WO2020057360A1

WO2020057360A1 - Method and apparatus for improving security of terminal, and computer-readable storage medium

Info

Publication number: WO2020057360A1
Application number: PCT/CN2019/103956
Authority: WO
Inventors: 杨海城; 郭海林
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-09-19
Filing date: 2019-09-02
Publication date: 2020-03-26
Also published as: CN110933013A

Abstract

Provided are a method and apparatus for improving the security of a terminal, and a computer-readable storage medium. The method for improving the security of a terminal comprises: monitoring a session initiation protocol message sent by a terminal, and when the session initiation protocol message is a message for establishing communication and currently meets a communication termination condition, stopping establishing communication.

Description

Method and device for improving terminal security, and computer-readable storage medium

Technical field

The present disclosure relates to, but is not limited to, a method and device for improving terminal security, and a computer-readable storage medium.

Background technique

As the demand for data services continues to grow, mobile network operators are rapidly turning to high-speed networks. With higher bandwidth and lower latency, LTE (Long Term Evolution) has become the mainstream cellular network technology in recent years. SIP (Session Initiation Protocol) technology based on the IP (Internet Protocol) protocol can provide stable communication (such as voice calls) on a network with only data exchange. When SIP technology is used for communication, due to the vulnerability of the Android operating system, malicious applications can start communication without obtaining corresponding communication permissions. At this time, the communication will not be displayed on the screen, and the user will not realize that his mobile phone is communicating.

Summary of the Invention

At least one embodiment of the present disclosure provides a method and device for improving terminal security, a computer-readable storage medium, and improving terminal security.

At least one embodiment of the present disclosure provides a method for improving terminal security, including:

The session initiation protocol message sent by the terminal is monitored, and when the session initiation protocol message is a message for establishing communication and the termination communication condition is currently met, the establishment of communication is stopped.

At least one embodiment of the present disclosure provides a device for improving terminal security, which includes a memory and a processor. The memory stores a program. When the program is read and executed by the processor, the program implements any one of the embodiments. Ways to improve terminal security.

At least one embodiment of the present disclosure provides a computer-readable storage medium, where the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any A method for improving terminal security according to an embodiment.

Compared with the related art, in at least one embodiment of the present disclosure, a session initiation protocol message sent by a terminal is monitored, and when the session initiation protocol message is a message for establishing a communication and a termination communication condition is currently met, the establishment of communication is stopped. The solution provided by this embodiment can timely detect illegal communication operations, cut off communication, prevent users from being monitored, and passively dial toll calls, etc., thereby improving the user experience.

Other features and advantages of the present disclosure will be explained in the following description, and partly become apparent from the description, or be understood by implementing the present disclosure. The objects and other advantages of the present disclosure can be achieved and obtained by the structures particularly pointed out in the description, the claims, and the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings are used to provide a further understanding of the technical solutions of the present disclosure, and constitute a part of the specification. They are used to explain the technical solutions of the present disclosure together with the embodiments of the present application, and do not constitute a limitation to the technical solutions of the present disclosure.

FIG. 1 is a schematic diagram of a SIP architecture in related technologies;

2 is a flowchart of a method for improving terminal security according to an embodiment of the present disclosure;

3 is a flowchart of a method for improving terminal security according to another embodiment of the present disclosure;

4 is a flowchart of a method for improving terminal security provided by another embodiment of the present disclosure;

5 is a flowchart of a method for improving terminal security provided by another embodiment of the present disclosure;

6 is a flowchart of a method for improving terminal security according to another embodiment of the present disclosure;

7 is a block diagram of a device for improving terminal security provided by an embodiment of the present disclosure;

8 is a block diagram of a computer-readable storage medium according to an embodiment of the present disclosure;

FIG. 9 is a block diagram of a device for improving terminal security according to another embodiment of the present disclosure.

detailed description

In order to make the objectives, technical solutions, and advantages of the present disclosure more clear, the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other.

The steps shown in the flowchart of the figures may be performed in a computer system such as a set of computer-executable instructions. And, although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than here.

Research has found that Android's permission control has security vulnerabilities: applications with Android.Permission.INTERNET (Internet) permissions can send SIP messages to the SIP server to initiate communication, which may cause users to be monitored illegally. In this application, SIP packets are monitored, so that the creation of illegal communications can be found in time.

As shown in FIG. 1, it is a schematic diagram of a SIP architecture in the related art, including a terminal 101, a proxy call session control function (P-CSCF) 102, and a SIP server 103. The terminal 101 sends a call request to the P-CSCF 102, and establishes a call with the peer through the SIP server 103. The terminal 101 may be a smart terminal, a PAD (tablet), a computer, or the like.

As shown in FIG. 2, an embodiment of the present disclosure provides a method for improving terminal security, including:

Step 201: Monitor a SIP message sent by the terminal;

The SIP message sent may be a SIP message to be sent, or may be a SIP message already sent.

Step 202: When the SIP packet is a message for establishing communication and the termination condition for communication is currently met, stop establishing communication.

The communication establishment message is, for example, a message for establishing a call, or another type of communication message (for example, establishing a short message communication, etc.).

In the above embodiment, illegal communication can be monitored in a timely manner, and communication can be terminated in a timely manner, which solves the problem that malicious applications attack users through the VoLTE security vulnerability of the Android operating system, causing huge losses to users, and greatly improving the user experience.

The termination communication conditions may be set according to requirements. In an embodiment, the currently satisfying termination communication conditions include at least one of the following:

The application sending the SIP message is an unauthorized application;

Before the terminal sends the SIP message, no communication establishment instruction entered by the user through the application sending the SIP message is detected; that is, the application initiates communication without permission when the user does not initiate communication, which is generally illegal communication and damages the terminal. Safe and need to be terminated;

The application sending the SIP message is currently a background application. Since the application that initiates the communication is generally a foreground application, to interact with the user, in this embodiment, the communication initiated by the application running only in the background (without interacting with the user) is determined to be illegal communication and needs to be terminated.

In an embodiment, the unauthorized applications include at least one of the following: applications that do not have communication permissions (such as Android.Permission.CALL_PHONE permission) are not recorded in the first list that is set to record applications that allow communication Applications that are recorded in a second list that is set to record applications that are prohibited from communicating. The applications in the first list and the second list may be pre-configured or configured by a user. For example, you can directly obtain the permissions of the application and check whether the application has the Android.Permission.CALL_PHONE permission. If it does not, the application is an unauthorized application. For example, check whether the application is recorded in the first list. Authorized applications, for example, check whether the applications are recorded in the second list, and if they are, they are unauthorized applications. The first list and the second list can be viewed according to the application identification (application index number) or the application name. Only the first list and the second list may exist, or they may both exist.

In an embodiment, the SIP message sent by the monitoring terminal includes: a SIP message sent by the monitoring terminal to the P-CSCF. Because the SIP message is usually sent to the SIP server, and the message sent to the SIP server needs to pass through the P-CSCF, the message sent to the P-CSCF can be monitored. It should be noted that it is also possible to directly monitor the message sent by the terminal and determine whether it is a SIP message according to the message format. For example, if two terminals establish communication directly (not through a SIP server), at this time, directly monitor SIP packets sent by the terminals.

In an embodiment, the message that the SIP message is to establish communication includes that the SIP message is an INVITE message. Since VoLTE uses INVITE messages to establish a call between two or more parties, it is possible to determine whether a SIP message is a message to establish communication by determining whether the message is an INVITE message. It should be noted that if the message for establishing a call changes, correspondingly, it is determined whether the SIP message is a message for establishing a call by judging whether the SIP message is a changed message.

In an embodiment, the application that sends the SIP packet is determined according to the following manner:

Obtain the destination address information and source address information of the SIP packet, and obtain a corresponding socket connection according to the destination address information and source address information of the SIP packet, and the application creating the socket connection is to send the Application of SIP packets. When the terminal creates a socket connection, the system stores the correspondence between the socket connection and the application, and the application corresponding to the socket connection can be obtained by querying this information. In an embodiment, the destination address information includes a destination address and a port number, and the source address information includes a source address and a port number. The destination address information is, for example, the P-CSCF address information, and the source address information is the terminal's own address information.

In another embodiment, the application that sends the SIP packet is determined according to the following manner:

Determine the application that calls the interface that sends SIP packets. This application is the application that sends SIP packets.

In an embodiment, before obtaining the destination address information and the source address information of the SIP message, the method further includes: decrypting the SIP message. Based on security considerations, many mobile network operators use IPSec (IP Security) encryption algorithms to protect SIP messages. The IPSec algorithm encrypts SIP packets through ESP (Encapsulating Security Payload, Encapsulating Security Payload). Therefore, the SIP packets need to be decrypted to obtain the information carried in them. After the SIP packet is decrypted, the destination address information and source address information of the SIP packet can be obtained.

In an embodiment, the step of stopping establishing communication in step 102 is, for example, sending a BYE message to the SIP server to end the current VoLTE session. If the SIP message has not been sent, the step of stopping establishing communication in step 102 is, for example, not sending the SIP message.

In an embodiment, when the SIP packet is a message for establishing communication and currently meets the conditions for terminating communication, it further includes at least one of the following:

Adding the application that sends the SIP message to a second list for recording applications that are prohibited from communicating;

Close the Android.Permission.INTERNET (Internet) permission of the application sending the SIP message;

Uninstall or delete the application that sent the SIP message;

A message is displayed. The prompt information is, for example, that your terminal is being attacked by a malicious application and has undergone xxx (for example, uninstallation) processing. This is only an example, and the prompt information can be set as required.

It should be noted that the above processing is only an example, and other processing may be performed as needed.

FIG. 3 is a flowchart of a method for improving terminal security according to another embodiment of the present disclosure. As shown in FIG. 3, the method includes:

Step 301: Monitor the SIP message sent by the terminal.

Step 302: When the SIP message is a message for establishing communication and the termination of communication conditions is currently met, prompt the user whether to stop establishing communication; for example, a prompt interface pops up and provides the function options of continuing to establish communication and stopping establishing communication, so as to facilitate User's selection for subsequent operations.

Step 303: After receiving the user's instruction to stop establishing communication, stop establishing communication.

In this embodiment, when the user selects the option to stop establishing communication, the establishment of communication is stopped. In another embodiment, if the user selects the option to continue establishing communication, the communication continues to be established.

FIG. 4 is a flowchart of a method for improving terminal security according to another embodiment of the present disclosure. As shown in FIG. 4, the method includes:

Step 401: Monitor a SIP message sent by a terminal;

Step 402: when the SIP message is a message for establishing communication, obtain an application for sending the SIP message;

An application for obtaining and sending the SIP message is: obtaining destination address information and source address information of the SIP message, and obtaining a corresponding socket according to the destination address information and source address information of the SIP message. Word (socket) connection, the application that creates the socket connection is the application that sends the SIP message.

Step 403: When the application sending the SIP message is an unauthorized application or a background application, stop establishing communication.

FIG. 5 is a flowchart of a method for improving terminal security according to another embodiment of the present disclosure. As shown in FIG. 4, the method includes:

Step 501: Listen for a SIP message sent by a terminal;

Step 502: When the SIP message is a message for establishing communication and the termination condition for communication is currently met, stop establishing communication.

Step 503: Perform at least one of the following:

Disable the Internet permission of the application sending the SIP packet;

Uninstall or delete the application that sent the SIP message;

A message is displayed.

It should be noted that the above processing in step 503 is only an example, and other processing may be performed as needed.

The following uses VoLTE as an example to further explain this application.

As shown in FIG. 6, an embodiment of the present disclosure provides a method for improving VoLTE security, including:

Step 601: It is monitored that the terminal sends a SIP message to the SIP server;

Any SIP message sent from the VoLTE terminal to the SIP server must pass through the P-CSCF network element. Therefore, what is actually monitored is that the terminal sends a SIP message to the P-CSCF network element.

During the VoLTE registration phase, the terminal obtains the IP address of the P-CSCF network element from the network side.

Step 602: Decrypt the SIP message.

For security reasons, many mobile network operators use IPSec encryption algorithms to protect SIP packets. The IPSec algorithm encrypts SIP packets through the ESP protocol. Therefore, the SIP message needs to be decrypted to obtain the information in the SIP message.

Among them, the key (Ck, Ik) and cryptographic algorithm are obtained from the ESP, and the SIP message is decrypted.

After decryption, the SIP packet displayed in plain text, and the source port and destination port of the SIP packet are obtained.

It should be noted that if the SIP packet is not encrypted, no decryption is required, and this step can be omitted.

Step 603: Identify the decrypted SIP message, determine whether the SIP message is an INVITE message, and if yes, proceed to step 604; otherwise, end.

The decrypted SIP message has been clearly displayed. One method to determine whether the SIP message is an INVITE message is to check whether the header of the SIP message is "INVITE" and contains the calling and called numbers. If so, the SIP The message is an INVITE message.

Step 604: Obtain an application that sends the SIP message.

Specifically, the corresponding socket connection is obtained through the destination address and port number (SIP server), source address, and port number of the SIP packet, and then the application information for creating the socket connection is found. The PID (Program ID) and Program Name (Application Name) of the application can be obtained. Call the send SIP interface

Step 605: Determine whether the application is an unauthorized application, and if yes, proceed to step 606; if not, end.

Specifically, check whether the application has Android.Permission.CALL_PHONE permission. If not, it is determined that the application is an unauthorized application.

In one embodiment, the judgment is made according to the application name. If it is not the dialing application com.android.dialer of the Android system or the application in the first list (also known as the white list), it is determined as an unauthorized application.

Step 606: Stop establishing a call.

For example, send a BYE message to the SIP server to end this VoLTE session.

In step 606, at least one of the following may be performed:

Blacklist the application (ie, the second list).

Turn off the Android.Permission.INTERNET permission for the app.

Remove or uninstall the app.

Alert users to malicious application attacks. For example, the following message is displayed to the user: Your terminal is under attack by a malicious application and has been uninstalled.

Compared with related technologies, when using SIP technology to implement a call, a malicious application can start communication without obtaining the corresponding communication permission. At this time, the communication will not be displayed on the screen. This security vulnerability is extremely harmful and may cause users Huge losses: 1) Malicious applications allow the terminal to constantly make calls to the specified number, resulting in users not receiving incoming calls normally. 2) Malicious applications allow terminals to make expensive video calls or pay calls, causing users to suffer financial losses. 3) The user is illegally monitored. The solution provided by this embodiment can detect an illegal call in time and terminate the illegal call, avoiding the terminal in a state of continuously making calls, avoiding economic losses caused by dialing toll calls, and preventing users from being monitored.

As shown in FIG. 7, an embodiment of the present disclosure provides a device 70 for improving terminal security, which includes a memory 710 and a processor 720. The memory 710 stores a program, and the program is read by the processor 720. When executed, the method for improving terminal security according to any of the embodiments is implemented. Specifically, in an embodiment, when the program is read and executed by the processor 720, the following steps are implemented:

In an embodiment, the currently satisfied termination communication conditions include at least one of the following:

The application sending the session initiation protocol message is an unauthorized application;

Before the terminal sends the session initiation protocol message, no communication establishment instruction input by a user through an application that sends the session initiation protocol message is detected;

The application that sends the session initiation protocol message is currently a background application.

In an embodiment, the unauthorized application includes at least one of the following: an application that does not have communication permission, an application that is not recorded in the first list for recording applications permitted to communicate, and an application that is recorded for recording prohibited communication Apps in the second list of apps.

In an embodiment, the session initiation protocol message sent by the monitoring terminal includes: a session initiation protocol message sent by the monitoring terminal to the proxy call session control function.

In an embodiment, the stopping establishing communication includes:

Prompt the user to stop establishing communication, and stop receiving communication after receiving the instruction to stop establishing communication.

In an embodiment, when the program is read and executed by the processor 720, it further implements the following steps: determining an application for sending the session initiation protocol message according to the following method: obtaining the session initiation protocol message Destination address information and source address information. The corresponding socket connection is obtained according to the destination address information and source address information of the session initiation protocol message. The application that creates the socket connection is the one that sends the session initiation protocol message. application.

In an embodiment, before obtaining the destination address information and the source address information of the session initiation protocol message, the method further includes: decrypting the session initiation protocol message.

In an embodiment, in an embodiment, when the program is read and executed by the processor 720, the following steps are further implemented:

When the session initiation protocol message is a communication establishment message and currently does not meet the communication establishment conditions, at least one of the following is performed:

Adding an application that sends the session initiation protocol message to a second list for recording applications that are prohibited from communicating;

Turn off the Internet permission of the application sending the session initial protocol message;

Uninstall or delete the application sending the initial protocol message of the session;

A message is displayed.

An embodiment of the present disclosure further provides a terminal including the device 70 for improving terminal security.

As shown in FIG. 8, an embodiment of the present disclosure provides a computer-readable storage medium 80. The computer-readable storage medium 80 stores one or more programs 81. The one or more programs 81 may be stored in one or more programs 81. A plurality of processors execute to implement the method for improving terminal security according to any embodiment.

As shown in FIG. 9, an embodiment of the present disclosure provides a device for improving terminal security, including a monitoring module 901, an analysis module 902, a decision module 903, and an execution module 904, where:

The monitoring module 901 is configured to notify the parsing module 902 when monitoring the SIP packet sent by the terminal;

The parsing module 902 is configured to, after receiving the notification from the monitoring module 901, determine whether the SIP message is a message for establishing communication, and notify the judgment module when the SIP message is a message for establishing communication. 903;

The judging module 903 is configured to notify the execution module 904 when receiving the notification of the parsing module 902 and determining that the communication termination condition is currently met;

The execution module 904 is configured to stop establishing communication after receiving the notification from the decision module 903.

The application sending the SIP message is an unauthorized application;

Before the terminal sends the SIP message, no communication establishment instruction input by a user through an application sending the SIP message is detected;

The application sending the SIP message is currently a background application.

The unauthorized applications include at least one of the following: applications that do not have communication rights, applications that are not recorded in the first list for recording applications that are allowed to communicate, and applications that are not recorded in the first list for applications that are not allowed to communicate. Applications in the second list.

In one embodiment, the interception module 901 monitors the terminal to send a SIP message as follows: the interception module 901 is configured to monitor the terminal to send a SIP message to the P-CSCF.

In an embodiment, the execution module 904 stopping establishing communication includes: the executing module 904 prompts the user whether to stop establishing communication, and stops receiving communication after receiving an instruction to stop establishing communication.

In an embodiment, the execution module 904 is further configured to execute at least one of the following:

Close the Android.Permission.INTERNET permission of the application sending the SIP message;

Uninstall or delete the application that sent the SIP message;

A message is displayed.

In an embodiment, the parsing module 902 includes a decoding unit 9021 and a parsing unit 9022, where:

The decoding unit 9021 is configured to, after receiving the notification from the monitoring module 301, decrypt the SIP message to obtain a decrypted SIP message;

The parsing unit 9022 is configured to determine, according to the decrypted SIP message, whether the SIP message is a message for establishing communication, and when the SIP message is a message for establishing communication, notify the judgment module 903.

For other implementation details, please refer to the method embodiments, which will not be repeated here.

In an embodiment, the determination module 903 includes an application information acquisition unit 9031 and a determination unit 9032, where:

The application information obtaining unit 9031 is configured to, after receiving the notification from the parsing module 902, obtain an application that sends the SIP packet;

The judging unit 9032 is configured to determine whether the communication termination conditions are currently met, and notify the execution module 904 when it is determined that the communication termination conditions are currently met.

In an embodiment, the application information obtaining unit 9031 obtains an application that sends the SIP packet includes:

Obtain the destination address information and source address information of the SIP message, and obtain a corresponding socket connection according to the destination address information and source address information of the SIP message, and the application that creates the socket connection is to send the SIP Application of messages.

This article uses VoLTE as an example, but this application can be applied to include, but is not limited to, VoLTE, VoWiFi (Voice Over WiFi, Voice over Wi-Fi), RCS (Rich Communication Communications Suite), Vo5G (VoNR, Voice Overover New Radio, 5G voice solutions) and other VoIMS (Voice over IMS, voice solutions based on IP multimedia subsystem) scenarios.

Those of ordinary skill in the art can understand that all or some of the steps, systems, and functional modules / units in the devices disclosed in the methods above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components execute cooperatively. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile implemented in any method or technology used to store information such as computer-readable instructions, data structures, program modules or other data. Removable, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that a communication medium typically contains computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium .

Industrial applicability

In at least one embodiment of the present disclosure, a session initiation protocol message sent by a terminal is monitored, and when the session initiation protocol message is a message for establishing a communication and a condition for terminating communication is currently met, the establishment of communication is stopped. The solution provided by this embodiment can timely detect illegal communication operations, cut off communication, prevent users from being monitored, and passively dial toll calls, which improves the user experience.

Claims

A method for improving terminal security includes:

The session initiation protocol message sent by the terminal is monitored, and when the session initiation protocol message is a message for establishing communication and the termination communication condition is currently met, the establishment of communication is stopped.
The method for improving terminal security according to claim 1, wherein the currently satisfying termination communication conditions include at least one of the following:

The application sending the session initiation protocol message is an unauthorized application;

Before the terminal sends the session initiation protocol message, no communication establishment instruction input by a user through an application that sends the session initiation protocol message is detected;

The application that sends the session initiation protocol message is currently a background application.
The method for improving terminal security according to claim 2, wherein:

The unauthorized applications include at least one of the following: applications that do not have communication permissions, applications that are not recorded in the first list set to record applications that allow communication, and applications that are not recorded in the second list set to record applications that are prohibited from communication Application.
The method for improving terminal security according to claim 1, wherein the session initiation protocol message sent by the monitoring terminal comprises: a session initiation protocol message sent by the monitoring terminal to a proxy call session control function.
The method for improving terminal security according to claim 1, wherein the stopping establishing communication comprises:

Prompt the user to stop establishing communication, and stop receiving communication after receiving the instruction to stop establishing communication.
The method for improving terminal security according to claim 2, wherein the application for sending the session initiation protocol message is determined according to the following manner:

Obtain the destination address information and source address information of the session initiation protocol message, obtain a corresponding socket connection according to the destination address information and source address information of the session initiation protocol message, and an application that creates the socket connection An application that sends an initial protocol message for the session.
The method for improving terminal security according to claim 6, wherein before acquiring the destination address information and the source address information of the session initial protocol message, further comprising: decrypting the session initial protocol message.
The method for improving terminal security according to any one of claims 1 to 7, wherein when the session initiation protocol message is a message for establishing communication and currently does not satisfy the conditions for establishing communication, at least one of the following is performed:

Adding an application that sends the session initial protocol message to a second list that is set to record applications that are prohibited from communicating;

Turn off the Internet permission of the application sending the session initial protocol message;

Uninstall or delete the application sending the initial protocol message of the session;

A message is displayed.
The method for improving terminal security according to any one of claims 1 to 7, wherein the communication establishment message is a communication establishment message.
An apparatus for improving terminal security includes a memory and a processor. The memory stores a program. When the program is read and executed by the processor, the terminal improves the terminal according to any one of claims 1 to 8. Security approach.
A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any one of claims 1 to 8. The method for improving terminal security.