depending on the order in which they are illustrated, which should be It will be understood by those skilled in the art to which the embodiments of the present invention pertain.

The logic and/or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer readable medium, Used in conjunction with, or in conjunction with, an instruction execution system, apparatus, or device (eg, a computer-based system, a system including a processor, or other system that can fetch instructions and execute instructions from an instruction execution system, apparatus, or device) Or use with equipment. For the purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport a program for use in an instruction execution system, apparatus, or device, or in conjunction with the instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer readable media include the following: electrical connections (electronic devices) having one or more wires, portable computer disk cartridges (magnetic devices), random access memory (RAM), Read only memory (ROM), erasable editable read only memory (EPROM or flash memory), fiber optic devices, and portable compact disk read only memory (CDROM). In addition, the computer readable medium may even be a paper or other suitable medium on which the program can be printed, as it may be optically scanned, for example by paper or other medium, followed by editing, interpretation or, if appropriate, other suitable The method is processed to obtain the program electronically and then stored in computer memory.

It should be understood that portions of the invention may be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

One of ordinary skill in the art can understand that all or part of the steps carried by the method of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium.

The above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like. Although the embodiments of the present invention have been shown and described, it is understood that the foregoing embodiments are illustrative and are not to be construed as limiting. Variations, modifications, alterations and variations of the above-described embodiments may be made by those skilled in the art within the scope of the invention.

Claims

A method for monitoring information, characterized in that it comprises:

Receive notification of changes in information;

Reading information from the information database and the backup database, respectively, and comparing the information from the information database with information from the backup database to identify deleted or modified information;

If it is determined that the deleted or modified information is from a trusted source, the prompt information that the information is deleted or modified is issued or/and the information deleted or modified is restored.
The method according to claim 1, wherein before the reading of the information from the information database and the backup database, the method further comprises:

The information is received from the wireless interface layer RIL and saved to the backup database.
The method according to claim 1, wherein before the reading of the information from the information database and the backup database, the method further comprises:

The received information is saved to the information database and the information database is updated according to the operation of the information by the user or a third party application.
The method according to any one of claims 1 to 3, wherein the determining that the deleted or modified information is from a trusted source comprises:

Checking whether the sender number of the deleted or modified information is in a trusted source database, and if so, determining that the deleted or modified information is from a trusted source; or

Checking whether the sender number of the deleted or modified information is in the untrusted source database, and if not, determining that the deleted or modified information is from a trusted source.
The method of claim 1 wherein said restoring deleted or modified information comprises:

Reading a corresponding short message from the backup database and restoring to the information database; or

Reading a corresponding short message from the backup database, and restoring to the information database, and issuing a prompt message, and displaying a corresponding short message based on an operation performed by the user according to the prompt information.
An information monitoring device, comprising:

a processing module, configured to send a notification of the information change to the monitoring module;

The monitoring module is configured to, after receiving the notification, read information from the information database and the backup database, and compare the information from the information database with the information from the backup database to identify the Deleted or modified information;

The warning reminding module is configured to: if it is determined that the deleted or modified information identified by the monitoring module is from a trusted source, the prompt information or/and the restoration information that is deleted or modified is deleted or modified. information.
The device according to claim 6, further comprising:

The receiving module is configured to send a backup instruction to the monitoring module and send an update instruction to the processing module after receiving the information.
The device according to claim 7, wherein the monitoring module is further configured to: receive the information from the wireless interface layer RIL according to the backup instruction, and save the information to the backup database;

The processing module is further configured to: save the information into the information database according to the update instruction.
The apparatus according to claim 8, wherein the processing module is further configured to: update the information database according to an operation of information by a user or a third-party application.
The device according to any one of claims 6-9, wherein the warning reminding module is specifically configured to: check whether a sender number of the deleted or modified information is located in a trusted source database. And if so, determining that the deleted or modified information is from a trusted source; or

Checking whether the sender number of the deleted or modified information is in the untrusted source database, and if not, determining that the deleted or modified information is from a trusted source.
A mobile terminal, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside a space enclosed by the housing, the processor and the a memory is disposed on the circuit board; the power circuit is configured to supply power to each circuit or device of the mobile terminal; the memory is configured to store executable program code; and the processor reads the memory by reading Stored executable program code to execute a program corresponding to the executable program code for:

Receive notification of changes in information;

Reading information from the information database and the backup database, respectively, and comparing the information from the information database with information from the backup database to identify deleted or modified information;

If it is determined that the deleted or modified information is from a trusted source, the prompt information that the information is deleted or modified is issued or/and the information deleted or modified is restored.