WO2012139323A1

WO2012139323A1 - Method and system for monitoring application

Info

Publication number: WO2012139323A1
Application number: PCT/CN2011/075480
Authority: WO
Inventors: 刘雪芹
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-04-11
Filing date: 2011-06-08
Publication date: 2012-10-18
Also published as: CN102186167A; CN102186167B

Abstract

The invention discloses a method for monitoring application of a terminal that utilizes an open source operating system, the method includes: monitoring the location application instantly; forbidding the location application from invoking the system resource if the location application is determined, based on the preset security policy when the location application is monitored to invoke the system resource, not to be provided with the authority for invoking the system resource. The invention also discloses the corresponding system. The invention can enhance the security performance of the terminal data service and wireless application, and reduce the user data service cost and wireless application cost while protecting the user privacy effectively.

Description

Method and system for monitoring application

Technical field

The present invention relates to the field of mobile terminals, and in particular, to a method and system for monitoring an application. Background technique

In the increasingly competitive electronic market, in order to improve the user experience, more and more multi-mode terminals integrate network applications to meet the needs of users similar to the network on the PC. It turns out that this type of network application is integrated. Electronic devices are consistently sought after by users and are seen as a high-priority configuration option for high-end electronic consumption.

It is worth mentioning that in the open source Android (Android) OS (Open source, open source, also referred to as open source) system supported by the OHA (Open Handset Alliance) alliance, it has its own Internet application. Very good support, the Android platform integrates a lot of applications such as Email (E-mail), Market (Market), Youtube and so on that require a lot of data service support. At the same time, Android mobile terminals also provide a variety of means to install applications, including downloading from the android market (Android market), downloading from the Internet (Internet), direct installation from SD (Secure Digital Card) cards, and so on.

With thousands of Android apps flooding into user choices, huge security risks are emerging. As we all know, the Android platform is a very open platform, and applications can easily obtain access to various system resources, such as using data services, using wireless communication services, copying private information on mobile phones, and so on.

The following is a simple example. When the user installs the application, the application gives at most two simple tips: 1. Whether to support the installation of unknown sources; 2. Which system resources are needed for this application. Once the user selects an unknown source to install and licenses the application's requirements for using system resources, the user will be unaware of how the application uses system resources (including frequency, content, etc.). Once the user has inadvertently installed a malicious application, the user's personal privacy and communication costs will fall into the black hole of the malicious application, and the application can freely use the various system resources of the mobile terminal. With the popularity of Android terminals, operators and equipment manufacturers have received more and more information about Complaints about security risks in Android terminals. Summary of the invention

It is an object of the present invention to provide a method and system for monitoring an application to solve the security risks of existing terminals using an open source operating system.

To solve the above problems, the present invention provides a method for monitoring an application, which is applied to a terminal using an open source operating system, including:

Monitor local applications in real time;

When monitoring the local application to invoke the system resource, if it is determined according to the pre-configured security policy that the application does not have the right to invoke the system resource, the application is prohibited from invoking the system resource.

Preferably, the method further includes:

And if the application determines that the application has the right to invoke the system resource according to the pre-configured security policy, allowing the application to invoke the system resource, and after the application invokes the system resource, recording the call. Operational information.

Preferably, the method further includes:

The terminal updates the operation information of each application calling system resource to the server periodically or irregularly, and the server updates and processes the information according to the operation information received from each terminal. security strategy.

Preferably, the maximum number of times the application uses the system resource is set in the security policy. The recording the call operation information includes: recording the number of times the application invokes the system resource; and determining, according to the pre-configured security policy, the The application does not have permission to invoke the system resources, including:

And determining, according to the recorded call operation information corresponding to the application, that the number of times the recorded application invokes the system resource has reached the maximum number of times.

Preferably, the terminal obtains the pre-configured security policy by using one of the following manners: the terminal provides a human-computer interaction interface for the user to set the security policy; The terminal acquires the security policy periodically or irregularly from the designated server side and updates to the local.

Preferably, the prohibiting the application from invoking the system resource includes:

Prompting the user that the application requests to invoke the system resource;

After receiving the command sent by the user to prohibit the application from invoking the system resource, the application is prohibited from calling the system resource.

Correspondingly, the present invention also provides a system for monitoring an application, which is applied to a terminal using an open source operating system, including:

a first device, configured to: monitor a local application in real time;

a second device, configured to: when monitoring the local application to invoke the system resource, if it is determined according to the pre-configured security policy that the application does not have the right to invoke the system resource, prohibiting the application from calling the system Resources.

Preferably, the second device is further configured to: if the application determines that the application has the right to invoke the system resource according to the pre-configured security policy, allowing the application to invoke the system resource, and in the After the application invokes the system resource, the call operation information is recorded.

Preferably, the system further comprises:

And a third device, configured to: periodically update the operation information of the application calling system resources recorded by the second device to the server.

Preferably, the security policy is configured with a maximum number of times the application uses system resources; the second device is configured to:

Recording the call operation information includes: recording the number of times the application invokes the system resource;

Determining, according to the pre-configured security policy, that the application does not have the right to invoke the system resource, the method includes: determining, according to the recorded call operation information corresponding to the application, that the recorded application invokes the system resource has The maximum number of times is reached.

Preferably, the second device is configured to: prohibiting the application from invoking the system resource, including: prompting a user to request the application to invoke the system resource; receiving a ban from the user After the application invokes the command of the system resource, the application is prohibited from calling the system resource.

After the invention is used, the purpose of improving the security performance of the data service and the wireless application, effectively protecting the privacy of the user, and helping to reduce the user data service fee and the wireless application tariff, thereby improving the user experience, can satisfy the user's massive amount. The random installation requirements of the application can improve the security performance of the terminal data service and the wireless communication service, and improve the security control capability of the terminal device and the application security performance of the terminal by the operator and the device manufacturer.

BRIEF abstract

1 is a flowchart of a method for monitoring an application according to an embodiment of the present invention;

2 is a flow chart of implementing a user configuration and viewing security information design implementation process;

FIG. 3 is a flowchart of implementation of terminal security information collection and security policy implementation process design; FIG. 4 is a flowchart of design and implementation of terminal vendor or operator terminal side security policy;

Figure 5 is a flow chart showing the implementation of the security policy design of the server vendor on the terminal vendor or carrier;

FIG. 6 is a flow chart of an application example of the present invention.

Preferred embodiment of the invention

In order to make the objects, the technical solutions and the advantages of the present invention more clearly, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments of the present application may be arbitrarily combined with each other.

In this embodiment, a method for monitoring an application is applied to a terminal using an open source operating system, as shown in FIG. 1, including:

The local application is monitored in real time. When the local application wants to invoke the system resource, if the application determines that the application does not have the right to invoke the system resource according to the pre-configured security policy, the application is prohibited from calling the system resource.

The terminal can obtain the above pre-configured security policy in the following manner:

Method 1: Provide a human-computer interaction interface for the user to set a security policy;

Method 2: Update the security policy periodically or irregularly from the specified server side. In the above method, if it is determined according to the pre-configured security policy that the application has the right to invoke the system resource, the application is allowed to invoke the system resource, and after the application invokes the system resource, the calling operation is recorded. The recorded content may include: the name of the application, the name of the called system resource, and the number of calls, and the time and duration of using the system resource.

When the user wants to view the system resource usage, the terminal can display the details of the call operation recorded by the terminal to the user. In addition, the terminal may periodically or irregularly update the operation information of the recorded application calling system resources to the designated server side, and the server analyzes and sorts according to the operation information received from each terminal to update the local security policy.

In addition, the maximum number of times the application uses the system resource is set in the foregoing security policy; determining that the application does not have the right to invoke the system resource according to the pre-configured security policy may be: determining, according to the call operation record corresponding to the application, The number of times the application has called the system resource has reached the maximum number of times mentioned above.

The application is prohibited from invoking the system resource, and may be: prompting the user to request the system resource to be invoked; and after receiving the command sent by the user to prohibit the application from calling the system resource, the application is prohibited from calling the system resource. In addition, the application may be allowed to invoke the system resource upon receiving a command from the user that allows the application to invoke the system resource.

After using the above method, the user can know the statistical analysis of the call of the malicious application to the resource, and the server deployed by the terminal manufacturer or the operator to analyze and analyze the malicious application, and reduce the security risk of the malicious application. Through the powerful computing and statistical capabilities of the server, and the powerful information sources of terminal vendors and operators, and the information security knowledge base to assist users in the security risks of malicious applications.

In order to further illustrate the present invention, further explanation will be made from the following aspects:

User configuration and viewing of security information processes;

Terminal security information collection and security policy implementation process;

Terminal vendor or carrier terminal side security policy design process;

The terminal vendor or carrier server side security policy design process.

As shown in Figure 2, the process of configuring and viewing security information by users includes:

Step one, the terminal is powered on and the booting is started; Step 2: The terminal starts and monitors the behavior of the terminal in real time;

Step 3: The user configures to enable and disable the use notification of the real-time data service, the wireless communication service, and other system resources through the menu configuration;

Step 4: The user configures at least part of the application authority information of using the system resource;

Step 5: The user can view the data service sent by the terminal and the request for the wireless communication service and other system resources through the menu;

Step 6: If the user opens the security information usage notification, when the configured application requests to use the configured system resource request, the prompt box is used to prompt the user whether to prohibit the request; if the user does not open the security information usage notification, Do not prompt the user;

Step 7: In the factory setting, if the server synchronization analysis and management is set, the terminal can be used by the user to check which applications and detailed security policies are controlled by the server.

As shown in FIG. 3, the terminal security information collection and security policy implementation process includes the following steps: Step 1: The terminal is powered on and started;

Step 2: Read the user configuration information, if the user has not configured, the factory setting is the default; Step 3, real-time monitoring the API of the calling system resource sent by the application installed on the terminal

( Application Programming Interface , Application Programming Interface ) ;

Step 4: When the user-configured or system-configured application calls the API of the system resource, the following information is recorded: the name of the application, the name of the called system resource, the time and duration of using the system resource, the number of calls, and the like;

Step 5: In the case that the server synchronization analysis and management is set, the security policy synchronized from the server side is invoked, the system resource invocation request initiated by the malicious application is filtered, and the information is recorded for the user to monitor and view;

Step 6: Calculate terminal security information, such as performing statistical analysis of system resource invocation requests initiated by the monitored application;

Step 7: In the case that the server synchronization analysis and management is set, the terminal side can synchronize the information of the system resource called by the locally recorded application request to the server side;

Step 8: Synchronize periodically or irregularly when the server synchronization analysis and management is set. Security policy on the server side.

As shown in Figure 4, the process of synchronizing security policies on the terminal manufacturer or the carrier terminal side is as follows: Step 1: The terminal is powered on and started.

Step 2: After the security management function is activated, the terminal reports the application request resource information recorded by the terminal to the network provider deployed by the terminal manufacturer or the operator;

Step 3: During standby, the terminal waits for a security policy update of the network server deployed by the terminal manufacturer or the operator;

Step 4: When a new security policy can be updated, the user is prompted to have the latest security policy, and asks whether the latest security policy needs to be updated in time; after the user selects the update, the new security policy is downloaded to the local;

Step 5: Start a real-time application monitoring security policy;

Step 6: When monitoring that system resources within the scope of the policy are used, intercept and record information for the user to view;

Step 7: When the frequency of calling an application resource reaches a certain limit, the application is determined to be a malicious application, and the user is notified in time to prompt the security risk of the application;

Step 8: Assist the user to uninstall the identified malicious application. That is, the user is provided with an interface asking whether to uninstall the application. If the user selects the uninstall operation, the user directly jumps to the uninstall interface of the application for the user to perform the subsequent uninstall operation.

As shown in Figure 5, the terminal vendor or carrier server-side security policy design process is as follows: Step 1: Configure the server on the network side to deploy the model batch information of the terminal that needs to be controlled. At this time, the terminal is required to report the application request. When the information of the system resource is called, the model and batch information of the system are reported together;

Step 2: The server collects the usage information of the system resources reported by the terminal of the model batch of the terminal that needs to be controlled and controlled in real time.

Step 3, batch statistical analysis of malicious applications;

Step 4: screening the malicious application and writing the malicious application to the security policy;

Step 5: Synchronize security policies to the terminal periodically to prevent malicious applications from abusing user resources. Curb the scope of security risks;

Step 6: Regularly collect the security management and control information obtained by other channels, and timely synchronize the security policies updated according to these security management information to the terminal, prevent malicious applications from abusing user resources, and curb the scope of security risks.

In this embodiment, a system for monitoring an application is applied to a terminal using an open source operating system, including:

a first device, configured to monitor a local application in real time;

The second device is configured to, when monitoring, that the local application is to invoke the system resource, if the application determines that the application does not have the right to invoke the system resource according to the pre-configured security policy, prohibiting the application from invoking the system resource.

Preferably,

The second device is further configured to: if the application determines that the application has the right to invoke the system resource according to the pre-configured security policy, permit the application to invoke the system resource, and invoke the After the system resources are recorded, the call operation information is recorded.

Preferably, the system further comprises:

And a third device, configured to update operation information of each application calling system resource recorded by the second device to the server periodically or irregularly.

Preferably,

The maximum number of times the application uses system resources is set in the security policy;

The second device is configured to record the call operation information, where the second device is configured to record the number of times the application invokes the system resource;

The second device is configured to determine, according to the pre-configured security policy, that the application does not have the right to invoke the system resource, and specifically includes:

The second device is configured to determine, according to the recorded call operation information corresponding to the application, that the number of times the recorded application invokes the system resource has reached the maximum number of times.

Preferably,

The second device is configured to prohibit the application from invoking the system resource, and specifically includes: The second device is configured to prompt the user to request the system resource to be invoked; after receiving the command sent by the user to prohibit the application from calling the system resource, the second device is configured to prohibit the application from calling the system resource .

The invention will now be described in conjunction with the drawings and embodiments.

This embodiment is designed by taking an operator customization requirement and a user experience improvement requirement as an example. The present invention is fully described. According to different system resources used by different applications initiated by the user, corresponding to different scenarios, the three scenarios are respectively For:

Scenario 1: The scenario when each application customized by the operator requests to use system resources. The security management and control of this kind of scenario can minimize the amount of security control. This type of application is a reliable and reliable security application, and can call any system resources of the terminal. However, the terminal still needs to use security management to count the number of calls for users to view and protect the user's right to know;

Scenario 2: An application that users download in their own reliable application market, requesting the use of system resources. In this scenario, the source of the application can be checked, so the security level of each application market can be classified in the security policy. Applications that are downloaded from the reliable application market generally do not prompt the user for security monitoring settings, and the security monitoring system can be appropriately reduced.

When a user installs the app, there is no need to initiate a security policy. When the application invokes resources in this type of application, the user does not control and records only the simple operation information. When the application uses the system resources to a certain amount, the user should prompt the user for security risks and assist the user to close and uninstall the application. When there is a new security policy, when the server synchronizes to the terminal, it checks whether the application is in the new policy control scope. If it is, it prompts the user to close the uninstall.

Scenario 3: The application that each user downloads on the network by itself, that is, the application installed by the network or downloaded to the SD card, requests the use of system resources. In this scenario, the source of the application is not available and the source is very unsafe. The security control factor must be mentioned as the highest, prompting the user to perform security monitoring settings, and filtering through the security policy during installation. If the security policy is prohibited, the user should be prompted if the application has a slight malicious call record. To inform the app. If the user insists on installing, when the application uses system resources to a certain amount, it should prompt the user for security risks and assist the user to close and uninstall the application.

For the above three scenarios, the steps in the specific implementation are listed below, which can be combined with Figure 6. To explain, the steps are as follows:

101, the terminal is powered on and started;

102. The user configures the application resource and the monitored system resource item to be monitored through the menu. If not configured, the terminal is configured according to the factory settings of the terminal;

103, the user starts an application that has a resource calling requirement;

104. If the application is a customized application of each operator, since it is a built-in application of the system, the application is a reliable and trusted security application, so the system resources of the terminal can be arbitrarily invoked. When the application invokes system resources, the terminal does not control, only records the simple operation information, and uses security control to count the number of calls for the user to view, and protect the user's right to know;

105. If the application is an application downloaded by the user in a reliable application market, the application may be classified according to the security control coefficient of the application market itself. For a reliable application market download application, the user is generally not prompted to perform security monitoring settings, and the security monitoring coefficient is Can be reduced appropriately. When a user installs the app, there is no need to initiate a security policy. When the application calls the resource, the user does not control, only records the operation simple information. When the application uses the system resource to a certain amount, the user should promptly prompt the user for security risks and assist the user to close and uninstall the application. When a new security policy is synchronized by the server to the terminal, check whether the application is in the new policy control scope, and if so, prompt the user to close the uninstallation;

106. If the application is an application downloaded by the user on the network, that is, an application installed through a network installation or downloaded to an SD card, the terminal may prompt the user to perform security monitoring settings, and filter through the security policy during installation. It is already in the scope of the security policy prohibition, to prompt the user, if the application has a slight malicious call record, also inform the application. If the user insists on installing, when the application uses system resources to a certain amount, it should prompt the user for security risks and assist the user to close and uninstall the application.

Preferably, the method further comprises:

107, the user can view the resource call statistics record information of all applications;

108. The user configures resource calling rights of each application through a menu to prevent security risks of malicious applications.

One of ordinary skill in the art can understand that all or part of the above steps can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, such as read only. Memory, disk or disc, etc. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. In view of the present invention, various other modifications, equivalents, improvements, etc., should be made without departing from the spirit and scope of the invention. It is included in the scope of protection of the present invention.

Industrial Applicability After the present invention, the purpose of improving the security performance of the data service and the wireless application, effectively protecting the user's personal privacy, and helping to reduce the user data service fee and the wireless application fee are achieved, thereby improving the user experience and satisfying the requirements. The user's random installation requirements for mass applications can improve the security performance of the terminal data service and the wireless communication service, and improve the security control capability of the terminal device and the application security performance of the terminal by the operator and the device manufacturer.

Claims

Claim

A method for monitoring an application, which is applied to a terminal using an open source operating system, including:

Monitor local applications in real time;

2. The method according to claim 1, wherein the method further comprises:

3. The method of claim 2, wherein the method further comprises:

4. The method of claim 2, wherein

Recording the call operation information includes: recording the number of times the application invokes the system resource; and determining, according to the pre-configured security policy, that the application does not have the permission to invoke the system resource, including:

The method according to any one of claims 1 to 4, wherein

The terminal obtains the pre-configured security policy in one of the following manners:

The terminal provides a human-machine interaction interface for the user to set the security policy;

The terminal acquires the security policy periodically or irregularly from the designated server side and updates to the local.

6. The method of claim 1, wherein

The prohibiting the application from invoking the system resource includes:

Prompting the user that the application requests to invoke the system resource;

7. A system for monitoring an application, applied to a terminal using an open source operating system, including:

a first device, configured to: monitor a local application in real time;

8. The system of claim 7, wherein

The second device is further configured to: if the application determines that the application has the right to invoke the system resource according to the pre-configured security policy, allowing the application to invoke the system resource, and calling the application in the application After the system resources are described, the call operation information is recorded.

9. The system of claim 8, further comprising:

10. The system of claim 8 wherein

The second device is configured to: record the call operation information, including: recording a number of times the application invokes the system resource;

11. The system of claim 7 wherein The second device is configured to: prohibit the application from invoking the system resource, including: prompting the user that the application requests to invoke the system resource; receiving a command sent by the user to prohibit the application from invoking the system resource After that, the application is prohibited from calling the system resource.