WO2013075418A1

WO2013075418A1 - Method for controlling right to use of connection function, and mobile terminal

Info

Publication number: WO2013075418A1
Application number: PCT/CN2012/071535
Authority: WO
Inventors: 雷明剑; 王巍; 徐立锋; 古幼鹏; 钟声; 胡炜
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-11-24
Filing date: 2012-02-23
Publication date: 2013-05-30
Also published as: CN102413220A; CN102413220B

Abstract

Disclosed is a method for controlling the right to use of a connection function, including: generating a connection function control policy according to a preset connection function control policy configuration file; when detecting that an application software uses a connection function defined in the connection function control policy, controlling the right of the connection function to be used by the application software using the right to use control policy of the connection function in the connection function control policy. Also at the same time disclosed is a mobile terminal. The present invention can be applied to prevent the connection function of a mobile terminal being used by a malicious application software, thus ensuring the information security of the mobile terminal user.

Description

Method for controlling usage right of connection function and mobile terminal

The present invention relates to an access control technology in a mobile terminal, and more particularly to a method and a mobile terminal for controlling usage rights of a connection function. Background technique

Mobile terminals such as mobile phones have entered the era of intelligence, and a variety of application software can be installed and run on mobile phones to enhance the convenience of mobile phone users.

At present, in the application software installed and running on the mobile phone, the number of malicious application software that easily leaks user privacy information, private data information, and data storage files is increasing. These malicious application softwares run in the background of the mobile phone, and can use the connection function concealedly. It is difficult for users to detect, for example, by using the wireless broadband (Wi-Fi, Wireless Fidelity) and Bluetooth connection functions in the mobile phone to transmit the user's private information to the outside, resulting in the user's private information security being threatened.

It can be seen that since the right to use the connection function of the malicious application in the mobile phone is not currently controlled, the connection function of the mobile phone is used by the malicious application software, thereby threatening the information security of the mobile phone user. Summary of the invention

In view of the above, an object of the present invention is to provide a method for controlling the use right of a connection function and a mobile terminal, which can prevent the connection function of the mobile terminal from being used by the malicious application software, thereby ensuring the information security of the mobile terminal user.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention provides a method for controlling usage rights of a connection function, the method comprising: generating a connection function control policy according to a configuration file of a preset connection function control policy; When detecting that the application software uses the connection function defined in the connection function control policy, the permission control policy according to the permission function of the connection function control policy controls the authority of the connection function to be used by the application software.

In the above solution, before detecting that the application software uses the connection function defined in the connection function control policy, the method further includes: determining whether the currently accessed application software uses the connection function in real time, and if yes, detecting the connection used by the application software. Whether the permission corresponding to the function matches any one of the connection function control policies; otherwise, it repeatedly determines whether the currently accessed application software uses the connection function.

In the above solution, whether the permission corresponding to the connection function used by the detection application software is consistent with any one of the connection function control policies includes: viewing the connection function under the corresponding trust level in the connection function control policy according to the trust level of the application software The permission control list; determining whether the connection function used by the application software is the same as the connection function to be controlled in the connection function permission control list, and if there is the same item, detecting that the application software uses the connection function defined in the connection function control policy; If there is no identical item, the application is allowed to use the connection function.

In the foregoing solution, before the viewing the function permission control list under the corresponding trust level in the connection function control policy according to the trust level of the application software, the method further includes: determining to install the new application software, decompressing the new application software The installation package extracts the signature information of the new application software; uses the signature information of the application software for authentication, determines the trust level of the application software according to the authentication result; and saves the trust level in the attribute configuration file corresponding to the application software.

In the above solution, before the controlling the privilege usage control policy of the connection function in the connection function control policy to control the permission of the connection function to be used by the application software, the method further includes: determining the connection function used by the application software Whether there is a corresponding permission to use the control policy, if any, the control policy is used according to the permission, and the authority of the connection function to be used by the application software is controlled and managed; if not, the permission control policy for the connection function is set. Set and save. The present invention also provides a mobile terminal, where the mobile terminal includes: a rights usage policy module and a rights usage control module;

The permission use policy module is configured to generate a connection function control policy according to a preset connection function control policy configuration file and provide the permission use control module;

The permission use control module is configured to: when detecting that the application software uses the connection function defined in the system connection permission control policy in the permission use policy module, use the control policy pair according to the permission of the connection function in the connection function control policy The application software controls the permissions of the connection function to be used.

In the above solution, the mobile terminal further includes:

The application processing module is configured to determine in real time whether the currently accessed application software uses the connection function, and if yes, send the name of the connection function used by the application software to the permission use control module; otherwise, repeatedly determine whether the currently accessed application software uses any a connection function;

Correspondingly, the permission use control module is specifically configured to receive a name of a connection function used by the application software sent by the application processing module, and detect whether the connection function matches any one of the connection function control policies.

In the above solution, the permission use control module is specifically configured to view, according to the trust level of the application software, a connection function permission control list under the corresponding trust level in the connection function control policy in the permission use policy module; determine the connection used by the application software. Whether the function is the same as the connection function to be controlled in the connection function permission control list. If there is the same item, it detects that the application software uses the connection function defined in the connection function control policy; if there is no identical item, the application processing module is notified to allow The application software uses this connection function;

Correspondingly, the application processing module is further configured to: receive the permission application software sent by the permission usage control module to use the connection function;

The rights usage policy module is specifically configured to provide a connection function control policy for the rights usage control module. In the above solution, the mobile terminal further includes: an application trust level authentication module, configured to receive an installation package of a new application software sent by the application processing module, decompress a new application software installation package, and extract a new application software. Signature information; use the signature information of the application software for authentication, determine the trust level of the application software according to the authentication result; and then save the trust level in the attribute configuration file corresponding to the application software;

Correspondingly, the application processing module is further configured to: when the installation of the new application software is performed, send the installation package of the new application software to the application trust level authentication module.

In the foregoing solution, the privilege use control module is specifically configured to determine whether a connection privilege usage control policy is used for the connection function used by the application software, and if yes, use the control policy according to the privilege to use the application software. The permission of the connection function is controlled and managed; if not, the permission of the connection function is set by using the control policy, and then the permission use control policy of the connection function is saved to the permission use policy module;

Correspondingly, the permission usage policy module is specifically configured to receive the permission usage control policy sent by the permission control module, and save the permission usage control policy to the corresponding connection function item in the connection function permission control list.

The method for controlling the use permission of the connection function and the mobile terminal provided by the invention, by setting the connection function control strategy, focus on detecting the use of some connection functions that the user cares about; the connection function control strategy used by the application software to the mobile terminal When any one of the connection functions is used, the control policy is used according to the specific permission of the connection function; thus, the connection function of the mobile terminal can be prevented from being used by the malicious application software, thereby ensuring the information data of the mobile terminal user. safety. In addition, you can modify or delete the connection function control policy according to the actual situation, so that you can flexibly control the usage rights of the connection function. DRAWINGS

1 is a schematic flow chart of a method for controlling usage rights of a connection function according to the present invention;

2 is a schematic structural diagram of a mobile terminal according to the present invention. detailed description

The basic idea of the present invention is: The mobile terminal generates a connection function control policy according to a configuration file of a preset connection function control policy; and when the mobile terminal detects that the application software uses the connection function defined in the connection function control policy, according to the connection function The permissions of the connection function in the control policy use the control policy to control the permissions of the connection function to be used by the application software.

The connection function control policy is: a specific connection function of the required control corresponding to the connection function recorded by the mobile terminal, and a permission use control policy of the connection function;

The permission usage control policy is that the control of the authority to use any one of the connection functions may include: always allowing, always rejecting, or asking each time.

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

The following is a method in which the mobile terminal is a mobile phone. The method for controlling the use permission of the connection function of the present invention is as shown in FIG. 1 and includes the following steps:

Step 101: Preset the configuration file of the connection function control policy in the mobile phone.

Here, the configuration file of the connection function control policy writes the usage authority of the connection function to be controlled according to the actual situation, and may include the type of the permission, the trust level, the name of the permission group, and the connection function to be controlled under the permission group. The format can be written in Extensible Markup Language (XML) format;

For example, you can write a configuration file for the connection function control policy in the format shown below: <?xml version- 1.0' encoding='utf-8' standalone='yes' ?>

Permission name="WIFr' />

Permission name=" BLUETOOTH" />

< /permissionGroup > </ trustLevel >

</sysControlPermission>

Where <sysControlPermission> indicates that the type of the permission belongs to the default control of the system, <trustLevel name="unApproved"> indicates that the trust level is untrusted ( unApproved ), and <permissionGroup name=" connect " /> indicates that the permission group name is the connection class ( connect ) , permission name=" WIFI" /> and permission name=" BLUETOOTH " /> indicates that the Wi-fi and Bluetooth ( BLUETOOTH ) connection functions are required under the connection class permission group.

Step 102: After the mobile phone is started, a connection function control policy is generated according to the configuration file of the connection function control policy.

Specifically: After the mobile phone is started, check whether there is a configuration file of the new connection function control policy from the specified directory. If not, directly execute step 103; if yes, read the configuration file of the connection function control policy, and the connection function In the configuration file of the control policy, extract the trust level, the permission group name, and the specific control connection function under the permission group; add the connection function to the connection function permission control list with the trust level as the identifier, the permission group name, and the specific control under the permission group. Finally, the connection function permission control list is saved in the memory of the mobile phone to form a connection function control policy, and then step 103 is performed;

Here, the specified directory is: a file directory storing a configuration file of the connection function control policy, for example, the specified directory may be the root directory of the mobile phone memory card.

Step 103: Determine in real time whether the currently used application software uses any one of the connection functions in the mobile phone, and if yes, execute step 104; otherwise, repeat step 103.

Specific: During the running process of the mobile phone real-time monitoring application software, it is judged whether the calling information of any one of the connecting functions is issued during the running process of the application software, so that it can be judged whether the currently used application software uses any one of the mobile phones. Item connection function, if issued, proceed to step 104, and extract the connection function to be used in the call information of the connection function; if not, repeat step 103; Here, the calling information for any one of the connection functions includes: a connection function to be called; a method for generating the call information is a prior art, and is not mentioned here.

Step 104: Detect whether the permission corresponding to the connection function used by the application software matches any one of the connection function control policies. If yes, execute step 105; otherwise, allow the application software to use the connection function to end the processing flow.

Specifically, the mobile phone checks the connection function permission control list under the corresponding trust level in the connection function control policy according to the trust level of the application software; determines whether the connection function used by the application software and any connection in the connection function permission control list need to be controlled. The function is the same, if there is the same item, step 105 is performed; if not, the application software is allowed to use the connection function, and the access application software is subsequently processed according to the prior art, and the processing flow is ended;

For example, if the mobile phone determines that the currently used application software uses the Wi-fi connection function, the mobile phone checks the connection function permission control list under the corresponding trust level in the connection function control policy according to the trust level of the application software; when the application software trust level If it is untrustable, if there is a Wi-fi connection function item in the connection function permission control list corresponding to the untrustable level, step 105 is performed; when the application software trust level is trusted, if the connection in the corresponding trusted level is If there is a Wi-fi connection function item in the function authority control list, step 105 is performed.

Step 105: The mobile phone determines whether there is a corresponding permission for the connection function used by the application software, and uses the control policy, if yes, step 106 is performed; if not, step 107 is performed.

Step 106: The mobile phone uses the control policy according to the permission to control the permission of the connection function to be used by the application software, and ends the processing flow.

Here, the control refers to: viewing the specific settings in the permission use control policy, and when the specific setting is always allowed, the application software is allowed to use the connection function, and then the application software is followed according to the prior art; When it is set to always refuse, the application software is refused to use the connection function, and then the application software is followed according to the prior art; when the specific setting is for each inquiry, the user pops up a selection box, and the user selects whether to allow the application software. Use this connection Function, then allow or deny the application to use the connection function according to the user's choice, and then follow up the application according to the prior art.

Step 107: The mobile phone sets the permission usage control policy of the connection function.

This step is specifically as follows: The mobile phone pops up a prompt dialog box for the user, reminding the user that the permission of the connection function is always allowed, always refused, or each inquiry is set, and the current application processing flow is suspended; The permission setting is saved as the permission usage control policy, added in the corresponding connection function item in the connection function control policy, and the current application is subsequently processed according to the set authority using the control policy.

In addition, before the foregoing step 103, the trust level of the application software needs to be authenticated. The specific authentication process includes the following steps:

Step a: The mobile phone determines in real time whether the operation selected by the user is to install any new application software or use any application software. If any new application software is installed, step b is performed; if any application software is accessed, the steps are executed. 103.

Step b: The mobile phone decompresses the installation package of the new application software, and extracts the signature information of the new application software. Here, the installation package of the decompressed new application software is prior art, and no comment is made here; the new application is extracted. The signature information of the software is: After extracting the installation package of the new application software, extracting the signature information therein;

The signature information is: using a special tool to write signature information into a specific field of the application software, indicating that the application has passed the audit of the signer, and the specific fields are divided into three types: Saipan.

(Symbian) Signature of the charge certificate, the author uses the public free certificate signature and the user's signature.

Step c: The mobile phone first uses the signature information of the application software to perform authentication, and determines the trust level of the application software according to the authentication result; then saves the trust level in the attribute configuration file corresponding to the application software, and continues to install the application software according to the prior art, and returns step&.

Here, the authenticating by using the signature information of the application software includes: signing the application software The name information is matched with the signature information of the plurality of certificates preset in the mobile phone. If the signature information of the application is the same as the signature information of any one of the certificates, the authentication result is passed; otherwise, the authentication result is not passed;

The determining the trust level of the application software according to the authentication result includes: setting the trust level of the application software according to the specific signature information when the authentication result is passed; and setting the application software to be unavailable when the authentication result is not passed. Trust level

The trust level includes two categories, namely, an untrustworthy level and a trusted level. The trusted level of the application is set according to the specific signature information: the mobile phone manufacturer customizes the preset certificate according to actual needs. Signature information, the trust level corresponding to different signature information may include: "vendor trust level", "operator trust level", "third-party partner trust level", and the like.

In addition, before the foregoing step 102, the connection function control policy may be modified or deleted according to actual conditions, specifically: when any one of the connection function control policies needs to be modified or deleted, the configuration file of the original connection function control policy is found. , make specific modifications in the configuration file, and then perform step 102.

The present invention further provides a mobile terminal. As shown in FIG. 2, the mobile terminal includes: a rights usage policy module 21 and a rights usage control module 22;

The permission usage policy module 21 is configured to generate a connection function control policy according to the configuration file of the preset connection function control policy, and provide a connection function control policy for the authority usage control module 22;

The privilege use control module 22 is configured to: when detecting that a connection function defined by the connection function control policy in the privilege use policy module 21 is used by the application software, use the control policy according to the privilege of the connection function in the connection function control policy Controls the permissions of the connection functions that the application uses.

The permission usage policy module 21 is specifically configured to save a preset connection function control policy. The configuration file; when the mobile terminal is powered on, generates a system connection permission control policy according to the configuration file of the connection function control policy.

The permission usage policy module 21 is specifically configured to check whether there is a configuration file of a new connection function control policy from the specified directory, and if not, end the processing flow; if yes, read the configuration file of the connection function control policy, From the configuration file of the connection function control policy, extract the trust level, the permission group name, and the specific control connection function under the permission group; add the connection function to the connection function with the trust level as the identifier, the permission group name, and the specific control group under the permission group. In the permission control list; finally save the connection function permission control list to form a connection function control strategy.

The mobile terminal further includes: an application processing module 23, configured to determine in real time whether the currently accessed application software uses any one of the connection functions, and if yes, send the name of the connection function used by the application software to the rights usage control module 22; Otherwise, continue to determine whether the currently accessed application software uses any of the connection functions;

Correspondingly, the permission use control module 22 is specifically configured to receive a name of a connection function used by the application software sent by the application processing module 23, and detect whether the connection function matches any one of the connection function control policies.

The application processing module 23 is specifically configured to detect whether the calling information of any one of the connection functions is issued during the running process of the application software to determine whether the currently used application software is used arbitrarily during the running process of the real-time monitoring application software. A connection function, if yes, sends the name of the connection function used by the application software to the rights usage control module 11; otherwise, it continues to determine whether the currently accessed application software uses any of the connection functions.

The privilege use control module 22 is configured to check whether the connection function is consistent with any one of the connection function control policies, and view the corresponding trust level in the connection function control policy of the privilege usage policy module 21 according to the trust level of the application software. The connection function permission control list under the connection; determining whether the connection function used by the application software is the same as the connection function to be controlled by any one of the connection function permission control lists, and if there is the same item, determining the application software Whether the connection function used has a corresponding permission usage control policy; if there is no identical item, the notification application processing module 23 allows the application software to use the connection function;

Correspondingly, the application processing module 23 is further configured to receive the permission application software sent by the permission usage control module 22 to use the connection function, and then perform subsequent processing on the access application software according to the prior art.

The privilege usage control module 22 is specifically configured to: when the privilege corresponding to the connection function used by the application software has the privilege to use the control policy, use the privilege usage control policy in the connection function control policy of the policy module 21 according to the viewing privilege, The permission of the connection function to be used by the software is controlled, and the operation flow is ended; if not, the permission use control policy of the connection function is set, and the permission use control policy of the connection function is saved to the authority use policy module 21;

Correspondingly, the rights usage policy module 21 is specifically configured to receive the rights usage control policy sent by the rights usage control module 22, and save the rights usage control policy to the corresponding connection function item in the connection function authority control list.

The privilege usage control module 22 is specifically configured to view specific settings in the privilege usage control policy. When the specific setting is always allowed, the application software is allowed to use the connection function, and then the application software is subsequently operated according to the prior art. When the specific setting is always rejected, the application software is refused to use the connection function, and then the application software is followed according to the prior art; when the specific setting is for each inquiry, the user pops up a selection box, and the user selects whether The application software is allowed to use the connection function, and then the application software is allowed or denied according to the user's selection, and then the application software is followed according to the prior art.

The permission use control module 22 is further configured to remind the user to use the control setting of the permission of the connection function, and suspend the processing flow of the current application; receive the user's permission control policy for the function, and according to The permissions set by the user use the policy to control the permissions of the functions to be used by the application. The mobile terminal further includes: an application trust level authentication module 24, configured to receive an installation package of the application software sent by the application processing module 23; correspondingly, the application processing module 23 is further configured to determine, in real time, that the operation selected by the user is Install any new application software or access any application software. If any new application software is installed, the installation package of the application software is sent to the application trust level authentication module 24, and if any application software is accessed, it is determined. Whether the currently accessed application uses any of the connection features.

The application trust level authentication module 24 is further configured to decompress the installation package of the new application software, extract signature information of the new application software, authenticate the application by using the signature information of the application software, and determine the trust level of the application software according to the authentication result. Then, the trust level is saved in the attribute configuration file corresponding to the application software, and the installation package of the decompressed application software and the attribute configuration file of the application software are sent back to the application processing module 23; correspondingly, the application processing module 23 The utility model is further configured to receive an installation package of the decompressed application software sent by the application trust level authentication module 24 and an attribute configuration file of the application software, and then continue to install the application software according to the prior art on the decompressed application software.

The application trust level authentication module 24 is specifically configured to match signature information of the application software with signature information of multiple certificates preset in the module. If the signature information of the application is the same as the signature information of any one of the certificates, The authentication result is passed; otherwise, the authentication result is not passed.

The application trust level authentication module 24 is specifically configured to: when the authentication result is passed, set a trusted level of the application according to the specific signature information; when the authentication result is not passed, set the application software to an untrustable level. .

It can be seen that, by using the above scheme, the use of the connection function by the application of the mobile terminal can be classified and controlled according to the trust level of the application, and the connection function of the mobile terminal can be effectively prevented from being used by the malware, thereby ensuring the information data of the mobile terminal user. safety.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Range of protection.

Claims

Claim

A method for controlling usage rights of a connection function, the method comprising: generating a connection function control policy according to a preset connection function control policy configuration file; detecting that the application software uses a connection function control strategy When the limited connection function is used, the control policy is used to control the permission of the connection function to be used by the application according to the permission of the connection function in the connection function control policy.

2. The method according to claim 1, wherein before the detecting that the application software uses the connection function defined in the connection function control policy, the method further comprises: determining in real time whether the currently accessed application software uses the connection. Function, if yes, check whether the permission corresponding to the connection function used by the application software matches any one of the connection function control policies; otherwise, it repeatedly determines whether the currently accessed application software uses the connection function.

The method according to claim 2, wherein the detecting the permission corresponding to the connection function used by the application software is consistent with any one of the connection function control policies, including: viewing the connection according to the trust level of the application software. In the function control policy, the connection function permission control list corresponding to the trust level; determining whether the connection function used by the application software is the same as the connection function to be controlled in the connection function permission control list, and if there is the same item, detecting that the application software is used The connection function defined in the connection function control policy; if there is no identical item, the application software is allowed to use the connection function.

The method according to claim 3, wherein before the viewing the connection function permission control list under the corresponding trust level in the connection function control policy according to the trust level of the application software, the method further includes: determining to perform a new When the application software is installed, the installation package of the new application software is decompressed, and the signature information of the new application software is extracted; the signature information of the application software is used for authentication, and the trust level of the application software is determined according to the authentication result; and the trust level is saved in the The application software corresponds to the property profile.

5. The method according to claim 1, wherein said controlling according to a connection function Before the permission of the connection function in the policy uses the control policy to control the permission of the connection function to be used by the application software, the method further includes: determining whether the connection function used by the application software has a corresponding permission use control policy, if If yes, the control policy is used according to the permission, and the authority of the connection function to be used by the application software is controlled and managed; if not, the permission of the connection function is set and saved using the control policy.

A mobile terminal, the mobile terminal comprising: a rights usage policy module and a rights usage control module; wherein

The mobile terminal according to claim 6, wherein the mobile terminal further includes:

8. The mobile terminal of claim 6, wherein

The permission use control module is specifically configured to: according to the trust level of the application software, view the connection function permission control list under the corresponding trust level in the connection function control policy in the permission use policy module; determine whether the connection function used by the application software is connected Function permission control list The connection function to be controlled is the same. If there is the same item, the application software detects that the connection function defined in the connection function control policy is used; if there is no identical item, the application processing module is notified to allow the application software to use the connection function;

The rights usage policy module is specifically configured to provide a connection function control policy for the rights usage control module.

The mobile terminal according to claim 8, wherein the mobile terminal further comprises: an application trust level authentication module, configured to receive an installation package of a new application software sent by the application processing module, and decompress the new one. The installation package of the application software extracts the signature information of the new application software; the signature information of the application software is used for authentication, and the trust level of the application software is determined according to the authentication result; and the trust level is saved in the attribute configuration file corresponding to the application software;

10. The mobile terminal of claim 9, wherein

The permission use control module is specifically configured to determine whether there is a corresponding permission use control policy for the connection function used by the application software, and if yes, use the control policy according to the permission, and the permission function of the connection function to be used by the application software Perform control management; if not, set the permission of the connection function using the control policy, and then save the permission usage control policy of the connection function to the permission usage policy module;