WO2018098881A1

WO2018098881A1 - Access processing method and device for application

Info

Publication number: WO2018098881A1
Application number: PCT/CN2016/112862
Authority: WO
Inventors: 杨斌
Original assignee: 深圳Tcl新技术有限公司
Priority date: 2016-12-01
Filing date: 2016-12-29
Publication date: 2018-06-07
Also published as: CN106778208A

Abstract

An access processing method and device for an application. The access processing method for an application comprises: detecting whether an application accessing a system kernel interface by means of a system call exists currently (S10); determining, when an application accessing a system kernel interface by means of a system call exists currently, whether the application has a permission to access the system kernel interface (S20); and intercepting, when the application has no permission to access the system kernel interface, the system call so as to prevent the application from accessing the system kernel interface (S30). The method and device can prevent an illegal application from accessing a system kernel interface, and improve the operation security of the system.

Description

Application access processing method and device

Technical field

The present invention relates to the field of application access security, and in particular, to an access processing method and apparatus for an application.

Background technique

With the popularity and application of smart terminals, more and more users are using smart terminals. On the smart terminal, users can download various types of applications with different functions, such as instant messaging applications, audio and video applications, office applications, and the like. Although the use of these applications brings a lot of convenience to our lives, it does not guarantee the absolute security of application access. For example, some applications will secretly call the kernel network interface to access the server in the background, which will not only cause loss of user network traffic, but also automatically send private data in the system to the remote server without the user's permission, thereby invading the user. privacy.

In the prior art, the application is usually scanned for security when the application is installed, and the scanned application has hidden malicious interface calls, but this method can only perform a security scan when the application is installed, if the application After the program installation scan is completed, and further update the code by remote access in the background, there is still a security risk.

Summary of the invention

The main object of the present invention is to provide an access processing method and apparatus for an application, which aims to solve the technical problem that the application still has security risks after the security scan of the application.

To achieve the above objective, the present invention provides an access processing method for an application, and the access processing method of the application includes:

Detect whether there is an application currently accessing the system kernel interface through a system call;

Obtaining the identity information of the application and the permission mapping table of the application accessing the kernel interface when the application currently accesses the system kernel interface through the system call;

Determining, according to the identity information and the rights mapping table, whether the application has the right to access a system kernel interface;

When the application does not have access to the system kernel interface, the system call is intercepted to prevent the application from accessing the system kernel interface and generating an intercept warning prompt.

Preferably, the access processing method of the application further includes:

It is detected whether there is an instruction to modify the permission mapping table, and if yes, a permission modification warning prompt is generated.

To achieve the above object, the present invention further provides an access processing method for an application, where the access processing method of the application includes:

When the currently existing application accesses the system kernel interface through a system call, determining whether the application has the right to access the system kernel interface;

When the application does not have access to the system kernel interface, the system call is intercepted to prevent the application from accessing the system kernel interface.

Preferably, when the currently existing application accesses the system kernel interface through a system call, determining whether the application has access to the system kernel interface includes:

Determining, according to the identity information and the rights mapping table, whether the application has the right to access a system kernel interface.

Preferably, the access processing method of the application further includes:

Preferably, when the application does not have the right to access the system kernel interface, intercepting the system call to prevent the application from accessing the system kernel interface includes:

Preferably, when the currently existing application accesses the system kernel interface through the system call, determining whether the application has the right to access the system kernel interface includes:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.

In addition, in order to achieve the above object, the present invention further provides an access processing device for an application, where the access processing device of the application includes:

a detection module, configured to detect whether an application currently accesses a system kernel interface through a system call;

a judging module, configured to determine, when the application currently accesses the system kernel interface by using a system call, whether the application has the right to access the kernel interface of the system;

And a processing module, configured to: when the application does not have the right to access the system kernel interface, intercept the system call to prevent the application from accessing the system kernel interface.

Preferably, the determining module comprises:

An obtaining unit, configured to acquire identity information of the application and a permission mapping table of the application accessing the kernel interface when the currently existing application accesses the system kernel interface through the system call;

The determining unit is configured to determine, according to the identity information and the rights mapping table, whether the application has the right to access the system kernel interface.

Preferably, the detecting module is further configured to:

Preferably, the processing module is further configured to:

In the present invention, when a malicious application is usually running, in order to implement a certain function or purpose, the system kernel interface is generally accessed through a system call, thereby causing a security risk to the user. Therefore, by detecting whether an application exists to access the system kernel interface through a system call, when it exists, it determines whether the application has the right to access the system kernel interface, and if the application does not have the corresponding permission, intercepts the application. A system call issued by the program to prevent the application from illegally accessing the system kernel interface. The invention can further prevent the illegal application from accessing the system kernel interface on the basis of the security scan of the application, thereby improving the security of the system operation.

DRAWINGS

1 is a schematic flowchart of an embodiment of an access processing method of an application according to the present invention;

2 is a schematic diagram showing spatial division of an Android system in an access processing method of an application according to the present invention;

3 is a schematic diagram showing the refinement process of step S20 in FIG. 1;

4 is a schematic diagram of functional modules of an embodiment of an access processing apparatus of an application according to the present invention;

FIG. 5 is a schematic diagram of a refinement function module of the judging module in FIG. 4. FIG.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

detailed description

It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The core idea of the present invention is that when a malicious application is usually running, in order to implement a certain function or purpose, the system kernel interface is generally accessed through a system call, thereby causing a security risk to the user. Therefore, in the present invention, when the application accesses the kernel through the system call, the interception is completed, thereby fundamentally preventing the illegal access of the application and improving the security of the system operation.

In addition, in order to facilitate the description of the present invention, the following is specifically illustrated by the Android system.

The invention provides an access processing method of an application.

Referring to FIG. 1, FIG. 1 is a schematic flowchart diagram of an embodiment of an access processing method of an application program according to the present invention. In this embodiment, the access processing method of the application includes:

Step S10, detecting whether an application currently accesses the system kernel interface through a system call;

Android usually divides the entire virtual address space into two parts: user space and kernel space. It also stipulates that user space cannot directly access kernel space, while kernel space can access user space. By dividing this level, the kernel space can be made more stable and secure. However, if the application process needs to access the kernel or use a kernel function, it usually needs to pass the system call (System Call) to complete. In Android, system calls are the only way for user space to access kernel space. as shown in picture 2. A system call is a set of function interfaces provided by the kernel that allows a process running on user space to interact with the kernel.

For example, a user process accesses a hardware device or some resources of an operating system through a system call, and the like. When all applications in Android run, they will generate system calls through the Android application programming interface API to access the Android kernel, such as network interface, file system interface, CPU FM interface. In this embodiment, there is no limitation on the type of the application program accessing the system kernel interface through the system call, for example, a network interface, a file system interface, a CPU FM interface, and the like.

In addition, in this embodiment, the manner of detecting the system call generated by the application is not limited, and is specifically set according to actual needs.

Step S20, when the currently existing application accesses the system kernel interface through the system call, determining whether the application has the right to access the system kernel interface;

In this embodiment, when it is detected that there is a system call generated by the application, in order to avoid the corresponding kernel function of the system kernel interface corresponding to the system call, it is necessary to first determine whether the application has the right to access the kernel interface of the system. . In this embodiment, the determination manner is not limited. For example, the corresponding authority mapping table may be set in advance for determination.

It should be further noted that, as shown in FIG. 2, in this embodiment, the system function of all applications is filtered by the filtering function provided by the system kernel, thereby determining whether the application has the right to access the corresponding system kernel interface. .

In addition, since the filter function needs to be performed in the privilege level mode of the Android system, the system mode needs to be converted from the user level mode to the privilege level mode before filtering the application system call. Among them, the user level mode and the privilege level mode are two security level modes of the Android system. Generally, all applications run in the user level mode, and the Android kernel system functions run in the privilege level mode. At the same time, in privilege level mode, the filter function can scan any system call of any application.

In this embodiment, the implementation manner of converting the user level mode to the privilege level mode is not limited. For example, a trap call generates a system call to trigger a processor interrupt, which in turn is converted from a user-level mode to a privileged-level mode.

Step S30, when the application does not have the right to access the system kernel interface, intercept the system call to prevent the application from accessing the system kernel interface.

In this embodiment, when it is determined that the current application does not have the right to access the system kernel interface, the system call generated by the application is intercepted, thereby fundamentally preventing malicious applications from accessing the system kernel interface, thereby causing security risks. .

In this embodiment, the manner of intercepting the system call generated by the application is not limited. For example, in the kernel space, when the Android system is in the privilege level mode, the system function of the illegal application is intercepted by the intercept function of the system kernel. Intercept.

In this embodiment, when a malicious application is usually running, in order to implement a certain function or purpose, the system kernel interface is generally accessed through a system call, thereby causing a security risk to the user. Therefore, by detecting whether an application exists to access the system kernel interface through a system call, when it exists, it determines whether the application has the right to access the system kernel interface, and if the application does not have the corresponding permission, intercepts the application. A system call issued by the program to prevent the application from illegally accessing the system kernel interface. The invention can further prevent the illegal application from accessing the system kernel interface on the basis of the security scan of the application, thereby improving the security of the system operation.

Referring to FIG. 3, FIG. 3 is a schematic diagram of the refinement process of step S20 in FIG. In this embodiment, the foregoing step S20 further includes:

Step S201, when the application program currently accesses the system kernel interface through the system call, acquiring the identity information of the application, and the permission mapping table of the application program accessing the kernel interface;

In this embodiment, the identity information of the acquired application is not limited, and may be, for example, a process PID, an application name, an application category, an application credibility level, and the like. For example, the acquired application's identity information may be process PID: 1234, application name: A, application category: file management class, application credibility level: level 3.

In this embodiment, the permission mapping table of the application accessing the kernel interface may be set in advance according to the category of the application, the credibility of the application, the confidentiality level of the kernel interface, and the like.

For example, an application that is set according to the category of the application accesses the permission mapping table of the kernel interface, as shown in Table 1.

Table 1

应用程序类别 Application category	系统内核接口访问权限 System kernel interface access
文件管理 Document management	接口A、B、C Interface A, B, C
文字处理 Word processing	所有接口 All interfaces
图片展示 image display	接口A、B、C、D、E Interface A, B, C, D, E

For example, an application that is set according to the credibility of the application accesses the permissions map of the kernel interface, as shown in Table 2:

Table 2

应用程序可信度 Application credibility	系统内核接口访问权限 System kernel interface access
级别1 Level 1	接口A、B、C Interface A, B, C
级别2 Level 2	接口A、B、C Interface A, B, C
级别3Level 3	接口A、B、C、D、EInterface A, B, C, D, E

Step S202: Determine, according to the identity information and the rights mapping table, whether the application has the right to access a system kernel interface.

In this embodiment, if the application program accesses the kernel interface of the Android system through the system call, the mapping relationship between the application program and the access authority of the kernel interface as shown in Table 1 is obtained, and the identity information of the application is obtained. According to the identity information of the application, it is known that the application belongs to the picture display category, and according to Table 1, it can be determined that the application does not have the right to access the kernel interface of the Android system.

Further, in another embodiment of the access processing method of the application of the present invention, based on an embodiment of the access processing method of the application program of the present invention, in the embodiment, after step S20, the method includes:

In this embodiment, if the application has the right to access the system kernel network interface, the application can only access the system kernel network interface through the system call.

In an optional embodiment of the present invention, if the application accesses the system kernel network interface through a system call, and determines that the application has the right to access the system kernel network interface, the kernel function corresponding to the system call number is invoked to achieve the The purpose of the application to access the system kernel network interface. The system call number is generated when the application accesses the system kernel through a system call.

In this embodiment, when the application has legal permission to access the system kernel interface, the application program uses the system call through the application programming interface, and generates a system call number, which is found in the system call table and corresponds to the system call number. The Android kernel function, which is called in the Android kernel to implement the system call to the Android kernel interface.

Further, in another embodiment of the access processing method of the application program of the present invention, based on an embodiment of the access processing method of the application program of the present invention, in the embodiment, step S30 specifically includes:

When the application does not have permission to access the system kernel interface, the system call is intercepted and an intercept warning prompt is generated.

In this embodiment, when the application does not have the legal permission to access the system kernel, the method for suspending the application to access the kernel of the system is not limited, and may be intercepting the system call generated by the application through the application programming interface API, or directly killing Dead this application process. And exit the kernel space to return to the user space, the system will generate an intrusion report and push it to the user, for example, the application name C, at time T, illegally call the Android kernel interface, blocked, and can also prompt the user to be prompted.

Further, in another embodiment of the access processing method of the application of the present invention, the access processing method of the application further includes:

In this embodiment, the mapping relationship between the application and the access rights of the kernel interface can be formulated through preset rules. For example, in an optional embodiment of the present invention, the preset rule is that only the application that comes with the smart terminal has the right to access the kernel interface, so that only the application that is included in the system has access to the kernel on the smart terminal. The permissions of the interface, other third-party software installed on the smart terminal do not have access to the system kernel interface.

In this embodiment, the mapping relationship between the application and the access rights of the kernel interface may also be pre-defined by the user. In this embodiment, the user formulates a mapping relationship between the application and the access authority of the kernel interface of the Android system. The method is not limited, for example, according to the name of the application, the function classification of the application, the credibility level of the application, etc., and the type of the kernel interface of the Android system is not limited, such as a network interface, a file system interface, a CPU FM interface, and the like. The application can be set to not have the call permission to the Android kernel interface, or can be set to have one or more call permissions to the Android kernel interface.

In an optional embodiment of the present invention, if the user has a mapping relationship with an access right of the kernel interface defined by an application called A: the application has the right to invoke the kernel network interface of the Android system, the application A has the right to call the Android kernel network interface.

In another optional embodiment of the present invention, if the user has a mapping relationship with the kernel interface for the application of the file management category, the application of the file management category has the right to invoke the kernel system file system interface of the Android system. At this time, all file management category applications in the Android system have the right to call the Android kernel file system interface.

In another optional embodiment of the present invention, if the user has a mapping relationship with the kernel interface for the application whose credibility is level 5, the application with the credibility level 5 has the function of calling Android. The system kernel CPU FM interface and network interface permissions, at this time, all the credibility of the Android system level 5 applications have the right to call the Android system kernel CPU FM interface and network interface.

In this embodiment, the scenario in which the user formulates the mapping relationship between the application and the access authority of the Android system kernel interface is not limited. For example, it can be either when the application is installed or when the application is running.

In an optional embodiment of the present invention, when the application is installed, an interface is popped up for the user to formulate a mapping relationship between the application and the access authority of the Android system kernel interface.

Further, in another optional embodiment of the present invention, in the user level mode, when an application accesses the system kernel by using a system call, the trap instruction is executed to convert the system from the user level mode to the privilege level mode, and In privilege level mode, all interface calls brought by the application are detected, and the corresponding kernel interface is invoked according to the interface of the application to ask the user whether the application has the right to call one or more kernel interfaces in the kernel interfaces.

Optionally, if the user determines the mapping relationship between the application and the access authority of the Android kernel interface when the application is installed, the mapping relationship is stored for a long time until the user manually deletes the mapping relationship. Optionally, if the user needs to determine the mapping relationship between the application and the access authority of the Android kernel interface each time the user uses an application, the mapping relationship may be temporarily stored, and the user ends the application to the application. The use of the mapping is automatically removed after the application's process is closed.

In this embodiment, after the permission mapping table is generated, the information of the rights mapping table is monitored. When the application applies to modify the permission mapping table, when the application submits the modification permission request, for example, deletes the mapping relationship between an application and the system kernel interface or adds a mapping relationship between an application and the system kernel interface. , a warning screen is generated, prompting the user to perform identity authentication, which may be through password verification, fingerprint verification, facial recognition, etc., and only through authentication can complete the operation of modifying the permission mapping table; otherwise, the permission mapping table information is not made. modify.

In this embodiment, by determining the mapping relationship between the application and the access authority of the kernel interface of the Android system, only the application having the authority to access the kernel interface of the system can invoke the kernel interface of the Android system that can be called within the scope of the permission. Give users a better experience, and on the other hand improve the security of the Android kernel.

Further, the present invention provides an access processing device for an application.

Referring to FIG. 4, FIG. 4 is a schematic diagram of functional modules of an access processing apparatus of an application program according to the present invention. In this embodiment, the access processing device of the application includes:

The detecting module 10 is configured to detect whether an application currently accesses the system kernel interface through a system call;

The determining module 20 is configured to determine, when the application currently accesses the system kernel interface by using a system call, whether the application has the right to access the system kernel interface;

The processing module 30 is configured to intercept the system call when the application does not have the right to access the system kernel interface to prevent the application from accessing the system kernel interface.

Referring to FIG. 5, FIG. 5 is a schematic diagram of a refinement function module of the judging module in FIG. 4. In the embodiment, the judging module 20 includes:

The obtaining unit 201 is configured to acquire, when the application currently accesses the system kernel interface by using a system call, the identity information of the application, and the permission mapping table of the application accessing the kernel interface;

For example, an application that is set according to the category of the application accesses the permission mapping table of the kernel interface, as shown in Table 3.

table 3

Application category	System kernel interface access
Document management	Interface A, B, C
Word processing	All interfaces
image display	Interface A, B, C, D, E

For example, an application that is set according to the credibility of the application accesses the permissions map of the kernel interface, as shown in Table 4:

Table 4

Application credibility	System kernel interface access
Level 1	Interface A, B, C
Level 2	Interface A, B, C
Level 3	Interface A, B, C, D, E

The determining unit 202 is configured to determine, according to the identity information and the rights mapping table, whether the application has the right to access a system kernel interface.

In this embodiment, if the application program accesses the kernel interface of the Android system through the system call, the mapping relationship between the application program and the access authority of the kernel interface as shown in Table 3 is obtained, and the identity information of the application is obtained, According to the identity information of the application, it is known that the application belongs to the picture display category, and according to Table 3, it can be judged that the application does not have the right to access the kernel interface of the Android system.

Further, in another embodiment of the access processing device of the application program of the present invention, an embodiment of the access processing device based on the application program of the present invention described above, in the embodiment, the processing module 30 is further configured to:

Further, in another embodiment of the access processing device of the application program of the present invention, an embodiment of the access processing device based on the application program of the present invention described above, in the embodiment, the detecting module 10 is further configured to:

In this embodiment, after the permission mapping table is generated, the information of the rights mapping table is monitored. Generated when the application requests to modify the permission mapping table and submit a modification permission request, such as deleting the mapping relationship between an application and the system kernel interface or adding a mapping relationship between an application and the system kernel interface. A warning screen prompts the user to perform identity authentication, which may be through password verification, fingerprint verification, facial recognition, etc., and only through authentication can the operation of modifying the permission mapping table be completed; otherwise, the permission mapping table information is not modified.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the drawings are directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Claims

An access processing method for an application, characterized in that the access processing method of the application comprises:

Detect whether there is an application currently accessing the system kernel interface through a system call;

Obtaining the identity information of the application and the permission mapping table of the application accessing the kernel interface when the application currently accesses the system kernel interface through the system call;

Determining, according to the identity information and the rights mapping table, whether the application has the right to access a system kernel interface;

When the application does not have access to the system kernel interface, the system call is intercepted to prevent the application from accessing the system kernel interface and generating an intercept warning prompt.
The access processing method of the application according to claim 1, wherein the access processing method of the application further comprises:

It is detected whether there is an instruction to modify the permission mapping table, and if yes, a permission modification warning prompt is generated.
An access processing method for an application, characterized in that the access processing method of the application comprises:

Detect whether there is an application currently accessing the system kernel interface through a system call;

When the currently existing application accesses the system kernel interface through a system call, determining whether the application has the right to access the system kernel interface;

When the application does not have access to the system kernel interface, the system call is intercepted to prevent the application from accessing the system kernel interface.
The access processing method of an application according to claim 3, wherein said said system call is intercepted when said application does not have permission to access said system kernel interface to prevent said application from accessing System kernel interfaces include:

When the application does not have access to the system kernel interface, the system call is intercepted to prevent the application from accessing the system kernel interface and generating an intercept warning prompt.
The access processing method of an application according to claim 3, wherein when the currently existing application accesses the system kernel interface through a system call, it is determined whether the application has the right to access the system kernel interface. include:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.
The access processing method of an application according to claim 4, wherein when the currently existing application accesses the system kernel interface through a system call, it is determined whether the application has the right to access the system kernel interface. include:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.
An access processing device for an application, characterized in that the access processing device of the application comprises:

a detection module, configured to detect whether an application currently accesses a system kernel interface through a system call;

a judging module, configured to determine, when the application currently accesses the system kernel interface by using a system call, whether the application has the right to access the kernel interface of the system;

And a processing module, configured to: when the application does not have the right to access the system kernel interface, intercept the system call to prevent the application from accessing the system kernel interface.
The access processing device of the application of claim 7, wherein the determining module comprises:

An obtaining unit, configured to acquire identity information of the application and a permission mapping table of the application accessing the kernel interface when the currently existing application accesses the system kernel interface through the system call;

The determining unit is configured to determine, according to the identity information and the rights mapping table, whether the application has the right to access the system kernel interface.
The access processing device of the application of claim 8, wherein the detecting module is further configured to:

It is detected whether there is an instruction to modify the permission mapping table, and if yes, a permission modification warning prompt is generated.
The access processing device of the application according to claim 7, wherein the processing module is further configured to:

When the application does not have access to the system kernel interface, the system call is intercepted to prevent the application from accessing the system kernel interface and generating an intercept warning prompt.
The access processing device of the application of claim 7, wherein the processing module is further configured to:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.
The access processing device of the application of claim 8, wherein the processing module is further configured to:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.
The access processing device of the application according to claim 9, wherein the processing module is further configured to:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.
The access processing device of the application of claim 10, wherein the processing module is further configured to:

When the application has the right to access the system kernel interface, the kernel function corresponding to the system call is determined according to a preset function mapping table for invoking execution of the kernel function.