WO2022252609A1

WO2022252609A1 - Plug-in protection method and apparatus, and device and storage medium

Info

Publication number: WO2022252609A1
Application number: PCT/CN2021/143643
Authority: WO
Inventors: 郑劲松; 魏狄龙; 曹经纬
Original assignee: 三六零科技集团有限公司
Priority date: 2021-05-31
Filing date: 2021-12-31
Publication date: 2022-12-08
Also published as: CN115964700A

Abstract

A plug-in protection method and apparatus, and a device and a storage medium, belonging to the technical field of computers. The method comprises: when it is detected that a plug-in is loaded in the current window, acquiring a process identifier of the current process that is run in the current window (S10); determining, according to the process identifier, whether the current process that is run in the current window is a protected process (S20); and if the current process is a protected process, preventing the loading of the plug-in in the current window (S30). The loading of a plug-in is prevented to protect a protected process in the current window, such that a browser can be subjected to security protection in a timely manner, without the need to use preset black and white lists, thereby improving the user experience.

Description

Plug-in protection method, device, equipment and storage medium

technical field

The present invention relates to the field of computer technology, in particular to a plug-in protection method, device, equipment and storage medium.

Background technique

The current online shopping model, especially the browser online shopping model, mainly conducts a full-scale scan (global environment scan) for malicious attacks to discover risky programs that may exist in the system. The program is considered to have a security risk) mode, and some malicious attack software can steal user information by loading malicious plug-ins in the browser, but due to the feature of the white list that needs to be actively reported, the white list is added There is a delay in utilization and utilization, and it is impossible to prevent malicious plug-ins from stealing user information in time, which will make the user experience poor, and due to the delay, sometimes adding it in time may even cause losses to users.

The above content is only used to assist in understanding the technical solution of the present invention, and does not mean that the above content is admitted as prior art. Contents of the invention

The main purpose of the present invention is to provide a plug-in protection method, device, equipment and storage medium, aiming to solve the technical problem of delay in security protection of browsers in the prior art.

To achieve the above object, the present invention provides a plug-in protection method, the plug-in protection method includes the following steps:

When it is detected that a plug-in is loaded in the current window, obtain the process identifier of the current process running in the current window;

judging whether the current process running in the current window is a protected process according to the process identifier;

If the current process is a protected process, the loading of the plug-in in the current window is prevented.

Optionally, before determining whether the current process running in the current window is a protected process according to the process identifier, the method further includes:

Detect whether the plug-in protection function is enabled in the current window;

If it is detected that the plug-in protection function is enabled in the current window, then perform the step of judging whether the current process running in the current window is a protected process according to the process identifier;

If it is detected that the plug-in protection function is not enabled in the current window, the loading of the plug-in is controlled according to preset rights management rules.

Optionally, the controlling the loading of the plug-in according to preset rights management rules includes:

detecting the plug-in type of the plug-in;

Determine the target loading authority corresponding to the plug-in according to the plug-in type and preset rights management rules;

The loading of the plug-in is controlled according to the target loading permission.

Optionally, the judging whether the current process running in the current window is a protected process according to the process identifier includes:

Query the target authority information corresponding to the process identifier in the preset process list, and determine the corresponding security verification information according to the target authority information;

extracting a verification return value from the security verification information;

Judging whether the current process running in the current window is a protected process according to the verification return value.

Optionally, the determining the corresponding security verification information according to the target authority information includes:

If the target authority information is protected information, use the first check value as security check information;

If the target authority information is unprotected information, the second check value is used as security check information.

Optionally, the judging whether the current process running in the current window is a protected process according to the check return value includes:

If the extracted verification return value is the first verification value, it is determined that the current process is a protected process;

If the extracted verification return value is the second verification value, it is determined that the current process is an unprotected process.

Optionally, after determining whether the current process running in the current window is a protected process according to the process identifier, the method further includes:

If the current process is an unprotected process, then load the plug-in in the current window.

Optionally, the loading of the plug-ins in the current window includes:

Obtain the class identifier of the plug-in in the current window;

Obtaining the file information of the plug-in according to the class identifier;

The plug-in is loaded according to the file information.

Optionally, the obtaining the class identifier of the plug-in in the current window includes:

Obtaining the class identifier of the plug-in in the current window from the registry through the first path;

Correspondingly, the acquiring the file information of the plug-in according to the class identifier includes:

The file information of the plug-in corresponding to the class identifier is obtained from the registry through the second path.

Optionally, if the current process is an unprotected process, after loading the plug-in in the current window, it further includes:

After the plug-in is loaded, obtain the flow data of the plug-in in real time during operation;

Perform legality detection on the traffic data;

Control the running plug-in according to the traffic detection result.

Optionally, the legality detection of the traffic data includes:

Detecting whether user information is included in the traffic data;

Correspondingly, the controlling the running plug-in according to the traffic detection result includes:

If the traffic data includes the user information, delete the file information corresponding to the plug-in from the registry, so that the plug-in stops running.

Optionally, after preventing the loading of plug-ins in the current window if the current process is a protected process, the method further includes:

Generate a loading interception report according to the class identifier corresponding to the plug-in, the process identifier, and the blocking loading operation corresponding to the plug-in;

The loading interception report is displayed.

In addition, in order to achieve the above purpose, the present invention also proposes a plug-in protection device, the plug-in protection device includes:

An acquisition module, configured to acquire the process identifier of the current process running in the current window when it is detected that a plug-in is loaded in the current window;

A judging module, configured to judge whether the current process running in the current window is a protected process according to the process identifier;

A control module, configured to prevent the loading of plug-ins in the current window if the current process is a protected process.

Optionally, the plug-in protection device further includes: a detection module;

The detection module is used to detect whether the plug-in protection function is enabled in the current window;

The judging module is further configured to judge whether the current process running in the current window is a protected process according to the process identifier if it is detected that the plug-in protection function is enabled in the current window;

The control module is further configured to control the loading of the plug-in according to preset rights management rules if it is detected that the plug-in protection function is not enabled in the current window.

Optionally, the control module is further configured to load the plug-in in the current window if the current process is an unprotected process.

Optionally, the control module is further configured to obtain the class identifier of the plug-in in the current window; obtain the file information of the plug-in according to the class identifier; perform an operation on the plug-in according to the file information load.

Optionally, the control module is further configured to obtain the class identifier of the plug-in in the current window from the registry through a first path; obtain the class identifier from the registry through a second path The file information of the corresponding plug-in.

Optionally, the plug-in protection device also includes a monitoring module;

The monitoring module is configured to obtain real-time flow data of the plug-in during operation after the plug-in is loaded; to detect the validity of the flow data; and to control the running plug-in according to the flow detection result.

In addition, in order to achieve the above object, the present invention also proposes a plug-in protection device, which includes: a memory, a processor, and a plug-in protection program stored in the memory and operable on the processor. The plug-in protection program is configured to implement the steps of the plug-in protection method as described above.

In addition, to achieve the above object, the present invention also proposes a storage medium, on which a plug-in protection program is stored, and when the plug-in protection program is executed by a processor, the steps of the above-mentioned plug-in protection method are implemented.

The present invention acquires the process identifier of the current process running in the current window when detecting that there is a plug-in loaded in the current window; judges whether the current process running in the current window is protected according to the process identifier process; if the current process is a protected process, the loading of the plug-in in the current window is prevented, and the protected process in the current window is protected by preventing the loading of the plug-in. Browser security protection improves user experience.

Description of drawings

Fig. 1 is a schematic structural diagram of a plug-in protection device for a hardware operating environment involved in the solution of an embodiment of the present invention;

Fig. 2 is a schematic flow chart of the first embodiment of the plug-in protection method of the present invention;

FIG. 3 is a schematic flowchart of a second embodiment of the plug-in protection method of the present invention;

4 is a schematic flowchart of a third embodiment of the plug-in protection method of the present invention;

Fig. 5 is a structural block diagram of the first embodiment of the plug-in protection device of the present invention.

The realization of the purpose of the present invention, functional characteristics and advantages will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Referring to FIG. 1 , FIG. 1 is a schematic structural diagram of a plug-in protection device in a hardware operating environment involved in the solution of an embodiment of the present invention.

As shown in FIG. 1 , the plug-in protection device may include: a processor 1001, such as a central processing unit (Central Processing Unit, CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Wherein, the communication bus 1002 is used to realize connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the structure shown in FIG. 1 does not constitute a limitation on the plug-in protection device, and may include more or less components than shown in the figure, or combine some components, or arrange different components.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a plug-in protection program.

In the plug-in protection device shown in Figure 1, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the plug-in protection device of the present invention can be Set in the plug-in protection device, the plug-in protection device calls the plug-in protection program stored in the memory 1005 through the processor 1001, and executes the plug-in protection method provided by the embodiment of the present invention.

An embodiment of the present invention provides a plug-in protection method. Referring to FIG. 2 , FIG. 2 is a schematic flowchart of a first embodiment of a plug-in protection method according to the present invention.

In this embodiment, the plug-in protection method includes the following steps:

Step S10: when it is detected that a plug-in is loaded in the current window, obtain the process identifier of the current process running in the current window.

It should be noted that the execution subject of this embodiment may be a plug-in protection device, and the plug-in protection device may be an electronic device such as a personal computer or a server, or other devices that can achieve the same or similar functions. Restrictions, in this embodiment and the following embodiments, the plug-in protection device of the present invention is used as an example to illustrate the plug-in protection method of the present invention. In this embodiment, the plug-in protection device can monitor the browser in real time, obtain browser data, and perform safety detection on the browser according to the obtained data, so as to ensure the safety of users' online shopping and network usage.

It should be noted that the plug-in in this embodiment refers to a browser plug-in, which is a small computer program that extends the standard functions of the browser and can supplement the functions of the browser. Plug-ins include video plug-ins, picture plug-ins or payment plug-ins. Plug-ins, etc., can open the corresponding videos and pictures of online shopping products for users when they shop online through the browser, but malicious plug-ins will steal the user's personal account information when the user is shopping online, and then use other illegal means to steal the user's personal information. personal property.

In the specific implementation, if it is detected that there is a plug-in loaded in the current window, because it is not sure whether the loaded plug-in is a security plug-in that comes with the browser or a malicious third-party plug-in, in order to ensure the user's Internet security, it is necessary to The running process is detected, because the user usually enters the user's personal account information when the payment process starts. In this embodiment, it detects whether the current process is a payment process, etc. by obtaining the process identifier of the current process running in the current window.

It should be noted that all windows opened by the user in the browser have corresponding processes. For example, when the user opens the payment window, the process running in the payment window is a secure payment process. , the rendering process starts in the browser's current window. Further, the current process running in the current window has a corresponding identifier, that is, a process identifier, and each process has a unique process identifier represented by a non-negative integer, that is, the corresponding process identifiers of each process are different, In this embodiment, the process identifier of the current process running in the current window can be read through the task manager, and the process identifier of the current process running in the current window can also be obtained through other methods, which is not limited in this embodiment .

Step S20: Determine whether the current process running in the current window is a protected process according to the process identifier.

In a specific implementation, after obtaining the process identifier of the current process running in the current window, it is judged based on the correspondence between the process identifier and the process whether the process corresponding to the process identifier of the current process is a protected process, for example The process identifier 1111 corresponds to the browser rendering process, the process identifier 2222 corresponds to the browser loading process, and the process identifier 3333 corresponds to the browser security payment process. Assuming that the security payment process is a protected process, it can be determined by passing The browser corresponding to the identifier 3333 is a protected process, and the protected process can be set accordingly according to the actual situation, which is not limited in this embodiment.

Furthermore, before judging the current process, it is necessary to detect whether the plug-in protection function is enabled in the current window, so as to avoid timely protection of the user's payment security due to the plug-in protection function not being enabled. Before step S20, it also includes: detecting whether the plug-in protection function is enabled in the current window; if it is detected that the plug-in protection function is enabled in the current window, then performing the process of judging the current process running in the current window according to the process identifier. The step of whether the process is a protected process; if it is detected that the plug-in protection function is not enabled in the current window, the loading of the plug-in is controlled according to preset rights management rules.

It is easy to understand that, if it is detected that the plug-in protection function is enabled in the current window, it can be detected whether the current process running in the current window is a protected process according to the process identifier, so as to realize security protection.

In the specific implementation, if it is detected that the plug-in protection function is not enabled in the current window, the corresponding security protection cannot be performed according to the process identifier, but in order to ensure that the user's network security can continue to be guaranteed, in this embodiment, the The rights management rules control the loading of plug-ins in the current window. The preset rights management rules can be pre-set conditions, through which it is judged whether to continue to load the plug-in or prevent the loading of the plug-in, such as loading the security payment plug-in, preventing information from being read and recorded Functional malicious plug-ins can set corresponding preset rights management rules according to actual interception requirements, which is not limited in this embodiment.

Further, in this embodiment, in order to control the plug-ins loaded in the current window more timely and reasonably, the step of controlling the loading of the plug-ins according to preset rights management rules includes: detecting the plug-in type of the plug-ins; Determine the target loading authority corresponding to the plug-in according to the plug-in type and preset rights management rules; and control the loading of the plug-in according to the target loading permission.

It should be noted that in this embodiment, the plug-in type of the plug-in is detected in real time when the plug-in is loaded. For example, when the plug-in type is a malicious plug-in, combined with the preset management rules, it can be determined that the target loading permission of the plug-in is prohibited from loading, and when the plug-in type is a security plug-in, combined with the preset management rules, it can be determined that the target loading permission of the plug-in is allowed to load. The preset authority management rules and the loading authority corresponding to the plug-in type can be set correspondingly according to the actual situation, which is not limited in this embodiment.

Step S30: If the current process is a protected process, prevent the loading of plug-ins in the current window.

It is understandable that when a user uses a browser to pay for online shopping, he needs to go through a secure payment process to request corresponding payment information, such as Alipay account password or bank card online banking account password and other information, and some malicious plug-ins may be used without the user's knowledge. The payment information entered by the user is stolen. In order to prevent the malicious plug-in from stealing the payment information entered by the user, it will prevent the loading of such malicious plug-ins. In this embodiment, you can close the current window or delete the files required by the plug-in. Information and other means prevent the loading of plug-ins in the current window, which is not limited in this embodiment, and corresponding settings can be made according to actual conditions.

It is easy to understand that not all processes running in windows need to be protected. For example, users only browse products in the open online shopping window, and do not involve account information and other information related to user security and privacy. Such processes do not need to be protected. The process does not belong to the protected process. In this embodiment, the plug-in loaded when the process is not protected is not blocked, and the plug-in will continue to be loaded until it is completed.

Further, in order to display the interception results and improve user experience, this embodiment also includes after the step S30: according to the class identifier corresponding to the plug-in, the process identifier and the blocking loading operation corresponding to the plug-in Generate a loading interception report; display the loading interception report.

It should be noted that the current browser security protection intercepts malicious attacks encountered in the browser through black and white lists. Users only know that malicious attacks in the blacklist have been blocked, but they do not know the specific details. The interception situation, even if there is a wrong interception, the user cannot know, which makes the user unable to perform follow-up operations and does not understand why the follow-up operations cannot be performed, which reduces the user experience. In this embodiment, in order to allow users to understand more clearly The interception situation and the user’s follow-up operation are convenient. After the plug-in is blocked from loading, a corresponding loading interception report will be generated. In this embodiment, the loading interception can be generated according to the class identifier, process identifier and corresponding blocking operation of the plug-in. Reports, such as (1FD4978, 10111, blocking), (B4F3A835, 10222, blocking), and then save the loading interception report, which is convenient for developers to analyze why false positives occur, so as to optimize the process.

It is understandable that displaying the interception report can facilitate the user to know why the operation cannot continue and why the operation is prohibited. In the case of false positives, it can facilitate the user to understand why the follow-up operation cannot be performed and improve user experience.

In this embodiment, when it is detected that there is a plug-in loaded in the current window, the process identifier of the current process running in the current window is obtained; according to the process identifier, it is judged whether the current process running in the current window is Protected process; if the current process is a protected process, the loading of the plug-in in the current window is prevented, and the protected process in the current window is protected by preventing the loading of the plug-in, without the use of a preset black and white list, which can Timely protection of browser security improves user experience.

Referring to FIG. 3 , FIG. 3 is a schematic flowchart of a second embodiment of a plug-in protection method according to the present invention.

Based on the first embodiment above, the step S20 in the plug-in protection method of this embodiment includes:

Step S201: Query the target authority information corresponding to the process identifier in the preset process list, and determine the corresponding security check information according to the target authority information.

In a specific implementation, the preset process list is preset, and the processes recorded in the preset process list are processes that need to be protected, and the target authority can be determined according to the query result of the process identifier of the current process in the preset process list Information, the target authority information contains information such as permission or prohibition, and the security check information corresponding to different target authority information is different. For example, the security check information corresponding to the target authority information containing permission information is A, and the target authority information containing prohibition information The corresponding security check information is B.

Step S202: Extract a verification return value from the security verification information.

Step S203: Determine whether the current process running in the current window is a protected process according to the verification return value.

In a specific implementation, after the safety verification information is obtained, the verification return value can be extracted from the safety verification information in this embodiment, and the verification return value X or Y can be extracted from the safety verification information. Then according to the return value, it can be determined whether the current process running in the current window is a protected process, for example, the current process corresponding to the verification return value X is a protected process, and the current process corresponding to the verification return value Y is an unprotected process.

Further, in order to obtain the security verification information more accurately in this embodiment, the step of determining the corresponding security verification information according to the target authority information includes: if the target authority information is protected information, the first A check value is used as security check information; if the target authority information is unprotected information, a second check value is used as security check information.

It should be noted that, according to the query result of the process identifier in the preset process list, it can be determined whether the target permission information is protected information or non-protected information. If the process identifier of the current process is found in the preset process list, then The target permission information is protected information, and if the process identifier of the current process is not found in the preset process list, the target permission information is non-protected information. In this embodiment, the first check value can be set to 1, and the second check value can be set to 0. The first check value and the second check value are security check information. The first check value and the second check value The second check value can be set correspondingly according to the actual situation, which is not limited in this embodiment.

Further, in this embodiment, it is accurately judged whether the current process is a secure payment process, and the step S206 includes: if the extracted verification return value is the first verification value, then it is determined that the current process is a protected process; if the extracted If the verification return value is the second verification value, it is determined that the current process is an unprotected process.

It can be understood that if the verification return value is the first verification value, it means that the current process corresponding to the process identifier is a process that needs to be protected, that is, the protected process. If the verification return value is the second verification value value, it indicates that the current process corresponding to the process identifier is a process that does not need to be protected, that is, a non-protected process. In this embodiment, processes such as the security payment process are set as processes that need to be protected, and the rendering process Or the process such as the loading process is set as a process that does not need to be protected. Of course, the protected process and the non-protected process can also be set correspondingly according to the actual protection requirements, which is not limited in this embodiment.

In this embodiment, by querying the target authority information corresponding to the process identifier in the preset process list, the corresponding security check information is determined according to the target authority information; and the check return value is extracted from the security check information; Determine whether the current process running in the current window is a protected process according to the verification return value, and detect the current process in the current window through the verification return value pair extracted from the security verification information corresponding to the preset authority management rule. Whether the process is a protected process can detect the current process more accurately, improving the accuracy of browser security protection, and at the same time ensuring that even if the plug-in function is not enabled, the user's rights can be guaranteed based on basic settings such as preset permission management rules. Network security improves user experience

Referring to FIG. 4 , FIG. 4 is a schematic flowchart of a third embodiment of a plug-in protection method according to the present invention.

Based on the first embodiment or the second embodiment above, a third embodiment of a plug-in protection method of the present invention is proposed.

Taking the above-mentioned first embodiment as an example for illustration, after step S20 described in this embodiment, it also includes:

Step S30': If the current process is an unprotected process, load the plug-in in the current window.

It is understandable that if the current process is an unprotected process, it means that the user will not actively input private information related to the user's personal account in the current process, and the risk of the user's private information being stolen is low, so the current process can continue to be loaded. Plugins in windows.

Further, in order to load the plug-in in the current window more quickly and accurately, the step S30' in this embodiment includes: obtaining the class identifier of the plug-in in the current window; obtaining the The file information of the plug-in; the plug-in is loaded according to the file information.

It should be noted that when the plug-in is loaded, the class identifier of the plug-in is obtained. The class identifier is equivalent to the ID card of the plug-in in the registry, and the class identifier of each plug-in is different. The class identifier has a unique According to the class identifier, the file information of the plug-in can be found. For example, the file information corresponding to the rendering process can be obtained according to the class identifier 1FD4978, and the file information of the secure payment process can be obtained according to the class identifier B4F3A835. In addition, it should be noted that in this embodiment, the class identifier and the file information corresponding to the plug-in are obtained from the registry, and the class identifier and the plug-in are stored in the registry through different paths. In this embodiment The class identifier corresponding to the plug-in can be obtained from the registry through the first path. The first path can be HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelperObjects. In this embodiment, the class identifier can also be passed through the second path To obtain the file information corresponding to the plug-in, the second path can be HKEY_CLASSES_ROOT\CLSID\{xxx-xxxxxxx-xxxx-xxxxxx}\InprocServer32. Furthermore, it needs to be explained that a plug-in is essentially a program, and the start-up and loading of the program requires corresponding file information. The file information contains plug-in parameters such as the type of the plug-in, configuration data, etc. Based on these plug-in parameters, you can Load the corresponding plugin.

Furthermore, although the user will not actively input personal privacy information in an unprotected process, some malicious plug-ins can still obtain the user's personal privacy information without the user's knowledge. In order to better protect the user's online shopping And using network security, after the step S30', it also includes:

Step S40: After the plug-in is loaded, obtain the traffic data of the plug-in in real time during operation.

It should be noted that the malicious plug-in will generate corresponding traffic data in the process of obtaining the user's personal privacy information, and the size of the traffic data determines the amount of information obtained by the malicious plug-in. The larger the amount.

Step S50: Check the validity of the traffic data.

In the specific implementation, after the traffic data is obtained, the legality of the traffic data will be checked. In this embodiment, it is determined whether the traffic data is legal by checking whether the traffic data contains user information. If the traffic data contains user information, the traffic data is legal data, and if the traffic data contains user information, the traffic data is illegal data. Further, the user information includes a corresponding user information identifier, and based on the user information identifier, it can be detected whether the traffic data includes the user information.

Step S60: Control the running plug-in according to the traffic detection result.

In the specific implementation, after the traffic detection result is obtained, the running plug-in is controlled according to the traffic result. The control of the plug-in includes continuing to run the plug-in or immediately stopping the running of the plug-in. If the traffic data is illegal data, the operation of the plug-in will be stopped immediately. Specifically, in this embodiment, the running of the plug-in is stopped by deleting the file information corresponding to the plug-in from the registry. The deleted file information is obtained through the above-mentioned second path based on the class identifier. Therefore, in this embodiment The file information can be deleted from the registry through the second path, and of course the running plug-in can also be stopped in other ways, and corresponding settings can be made according to the actual situation, which is not limited in this embodiment.

In this embodiment, by obtaining the class identifier of the plug-in in the current window, the file information of the plug-in is obtained according to the class identifier, and the plug-in in the current window is loaded according to the file information, so that the current process is When the process is not protected, it can quickly and accurately load the plug-in in the current window, and at the same time, after the plug-in in the current window is loaded, it can also monitor the traffic data of the plug-in in real time during the running process, so as to prevent malware from being unnoticed by the user. It steals the user's personal privacy information, ensures the user's network security, and improves the user experience.

In addition, an embodiment of the present invention also provides a storage medium, on which a plug-in protection program is stored, and when the plug-in protection program is executed by a processor, the steps of the above-mentioned plug-in protection method are implemented.

Referring to FIG. 5 , FIG. 5 is a structural block diagram of the first embodiment of the plug-in protection device of the present invention.

As shown in Figure 5, the plug-in protection device proposed by the embodiment of the present invention includes:

The obtaining module 10 is configured to obtain the process identifier of the current process running in the current window when it is detected that a plug-in is loaded in the current window.

A judging module 20, configured to judge whether the current process running in the current window is a protected process according to the process identifier.

The control module 30 is configured to prevent the loading of plug-ins in the current window if the current process is a protected process.

In one embodiment, the plug-in protection device further includes a detection module;

The judging module 20 is also used to judge whether the current process running in the current window is a protected process according to the process identifier if it is detected that the plug-in protection function is enabled in the current window;

The control module 30 is further configured to control the loading of the plug-in according to preset authority management rules if it is detected that the plug-in protection function is not enabled in the current window.

In one embodiment, the control module 30 is further configured to detect the plug-in type of the plug-in; determine the target loading permission corresponding to the plug-in according to the plug-in type and preset permission management rules; Controls the loading of said plugins.

In an embodiment, the judging module 20 is further configured to query the target authority information corresponding to the process identifier in the preset process list, and determine the corresponding security check information according to the target authority information; from the Extracting a verification return value from the security verification information; judging whether the current process running in the current window is a protected process according to the verification return value.

In an embodiment, the judging module 20 is further configured to use the first verification value as security verification information if the target authority information is protected information; if the target authority information is unprotected information , the second check value is used as the security check information.

In one embodiment, the judging module 20 is further configured to determine that the current process is a protected process if the extracted verification return value is the first verification value; if the extracted verification return value is the second check value, it is determined that the current process is an unprotected process.

In an embodiment, the control module 30 is further configured to load the plug-in in the current window if the current process is an unprotected process.

In one embodiment, the control module 30 is further configured to obtain the class identifier of the plug-in in the current window; obtain the file information of the plug-in according to the class identifier; The above plugin is loaded.

In an embodiment, the control module 30 is further configured to obtain the class identifier of the plug-in in the current window from the registry through a first path; obtain the class identifier of the plug-in in the current window through a second path The file information of the plug-in corresponding to the class identifier.

In one embodiment, the control module 30 is further configured to acquire the flow data of the plug-in in real time after the plug-in is loaded; to check the validity of the flow data; Take control of running plugins.

In an embodiment, the detection module is further configured to detect whether user information is included in the traffic data;

The control module 30 is further configured to, if the traffic data includes the user information, delete the file information corresponding to the plug-in from the registry, so that the plug-in stops running.

In an embodiment, the plug-in protection device further includes a generating module;

The generating module is configured to generate a loading interception report according to the class identifier corresponding to the plug-in, the process identifier, and the loading blocking operation corresponding to the plug-in; and display the loading interception report.

It should be understood that the above is only an example, and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings according to needs, and the present invention is not limited thereto.

It should be noted that the workflow described above is only illustrative and does not limit the protection scope of the present invention. In practical applications, those skilled in the art can select part or all of them to implement according to actual needs. The purpose of the scheme of this embodiment is not limited here.

In addition, for technical details not described in detail in this embodiment, reference may be made to the plug-in protection method provided in any embodiment of the present invention, which will not be repeated here.

Furthermore, it should be noted that in this document, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or system comprising a set of elements includes not only those elements, but also other elements not expressly listed, or elements inherent in such a process, method, article, or system. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article or system comprising that element.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as a read-only memory (Read Only Memory) , ROM)/RAM, magnetic disk, optical disk), including several instructions to make a terminal device (which can be a mobile phone, computer, server, or network device, etc.) execute the methods described in various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process conversion made by using the description of the present invention and the contents of the accompanying drawings, or directly or indirectly used in other related technical fields , are all included in the scope of patent protection of the present invention in the same way.

Claims

A plug-in protection method, characterized in that the plug-in protection method includes:

When it is detected that a plug-in is loaded in the current window, obtain the process identifier of the current process running in the current window;

judging whether the current process running in the current window is a protected process according to the process identifier;

If the current process is a protected process, the loading of the plug-in in the current window is prevented.
The plug-in protection method according to claim 1, wherein before determining whether the current process running in the current window is a protected process according to the process identifier, further comprising:

Detect whether the plug-in protection function is enabled in the current window;

If it is detected that the plug-in protection function is enabled in the current window, then perform the step of judging whether the current process running in the current window is a protected process according to the process identifier;

If it is detected that the plug-in protection function is not enabled in the current window, the loading of the plug-in is controlled according to preset rights management rules.
The plug-in protection method according to claim 2, wherein the controlling the loading of the plug-in according to preset rights management rules includes:

detecting the plug-in type of the plug-in;

Determine the target loading authority corresponding to the plug-in according to the plug-in type and preset rights management rules;

The loading of the plug-in is controlled according to the target loading permission.
The plug-in protection method according to claim 1, wherein the judging whether the current process running in the current window is a protected process according to the process identifier comprises:

Query the target authority information corresponding to the process identifier in the preset process list, and determine the corresponding security verification information according to the target authority information;

extracting a verification return value from the security verification information;

Judging whether the current process running in the current window is a protected process according to the verification return value.
The plug-in protection method according to claim 4, wherein said determining corresponding security verification information according to said target authority information comprises:

If the target authority information is protected information, use the first check value as security check information;

If the target authority information is unprotected information, the second check value is used as security check information.
The plug-in protection method according to claim 4, wherein the judging whether the current process running in the current window is a protected process according to the check return value comprises:

If the extracted verification return value is the first verification value, it is determined that the current process is a protected process;

If the extracted verification return value is the second verification value, it is determined that the current process is an unprotected process.
The plug-in protection method according to any one of claims 1 to 6, wherein after determining whether the current process running in the current window is a protected process according to the process identifier, it further includes:

If the current process is an unprotected process, then load the plug-in in the current window.
The plug-in protection method according to claim 7, wherein said loading the plug-in in the current window comprises:

Obtain the class identifier of the plug-in in the current window;

Obtaining the file information of the plug-in according to the class identifier;

The plug-in is loaded according to the file information.
The plug-in protection method according to claim 8, wherein said obtaining the class identifier of the plug-in in the current window comprises:

Obtaining the class identifier of the plug-in in the current window from the registry through the first path;

Correspondingly, the acquiring the file information of the plug-in according to the class identifier includes:

The file information of the plug-in corresponding to the class identifier is obtained from the registry through the second path.
The plug-in protection method according to claim 7, wherein if the current process is an unprotected process, after loading the plug-in in the current window, further comprising:

After the plug-in is loaded, obtain the flow data of the plug-in in real time during operation;

Performing a legality check on the traffic data;

Control the running plug-in according to the traffic detection result.
The plug-in protection method according to claim 10, wherein said detecting the legality of said flow data comprises:

Detecting whether user information is included in the traffic data;

Correspondingly, the controlling the running plug-in according to the traffic detection result includes:

If the traffic data includes the user information, delete the file information corresponding to the plug-in from the registry, so that the plug-in stops running.
The plug-in protection method according to any one of claims 1 to 6, wherein if the current process is a protected process, after preventing the loading of plug-ins in the current window, further comprising:

Generate a loading interception report according to the class identifier corresponding to the plug-in, the process identifier, and the blocking loading operation corresponding to the plug-in;

The loading interception report is displayed.
A plug-in protection device, characterized in that the plug-in protection device includes:

An acquisition module, configured to acquire the process identifier of the current process running in the current window when it is detected that a plug-in is loaded in the current window;

A judging module, configured to judge whether the current process running in the current window is a protected process according to the process identifier;

A control module, configured to prevent the loading of plug-ins in the current window if the current process is a protected process.
The plug-in protection device according to claim 13, further comprising: a detection module;

The detection module is used to detect whether the plug-in protection function is enabled in the current window;

The judging module is further configured to judge whether the current process running in the current window is a protected process according to the process identifier if it is detected that the plug-in protection function is enabled in the current window;

The control module is further configured to control the loading of the plug-in according to preset rights management rules if it is detected that the plug-in protection function is not enabled in the current window.
The plug-in protection device according to claim 13, wherein the control module is further configured to load the plug-in in the current window if the current process is an unprotected process.
The plug-in protection device according to claim 15, wherein the control module is further configured to obtain the class identifier of the plug-in in the current window; obtain the file information of the plug-in according to the class identifier ; Load the plug-in according to the file information.
The plug-in protection device according to claim 16, wherein the control module is further configured to obtain the class identifier of the plug-in in the current window from the registry through a first path; The file information of the plug-in corresponding to the class identifier is obtained from the registry.
The plug-in protection device according to claim 15, wherein the plug-in protection device further comprises a monitoring module;

The monitoring module is configured to obtain real-time flow data of the plug-in during operation after the plug-in is loaded; to detect the validity of the flow data; and to control the running plug-in according to the flow detection result.
A plug-in protection device, characterized in that the plug-in protection device includes: a memory, a processor, and a plug-in protection program stored on the memory and operable on the processor, and the plug-in protection program is configured to implement The steps of the plug-in protection method according to any one of claims 1-12.
A storage medium, characterized in that a plug-in protection program is stored on the storage medium, and when the plug-in protection program is executed by a processor, the steps of the plug-in protection method according to any one of claims 1 to 12 are implemented.