WO2012097553A1

WO2012097553A1 - Virus prevention method and system for intelligent mobile terminal

Info

Publication number: WO2012097553A1
Application number: PCT/CN2011/073710
Authority: WO
Inventors: 周昊; 杨小明; 甘惠亮; 苏玉婷
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-01-20
Filing date: 2011-05-05
Publication date: 2012-07-26
Also published as: CN102045368A

Abstract

A virus prevention method and system for an intelligent mobile terminal are provided. In the above method, a communication processor of the intelligent mobile terminal performs protocol resolution for the received downlink data, and obtains payload of the downlink data by resolution (S702); the communication processor matches the payload with suspected virus features to obtain a match degree value (S704); when the match degree value is greater than a threshold value, the communication processor transmits the payload to the base station to perform the subsequent virus analysis (S706). With the technical schemes provided by the present invention, virus is prevented effectively in the intelligent mobile terminal, and the decrease of operation efficiency in the mobile terminal due to the virus detection and killing is avoided.

Description

The present invention relates to the field of communications, and in particular to a virus flood prevention method and system for an intelligent mobile terminal. BACKGROUND In a large environment where smart mobile terminals (for example, smart phones) are becoming more and more popular and accepted and used by people, there are some criminals who can use smart mobile terminals to install application software at will, and manufacture and Spreading smartphone viruses and malware, there are digital displays. From December 2009 to June 2010, there were more than 500 new mobile phone viruses in the world in just half a year, which is more than the sum of previous years. Once hundreds of millions of smartphone users are infected with viruses, or the back door of some mobile phone software is maliciously exploited, it is likely to cause incalculable losses to users. FIG. 1 is a schematic diagram of a virus intrusion smartphone in the related art. As shown in Figure 1, the virus intrusion intelligent mobile terminal is mainly divided into the following processes: Process (1): The process of hiding and spreading the virus in the mobile phone network; Process (2): The process of the virus reaching the smartphone communication processor through the base station; Process (3): The virus arrives at the application processor process through the smartphone communication processor; Process (4): The virus is implanted in the process of applying the processor; Process (5): Virus triggering and bursting process. At present, the virus defense and killing system of intelligent mobile terminals are gradually improving, but mainly focus on virus detection and removal, and the detection and removal work is completed on the smartphone local application processor. At present, the operating frequency of the processor of the terminal is biased. When the application detects the virus in parallel, the operation efficiency is too low, and only if the virus is checked and killed, the effective interception of similar or similar viruses cannot be achieved. Or the effect of a malicious program propagation path. Summary of the invention

The virus detecting and erasing work of the smart mobile terminal in the related technology is completed on the local application processor, resulting in the problem of low operating efficiency, and the invention provides a virus anti-smashing method and system for the intelligent mobile terminal To solve at least one of the above problems. In an aspect of the invention, a virus anti-P method for an intelligent mobile terminal is provided. The virus defense method of the intelligent mobile terminal according to the present invention includes: the communication processor of the intelligent mobile terminal performs protocol decomposition on the received downlink data, and parses out the payload of the downlink data; the communication processor matches the payload with the suspected virus feature To obtain a matching value; when the matching value is greater than the threshold, the communications processor transmits the payload to the base station to perform subsequent virus analysis. The communication processor performs protocol decomposition on the received downlink data, including: the communication processor determines whether the downlink data is circuit domain data or packet domain data; when the downlink data is circuit domain data, parses according to a short message format or a circuit domain data format. When the downlink data is packet domain data, the payload of the downlink data is parsed by the transport layer protocol, the routing layer protocol, and the upper layer protocol. When the matching value is obtained, the method further includes: when the matching value is less than or equal to the threshold, the communications processor directly sends the downlink data to the application processor of the smart mobile terminal. Performing the subsequent virus analysis by the base station includes: The base station matches the payload with the virus information in the virus database, and determines whether the downlink data is virus information. When determining that the downlink data is virus information, the method further includes: the communication processor receiving the determination response and the analysis report from the base station feedback, wherein the determining response carries the indication information that the downlink data is the virus information; the communication processor intercepts the downlink data and the local The data other than the downlink data in the secondary transmission, and the information corresponding to the downlink data is recorded. The information corresponding to the downlink data includes at least one of the following: source information of the data packet, and a propagation path. In one aspect of the invention, a virus anti-P system for an intelligent mobile terminal is provided. The virus defense system of the smart mobile terminal according to the present invention includes: an intelligent mobile terminal; the smart mobile terminal includes: a communication processor; the communication processor further includes: a protocol analysis module configured to perform protocol decomposition and parsing on the received downlink data The payload of the downlink data; the first decision mode a block, configured to match the payload with the suspected virus feature to obtain a matching value, and determine whether the matching value is greater than a threshold; the first communication module is configured to send the valid to the base station when the output of the first determining module is YES Load to perform subsequent virus analysis. The base station includes: a second communication module configured to receive a payload from the first communication module; and a second determination module configured to perform virus analysis on the downlink data according to the payload. The protocol analysis module includes: a determining unit, configured to determine whether the downlink data is circuit domain data or packet domain data; and the first parsing unit is configured to parse the short message format or the circuit domain data format when the downlink data is circuit domain data The payload of the downlink data; the second parsing unit is configured to parse the payload of the downlink data by using a transport layer protocol, a routing layer protocol, and a higher layer protocol when the downlink data is packet domain data. The smart mobile terminal further includes: an application processor, configured to receive downlink data from the communications processor when the matching value is less than or equal to the threshold. The second determining module includes: a matching unit configured to match the payload with the virus information in the virus database to determine whether the downlink data is virus information. The first communication module is further configured to receive the determination response and the analysis report from the feedback of the base station, where the determination response carries the indication information that the downlink data is the virus information; the communication processor further includes: an intercepting module, configured to intercept the downlink data And other data except the downlink data in the current transmission; the statistics module is set to record the information corresponding to the downlink data. Through the invention, the communication processor of the intelligent mobile terminal and the mobile network base station are combined to implement virus protection and unloading of the intelligent mobile terminal, and the virus detection and removal of the intelligent mobile terminal are all performed on the local application processor. The virus detection and removal work of the smart phone in the related art is solved on the local application processor, which leads to the problem of low operation efficiency, effectively realizes the virus defense against the intelligent mobile terminal, and avoids the reduction of the virus when the virus is detected. The operating efficiency of intelligent mobile terminals. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a schematic diagram of a virus intrusion intelligent mobile terminal in the related art; 2 is a structural block diagram of a virus defense system of an intelligent mobile terminal according to an embodiment of the present invention; FIG. 3 is a structural block diagram of a virus anti-P system of an intelligent mobile terminal according to a preferred embodiment of the present invention; FIG. 5 is a flowchart showing the operation of the first decision module and the first communication module according to a preferred embodiment of the present invention; FIG. 6 is a second embodiment of the preferred embodiment of the present invention; FIG. 7 is a flowchart of a virus anti-discharge method of an intelligent mobile terminal according to an embodiment of the present invention; FIG. 8 is a preferred implementation according to the present invention. A flow chart of a virus defense method for an intelligent mobile terminal. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. 2 is a structural block diagram of a virus anti-discharge system of an intelligent mobile terminal according to an embodiment of the present invention. As shown in FIG. 2, the virus defense system includes: an intelligent mobile terminal 1; wherein, the smart mobile terminal 1 includes: a communication processor 10; the communication processor 10 further includes: a protocol analysis module 100, configured to receive downlink data Performing protocol decomposition to parse the payload of the downlink data; the first determining module 102 is configured to match the payload with the suspected virus feature to obtain a matching value, and determine whether the matching value is greater than a threshold; the first communication module 104 And being configured to send a payload to the base station to perform subsequent virus analysis when the first decision module output is YES. Preferably, as shown in FIG. 3, the foregoing virus defense system may further include: a base station 2, the base station may further include: a second communication module 200, configured to receive a payload from the first communication module; The second determining module 204 is configured to perform virus analysis on the downlink data by using the payload. In the related art, an intelligent mobile terminal (for example, a smart phone) processor is divided into an application processor and a communication processor, wherein a general application processor operating system is mostly a common platform (such as Windows, Linux, etc.). There are many viruses for these platforms, and the operating systems of communication processors are some RTOSs, and the possibility of being infected by viruses is very small. Therefore, in this embodiment, it is not easy to be infected by viruses on the communication processor. Destruction, risk is better than 'J. In addition, the application processor of the intelligent mobile terminal is usually also responsible for local external storage, and the virus usually needs to be stored for self-replication and self-replication and re-propagation. Controlling the virus on the application processor is "killing" ,,,, and blocking the virus on the communication processor is "preventing the problem," and the virus or malicious program is discarded and not safely rooted in the mobile phone. Preferably, the foregoing protocol analysis module 100 may further include: a determining unit 1000 (not shown in FIG. 3) configured to determine whether the downlink data is circuit domain data or packet domain data; the first parsing unit 1002 (not shown in FIG. 3 And being configured to parse the payload of the downlink data according to the short message format or the circuit domain data format when the downlink data is the circuit domain data; the second parsing unit 1004 (not shown in FIG. 3) is set to be in the downlink data. When packet domain data is used, the payload of the downlink data is parsed by the transport layer protocol, the routing layer protocol, and the upper layer protocol. The detailed workflow of the above protocol analysis module will be described below with reference to FIG. As shown in FIG. 4, the following processing is mainly included: Step S402: All submodules in the communication processor of the smart mobile terminal (for example, a smart phone) are started when the communication processor is started, and run in the background at work; S404: The protocol analysis module monitors whether data arrives. Step S406: After receiving the data packet, the protocol analysis module first determines, according to the current service, that the data arrives at the mobile terminal through the circuit domain or the packet domain. Step S408: If it is a circuit domain, perform protocol analysis according to the normal short message format or the circuit domain data format, extract the payload of the user data, and submit the payload to the first determining module 102, and end the current processing. Step S410: If it is a packet domain, the protocol is analyzed by using a transport layer protocol and a routing layer protocol. Step S412: Determine how the downlink data is encapsulated in the upper layer protocol stack, and divide it into IP/PPP HTTP/MMS/SMTP according to a common protocol, and parse the payload of the user data, and submit it to the first determining module 102, ending the present Secondary processing. Preferably, as shown in FIG. 3, the smart mobile terminal 1 may further include: an application processor 12 configured to receive downlink data from the communications processor when the matching value is less than or equal to the threshold. That is, when the matching degree value is less than or equal to the threshold, the communication processor 10 is set to directly transmit the downlink data to the application processor 12 of the smart mobile terminal. Preferably, as shown in FIG. 3, the second determining module 204 includes: a matching unit 2040 (not shown in FIG. 3) configured to match the payload with the virus information in the virus database to determine whether the downlink data is virus information. . The detailed workflow of the first decision module and the first communication module will be described below with reference to FIG. FIG. 5 is a flowchart showing the operation of the first determining module 102 and the first communication module 104 according to a preferred embodiment of the present invention. As shown in FIG. 5, the method includes the following steps: Step S502: The first determining module 102 monitors whether data arrives. Step S504: The first determining module 102 receives the data information submitted by the protocol analyzing module 100, and needs to perform the first time. determination. Specifically, the virus suspicious judgment can be made according to a very simple matching rule (for example, data source, data length, basic characteristics of the virus head, file type, etc.), that is, the basic principle of arbitrarily misjudged and not missed, and effectively avoiding the virus Leaking the net. For example, step S506, step S508, and step S510 are performed. Step S506: determining whether the downlink data is suspicious source data; if yes, executing step S512. Otherwise, step 4 is performed to gather S 508. Step S508: Determine whether the data format is suspicious. If yes, step S512 is performed, otherwise step 4 is performed S510. Step S510: The other determination criterion is used to determine whether the downlink data is suspicious. If yes, step S512 is performed, otherwise, step 4 is performed S514. Step S512: The first determining module 102 determines that the virus is suspected, and submits the payload of the downlink data to the first communication module 104. The first communication module 104 directly submits the payload of the first determining module 102 to the base station of the cloud. With a second decision request message. The communication processor of the intelligent mobile terminal generally has a low main frequency and has high real-time requirements in the communication process, so it is not suitable for running a virus detailed matching algorithm program requiring high time complexity on the communication processor, so the intelligence is The communication processor of the mobile terminal is only responsible for the virus one-time decision, finds suspicious data and submits it to the base station for processing. Step S514: The first determining module 102 determines that the non-suspicious virus is directly submitted to the application processor 12 of the smart mobile terminal 1. Preferably, as shown in FIG. 3, the first communication module 104 is further configured to receive a determination response and an analysis report fed back from the base station, where the determination response carries indication information that the downlink data is virus information; The data may further include: an intercepting module 106, configured to intercept downlink data and other data in the current transmission except the downlink data; and a statistics module 108, configured to record information corresponding to the downlink data, where the information may include but not limited to the following At least one: source information of the packet, propagation path. Setting the statistics module 108 can facilitate collecting virus-related information as a basis for the next determination, and can effectively prevent future infringement of similar viruses. It should be noted that statistical modules of the same function can also be deployed in base stations and other wireless access point systems, and a special mobile virus statistics library can be established to collect activity data of those criminals, find virus sources and collect viruses. sample. The detailed workflow of the second communication module, the second determination module, the interception module, and the statistics module will be described below with reference to FIG. 6 is a flowchart showing the operation of a second communication module, a second determination module, an interception module, and a statistics module in accordance with a preferred embodiment of the present invention. As shown in FIG. 6, the method mainly includes the following steps: Step S602: The second communication module 200 waits to receive a scan request and scanned data (ie, the above payload) sent by the communication processor of the smart mobile terminal. Step S604: After the second communication module 200 receives the data to be scanned and the scan request, the second determining module 200 located at the cloud base station performs a second scan determination on the data. It should be noted that the second decision module 200 deployed on the base station is not always running because the traffic of the base station is large and busy. After receiving the suspicious data sent by the smartphone and the second determination request, the base station immediately starts the virus secondary determination program to perform detailed scanning on the suspicious data, and the matching criterion is to match according to the standard virus database, if it is confirmed that the program includes The mobile phone virus immediately sends feedback and virus information to the smartphone. When the smart mobile terminal needs to perform more detailed detection on the virus, it then initiates a request to the base station, which greatly reduces the burden on the base station. In this way, the communication processor of the client and the cloud base station work together, so that the processing capability of the virus is greatly improved. Step S606: The second determining module 200 matches the payload with the virus information in the virus database to determine whether the downlink data is virus information. If yes, go to step S608, otherwise, go to step S610. Step S608: The second communication module 200 sends a scan message to the smart mobile terminal, indicating that the data is a virus. Then, the process returns to step S602. Step S610: The second communication module 200 sends a scan 4 notification to the smart mobile terminal, indicating that the data is not a virus. Then, the process returns to step S602. Step S612: The first communication module 104 waits to receive a virus secondary scan. Step S614: It is determined whether the determination result is a virus. If yes, go to step S616, otherwise, go to step S618. Step S616: The data code that is determined to be the mobile terminal virus in the virus secondary determination is received by the statistical module of the smart mobile terminal, and the intercepting module immediately stops processing the data other than the downlink data in the current transmission. Discard the data so as not to invade the application processor, and the statistics module records the source of the packet (short message sender number, IP source address, IP transmission route, etc.) currently determined to be virus data, as the basis for the next decision. If you receive data from these sources, you should prioritize its potential as virus data. After that, the process returns to step S612. Step S618: The communication processor of the smart mobile terminal directly sends the downlink data to the application processor of the smart mobile terminal. After that, the process returns to step S612. FIG. 7 is a flowchart of a virus anti-discharge method of an intelligent mobile terminal according to an embodiment of the present invention. As shown in FIG. 7, the virus anti-discharging method mainly includes the following processing: Step S702: The communication processor of the intelligent mobile terminal performs protocol decomposition on the received downlink data, and parses the payload of the downlink data. Step S704: The communication processor matches the payload with the suspected virus feature to obtain a matching value. Step S706: When the matching degree value is greater than the threshold, the communications processor sends the payload to the base station to perform subsequent virus analysis. In the related art, the virus detection and cleaning work of the intelligent mobile terminal is performed on the local application processor, and detecting the virus when the application runs in parallel may result in low operation efficiency. Starting from the process (3) in FIG. 1, the above modules are deployed on the communication processor of the intelligent mobile terminal and the mobile network base station, and the communication processor and the base station are combined to effectively implement the virus protection against the smart mobile terminal. And to avoid the operation efficiency of the descending intelligent mobile terminal when killing the virus. Preferably, the above step S702 may further include the following processing:

(1) The communication processor determines whether the downlink data is circuit domain data or packet domain data;

(2) When the downlink data is circuit domain data, the payload of the downlink data is parsed according to the short message format;

(3) When the downlink data is packet domain data, the payload of the downlink data is parsed according to the transport layer protocol and the routing layer protocol. Preferably, when the matching degree value is less than or equal to the threshold, the communications processor directly sends the downlink data to the application processor of the smart mobile terminal. Preferably, the performing the subsequent virus analysis by the base station may further include the following process: The base station matches the payload with the virus information in the virus database to determine whether the downlink data is virus information. Preferably, when it is determined that the downlink data is virus information, the following processing may also be included:

(1) The communication processor receives the determination response and the analysis report from the feedback of the base station, wherein the determination response carries the indication information that the downlink data is the virus information; (2) the communication processor intercepts the downlink data and the downlink data in the current transmission Other data than the other, and record the information corresponding to the downlink data. The information corresponding to the downlink data includes, but is not limited to, at least one of the following: source information of the data packet, and a propagation path. The following preferred embodiments are described in detail below by taking a smart mobile terminal as a smart phone as an example. FIG. 8 is a flowchart of a virus anti-discharge method of a smart mobile terminal according to a preferred embodiment of the present invention. As shown in FIG. 8, the virus anti-discharge method mainly includes the following processing: Step S802: The communication processor of the smart phone receives the downlink data. Step S804: The communication processor performs protocol decomposition on all downlink data (including Circuit Switch (CS) domain and Packet Switch (PS) domain) in accordance with different communication protocols. This process involves the above protocol analysis module. Step S806: The decomposed payload is determined by the first determining module of the smartphone communication processor. In the specific implementation process, a simple decision criterion can be set. Due to the low time complexity of the algorithm, the normal operation of the smartphone communication processor is hardly affected. Step S808: The first determining module determines whether it is a suspected virus. If yes, go to step S810, otherwise, go to step S822. Step S810: If the determination result is established, that is, the matching degree between the payload and the suspected virus feature is considered to be high, and if the threshold value is exceeded, the communication processor pauses to send the downlink data to the application processor, and the first communication module transfers the payload. Submitted to the cloud base station, and initiates a virus secondary determination request to the cloud base station. Step S812: The cloud base station receives the virus secondary determination request and the payload data of the suspected virus, and inputs a virus secondary determination procedure (ie, the second determination module) that is dependent on the high-speed processing device. Step S814: Detailed virus analysis is performed by the second determination module to analyze whether it is a virus and which virus. If it is a virus, the process goes to step S816, and if it is not a virus, the process goes to step S818. Step S816: The cloud base station organizes the detailed analysis result into a communication processor that is sent to the smart phone, and attaches a virus secondary determination response, indicating that the payload is a virus or a malicious program. Step S818: The smartphone communication processor receives the second determination response and the analysis report, intercepts the segment data, does not allow the data to be sent to the smartphone application processor, and records the virus or malicious program information on the external memory of the communication processor. , including the data source and the propagation path. When the data of this source or propagation path arrives in the future, it will automatically report to the cloud base station for a second decision. Step S820: The cloud base station organizes the detailed analysis result into a communication processor that is sent to the smart phone, and attaches a virus secondary determination response, indicating that the payload is safety data. Step S822: If the data is not a virus or a malicious program, the smartphone communication processor directly transmits the valid data to the application processor for processing. It should be noted that in terms of the communication processor, since the smart phone can not only support the traditional base station communication, but also supports the communication modes such as Wi-Fi and Bluetooth, the data transmission path can be diversified and can be deployed. A similar solution is on Wi-Fi, Bluetooth processing chips or drivers as well as Wi-Fi, Bluetooth access points. In summary, with the above embodiments provided by the present invention, a communication processor of a smart mobile terminal (for example, a smart phone) and a mobile network base station are combined to implement effective detection, interception, and virus transmission of the smart phone virus. Paths and virus types are monitored to effectively avoid future hidden dangers. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A virus anti-p method for an intelligent mobile terminal, comprising:

The communication processor of the intelligent mobile terminal performs protocol decomposition on the received downlink data, and analyzes the payload of the downlink data;

The communication processor matches the payload with a suspected virus signature to obtain a match value;

The communication processor transmits the payload to a base station to perform subsequent virus analysis when the match value is greater than a threshold.

2. The method according to claim 1, wherein the communication processor performs protocol decomposition on the received downlink data, including:

The communication processor determines whether the downlink data is circuit domain data or packet domain data; when the downlink data is circuit domain data, parsing the payload of the downlink data according to a short message format or a circuit domain data format;

When the downlink data is packet domain data, the payload of the downlink data is parsed by using a transport layer protocol, a routing layer protocol, and a higher layer protocol.

The method according to claim 1, wherein when the matching value is obtained, the method further includes:

And when the matching degree value is less than or equal to the threshold, the communications processor directly sends the downlink data to an application processor of the smart mobile terminal.

The method according to claim 1, wherein the performing, by the base station, the subsequent virus analysis comprises: the base station matching the payload with the virus information in the virus database, and determining whether the downlink data is virus information. .

The method according to claim 4, wherein when determining that the downlink data is virus information, the method further includes:

The communication processor receives a determination response and an analysis report from the feedback of the base station, where the determination response carries indication information that the downlink data is virus information; the communication processor intercepts the downlink data and the local Other data except the downlink data in the secondary transmission, and recording information corresponding to the downlink data.

The method according to claim 5, wherein the information corresponding to the downlink data comprises at least one of the following: source information of the data packet, and a propagation path.

7. A virus defense system for a smart mobile terminal, comprising: an intelligent mobile terminal;

The smart mobile terminal includes: a communications processor; the communications processor further includes: a protocol analyzing module, configured to perform protocol decomposition on the received downlink data, and parse the payload of the downlink data;

a first determining module, configured to match the payload with a suspected virus feature to obtain a matching value, and determine whether the matching value is greater than a threshold;

The first communication module is configured to transmit the payload to the base station to perform subsequent virus analysis when the first decision module output is YES.

8. The system according to claim 7, wherein the base station comprises:

a second communication module, configured to receive the payload from the first communication module;

The second determining module is configured to perform virus analysis on the downlink data according to the payload.

9. The system according to claim 7, wherein the protocol analysis module comprises:

a determining unit, configured to determine whether the downlink data is circuit domain data or packet domain data; and the first parsing unit is configured to parse the short message format or the circuit domain data format when the downlink data is circuit domain data The payload of the downlink data;

The second parsing unit is configured to parse the payload of the downlink data by using a transport layer protocol, a routing layer protocol, and a higher layer protocol when the downlink data is packet domain data.

10. The system of claim 7, wherein the smart mobile terminal further comprises:

The application processor is configured to receive the downlink data from the communications processor when the match value is less than or equal to the threshold.

The system according to claim 7, wherein the second determining module comprises:

The matching unit is configured to match the payload with the virus information in the virus database, and determine whether the downlink data is virus information. The system according to claim 11, wherein

The first communication module is further configured to receive a determination response and an analysis report from the feedback of the base station, where the determination response carries indication information that the downlink data is virus information;

The communication processor further includes:

And an intercepting module, configured to intercept the downlink data and other data in the current transmission except the downlink data;

The statistics module is configured to record information corresponding to the downlink data.