CN105930729A - Keyboard focus changing method and device and terminal equipment - Google Patents
Keyboard focus changing method and device and terminal equipment Download PDFInfo
- Publication number
- CN105930729A CN105930729A CN201610517603.8A CN201610517603A CN105930729A CN 105930729 A CN105930729 A CN 105930729A CN 201610517603 A CN201610517603 A CN 201610517603A CN 105930729 A CN105930729 A CN 105930729A
- Authority
- CN
- China
- Prior art keywords
- keyboard focus
- current process
- focus change
- change function
- function
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- User Interface Of Digital Computer (AREA)
- Input From Keyboards Or The Like (AREA)
- Telephone Function (AREA)
Abstract
The invention provides a keyboard focus changing method, a keyboard focus changing device and terminal equipment, wherein the method comprises the following steps: monitoring whether a keyboard focus changing function provided by an operating system kernel is called; if the current process calls a keyboard focus changing function, a preset hook function corresponding to the keyboard focus changing function is operated; detecting the legality of the current process; and if the current process is detected to be legal, allowing the current process to call a keyboard focus changing function so as to set the keyboard focus in the target window. The method avoids the malicious tampering of the keyboard focus, and protects the safety of the operating system.
Description
Technical field
The present invention relates to field of information security technology, particularly relate to a kind of keyboard focus change method, device and terminal unit.
Background technology
Generally, operating system can provide the user keyboard focus change function, and under some application scenarios, this keyboard of process is burnt
Point change function by the focus of keyboard, is arranged on the application program of current operation, makes this application program meeting user
With.
But, some rogue program can utilize this keyboard focus to change function, is distorted by keyboard focus so that other should
Keyboard can not be used by program.
Summary of the invention
The purpose of the present invention is intended to solve one of above-mentioned technical problem the most to a certain extent.
To this end, it is an object of the present invention to propose a kind of keyboard focus change method, this method avoid keyboard focus quilt
Malice is distorted, and protects the safety of operating system.
Second object of the present invention is to propose a kind of keyboard focus change device.
Third object of the present invention is to propose a kind of terminal unit.
Fourth object of the present invention is to propose another kind of terminal unit.
To achieve these goals, first aspect present invention embodiment proposes a kind of keyboard focus change method, including following
Step: whether the keyboard focus change function that monitor operating system kernel provides is called；If monitoring current process to call
Described keyboard focus change function, runs the Hook Function corresponding with described keyboard focus change function preset；Detection is current
The legitimacy of process；If detection knows that current process is legal, then current process is allowed to call described keyboard focus change function,
So that keyboard focus is arranged on target window.
The keyboard focus change method of the embodiment of the present invention, at the keyboard focus change function quilt that monitor operating system kernel provides
When calling, if monitor current process call keyboard focus change function time, run preset with keyboard focus change function
Corresponding Hook Function, to capture current process and to detect the legitimacy of current process, if detection knows that current process is legal,
Current process is then allowed to call keyboard focus change function, so that keyboard focus is arranged on target window.Thus, it is to avoid key
Dish focus is maliciously tampered, and protects the safety of operating system.
It addition, the keyboard focus change method of the embodiment of the present invention also has a following additional technical characteristic:
In one embodiment of the invention, also include: if detection knows that current process is illegal, then refusal current process is adjusted
Function is changed with described keyboard focus.
In one embodiment of the invention, the keyboard focus change function provided at described monitor operating system kernel whether by
Before calling, also include: arrange corresponding with described keyboard focus change function in the defence with network security application drives
Hook Function.
In one embodiment of the invention, the legitimacy of described detection current process, including: according to default feature database inspection
Survey the legitimacy of current process.
In one embodiment of the invention, described feature database includes: the white list of legitimate processes, and/or, illegal process
Blacklist.
To achieve these goals, second aspect present invention embodiment proposes a kind of keyboard focus change device, including: prison
Surveying module, whether the keyboard focus change function provided for monitor operating system kernel is called；Run module, be used for
Monitor current process call described keyboard focus change function time, run preset with described keyboard focus change function corresponding
Hook Function；Detection module, for detecting the legitimacy of current process；Processing module, for knowing when advancing in detection
During Cheng Hefa, it is allowed to current process calls described keyboard focus change function, so that keyboard focus is arranged on target window.
The keyboard focus change device of the embodiment of the present invention, at the keyboard focus change function quilt that monitor operating system kernel provides
When calling, if monitor current process call keyboard focus change function time, run preset with keyboard focus change function
Corresponding Hook Function, to capture current process and to detect the legitimacy of current process, if detection knows that current process is legal,
Current process is then allowed to call keyboard focus change function, so that keyboard focus is arranged on target window.Thus, it is to avoid key
Dish focus is maliciously tampered, and protects the safety of operating system.
It addition, the keyboard focus change device of the embodiment of the present invention also has a following additional technical characteristic:
In one embodiment of the invention, described processing module is additionally operable to: when detection knows that current process is illegal, refusal
Current process calls described keyboard focus change function.
In one embodiment of the invention, also include: module is set, for driving in the defence with network security application
The Hook Function that middle setting is corresponding with described keyboard focus change function.
In one embodiment of the invention, described detection module is used for: according to the conjunction of default feature database detection current process
Method.
In one embodiment of the invention, described feature database includes: the white list of legitimate processes, and/or, illegal process
Blacklist.
To achieve these goals, third aspect present invention embodiment proposes a kind of terminal unit, including second party of the present invention
Keyboard focus change device described in the embodiment of face.
The terminal unit of the embodiment of the present invention, when the keyboard focus change function that monitor operating system kernel provides is called,
If monitoring current process when calling keyboard focus change function, run preset with keyboard focus change hook corresponding to function
Subfunction, to capture current process and to detect the legitimacy of current process, if detection knows that current process is legal, then allows
Current process calls keyboard focus change function, so that keyboard focus is arranged on target window.Thus, it is to avoid keyboard focus
It is maliciously tampered, protects the safety of operating system.
To achieve these goals, fourth aspect present invention embodiment proposes another kind of terminal unit, including with next or
Multiple assemblies: processor, memorizer, power circuit, multimedia groupware, audio-frequency assembly, the interface of input/output (I/O),
Sensor cluster, and communications component；Wherein, circuit board is placed in the interior volume that housing surrounds, described processor and institute
State memorizer to be arranged on described circuit board；Described power circuit, powers for each circuit or the device for terminal unit；
Described memorizer is used for storing executable program code；Described processor is by reading the performed journey of storage in described memorizer
Sequence code runs the program corresponding with described executable program code, for performing following steps:
Whether the keyboard focus change function that monitor operating system kernel provides is called；
If monitoring current process to call described keyboard focus change function, what operation was preset changes letter with described keyboard focus
The Hook Function that number is corresponding；
The legitimacy of detection current process；
If detection knows that current process is legal, then current process is allowed to call described keyboard focus change function, with by keyboard
Focus is arranged on target window.
The terminal unit of the embodiment of the present invention, when the keyboard focus change function that monitor operating system kernel provides is called,
If monitoring current process when calling keyboard focus change function, run preset with keyboard focus change hook corresponding to function
Subfunction, to capture current process and to detect the legitimacy of current process, if detection knows that current process is legal, then allows
Current process calls keyboard focus change function, so that keyboard focus is arranged on target window.Thus, it is to avoid keyboard focus
It is maliciously tampered, protects the safety of operating system.
Aspect and advantage that the present invention adds will part be given in the following description, and part will become bright from the following description
Aobvious, or recognized by the practice of the present invention.
Accompanying drawing explanation
The present invention above-mentioned and/or that add aspect and advantage will be apparent from from the following description of the accompanying drawings of embodiments
With easy to understand, wherein:
Fig. 1 is the flow chart of keyboard focus change method according to an embodiment of the invention；
Fig. 2 is the flow chart of the keyboard focus change method according to one specific embodiment of the present invention；
Fig. 3 is the structural representation of keyboard focus change device according to an embodiment of the invention；
Fig. 4 is the structural representation of the keyboard focus change device according to one specific embodiment of the present invention；
Fig. 5 is the structural representation of terminal unit according to an embodiment of the invention；And
Fig. 6 is the structural representation of the terminal unit according to one specific embodiment of the present invention.
Detailed description of the invention
Embodiments of the invention are described below in detail, and the example of described embodiment is shown in the drawings, the most identical
Or similar label represents same or similar element or has the element of same or like function.Retouch below with reference to accompanying drawing
The embodiment stated is exemplary, it is intended to is used for explaining the present invention, and is not considered as limiting the invention.
Below with reference to the accompanying drawings keyboard focus change method, device and the terminal unit of the embodiment of the present invention are described.
Fig. 1 is the flow chart of keyboard focus change method according to an embodiment of the invention, as it is shown in figure 1, this key
Dish focus change method includes:
S110, whether the keyboard focus change function that monitor operating system kernel provides is called.
S120, if monitoring current process to call keyboard focus change function, what operation was preset changes function with keyboard focus
Corresponding Hook Function.
Generally, operating system nucleus can provide keyboard focus to change function, by this keyboard focus change function so that key
The focus of dish is arranged on the window of related application so that user can input relevant information by keyboard at this window.Its
In, according to the difference of concrete application scenarios, the keyboard focus change function that operating system nucleus provides is different.
For example, when the keyboard focus change function that operating system provides is SetFocus function, chat application is worked as
When A is desirable for input through keyboard chat message, the process of application A can call, with crossing, the kernel that SetFocus function is corresponding
Function NtUserSetFocus function, is arranged on keyboard focus on the window that application A is corresponding, thus user can pass through
Operation to keyboard inputs relevant chat message in application A.
But, some performs the malicious process of malice task, and such as virus, anthelmintic and Trojan Horse process etc., can use
The keyboard focus change function that call operation system kernel provides, is modified the focal position of keyboard so that other application
Program cannot use keyboard, causes the destruction to operating system security.
Therefore, in order to prevent malicious process from by calling keyboard focus change function, keyboard focus illegally being changed, permitting
Before process of being permitted uses keyboard focus change function, need the legitimacy first judging to call keyboard focus change function process, from
And determine whether that this process uses this keyboard focus change function change keyboard focus according to judged result.
Wherein, it should be appreciated that Hook Function can use various ways determine call keyboard focus change function call into
Journey, than such as by obtain call keyboard focus change function operation process path determine calling process.
In order to realize before allowing current process to use keyboard focus change function, it is judged that the legitimacy of current process, this
Bright embodiment arranges the Hook Function corresponding with keyboard focus change function in system in advance.
And then, whether the keyboard focus change function that monitor operating system kernel provides is called, whenever monitoring keyboard focus
When change function is called, then run the Hook Function corresponding with this keyboard focus change function preset.
I.e. operating system respond this keyboard focus change function call event before, by with this keyboard focus change letter
It is the most legal that the Hook Function that number is corresponding calls this keyboard focus change function process with judgement.
S130, the legitimacy of detection current process.
S140, if detection knows that current process is legal, then allows current process to call keyboard focus change function, with by key
Dish focus is arranged on target window.
Specifically, after the current process of function is called in Hook Function capture, detect the legitimacy of this current process, if inspection
Survey knows that current process is legal, it is allowed to current process calls keyboard focus change function, so that keyboard focus to be arranged on target window
Mouthful, to meet the properly functioning of related application.
Wherein it is desired to explanation, according to the difference of concrete application scenarios, default Hook Function can take various ways to examine
Survey the legitimacy of the current process calling keyboard focus change function.
The first example, can comprise related legitimate or illegal process correlated characteristic by being correspondingly arranged in operating system this locality
Feature database, and called the legitimacy of current process of keyboard focus change function by feature database detection.
The second example, can arrange on the remote server and comprise related legitimate or the feature database of illegal process correlated characteristic,
And arrange one in Hook Function and carry out, with this remote server, the correlation function that information is mutual, thus relevant in Hook Function
Function, sends the relevant information calling the current process of keyboard focus change function to remote server, for remote service
Device calls the legitimacy of the current process of keyboard focus change function according to feature database detection.
The third example, prestores process reliable, believable binding secure ID, thus keyboard is called in Hook Function capture
After the current process of focus change function, whether detection current process has above-mentioned secure ID to detect the legal of current process
Property.
In sum, the keyboard focus change method of the embodiment of the present invention, at the keyboard focus that monitor operating system kernel provides
Change function is when being called, if monitoring current process when calling keyboard focus change function, runs preset burnt with keyboard
The Hook Function that some change function is corresponding, to capture current process and to detect the legitimacy of current process, works as if detection is known
Front process is legal, then allow current process to call keyboard focus change function, so that keyboard focus is arranged on target window.By
This, it is to avoid keyboard focus is maliciously tampered, and protects the safety of operating system.
In order to more clearly describe the legitimacy how detecting current process, 2 it is illustrated below in conjunction with the accompanying drawings,
In this example, comprised the feature database of associated process feature by setting, and call keyboard focus change letter by feature database detection
The legitimacy of the current process of number, is described as follows:
Fig. 2 is the flow chart of the keyboard focus change method according to one specific embodiment of the present invention, as in figure 2 it is shown, this key
Dish focus change method includes:
S210, arranges the Hook Function corresponding with keyboard focus change function in the defence with network security application drives.
It should be appreciated that according to the difference of application scenarios, the Hook Function corresponding with keyboard focus change function can be set
It is placed in multiple positions of operating system.In the keyboard focus change method of the embodiment of the present invention, in order to by relevant in operating system
The integration of the resource of Prevention-Security, is arranged at the Hook Function corresponding with keyboard focus change function and has network security application
Defence drive in.
S220, whether the keyboard focus change function that monitor operating system kernel provides is called.
S230, if monitoring current process to call keyboard focus change function, what operation was preset changes function with keyboard focus
Corresponding Hook Function.
It should be noted that the description of step S220-S230 is corresponding with above-mentioned steps S110-S120, therefore to step
S220-S230 describes the description with reference to above-mentioned steps S110-S120, does not repeats them here.
S240, according to the legitimacy of default feature database detection current process.
S250, if detection knows that current process is legal, then allows current process to call keyboard focus change function, with by key
Dish focus is arranged on target window.
S260, if detection knows that current process is illegal, then refusal current process calls keyboard focus change function.
Specifically, the present embodiment calls, according to the feature database detection preset, the legitimacy that keyboard focus changes the process of function.As
The process that keyboard focus change function is called in fruit detection is illegal, then show that the process calling this keyboard focus change function is probably
Malicious process, thus refuse this process and call keyboard focus change function.If entering of keyboard focus change function is called in detection
Cheng Hefa, then allow current process to call keyboard focus change function, so that keyboard focus is arranged on target window.
It should be noted that the particular content in feature database can be configured according to application needs, such as, include legitimate processes
White list, and/or, including the blacklist of illegal process.It is illustrated below:
The first example, can include white list in feature database, the process that the progress information that comprises in white list is corresponding be legal enter
Journey, it is allowed to this process is called keyboard focus change function and is not result in that keyboard focus is maliciously altered.
In this example, determine the current process calling keyboard focus change function, inquire about spy according to the progress information of this process
Levy storehouse, if inquiry obtains this progress information, mate with the progress information in white list, then it is assumed that this process is legitimate processes,
Therefore this process is allowed to call keyboard focus change function, so that keyboard focus is arranged on target window.Should if inquiry obtains
Progress information, does not mates with the progress information in white list, then it is assumed that this process is illegal process, therefore refuses this process and adjusts
Function is changed with keyboard focus.
The second example, comprises blacklist in feature database, the process that progress information that blacklist comprises is corresponding is illegal process,
For instance it can be possible that the process that rogue program is corresponding, can cause keyboard burnt if allowing this process to call keyboard focus change function
The malice change of point, the application program affecting other obtains the use to keyboard, the safety of operating system is brought destruction.
In this example, determine the current process calling keyboard focus change function, look into according to the progress information of this current process
Ask feature database, if the progress information that the progress information of this process comprises with blacklist mates, then it is assumed that this process is illegally to enter
Journey, therefore refuses this process and calls keyboard focus change function.If the process that the progress information of this process and blacklist comprise
Information is not mated, then it is assumed that this process is legitimate processes, therefore allows this process to call keyboard focus change function, with by key
Dish focus is arranged on target window.
The third example, can comprise blacklist and white list in feature database, the process that the progress information that comprises in white list is corresponding
Being legitimate processes, the process that the progress information that comprises in blacklist is corresponding is illegal process.
In this example, determine the current process calling keyboard focus change function, inquire about spy according to the progress information of this process
Levy storehouse, if inquiry obtains this progress information, mate with the progress information of white list, then it is assumed that this process is legitimate processes,
Therefore this process is allowed to call keyboard focus change function, so that keyboard focus is arranged on target window；If entering of this process
The progress information that journey information comprises with blacklist mates, then it is assumed that this process is illegal process, therefore refuses this process CK call key
Dish focus change function.
In sum, the keyboard focus change method of the embodiment of the present invention, by the hook letter corresponding with keyboard focus change function
Number is arranged in the defence driving with network security application, and judges to call keyboard focus change function process by feature database
Legitimacy, only when this process is legal, just allow this process to keyboard focus change function call, by keyboard focus
Change is in fixed area, so that keyboard focus is arranged on target window.Thus, it is to avoid keyboard focus is maliciously tampered, protect
Protect the safety of operating system.
In order to realize above-described embodiment, the invention allows for a kind of keyboard focus change device, Fig. 3 is according to the present invention one
The structural representation of the keyboard focus change device of individual embodiment, as it is shown on figure 3, this keyboard focus change device includes:
Monitoring modular 110, whether the keyboard focus change function provided for monitor operating system kernel is called.
Run module 120, for when monitoring current process and calling keyboard focus change function, running preset and keyboard
The Hook Function that focus change function is corresponding.
Detection module 130, for detecting the legitimacy of current process.
Processing module 140, for when detection knows that current process is legal, it is allowed to current process calls keyboard focus change letter
Number, to be arranged on target window by keyboard focus.
Specifically, in order to realize before allowing calling process to use keyboard focus change function, it is judged that calling process legal
Property, the embodiment of the present invention arranges in system in advance and changes, by focus, the Hook Function that function is corresponding with keyboard.
And then, whether the keyboard focus change function that monitoring modular 110 monitor operating system kernel provides is called, Mei Dangjian
Survey module 110 and monitor keyboard focus change function when being called, run module 120 and then runs default with this keyboard focus
The Hook Function that change function is corresponding.
I.e. operating system respond this keyboard focus change function call event before, by with this light keyboard focus change
It is the most legal that the Hook Function that function is corresponding calls this keyboard focus change function process with judgement.
Further, after the process of keyboard focus change function is called in Hook Function capture, detection module 130 detects this and enters
The legitimacy of journey, if detection module 130 detection knows that current process is legal, processing module 140 then allows current process to adjust
Keyboard focus is arranged on target window, to meet the properly functioning of related application with keyboard focus change function.
In sum, the keyboard focus change device of the embodiment of the present invention, at the keyboard focus that monitor operating system kernel provides
Change function is when being called, if monitoring current process when calling keyboard focus change function, runs preset burnt with keyboard
The Hook Function that some change function is corresponding, to capture current process and to detect the legitimacy of current process, works as if detection is known
Front process is legal, then allow current process to call keyboard focus change function, so that keyboard focus is arranged on target window.By
This, it is to avoid keyboard focus is maliciously tampered, and protects the safety of operating system.
In order to more clearly describe the legitimacy how detecting current process, 4 it is illustrated below in conjunction with the accompanying drawings,
In this example, comprised the feature database of associated process feature by setting, and call keyboard focus change letter by feature database detection
The legitimacy of the current process of number, is described as follows:
Fig. 4 is the structural representation of the keyboard focus change device according to one specific embodiment of the present invention, as shown in Figure 4,
On the basis of as shown in Figure 3, this keyboard focus change device also includes:
Arranging module 150, for when detection knows that current process is illegal, refusal current process calls keyboard focus change letter
Number.
It should be appreciated that according to the difference of application scenarios, the Hook Function corresponding with keyboard focus change function can be set
It is placed in multiple positions of operating system.In the cursor processing means of the embodiment of the present invention, in order to by associated safety in operating system
The integration of resource of defence, arranges module 150 and is arranged at by the Hook Function corresponding with keyboard focus change function and has network
During the defence of safety applications drives.
Further, when the keyboard focus change function that monitoring modular 110 monitors operating system nucleus offer is called,
Run module 120 and run the Hook Function acquisition current process corresponding with keyboard focus change function preset.
And then detection module 130 calls, according to default feature database detection, the legitimacy that keyboard focus changes the process of function.As
Really detection module 130 detection calls the process of keyboard focus change function illegally, then show to call this keyboard focus change function
Process be probably malicious process, thus processing module 140 is refused this process and is called keyboard focus change function.If detection
The process that keyboard focus change function is called in module 130 detection is legal, then processing module 140 allows current process to call keyboard
Focus change function, to be arranged on target window by keyboard focus.
It should be noted that the particular content in feature database can be configured according to application needs, such as, include legitimate processes
White list, and/or, including the blacklist of illegal process.
It should be appreciated that the keyboard that the keyboard focus change device that we's embodiment describes describes with above-mentioned combination Fig. 1-Fig. 2
Focus change method is corresponding, the details not disclosed in the embodiment of the keyboard focus change device of the present invention, does not repeats them here.
In sum, the keyboard focus change device of the embodiment of the present invention, by the hook letter corresponding with keyboard focus change function
Number is arranged in the defence driving with network security application, and judges to call keyboard focus change function process by feature database
Legitimacy, only when this process is legal, just allow this process to keyboard focus change function call, by keyboard focus
Change is in fixed area, so that keyboard focus is arranged on target window.Thus, it is to avoid keyboard focus is maliciously tampered, protect
Protect the safety of operating system.
In order to realize above-described embodiment, the invention allows for a kind of terminal unit, Fig. 5 is according to one embodiment of the invention
The structural representation of terminal unit.
As it is shown in figure 5, the terminal unit of the embodiment of the present invention includes that keyboard focus changes device 1000.
Wherein it is desired to explanation, the keyboard focus change device 1000 in the embodiment of the present invention and reference in above-described embodiment
The keyboard focus change device that Fig. 3-Fig. 4 describes is corresponding, does not repeats them here.
In sum, the terminal unit of the embodiment of the present invention, at the keyboard focus change function that monitor operating system kernel provides
Time called, if monitoring current process when calling keyboard focus change function, run preset change letter with keyboard focus
The Hook Function that number is corresponding, to capture current process and to detect the legitimacy of current process, if detection knows that current process is closed
Method, then allow current process to call keyboard focus change function, so that keyboard focus is arranged on target window.Thus, it is to avoid
Keyboard focus is maliciously tampered, and protects the safety of operating system.
In order to realize above-described embodiment, the invention allows for another kind of terminal unit.
Fig. 6 is the structural representation of the terminal unit according to one specific embodiment of the present invention.As shown in Figure 6, this terminal sets
Standby 2000 can be mobile phone etc..
Seeing Fig. 6, terminal unit 2000 can include following one or more assembly: processor 2001, memorizer 2002,
Power circuit 2003, multimedia groupware 2004, audio-frequency assembly 2005, the interface 2006 of input/output (I/O), sensor
Assembly 2007, and communications component 2008.
Power circuit 2003, powers for each circuit or the device for terminal unit；Memorizer 2002 is used for storing can be held
Line program code；Processor 2001 runs by reading the executable program code of storage in memorizer 2002 and can perform
The program that program code is corresponding, for performing following steps:
Whether the keyboard focus change function that monitor operating system kernel provides is called.
If monitoring current process to call keyboard focus change function, it is corresponding with keyboard focus change function that operation is preset
Hook Function.
The legitimacy of detection current process.
If detection knows that current process is legal, then current process is allowed to call keyboard focus change function, with by keyboard focus
It is arranged on target window.
It should be noted that the above-mentioned description to terminal unit 2000 refers to above-mentioned combination Fig. 1 and Fig. 2 to keyboard focus more
Change the description of method, do not repeat them here.
In sum, the terminal unit of the embodiment of the present invention, at the keyboard focus change function that monitor operating system kernel provides
Time called, if monitoring current process when calling keyboard focus change function, run preset change letter with keyboard focus
The Hook Function that number is corresponding, to capture current process and to detect the legitimacy of current process, if detection knows that current process is closed
Method, then allow current process to call keyboard focus change function, so that keyboard focus is arranged on target window.Thus, it is to avoid
Keyboard focus is maliciously tampered, and protects the safety of operating system.
In the description of this specification, reference term " embodiment ", " some embodiments ", " example ", " tool
Body example " or the description of " some examples " etc. means to combine this embodiment or example describes specific features, structure, material
Material or feature are contained at least one embodiment or the example of the present invention.In this manual, the signal to above-mentioned term
Property statement be necessarily directed to identical embodiment or example.And, the specific features of description, structure, material or spy
Point can be to combine in one or more embodiments in office or example in an appropriate manner.Additionally, in the case of the most conflicting,
Those skilled in the art can be by the different embodiments described in this specification or example and different embodiment or the spy of example
Levy and be combined and combine.
Although above it has been shown and described that embodiments of the invention, it is to be understood that above-described embodiment is exemplary,
Being not considered as limiting the invention, those of ordinary skill in the art within the scope of the invention can be to above-described embodiment
It is changed, revises, replaces and modification.
Claims (10)
1. a keyboard focus change method, it is characterised in that comprise the following steps:
Whether the keyboard focus change function that monitor operating system kernel provides is called；
If monitoring current process to call described keyboard focus change function, what operation was preset changes letter with described keyboard focus
The Hook Function that number is corresponding；
The legitimacy of detection current process；
If detection knows that current process is legal, then current process is allowed to call described keyboard focus change function, with by keyboard
Focus is arranged on target window.
2. the method for claim 1, it is characterised in that also include:
If detection knows that current process is illegal, then refusal current process calls described keyboard focus change function.
3. the method for claim 1, it is characterised in that at the keyboard focus that described monitor operating system kernel provides
Before change function is the most called, also include:
The Hook Function corresponding with described keyboard focus change function is set in the defence with network security application drives.
4. method as claimed in claim 3, it is characterised in that the legitimacy of described detection current process, including:
Legitimacy according to default feature database detection current process.
5. method as claimed in claim 4, it is characterised in that described feature database includes:
The white list of legitimate processes, and/or, the blacklist of illegal process.
6. a keyboard focus change device, it is characterised in that including:
Monitoring modular, whether the keyboard focus change function provided for monitor operating system kernel is called；
Run module, for monitor current process call described keyboard focus change function time, run preset with described
The Hook Function that keyboard focus change function is corresponding；
Detection module, for detecting the legitimacy of current process；
Processing module, for when detection knows that current process is legal, it is allowed to current process calls described keyboard focus change letter
Number, to be arranged on target window by keyboard focus.
7. device as claimed in claim 6, it is characterised in that described processing module is additionally operable to:
When detection knows that current process is illegal, refusal current process calls described keyboard focus change function.
8. device as claimed in claim 6, it is characterised in that also include:
Module is set, arranges corresponding with described keyboard focus change function in driving in the defence with network security application
Hook Function.
9. device as claimed in claim 8, it is characterised in that described detection module is used for: according to default feature database inspection
Survey the legitimacy of current process.
10. device as claimed in claim 9, it is characterised in that described feature database includes:
The white list of legitimate processes, and/or, the blacklist of illegal process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610517603.8A CN105930729A (en) | 2016-07-04 | 2016-07-04 | Keyboard focus changing method and device and terminal equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610517603.8A CN105930729A (en) | 2016-07-04 | 2016-07-04 | Keyboard focus changing method and device and terminal equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN105930729A true CN105930729A (en) | 2016-09-07 |
Family
ID=56829723
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610517603.8A Pending CN105930729A (en) | 2016-07-04 | 2016-07-04 | Keyboard focus changing method and device and terminal equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105930729A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107967156A (en) * | 2016-10-18 | 2018-04-27 | 北京众纳鑫海网络技术有限公司 | The background video control method and device of computer video desktop |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102243699A (en) * | 2011-06-09 | 2011-11-16 | 深圳市安之天信息技术有限公司 | Malicious code detection method and system |
| CN103020527A (en) * | 2012-12-21 | 2013-04-03 | 北京奇虎科技有限公司 | Method, device and system for actively intercepting malicious programs |
| CN105354498A (en) * | 2015-10-30 | 2016-02-24 | 珠海市君天电子科技有限公司 | Operation method of registry, related device and equipment |
-
2016
- 2016-07-04 CN CN201610517603.8A patent/CN105930729A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102243699A (en) * | 2011-06-09 | 2011-11-16 | 深圳市安之天信息技术有限公司 | Malicious code detection method and system |
| CN103020527A (en) * | 2012-12-21 | 2013-04-03 | 北京奇虎科技有限公司 | Method, device and system for actively intercepting malicious programs |
| CN105354498A (en) * | 2015-10-30 | 2016-02-24 | 珠海市君天电子科技有限公司 | Operation method of registry, related device and equipment |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107967156A (en) * | 2016-10-18 | 2018-04-27 | 北京众纳鑫海网络技术有限公司 | The background video control method and device of computer video desktop |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104376263B (en) | The method and apparatus that application behavior intercepts | |
| CN106156619B (en) | Application security protection method and device | |
| WO2015035895A1 (en) | Methods, devices, and systems for account login | |
| CN105873068B (en) | Method and device for identifying pseudo base station | |
| CN105049592B (en) | Mobile intelligent terminal voice safety protection method and system | |
| CN101754213B (en) | Smart card, terminal equipment, and authentication server for guaranteeing application safety and methods thereof | |
| CN109697359A (en) | A kind of message prompt method, device, storage medium and electronic equipment | |
| CN107466041B (en) | Method and device for identifying pseudo base station and mobile terminal | |
| CN103577773A (en) | Mobile equipment safety protection method and device based on Android | |
| JP6429896B2 (en) | Base station access method, apparatus, program, and recording medium | |
| CN105072079A (en) | Account logon method, account logon device and terminal device | |
| CN104427089A (en) | Mobile terminal and mobile terminal authority management method | |
| CN106203111A (en) | Method and device for preventing clipboard data from being modified and terminal equipment | |
| CN100346248C (en) | Method and arrangement for automatically controlling access between a computer and a communication network | |
| CN105809440B (en) | Online payment method and device | |
| CN107992745A (en) | Kidnap countermeasure in a kind of interface based on Android platform | |
| CN111246451A (en) | Function setting method and device of SIM card, storage medium and terminal | |
| CN102497479B (en) | Method for smart phone to judge Trojprograms according to application software behaviors | |
| CN105930729A (en) | Keyboard focus changing method and device and terminal equipment | |
| CN106203079A (en) | Cursor processing method and device and terminal equipment | |
| CN106127041A (en) | Method and device for preventing clipboard data from being monitored and terminal equipment | |
| CN106203189A (en) | Equipment data acquisition method and device and terminal equipment | |
| CN115378686A (en) | Sandbox application method and device of industrial control network and storage medium | |
| CN105430090A (en) | Information push method and device | |
| CN106169046A (en) | Method and device for preventing message hook injection and terminal equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination |