WO2016070623A1 - 敏感信息安全保护方法和装置 - Google Patents

敏感信息安全保护方法和装置 Download PDF

Info

Publication number
WO2016070623A1
WO2016070623A1 PCT/CN2015/081277 CN2015081277W WO2016070623A1 WO 2016070623 A1 WO2016070623 A1 WO 2016070623A1 CN 2015081277 W CN2015081277 W CN 2015081277W WO 2016070623 A1 WO2016070623 A1 WO 2016070623A1
Authority
WO
WIPO (PCT)
Prior art keywords
target application
sensitive information
data
dynamic link
link library
Prior art date
Application number
PCT/CN2015/081277
Other languages
English (en)
French (fr)
Inventor
董振江
王蔚
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP15857551.4A priority Critical patent/EP3203406A4/en
Publication of WO2016070623A1 publication Critical patent/WO2016070623A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine

Definitions

  • the present invention relates to the field of information security, and in particular, to a method and device for protecting sensitive information.
  • the main purpose of the embodiments of the present invention is to provide a method and device for protecting sensitive information, aiming at preventing the malicious application from acquiring and leaking sensitive information in the intelligent terminal, and realizing the protection of sensitive information of the intelligent terminal user.
  • an embodiment of the present invention provides a method for protecting sensitive information, including the following steps:
  • the preset dynamic link library is injected into the process of the target application
  • the function data package is run to masquerade the sensitive information to be accessed by the target application to form masquerading data for the target application to acquire.
  • the method before monitoring whether the process exists in the target application, the method further includes: acquiring control permission of the activated target application to monitor the target application.
  • the process of injecting the preset dynamic link library into the application includes:
  • the running the function data packet, masquerading the sensitive information to be accessed by the target application, and forming the masquerading data includes:
  • the method for protecting a sensitive information further includes:
  • the target application's file system path is backed up to a pre-set quarantine by the reset user ID to protect the data of the target application.
  • the embodiment of the invention further provides a sensitive information security protection device, comprising:
  • a monitoring module configured to monitor whether a process of the target application exists in the process
  • Injecting a module configured to inject a pre-set dynamic link library into a process of the target application when the process of the target application exists in the process is detected;
  • a package loading module configured to execute a dynamic link library in a process of the target application to encapsulate and load a preset function data package
  • the masquerading module is configured to run the function data packet, and masquerade the sensitive information to be accessed by the target application to form masquerading data for the target application to acquire.
  • the sensitive information security protection device further includes:
  • the permission acquisition module is set to obtain the control permission of the launched target application to monitor the target application.
  • the injection module includes:
  • Obtaining a unit configured to acquire a preset dynamic link library when a process exists under the target application
  • a loading unit configured to load the dynamic link library into a process of the target application for a process of the target application to execute a function in the dynamic link library.
  • the camouflage module includes:
  • a monitoring unit configured to execute a function in the dynamic link library by a process of the target application to run the function data package, and monitor a data access request of the target application;
  • the masquerading processing unit when the data to be accessed by the data access request of the target application is pre-set sensitive information, performs corresponding masquerading processing according to the type of the sensitive information to form masquerading data.
  • the sensitive information security protection device further includes:
  • a reset module configured to reset a user identifier of the target application during startup of the target application
  • the backup module is configured to back up the file system path of the target application to a preset quarantine area by using the reset user identifier to protect data of the target application.
  • the embodiment of the present invention mainly adopts the core idea of data masquerading, and camouflages relevant sensitive information that the application needs to acquire.
  • This masquerading strategy causes the application to obtain a wrong data or not get the number. According to this, on the other hand, it can be guaranteed that this masquerading strategy will not be easily detected by the application, thus effectively preventing malicious applications from obtaining accurate and sensitive information.
  • FIG. 1 is a schematic flow chart of a first embodiment of a method for protecting sensitive information security according to the present invention
  • FIG. 2 is a schematic flowchart diagram of a second embodiment of a method for protecting sensitive information security according to the present invention
  • FIG. 3 is a schematic flowchart diagram of a third embodiment of a method for protecting sensitive information security according to the present invention.
  • FIG. 4 is a schematic diagram of a process of injecting a process of a sensitive information security protection method according to the present invention
  • FIG. 5 is a schematic diagram of a process of disguising sensitive information of a sensitive information security protection method according to the present invention
  • FIG. 6 is a diagram showing an example of an application accessing sensitive information resource in an Android system
  • FIG. 7 is a diagram showing an example of accessing sensitive information resources of a target application in an Android system according to the present invention.
  • FIG. 8 is a schematic diagram of functional modules of a first embodiment of a sensitive information security protection device according to the present invention.
  • FIG. 9 is a schematic diagram of functional modules of a second embodiment of a sensitive information security protection device according to the present invention.
  • FIG. 10 is a schematic diagram of functional modules of a third embodiment of a sensitive information security protection device according to the present invention.
  • FIG. 11 is a schematic diagram of an injection module of a sensitive information security protection device according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram of a masquerading module of a sensitive information security protection device according to an embodiment of the present invention.
  • the core idea of the embodiment of the present invention is to perform data masquerading on sensitive information.
  • the data is disguised by the present invention to provide data masquerading to the application: for example, open Is an empty file, or directly provides erroneous data and unrelated data, so that applications can not access the correct sensitive information when accessing sensitive information.
  • the embodiment of the present invention when an application requests to obtain the location information of a device, the embodiment of the present invention returns a coordinate that appears to be a location, but is not the true coordinate of the device, and is completely unrelated. Position coordinates.
  • an application wants to obtain information data of a device, such as a mobile phone number and a device ID
  • a device that combines a set fake mobile phone number and a set of fake random numbers and letters is returned by the present invention. ID, these disguised data looks almost indistinguishable from the actual data format, and the application cannot detect the data masquerading strategy of the present invention.
  • the application attempts to read the address book contact information or the short message record, the content provider database in the system is modified by the present invention, so that the data returned by the application query is an empty table.
  • the core idea of the present invention is applicable to any operating system in the smart terminal.
  • the embodiment of the present invention is specifically exemplified by the Android operating system.
  • FIG. 1 is a schematic flowchart of a first embodiment of a method for protecting a sensitive information according to the present invention.
  • a method for protecting a sensitive information includes:
  • Step S10 monitoring whether there is a process of the target application in the process
  • step S10 Checking the process to determine whether there is a process of the target application, if not, returning to step S10 to continue monitoring; if yes, proceeding to step S20;
  • Step S20 when the process of the target application exists in the process, the preset dynamic link library is injected into the process of the target application;
  • the process injection in this step specifically means that the preset dynamic link library is loaded into the running target process space, so that the function in the dynamic link library has a corresponding address in the target process space, and then the address is passed through the address.
  • Functions in the dynamic link library can be called in the target process.
  • the target application in the present invention performs process injection and sensitive information masquerading processing according to an application selected by the user.
  • step S10 When it is detected in step S10 that the process of the target application exists in the process, the Ptrace function is called in step S20 to inject the preset dynamic link library into the process of the target reference program. Since a large packet cannot be directly injected into the process, the Ptrace function is required to first inject a small amount of code calling the dlopen function into the target application process, and then call the dlopen function to load the dynamic link library. Inject the pre-set dynamic link library into the process of the target application.
  • the Ptrace function is a very powerful Android system function.
  • the Ptrace function provides a way for the parent process to monitor and control the other The way of the process, it can also change the registers and kernel images in the child process, thus enabling the process of breakpoint debugging and system call tracking.
  • System calls can also be intercepted and modified at the user level using the Ptrace function.
  • the dlopen function is also a function of the Android system function, it is mainly used to load and open the dynamic link library, and return a handle to the calling process.
  • the dynamic link library is a library containing code and data that can be used simultaneously by multiple programs.
  • the dynamic link library is not an executable file, so the dynamic link library provides a way for a process to call a program code that does not belong to it.
  • the function's executable code is located in a dynamic link library file, a non-executable binary program file that allows programs to share the code and other resources necessary to perform a particular task.
  • Step S30 executing a dynamic link library in the process of the target application to encapsulate and load a preset function data package
  • the dynamic link library has been injected into the process of the target application in step S20, so the process of the target application can execute the functions in the dynamic link library.
  • the Ptrace function calls a static method in the dynamic link library to encapsulate the function method in the function data packet, and then loads the pre-set function data packet to masquerade the sensitive information.
  • Step S40 running the function data packet, masquerading the sensitive information to be accessed by the target application, and forming masquerading data for the target application to acquire.
  • the function data packet has been loaded into the process of the target application in step S30, so the process of the target application can also execute the function method in the function data package.
  • the function data packet first intercepts the access request of the target application and confirms its intent, that is, whether the target application wants to access the preset sensitive information.
  • the function data packet performs masquerading processing on the sensitive information according to the type of sensitive information to be accessed by the target application, and forms the spoofed data, and returns the spoofed data to the target application.
  • Program access request is the access request of the target application and confirms its intent, that is, whether the target application wants to access the preset sensitive information.
  • the process of injecting the function data packet into the target application in the first time before the target application issues the access request is implemented.
  • the monitoring process begins with the application launching and ends with the application closing.
  • the system function Ptrace function is called to inject the preset dynamic link library into the process of the target application. Therefore, the process of the target application can execute a dynamic link library, and package and load the preset function data package by executing a dynamic link library in the process of the target application.
  • Running the function data packet masquerading the sensitive information to be accessed by the target application to form masquerading data for the target application to obtain, so that the target application cannot obtain the correct sensitive information data, thereby To achieve the purpose of protecting the sensitive information of users.
  • FIG. 2 is a schematic flowchart diagram of a second embodiment of a method for protecting sensitive information. Based on the foregoing first embodiment of the method for protecting the sensitive information security of the present invention, the method for protecting the sensitive information of the present embodiment further includes:
  • step S02 the control authority of the activated target application is acquired to monitor the target application.
  • each application is assigned a user ID when it is started, and uses the user ID to manage the rights of the application. If the applications need to call each other, they can only have the same user ID, and no other application data can be obtained between each application.
  • the Ptrace function is called to intercept and reset the user identifier of the application to obtain the control right of the application, and realize the target application process by controlling the authority. Dynamic monitoring.
  • the user identifier of the target application is modified to obtain the control authority of the target application, so that the target application can be dynamically monitored, thereby ensuring that the target application is not monitored and sensitive information is implemented. Accessing sensitive information in the case of protection measures can dynamically prevent target applications from obtaining sensitive information in real time.
  • FIG. 3 is a schematic flowchart diagram of a third embodiment of a method for protecting sensitive information security according to the present invention.
  • the sensitive information security protection method of the present embodiment further includes:
  • Step S01 resetting a user identifier of the target application during startup of the target application
  • the purpose of obtaining the control rights of the target application is achieved by resetting the user ID assigned to the target application by the system.
  • Step S03 backing up the file system path of the target application to a preset isolation area to protect data of the target application.
  • step S01 calls the Ptrace function to track the startup process of the target application and resets the user identifier assigned by the system to the target application, thereby obtaining the control permission of the target application. the goal of.
  • the data of the target application is to be It is regarded as sensitive information, that is, the target application is regarded as a protected object, and the data information of the target application needs to be protected when other applications want to access the target application, so the present invention obtains the control authority of the target application by Data that can be used to protect the target application is not accessed by other applications.
  • Step S03 copies the file system path of the target application to an isolation area under the present invention, so that other applications cannot access and modify the data of the target application, thereby achieving the purpose of protecting the data security of the target application.
  • FIG. 4 is a schematic flowchart of a process for injecting a sensitive information security protection method according to the present invention.
  • Step S20 when it is detected that there is a process under the target application, the preset dynamic link library is injected into the process of the application.
  • Step S20 is an important implementation of the present invention. Only the process injection can be used to execute the function data packet of the present invention by using the process of the target application, thereby realizing the interception of the target application access request and the disguise of the sensitive information to be accessed. Handle and ultimately achieve the purpose of protecting user sensitive information.
  • Step S20 specifically includes the following steps:
  • Step S201 hijacking the process of the target application
  • the control of the target application's process has been obtained before this step, so any operation can be performed on the target application.
  • the process of hijacking the target application is in the process of generating the process of the target application, in order to achieve the purpose of preventing the access intention of the first time.
  • the process of hijacking the target application by the Ptrace function can cause the process to be temporarily stopped, thereby executing step S202.
  • Step S202 injecting code that calls the dlopen function into the process of the target application
  • a small piece of code injected by the Ptrace function in this step is assembly code, which includes the calling method of the dlopen function and the loading path of the dynamic link library.
  • the assembly code is short, takes up less memory, and executes faster, so it can be completed more simply and quickly.
  • a call to a dynamic link library is assembly code, which includes the calling method of the dlopen function and the loading path of the dynamic link library.
  • Step S203 obtaining a preset dynamic link library by calling a dlopen function
  • a preset dynamic link library is obtained.
  • the target application process implements the call to the dlopen function by executing the injected assembly code, and notifies the dlopen function of the loading path of the dynamic link library.
  • Step S204 loading the dynamic link library into a process of the target application.
  • the dynamic link library is loaded into a process of the target application, so that the process of the target application executes a function in the dynamic link library.
  • Dlopen function by getting the dynamic link library plus Loading a path, loading the dynamic link library into a process of the target application, and opening the specified dynamic link library file in a specified mode. Since the functions in the dynamic link library file are executed in the process of the target application, the functions in the dynamic link library file can modify any memory of the target application process space, and of course, hooks can be added to change through the hook function. The purpose of the target application process working mechanism.
  • FIG. 5 is a schematic diagram of a process of disguising the sensitive information of the sensitive information security protection method according to the present invention.
  • Step S40 running the function data packet, masquerading the sensitive information to be accessed by the target application, and forming masquerading data for the target application to acquire. Therefore, step S40 specifically includes the following steps:
  • step S401 the process of the target application (also referred to as the target application process) runs the function method in the function data package by executing a function in the dynamic link library.
  • the dynamic link library provides a static invocation method that causes a process to call a function that does not belong to the executable code of the process.
  • the static method of the dynamic link library loads the function data package into the process of the target application and encapsulates the function data package.
  • step S402 the data access request of the target application is monitored by running the function data package.
  • step S403 it is determined whether the data access request of the target application is sensitive information set in advance, and if yes, step S404 is performed, otherwise, step S403 is continued.
  • step S404 the function data packet intercepts the process of the target application, and performs corresponding masquerading processing according to the type of sensitive information to be accessed, and returns the formed masquerading data to the access request of the application process.
  • the target application's process runs a function data package that has been loaded into the process, and the function data package monitors the target application's process and determines whether the target application's data access request has an intent to access the sensitive information, if any,
  • the data access request of the target application is intercepted by the Android management service program interface, and targeted data masquerading processing is performed according to the type of sensitive information accessed by the Android management service program interface, and data for masquerading data and masquerading data is returned to the target application. Access request. If it does not exist, continue to monitor the data access request of the target application.
  • FIG. 6 is a diagram showing an example of an application access sensitive information resource in an Android system.
  • the application access to system resources is managed through various management service program interfaces.
  • the Android system management service program interface includes a location service management class (LocationManager), a process service management class (ProcessManager), a registration service management class (AccountManger), and a communication service management class (TelephonyManager).
  • the application first sends access request information to the management service program interface.
  • the management service program interface After receiving the access request information sent by the application, the management service program interface first confirms whether the application has access rights corresponding to sensitive information, if Access rights, the management service program interface sends an access request to the sensitive information resource, and the sensitive information resource returns the relevant sensitive information to the management service program interface after receiving the access request, and finally manages the service program interface and then the application is sensitive to access. The information is returned to the application.
  • FIG. 7 is a schematic diagram of a target application accessing sensitive information resource in the Android system of the present invention.
  • the target application access sensitive information resource under the present invention differs from the normal application access sensitive information resource.
  • the communication of the target application to access sensitive information only occurs between the application and the management service interface, thus fundamentally ensuring that the application cannot access sensitive information.
  • the sensitive data information in the intelligent terminal that is directed to the embodiment of the present invention is mainly divided into two categories: the first type is the sensitive information related to the terminal device itself (for example, the International Mobile Equipment Identity (IMEI) and the device identifier.
  • the definition and setting of sensitive data information in the smart terminal can be predefined and set by the user. For example, if the user has set up sensitive information protection for an application, but only wants to obtain real data information of a certain type or type of sensitive information, it can be set in advance to obtain this or such sensitivity. The real data information of the information.
  • the target application wants to obtain the first type of sensitive information such as the mobile phone serial number or the device identification number, the target application must declare in the Android system's manifest.xml file that the mobile phone corresponds to the first type of sensitive information. Permission; if the target application wants to obtain the second type of sensitive information such as location information or address book information, the target application must also declare in the manifest.xml file of the Android system that the mobile phone corresponds to the second type of sensitive information. Permissions. Therefore, the target application's data access request intent is judged by the permission declaration of the target application in the Android system manifest.xml file, and if the access to the sensitive information is involved in the permission statement, the function data package can confirm the target application. To access sensitive information, the feature packet needs to intercept the data access request of the target application.
  • the function data package When the target application wants to access sensitive information, the function data package will call the management service program interface in the Android system to intercept the access request of the target application, and at the same time camouflage the sensitive information to be accessed by the target application, and then form The spoofed data is returned to the target application's data access request to protect sensitive information.
  • the present invention performs data masquerading for each target application that accesses preset sensitive information.
  • the smart terminal is used as an Android mobile phone as an example to describe the camouflage process of the two types of sensitive information involved in the present invention.
  • the first category is sensitive information related to Android phone information:
  • the Android system provides a telephone management service, one of which is to read, for example, the mobile phone serial number imei information.
  • the telephony management service can be divided into many layers, and the Telephony framework layer is involved in reading the mobile phone information.
  • the core TelephonyManager class in the Telephony framework layer provides a set of methods for accessing status and information related to mobile communication. These include the status and information of the mobile SIM, the status of the telecommunications network, and the information of the mobile phone user. Of course, obtaining the imei information also requires the related methods of the TelephonyManager class.
  • the TM When the application queries the status of the mobile phone through the TelephonyManager (hereinafter referred to as TM), the TM sends the request to the system service, so that the imei number can be obtained.
  • the getDeviceId method in TM can return the imei value.
  • the place where this method is defined is the IphoneSubinfo class.
  • the IphoneSubinfo service is a proxy object for registering a system service internally. According to TelephonyManager.java, this service is obtained in the getSubscriberInfo interface. Through this service, the mobile phone information such as the software version, device ID, and SIM card serial number can be obtained.
  • the iphonesubinfo service is obtained through the getService method of the ServiceManager, and the getService can be regarded as an Android service query process.
  • getservice will first query the scache for the existence of the service, and the service for each lookup is stored in the cache hash table. If it is the first time to find iphonesubinfo, the service does not exist in the cache, so it will be added to register the service through other functions; if there is a service, it will return directly.
  • the present invention implements the interception function by modifying the ibinder object of the iphonesubinfo service class in the sCache cache query.
  • the target application can call the phone state sensitive information that the service wants to obtain, such as imei, to become null.
  • the second category is sensitive information related to the content provider:
  • the Content Provider database is provided to provide data sharing function to the application, wherein the data provided by the application is organized by the Content Provider database in the mobile phone in the form of a table.
  • the functions provided by the Content Provider database include the query function query(), the insert function insert(), the modify function update(), and the delete function delete().
  • the most used one is the query function query(), which is used by the application to query the data in the database.
  • the invention analyzes the query function query() in the function data packet function, and directly sets the return value of the Cursor in the query function query() to a null value to ensure that the service to be queried by the target application cannot return its desired sensitivity. information.
  • the implementation can be implemented.
  • the sensitive information is disguised as described in the embodiments of the present invention.
  • this method only uses simple data masquerading instead of more elaborate data packaging, the data masquerading strategy of the method can be easily extended to a more detailed data packaging system if needed.
  • FIG. 8 is a schematic diagram of a functional module of a first embodiment of the sensitive information security protection device of the present invention.
  • the sensitive information security protection device includes:
  • the monitoring module 10 is configured to monitor whether a process of the target application exists in the process
  • the monitoring module 10 monitors whether there is a process of the target application in the Android system process, and if not, continues to monitor; if yes, enters the injection module 20.
  • the injection module 20 is configured to inject a preset dynamic link library into the process of the target application when the process of the target application exists in the process is detected;
  • the Ptrace function in the Android system is invoked in the injection module 20 to inject the preset dynamic link library into the process of the target reference program.
  • the Ptrace function first injects a small piece of code that calls the dlopen function into the target application's process, and then calls the dlopen function to load the dynamic link library, thereby injecting the pre-set dynamic link library into the target application's process.
  • the package loading module 30 is configured to execute a dynamic link library in a process of the target application to encapsulate and load a preset function data package;
  • the injection module 20 has injected the dynamic link library into the process of the target application, so in the package load module 30, the process of the target application can execute functions in the dynamic link library.
  • the Ptrace function calls a static method in the dynamic link library to encapsulate the function method in the function data packet, and then loads the preset function data packet to masquerade the sensitive information.
  • the masquerading module 40 is configured to run the function data packet, and masquerade the sensitive information to be accessed by the target application to form masquerading data for the target application to acquire.
  • the function data package has been loaded into the process of the target application in the package loading module 30, so the process of the target application can also execute the function method in the function data package.
  • the function data packet first intercepts the access request of the target application and confirms its intention, that is, determines whether the target application needs to access the preset sensitive information.
  • the function data packet performs masquerading processing on the sensitive information according to the type of sensitive information to be accessed by the target application, and forms the spoofed data, and returns the spoofed data to the target application.
  • Program access request is the access request of the target application and confirms its intention, that is, determines whether the target application needs to access the preset sensitive information.
  • the monitoring module 10 dynamically monitors whether there is a process of the target application in the process, so as to implement the process of injecting the function data packet into the target application in the first time before the target application issues the access request. Used to prevent targeted applications from accessing sensitive information.
  • the injection module 20 calls the system function Ptrace function to inject the preset dynamic link library into the process of the target application. Therefore the process of the target application can execute the dynamic link library.
  • the package loading module 30 a pre-set function data package is encapsulated and loaded by executing a dynamic link library in the process of the target application.
  • FIG. 9 is a schematic diagram of functional modules of a second embodiment of a sensitive information security protection device according to the present invention. Based on the first embodiment of the above-mentioned sensitive information security protection device of the present invention, the sensitive information security protection device of this embodiment further includes:
  • the permission obtaining module 60 is configured to acquire the control authority of the activated target application to monitor the target application.
  • each application is assigned a user ID when it is started, and uses the user ID to manage the rights of the application. If the applications need to call each other, they can only have the same user ID, and no other application data can be obtained between each application.
  • the privilege acquisition module 60 when the Android system starts and assigns a user identifier to the application, the privilege acquisition module 60 calls the Ptrace function to intercept and modify the user identifier of the application to obtain the control authority for the application, and realize the control authority. Dynamic monitoring of target application processes.
  • the user identifier of the target application is modified by the authority obtaining module 60 to obtain the control authority of the target application, so that the target application can be dynamically monitored by the monitoring module 10, thereby It ensures that the target application does not access sensitive information without being monitored and implementing sensitive information protection measures. Dynamically prevent target applications from obtaining sensitive information in real time.
  • the injection module 20 calls the system function Ptrace function to inject the preset dynamic link library into the process of the target application.
  • the package loading module 30 a pre-set function data package is encapsulated and loaded by executing a dynamic link library in the process of the target application.
  • FIG. 10 is a schematic diagram of functional modules of a third embodiment of a sensitive information security protection device according to the present invention.
  • the sensitive information security protection device of this embodiment further includes:
  • the reset module 50 is configured to reset a user identifier of the target application during startup of the target application
  • the reset module 50 resets the user identification of the target application, thereby obtaining control rights to the target application.
  • the backup module 70 is configured to back up the file system path of the target application to a preset isolation area to protect data of the target application.
  • the reset module 50 calls the Ptrace function to track the startup process of the target application and resets the user identifier assigned by the system to the target application, thereby obtaining the target application.
  • the present invention also uses the data of the target application as a protection object, and backs up the file system path of the target application to the previously set quarantine area through the backup module 70, thereby preventing other applications from accessing the data of the target application.
  • FIG. 11 is a schematic diagram of a function module of an injection module of a sensitive information security protection device according to an embodiment of the present invention.
  • the injection module 20 includes:
  • the obtaining unit 201 is configured to acquire a preset dynamic link library when a process exists under the target application;
  • the injection module 70 can perform any operation on the target application.
  • the obtaining unit 201 calls the Ptrace function to hijack the process of the target application, and the process of hijacking the target application through the Ptrace function can temporarily stop the process, and the Ptrace function injects a small piece of code into the process of the target application into the assembly application code.
  • the code contains the calling method of the dlopen function and the loading path of the dynamic link library.
  • the obtaining unit 201 executes the injected assembly code through the process of the target application to acquire related information of the dynamic link library.
  • the loading unit 202 is configured to load the dynamic link library into a process of the target application for a process of the target application to execute a function in the dynamic link library.
  • the loading unit 202 calls the dlopen function, and the dlopen function loads the dynamic link library into the process of the target application through the obtained loading path of the dynamic link library.
  • the acquisition unit 201 injects a piece of assembly code information into the target application process by calling the Ptrace function, and executes the injected assembly code through the process of the target application to obtain the relevant information of the dynamic link library.
  • the loading unit 202 loads the dynamic link library by calling the dlopen function, and the dlopen function loads the dynamic link library into the process of the target application by the obtained dynamic link library loading path, and opens the specified dynamic link library in the specified mode.
  • the file is executed by the process of the target application.
  • FIG. 12 is a schematic diagram of a functional module of a masquerading module of a sensitive information security protection device according to an embodiment of the present invention.
  • the camouflage module 40 includes:
  • the monitoring unit 401 is configured to execute a function in the dynamic link library by using a process of the target application to run the function data packet to monitor a data access request of the target application;
  • the functions in the function data packet can be executed by the process of the target application, so that the function data packet can monitor the data access request of the target application.
  • the monitoring unit 401 can dynamically understand the data access request of the target application in real time, so that the target application can intercept the sensitive data access request before issuing it.
  • the determining unit 402 is configured to intercept the data access request of the target application, and determine whether the data to be accessed by the data access request of the target application is pre-set sensitive information.
  • the intercept determining unit 402 intercepts the data access request of the target application, and determines whether the intercepted target application data access request is The preset sensitive information, if yes, enters the masquerading processing unit 403, if otherwise terminates the interception of the target application data access request.
  • the masquerading processing unit 403 is configured to masquerade the functional information to be accessed by the application program and form masquerading data.
  • the interception judging unit 402 intercepts and judges that the target application has an intention to access the sensitive information, it enters the masquerading processing unit 403.
  • the masquerading processing unit 403 masquerades the sensitive information to be accessed by the target application according to the type of sensitive information to be accessed by the target application, and returns the formed spoofed data to the access request of the target application.
  • the monitoring unit 401 monitors the data access request of the target application, thereby realizing real-time dynamic monitoring of the data access request of the target application, when the monitoring unit 401 monitors that the target application has a data access request.
  • the interception determining unit 402 intercepts the data access request of the target application, and determines whether the data access request of the target application is accessing the preset sensitive information. If so, the masquerading processing unit 403 determines the type of the sensitive information to be accessed according to the target application. Corresponding masquerading processing is performed on the sensitive information to be accessed by the target application, and the data access request for forming the masquerading data is returned to the target application. If otherwise, the monitoring unit 401 continues to monitor the data access request of the target application.

Abstract

一种敏感信息安全保护方法，包括监测进程中是否存在目标应用程序的进程（S10）；当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中（S20）；执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包（S30）；运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取（S40）。还公开了一种敏感信息安全保护装置。上述方案可以防止恶意应用程序获取准确的用户终端设备中的敏感信息，使得用户的敏感信息不会被泄露。

Description

敏感信息安全保护方法和装置 技术领域
本发明涉及信息安全领域，尤其涉及敏感信息安全保护方法和装置。
背景技术
智能终端的使用度和使用率正在稳步提高。随着移动平台逐渐强大的计算能力、收发能力和通讯通信能力，越来越多的应用程序被开发并且被用户安装到智能终端上。但是随着智能终端的快速发展，智能终端上的恶意应用程序和应用程序中的恶意行为发生率也越来越高。
已有的许多相类似的相关研究包括Android应用沙箱在内，都是基于传统的系统调用分析方法来描述应用程序行为的。但是通过一系列的探索后发现以往这些传统的基于系统调用分析的方法并不能获取应用程序和Android系统之间的核心交互过程。例如TaintDroid技术为所有敏感信息和信息标上敏感标示符，当这些标识信息要被获取或发送到服务器时就会被阻止，以此来保护这些标识信息资源不被泄露，但TaintDroid技术却不能分析出某些不期望发生的应用程序行为，如偷偷发送短信息，而且也不能检查敏感行为的内部逻辑。与此同时，也有很多研究者考虑到进程间通信方面的问题，通过监控应用程序的进程通信来实现对应用程序行为的监控和记录，但是却没有考虑到应用程序接口层面的隔离，从而不能真正的实现对应用程序接触敏感数据和资源的行为的隔离和阻止。
上述内容仅用于辅助理解本发明的技术方案，并不代表承认上述内容是现有技术。
发明内容
本发明实施例的主要目的在于提供一种敏感信息安全保护方法和装置，旨在达到防止恶意应用程序获取和泄露智能终端中的敏感信息的目的，实现了对智能终端用户敏感信息的保护。
为实现上述目的，本发明实施例提供一种敏感信息安全保护方法，包括以下步骤：
监测进程中是否存在目标应用程序的进程；
当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中；
执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包；
运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。
在本发明实施例中，所述监测目标应用程序下是否存在进程之前还包括获取已启动的目标应用程序的控制权限，以对目标应用程序进行监控。
在本发明实施例中，所述当监测到所述目标应用程序下存在进程时，则将预先设置的动态链接库注入应用程序的进程中包括：
当所述目标应用程序下存在进程时，获取预先设置的动态链接库；
将所述动态链接库加载到所述目标应用程序的进程中，以供所述目标应用程序的进程执行所述动态链接库中的函数。
在本发明实施例中，所述运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据包括：
通过所述目标应用程序的进程执行所述动态链接库中的函数，以运行所述功能数据包，对所述目标应用程序的数据访问请求进行监控；
当所述目标应用程序的数据访问请求所要访问的数据为预先设置的敏感信息时，根据所述敏感信息的类型，进行相应的伪装处理，形成伪装数据。
在本发明实施例中，所述敏感信息安全保护方法还包括：
在所述目标应用程序的启动过程中，重置所述目标应用程序的用户标识；
通过重置后的用户标识将所述目标应用程序的文件系统路径备份到预先设置的隔离区，以对目标应用程序的数据进行保护。
本发明实施例还提供了一种敏感信息安全保护装置，包括：
监测模块，设置为监测进程中是否存在目标应用程序的进程；
注入模块，设置为当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中；
封装加载模块，设置为执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包；
伪装模块，设置为运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。
在本发明实施例中，所述敏感信息安全保护装置还包括：
权限获取模块，设置为获取已启动的目标应用程序的控制权限，以对目标应用程序进行监控。
在本发明实施例中，所述注入模块包括：
获取单元，设置为当所述目标应用程序下存在进程时，获取预先设置的动态链接库；
加载单元，设置为将所述动态链接库加载到所述目标应用程序的进程中，以供所述目标应用程序的进程执行所述动态链接库中的函数。
在本发明实施例中，所述伪装模块包括：
监控单元，设置为通过所述目标应用程序的进程执行所述动态链接库中的函数，以运行所述功能数据包，对所述目标应用程序的数据访问请求进行监控；
伪装处理单元，当所述目标应用程序的数据访问请求所要访问的数据为预先设置的敏感信息时，根据所述敏感信息的类型，进行相应的伪装处理，形成伪装数据。
在本发明实施例中，所述敏感信息安全保护装置还包括：
重置模块，设置为在所述目标应用程序的启动过程中，重置所述目标应用程序的用户标识；
备份模块，设置为通过重置后的用户标识将所述目标应用程序的文件系统路径备份到预先设置的隔离区，以对目标应用程序的数据进行保护。
本发明实施例主要采用了数据伪装的核心思想，将应用程序需要获取的相关敏感信息进行伪装，这种伪装策略一方面使得应用程序拿到一个错误的数据或者拿不到数 据，另一方面则可以保证这种伪装策略不会轻易被应用程序反监测到，因而可以有效防止恶意应用程序获得准确的敏感信息。
附图说明
图1为本发明敏感信息安全保护方法第一实施例流程示意图；
图2为本发明敏感信息安全保护方法第二实施例流程示意图；
图3为本发明敏感信息安全保护方法第三实施例流程示意图；
图4为本发明敏感信息安全保护方法进程注入流程示意图；
图5为本发明敏感信息安全保护方法敏感信息伪装流程示意图；
图6为Android系统中应用程序访问敏感信息资源示例图；
图7为本发明下Android系统中目标应用程序访问敏感信息资源示例图；
图8为本发明敏感信息安全保护装置第一实施例功能模块示意图；
图9为本发明敏感信息安全保护装置第二实施例功能模块示意图；
图10为本发明敏感信息安全保护装置第三实施例功能模块示意图；
图11为本发明实施例的敏感信息安全保护装置注入模块示意图；
图12为本发明实施例的敏感信息安全保护装置伪装模块示意图。
本发明目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
本发明实施例的核心思想为对敏感信息进行数据伪装，当应用程序尝试打开这些敏感信息资源的时候，则通过本发明对敏感信息进行数据伪装，从而提供给应用程序伪装的数据：例如打开的是一个空文件，或者直接提供错误的数据和毫无相关的数据，从而使应用程序访问敏感信息时得不到正确的敏感信息。
具体举例来说，当一个应用程序要求获取一个设备所在的位置信息时，通过本发明实施例返回的是一个看上去似乎是一个位置的坐标，但并不是设备所在的真正坐标，完全是一个无关的位置坐标。当一个应用程序想要获取设备的信息数据，如手机号和设备ID时，通过本发明返回一个设定好的假的手机号码和一个设定好的假的随机数字和字母组合而成的设备ID，这些伪装过的数据看上去和真实的数据的格式几乎毫无差别，应用程序无法探测出本发明的数据伪装策略。当应用程序尝试读取通讯录联系人信息或者是短信记录的时候，通过本发明将系统中的content provider数据库进行修改，使得应用程序查询返回的数据是空表。
本发明的核心思想适用于智能终端中的任何操作系统，本发明实施例具体以Android操作系统进行举例。
下面将根据附图说明对本发明的具体实施方法步骤进行说明。
参照图1，图1为本发明敏感信息安全保护方法第一实施例流程示意图，在本实施例中，敏感信息安全保护方法包括：
步骤S10，监测进程中是否存在目标应用程序的进程；
通过监测进程来判断是否存在目标应用程序的进程，若不存在，则返回步骤S10继续监测；若存在，则进入步骤S20；
步骤S20，当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中；
本步骤中的进程注入具体是指：此预先设置的动态链接库被加载到已运行的目标进程空间中，从而动态链接库中的函数在目标进程空间中有对应的地址，然后通过此地址便可在目标进程中调用动态链接库中的函数。本发明中所述目标应用程序是根据用户选择的应用程序来进行进程注入和敏感信息伪装处理的。
当在步骤S10中监测到进程中存在目标应用程序的进程时，则在步骤S20中调用Ptrace函数将预先设置的动态链接库注入目标引用程序的进程中。由于不能将一个比较大的数据包直接注入进程中，因此需要Ptrace函数先将一小段调用dlopen函数的代码先注入目标应用程序的进程中，然后再调用dlopen函数来加载动态链接库，以此实现将预先设置的动态链接库注入到目标应用程序的进程中。
Ptrace函数是一个非常强大的Android系统函数，在Android系统中，新进程的产生都是通过父进程来实现的。Ptrace函数则提供了一种使父进程得以监视和控制其它 进程的方式，它还能够改变子进程中的寄存器和内核映像，因而可以实现进程的断点调试和系统调用的跟踪。使用Ptrace函数还可以在用户层拦截和修改系统调用。dlopen函数也是Android系统函数的一种，它主要用来加载和打开动态链接库，并返回一个句柄给调用进程。所述动态链接库是一个包含可由多个程序同时使用的代码和数据的库，动态链接库不是可执行文件，因此动态链接库就提供了一种方法，使进程可以调用不属于其可执行代码的函数。函数的可执行代码位于一个动态链接库文件中，该动态链接库文件是一种不可执行的二进制程序文件，它允许程序共享执行特殊任务所必需的代码和其他资源。
步骤S30，执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包；
在步骤S20中已经将动态链接库注入目标应用程序的进程中，因此目标应用程序的进程可以执行动态链接库中的函数。Ptrace函数调用所述动态链接库中的一静态方法先对功能数据包中的函数方法进行封装后，再加载预先设置的功能数据包对敏感信息进行伪装处理。
步骤S40，运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。
在步骤S30中已经将功能数据包加载到目标应用程序的进程中，因此目标应用程序的进程也可以执行功能数据包中的函数方法。功能数据包先拦截目标应用程序的访问请求并对其意图进行确认，也即判断目标应用程序是否要访问预设的敏感信息。当目标应用程序的访问请求为预设的敏感信息时，功能数据包会根据目标应用程序要访问的敏感信息类型，对敏感信息做相应的伪装处理形成伪装数据，并将伪装数据返回给目标应用程序的访问请求。
本实施例中，通过动态监测进程中是否存在目标应用程序的进程，以此实现在目标应用程序发出访问请求前的第一时间将功能数据包以加载的方式注入目标应用程序的进程中，用以防范目标应用程序访问敏感信息。所述监测过程开始于应用程序启动，结束于应用程序关闭退出。当监测到进程中存在目标应用程序的进程时，则调用系统函数Ptrace函数将预先设置的动态链接库注入目标应用程序的进程中。因此目标应用程序的进程可以执行动态链接库，通过执行所述目标应用程序的进程中的动态链接库来封装并加载预先设置的功能数据包。运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取，从而使得目标应用程序获取不到正确的敏感信息数据，以此达到保护用户敏感信息安全的目的。
进一步地，参照图2，图2为本发明敏感信息安全保护方法第二实施例流程示意图。基于上述本发明敏感信息安全保护方法第一实施例，本实施例的敏感信息安全保护方法在上述步骤S10之前还包括：
步骤S02，获取已启动的目标应用程序的控制权限，以对目标应用程序进行监控。
在Android系统中每个应用程序在被启动时就分配了一个用户标识，并利用用户标识来进行应用程序的权限管理。如果应用程序之间需要互相调用，只能是具有相同的用户标识才行，每个应用程序之间是不能随意获得其他应用程序数据的。在步骤S02中，当Android系统在应用启动并给其分配用户标识时，调用Ptrace函数拦截并重置应用程序的用户标识以达到获取对应用程序的控制权限，通过控制权限实现对目标应用程序进程的动态监控。
在本实施例中，先通过修改目标应用程序的用户标识以获取目标应用程序的控制权限，进而才能对目标应用程序进行动态监控，从而能够保证目标应用程序不会在未被监控且实施敏感信息保护措施的情况下访问敏感信息，能够实时动态地防止目标应用程序获得敏感信息。
可选地，参照图3，图3为本发明敏感信息安全保护方法第三实施例流程示意图。基于上述本发明敏感信息安全保护方法第二实施例，本实施例的敏感信息安全保护方法还包括：
步骤S01，在所述目标应用程序的启动过程中，重置所述目标应用程序的用户标识；
通过重置系统分配给目标应用程序的用户标识，从而达到获取目标应用程序控制权限的目的。
步骤S03，将所述目标应用程序的文件系统路径备份到预先设置的隔离区，以对目标应用程序的数据进行保护。
将目标应用程序的文件系统路径复制到本发明下的一隔离区中，从而使得其他应用程序无法访问和修改目标应用程序的数据，从而达到保护目标应用程序数据安全的目的。
本实施例中，当用户选择的目标应用程序被启动时，步骤S01会调用Ptrace函数跟踪目标应用程序的启动过程并重置系统分配给目标应用程序的用户标识，从而达到获取目标应用程序控制权限的目的。同时，本实施例中，如果将目标应用程序的数据 看做是敏感信息，即将目标应用程序看成保护对象，则当其他应用程序要访问目标应用程序时也需要对目标应用程序的数据信息进行保护，因此本发明通过获取目标应用程序的控制权限还可以用来保护目标应用程序的数据不会被其他应用程序访问。步骤S03将目标应用程序的文件系统路径复制到本发明下的一隔离区中，从而使得其他应用程序无法访问和修改目标应用程序的数据，从而达到保护目标应用程序数据安全的目的。
可选地，参照图4，图4为本发明敏感信息安全保护方法进程注入流程示意图。
如图3中步骤S20，所述当监测到所述目标应用程序下存在进程时，则将预先设置的动态链接库注入应用程序的进程中。步骤S20是本发明的重要实现，只有通过进程注入，才能利用目标应用程序的进程来执行本发明的功能数据包，以此实现对目标应用程序访问请求的拦截和对要访问的敏感信息的伪装处理，并最终实现保护用户敏感信息安全的目的。步骤S20具体还包括以下步骤：
步骤S201，劫持目标应用程序的进程；
在本步骤前已取得了对目标应用程序的进程的控制权限，因此可以对目标应用程序进行任何的操作。劫持目标应用程序的进程是发生在目标应用程序的进程生成的过程中，用以达到第一时间对其访问意图进行预防的目的。可以通过Ptrace函数劫持目标应用程序的进程可以使得该进程暂时停止，进而得以执行步骤S202。
步骤S202，将调用dlopen函数的代码注入所述目标应用程序的进程中；
本步骤中通过Ptrace函数注入的一小段代码为汇编代码，其包含了dlopen函数的调用方法和动态链接库的加载路径，汇编代码简短，占用内存少，执行速度快，因此能更加简洁、快速完成对动态链接库的调用。
步骤S203，通过调用dlopen函数获取预先设置的动态链接库；
本步骤中，当所述目标应用程序下存在进程时，获取预先设置的动态链接库。目标应用程序进程通过执行被注入的汇编代码来实现对dlopen函数的调用，同时将动态链接库的加载路径告知dlopen函数。
步骤S204，将所述动态链接库加载到所述目标应用程序的进程中。
本步骤中，将所述动态链接库加载到所述目标应用程序的进程中，以供所述目标应用程序的进程执行所述动态链接库中的函数。dlopen函数通过获取的动态链接库加 载路径，将所述动态链接库加载到所述目标应用程序的进程中，并以指定模式打开指定的动态连接库文件。由于动态链接库文件中的函数是在目标应用程序的进程中执行的，所以动态链接库文件中的函数可以修改目标应用程序进程空间的任何内存，当然也可以加钩子，通过钩子函数从而达到改变目标应用程序进程工作机制的目的。
可选地，参照图5，图5为本发明敏感信息安全保护方法敏感信息伪装流程示意图。
步骤S40，运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。因此步骤S40具体还包括以下步骤：
步骤S401中，目标应用程序的进程(又称为目标应用程序进程)通过执行动态链接库中的函数来运行功能数据包中的函数方法。所述动态链接库提供了一种静态调用方法，此静态调用方法可以使进程调用不属于该进程可执行代码的函数。所述动态链接库的静态方法将功能数据包加载到目标应用程序的进程中，并对功能数据包进行封装。
步骤S402中，通过运行所述功能数据包来对所述目标应用程序的数据访问请求进行监控。步骤S403中，判断目标应用程序的数据访问请求是否为预先设置的敏感信息，若是则执行步骤S404，若否则继续执行步骤S403。步骤S404中，所述功能数据包拦截所述目标应用程序的进程，并根据要访问的敏感信息类型进行相对应的伪装处理，同时将形成的伪装数据返回给所述应用程序进程的访问请求。
目标应用程序的进程运行已加载到进程中的功能数据包，所述功能数据包对目标应用程序的进程进行监控并判断目标应用程序的数据访问请求是否存在访问敏感信息的意图，若存在，则将通过Android管理服务程序接口拦截所述目标应用程序的数据访问请求，并根据其访问的敏感信息类型进行针对性的数据伪装处理，形成伪装数据并将伪装数据返回给所述目标应用程序的数据访问请求。若不存在，则继续对目标应用程序的数据访问请求进行监控。
具体地，参照图6，图6为Android系统中应用程序访问敏感信息资源示例图。
Android系统中是通过各种管理服务程序接口来管理应用程序对系统资源的访问的。根据各系统资源的不同类型，Android系统管理服务程序接口包含有位置服务管理类(LocationManager)、进程服务管理类(ProcessManager)、注册服务管理类(AccountManger)、通信服务管理类(TelephonyManager)等。
在正常情况下，应用程序会先向管理服务程序接口发送访问请求信息，当收到应用程序发送的访问请求信息后管理服务程序接口会先确认应用程序是否具有对应敏感信息的访问权限，若具有访问权限，则管理服务程序接口再向敏感信息资源发送访问请求，敏感信息资源收到访问请求后再将相关敏感信息返回给管理服务程序接口，最后管理服务程序接口再将应用程序要访问的敏感信息返回给应用程序。
具体地，参照图7，图7本发明下Android系统中目标应用程序访问敏感信息资源示意图。
从图7中可以看出，本发明下的目标应用程序访问敏感信息资源同正常情况下的应用程序访问敏感信息资源之间唯一的区别在于，在本发明对目标应用程序访问请求进行介入的情况下，目标应用程序访问敏感信息的通信只发生在应用程序和管理服务接口之间，因此从根本上保证了应用程序无法访问敏感信息。同时，为了避免应用程序在访问敏感信息时得不到返回值而产生程序异常或被应用程序反监测到，因此需要对应用程序要访问的敏感信息进行伪装处理，同时将形成的伪装数据返回给应用程序。从而一方面实现避免应用程序在访问敏感信息时得不到返回值而产生程序异常或被应用程序反监测到，另一方面也保证了敏感信息不被泄露。
本发明实施例针对的智能终端中的敏感数据信息，主要分为两大类：第一类是终端设备本身相关的敏感信息(例如手机串号(International Mobile Equipment Identity，简称为IMEI)和设备标识号对象device id)；第二类是同Android系统数据库Content Provider数据库相关的敏感信息(例如位置信息对象location和通讯录信息对象contacts)。在本发明中，对于智能终端中敏感数据信息的定义和设置可以由用户预先定义和设置。例如，如果用户已经设置了对某一应用程序进行敏感信息安全保护，但同时又只想获得某一个或一类敏感信息的真实数据信息，则可以预先进行设置后就可以得到这个或这类敏感信息的真实数据信息了。
例如，如果目标应用程序想要获取手机串号或设备标识号等所述第一类敏感信息时，目标应用程序必须在Android系统的manifest.xml文件中声明获取手机对应于第一类敏感信息的权限；如果目标应用程序想要获取位置信息或通讯录信息等所述第二类敏感信息时，目标应用程序也必须在Android系统的manifest.xml文件中声明获取手机对应于第二类敏感信息的权限。因此，通过目标应用程序在Android系统manifest.xml文件中的权限声明对目标应用程序的数据访问请求意图进行判断，若在权限声明中涉及对敏感信息的访问，则功能数据包可以确认目标应用程序要访问敏感信息，此时功能数据包需要对目标应用程序的数据访问请求进行拦截。
当目标应用程序要访问敏感信息时，功能数据包则会调用Android系统中的管理服务程序接口用以拦截目标应用程序的访问请求，同时对目标应用程序要访问的敏感信息进行伪装，再将形成的伪装数据返回给目标应用程序的数据访问请求，以此达到保护敏感信息的目的。本发明对于每一个访问预设的敏感信息的目标应用程序，都会进行数据伪装。
下面以智能终端为Android手机举例，对本发明涉及的两类敏感信息的伪装流程进行具体说明。
第一类是Android手机信息相关的敏感信息：
Android系统提供电话管理业务，该业务其中的一个功能就是读取例如手机串号imei信息。所述电话管理业务可以分为很多层，其中涉及到读取手机信息的是Telephony框架层。Telephony框架层中的核心TelephonyManager类提供了一系列用于访问与手机通讯相关的状态和信息的获取方法。其中包括手机SIM的状态和信息、电信网络的状态及手机用户的信息。当然获取imei信息也需要TelephonyManager类的相关方法。当应用程序通过TelephonyManager(以下简称TM)查询手机状态的时候，TM将这个请求发送给系统服务，所以才能获取到imei号。对TelephonyManager.java进行分析，TM中的getDeviceId方法可以返回imei值，找到这个方法定义的地方是IphoneSubinfo类。IphoneSubinfo服务是TM内部注册一个系统服务的代理对象，通过TelephonyManager.java可知，这个服务是在getSubscriberInfo接口中得到的，通过这个服务可以得到软件版本、设备ID、SIM卡串号等手机信息。而且通过返回语句可知：在java层，获取iphonesubinfo服务是通过ServiceManager的getService方法获取的，而getService其实可以看做是一个Android服务的查询过程。为了加快查询速度，getservice会先从scache中查询是否存在该服务，对每次查找的服务都存储在缓存哈希表中。如果是第一次查找iphonesubinfo，则缓存中不存在该服务，于是就会通过其他函数来添加注册该服务；如果存在服务，就直接返回。
因此，针对本类手机信息相关的敏感信息，本发明通过修改sCache缓存查询中的iphonesubinfo服务类的ibinder对象，以实现拦截功能。通过进程注入的方法将getService中的return service修改成return false，即可将目标应用程序调用该服务想要获取的手机状态敏感信息如imei变成空值null。
第二类是content provider相关的敏感信息：
在Android系统中提供了Content Provider数据库给应用程序提供数据共享的功能，其中，应用程序提供的数据由手机中Content Provider数据库以表的形式组织数据， Content Provider数据库所提供的函数包括查询函数query()、插入函数insert()、修改函数update()、删除函数delete()等。其中使用的最多的就是查询函数query()，它被应用程序用来查询数据库中的数据。本发明在功能数据包函数中通过分析查询函数query()，将查询函数query()中的Cursor的返回值直接设为空值null就能保证目标应用程序所要查询的服务无法返回其所要的敏感信息。
在本发明实施例中，只要找到在整个目标应用程序获取相关资源(例如敏感信息)的过程中涉及到的相关进程、类和方法，然后修改这些进程、类和方法的返回值，就能实现本发明实施例所述的对敏感信息进行伪装。本方法虽然只是采用了简单的数据伪装而不是进行更精心的数据包装，当时如果有需要的话本方法的数据伪装策略也可以轻易被扩展为更细致的数据包装系统。
本发明实施例进一步地还提供了一种敏感信息安全保护装置，参照图8，图8为本发明敏感信息安全保护装置第一实施例功能模块示意图。
在本实施例中，敏感信息安全保护装置包括：
监测模块10，设置为监测进程中是否存在目标应用程序的进程；
通过监测模块10来监测Android系统进程中是否存在目标应用程序的进程，若不存在，则继续监测；若存在，则进入注入模块20。
注入模块20，设置为当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中；
当监测模块10中监测到系统进程中存在目标应用程序的进程时，则在注入模块20中调用Android系统中的Ptrace函数将预先设置的动态链接库注入目标引用程序的进程中。Ptrace函数先将一小段调用dlopen函数的代码先注入目标应用程序的进程中，然后再调用dlopen函数来加载动态链接库，以此实现将预先设置的动态链接库注入到目标应用程序的进程中。
封装加载模块30，设置为执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包；
注入模块20已经将动态链接库注入目标应用程序的进程中，因此在封装加载模块30中，目标应用程序的进程可以执行动态链接库中的函数。Ptrace函数调用所述动态链接库中的一静态方法先对功能数据包中的函数方法进行封装后，再加载预先设置的功能数据包用以对敏感信息进行伪装处理。
伪装模块40，设置为运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。
封装加载模块30中已经将功能数据包加载到目标应用程序的进程中，因此目标应用程序的进程也可以执行功能数据包中的函数方法。在伪装模块40中，功能数据包先拦截目标应用程序的访问请求并对其意图进行确认，也即判断目标应用程序是否要访问预设的敏感信息。当目标应用程序的访问请求为预设的敏感信息时，功能数据包会根据目标应用程序要访问的敏感信息类型，对敏感信息做相应的伪装处理形成伪装数据，并将伪装数据返回给目标应用程序的访问请求。
本实施例中，通过监测模块10动态监测进程中是否存在目标应用程序的进程，以此实现在目标应用程序发出访问请求前的第一时间将功能数据包以加载的方式注入目标应用程序的进程中，用以防范目标应用程序访问敏感信息。当监测模块10监测到进程中存在目标应用程序的进程时，注入模块20调用系统函数Ptrace函数将预先设置的动态链接库注入目标应用程序的进程中。因此目标应用程序的进程可以执行动态链接库。在封装加载模块30中，通过执行所述目标应用程序的进程中的动态链接库来封装并加载预先设置的功能数据包。在伪装模块40中运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取，从而使得目标应用程序获取不到正确的敏感信息数据，以此达到保护用户敏感信息安全的目的。
可选地，参照图9，图9为本发明敏感信息安全保护装置第二实施例功能模块示意图。基于上述本发明敏感信息安全保护装置第一实施例，本实施例的敏感信息安全保护装置还包括：
权限获取模块60，设置为获取已启动的目标应用程序的控制权限，以对目标应用程序进行监控。
在Android系统中每个应用程序在被启动时就分配了一个用户标识，并利用用户标识来进行应用程序的权限管理。如果应用程序之间需要互相调用，只能是具有相同的用户标识才行，每个应用程序之间是不能随意获得其他应用程序数据的。在权限获取模块60中，当Android系统在应用启动并给其分配用户标识时，权限获取模块60调用Ptrace函数拦截并修改应用程序的用户标识以达到获取对应用程序的控制权限，通过控制权限实现对目标应用程序进程的动态监控。
在本实施例中，先通过权限获取模块60修改目标应用程序的用户标识以获取目标应用程序的控制权限，进而才能通过监测模块10对目标应用程序进行动态监控，从而 能够保证目标应用程序不会在未被监控且实施敏感信息保护措施的情况下访问敏感信息。能够实时动态地防止目标应用程序获得敏感信息。当监测模块10监测到进程中存在目标应用程序的进程时，注入模块20调用系统函数Ptrace函数将预先设置的动态链接库注入目标应用程序的进程中。在封装加载模块30中，通过执行所述目标应用程序的进程中的动态链接库来封装并加载预先设置的功能数据包。在伪装模块40中运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取，从而使得目标应用程序获取不到正确的敏感信息数据，以此达到保护用户敏感信息安全的目的。
可选地，参照图10，图10为本发明敏感信息安全保护装置第三实施例功能模块示意图。本实施例中，基于上述本发明敏感信息安全保护装置第二实施例，本实施例的敏感信息安全保护装置还包括：
重置模块50，设置为在所述目标应用程序的启动过程中，重置所述目标应用程序的用户标识；
在Android系统中，所有应用程序启动过程中都会被系统分配一个用户标识，用以管理应用程序的权限。为取得对目标应用程序的控制，则需要重置目标应用程序的用户标识。在目标应用程序的启动过程中，重置模块50将目标应用程序的用户标识进行重置，从而获得了对目标应用程序的控制权限。
备份模块70，设置为将所述目标应用程序的文件系统路径备份到预先设置的隔离区，以对目标应用程序的数据进行保护。
本实施例中，当用户选择的目标应用程序被启动时，重置模块50会调用Ptrace函数跟踪目标应用程序的启动过程并重置系统分配给目标应用程序的用户标识，从而达到获取目标应用程序控制权限的目的。同时，本发明也将目标应用程序的数据作为保护的对象，通过备份模块70将目标应用程序的文件系统路径备份到预先设置的隔离区中，从而防止其他应用程序访问目标应用程序的数据。
可选地，参照图11，图11为本发明实施例的敏感信息安全保护装置注入模块功能模块示意图。
可选地，注入模块20包括：
获取单元201，设置为当所述目标应用程序下存在进程时，获取预先设置的动态链接库；
权限获取模块60在获取到目标应用程序的进程的控制权限后，注入模块70就可以对目标应用程序进行任何操作。获取单元201调用Ptrace函数劫持目标应用程序的进程，通过Ptrace函数劫持目标应用程序的进程可以使得该进程暂时停止，Ptrace函数再将一小段代码为汇编语言代码注入目标应用程序的进程中，该小段代码包含了dlopen函数的调用方法和动态链接库的加载路径。获取单元201通过目标应用程序的进程执行注入的汇编代码从而获取到了动态链接库的相关信息。
加载单元202，设置为将所述动态链接库加载到所述目标应用程序的进程中，以供所述目标应用程序的进程执行所述动态链接库中的函数。
加载单元202通过调用dlopen函数，dlopen函数通过获得的动态链接库的加载路径将动态链接库加载到目标应用程序的进程中。
在注入模块20中，获取单元201通过调用Ptrace函数将一段汇编代码信息注入目标应用程序进程中，并通过目标应用程序的进程执行注入的汇编代码从而获取到了动态链接库的相关信息。加载单元202通过调用dlopen函数加载动态链接库，而dlopen函数通过获取的动态链接库加载路径将所述动态链接库加载到所述目标应用程序的进程中，并以指定模式打开指定的动态连接库文件以供目标应用程序的进程执行。
可选地，参照图12，图12为本发明实施例的敏感信息安全保护装置伪装模块功能模块示意图。
可选地，伪装模块40包括：
监控单元401，设置为通过所述目标应用程序的进程执行所述动态链接库中的函数，以运行所述功能数据包，对所述目标应用程序的数据访问请求进行监控；
在监控单元401中，功能数据包中的函数可以被目标应用程序的进程所执行，从而功能数据包能对目标应用程序的数据访问请求进行监控。通过监控单元401能够实时动态了解目标应用程序的数据访问请求，从而能在目标应用程序发出敏感数据访问请求前对其进行拦截。
判断单元402，设置为拦截目标应用程序的数据访问请求，并判断所述目标应用程序的数据访问请求所要访问的数据是否为预先设置的敏感信息。
当监控单元401监控到目标应用程序有发出数据访问请求时，拦截判断单元402拦截目标应用程序的数据访问请求，并判断所拦截的目标应用程序数据访问请求是否 为预设的敏感信息，若是，则进入伪装处理单元403，若否则终止对目标应用程序数据访问请求的拦截。
伪装处理单元403，设置为功能数据包对所述应用程序程要访问的敏感信息进行伪装并形成伪装数据。
当拦截判断单元402拦截并判断目标应用程序有访问敏感信息的意图时，则进入伪装处理单元403。伪装处理单元403根据目标应用程序要访问的敏感信息类型，对目标应用程序要访问的敏感信息进行伪装处理，并将形成的伪装数据返回给目标应用程序的访问请求。
在伪装模块40中，监控单元401对目标应用程序的数据访问请求进行监控，以此实现对目标应用程序的数据访问请求的实时动态监控，当监控单元401监控到目标应用程序有数据访问请求时，拦截判断单元402拦截目标应用程序的数据访问请求，并判断目标应用程序的数据访问请求是否为访问预设的敏感信息，若是，伪装处理单元403则根据目标应用程序要访问的敏感信息的类型对目标应用程序要访问的敏感信息进行相对应的伪装处理，并将形成伪装数据返回给目标应用程序的数据访问请求。若否则监测单元401继续对目标应用程序的数据访问请求进行监控。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (10)

  1. 一种敏感信息安全保护方法，包括：
    监测进程中是否存在目标应用程序的进程；
    当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中；
    执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包；
    运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。
  2. 如权利要求1所述的敏感信息安全保护方法，其中，监测进程中是否存在目标应用程序的进程之前还包括：
    获取已启动的目标应用程序的控制权限，以对目标应用程序进行监控。
  3. 如权利要求2所述的敏感信息安全保护方法，其中，所述当监测到所述目标应用程序下存在进程时，则将预先设置的动态链接库注入应用程序的进程中包括：
    当所述目标应用程序下存在进程时，获取预先设置的动态链接库；
    将所述动态链接库加载到所述目标应用程序的进程中，以供所述目标应用程序的进程执行所述动态链接库中的函数。
  4. 如权利要求3所述的敏感信息安全保护方法，其中，所述运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据包括：
    通过所述目标应用程序的进程执行所述动态链接库中的函数，以运行所述功能数据包，对所述目标应用程序的数据访问请求进行监控；
    当所述目标应用程序的数据访问请求所要访问的数据为预先设置的敏感信息时，根据所述敏感信息的类型，进行相应的伪装处理，形成伪装数据。
  5. 如权利要求1-4任一项所述的敏感信息安全保护方法，其中，所述敏感信息安全保护方法还包括：
    在所述目标应用程序的启动过程中，重置所述目标应用程序的用户标识；
    通过重置后的用户标识将所述目标应用程序的文件系统路径备份到预先设置的隔离区，以对目标应用程序的数据进行保护。
  6. 一种敏感信息安全保护装置，包括：
    监测模块，设置为监测进程中是否存在目标应用程序的进程；
    注入模块，设置为当监测到进程中存在目标应用程序的进程时，则将预先设置的动态链接库注入目标应用程序的进程中；
    封装加载模块，设置为执行所述目标应用程序的进程中的动态链接库以封装并加载预先设置的功能数据包；
    伪装模块，设置为运行所述功能数据包，对所述目标应用程序要访问的敏感信息进行伪装，形成伪装数据，以供所述目标应用程序获取。
  7. 如权利要求6所述的敏感信息安全保护装置，其中，所述敏感信息安全保护装置还包括：
    权限获取模块，设置为获取已启动的目标应用程序的控制权限，以对目标应用程序进行监控。
  8. 如权利要求7所述的敏感信息安全保护装置，其中，所述注入模块包括：
    获取单元，设置为当所述目标应用程序下存在进程时，获取预先设置的动态链接库；
    加载单元，设置为将所述动态链接库加载到所述目标应用程序的进程中，以供所述目标应用程序的进程执行所述动态链接库中的函数。
  9. 如权利要求8所述的敏感信息安全保护装置，其中，所述伪装模块包括：
    监控单元，设置为通过所述目标应用程序的进程执行所述动态链接库中的函数，以运行所述功能数据包，对所述目标应用程序的数据访问请求进行监控；
    伪装处理单元，设置为当所述目标应用程序的数据访问请求所要访问的数据为预先设置的敏感信息时，根据所述敏感信息的类型，进行相应的伪装处理，形成伪装数据。
  10. 如权利要求6-9任一项所述的敏感信息安全保护装置，其中，所述敏感信息安全保护装置还包括：
    重置模块，设置为在所述目标应用程序的启动过程中，重置所述目标应用程序的用户标识；
    备份模块，设置为通过重置后的用户标识将所述目标应用程序的文件系统路径备份到预先设置的隔离区，以对目标应用程序的数据进行保护。
PCT/CN2015/081277 2014-11-05 2015-06-11 敏感信息安全保护方法和装置 WO2016070623A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP15857551.4A EP3203406A4 (en) 2014-11-05 2015-06-11 Sensitive information security protection method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410618086.4 2014-11-05
CN201410618086.4A CN105631326A (zh) 2014-11-05 2014-11-05 敏感信息安全保护方法和装置

Publications (1)

Publication Number Publication Date
WO2016070623A1 true WO2016070623A1 (zh) 2016-05-12

Family

ID=55908510

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/081277 WO2016070623A1 (zh) 2014-11-05 2015-06-11 敏感信息安全保护方法和装置

Country Status (3)

Country Link
EP (1) EP3203406A4 (zh)
CN (1) CN105631326A (zh)
WO (1) WO2016070623A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106789893A (zh) * 2016-11-22 2017-05-31 北京奇虎科技有限公司 一种用于对信息项进行安全处理的系统及方法
TWI801855B (zh) * 2021-04-30 2023-05-11 精品科技股份有限公司 基於根節點之應用程式控管系統及方法

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106201633B (zh) * 2016-07-29 2018-02-27 腾讯科技（深圳）有限公司 一种注入dll文件的方法及装置
CN106503540B (zh) * 2016-10-11 2020-01-14 天脉聚源(北京)传媒科技有限公司 一种程序安装包的安装及运行方法及系统
CN107220538A (zh) * 2017-06-27 2017-09-29 广东欧珀移动通信有限公司 支付类应用程序管理方法、装置及移动终端
CN109144616A (zh) * 2018-09-30 2019-01-04 珠海市君天电子科技有限公司 一种检测反射式动态链接库文件的方法及装置
CN110062001B (zh) * 2019-04-26 2023-01-24 深圳前海微众银行股份有限公司 数据投放方法、装置、设备及计算机可读存储介质
CN111190833B (zh) * 2019-11-26 2023-03-24 腾讯云计算（北京）有限责任公司 敏感数据检测方法、装置、存储介质及设备
CN111212420A (zh) * 2019-12-31 2020-05-29 北京指掌易科技有限公司 一种通过vsa技术伪装设备信息的方法
CN112231699A (zh) * 2020-10-15 2021-01-15 北京明略昭辉科技有限公司 读取函数的拦截方法、装置、电子设备和计算机可读介质
CN112668021A (zh) * 2020-12-25 2021-04-16 深圳市中易通安全芯科技有限公司 一种移动终端的信息伪装方法及系统
CN115002269B (zh) * 2021-03-01 2023-03-24 华为技术有限公司 读取通讯录的方法、装置、系统及计算机可读存储介质
CN112988424B (zh) * 2021-03-22 2024-02-27 广州虎牙科技有限公司 独立进程接入实现方法、装置、电子设备和可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101227630A (zh) * 2008-01-29 2008-07-23 中兴通讯股份有限公司 一种基于窗口平台的应用程序监控方法
CN101373501A (zh) * 2008-05-12 2009-02-25 公安部第三研究所 针对计算机病毒的动态行为捕获方法
CN103778368A (zh) * 2014-01-23 2014-05-07 重庆邮电大学 一种基于系统虚拟化技术的进程安全隔离方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103379481B (zh) * 2012-04-26 2015-05-06 腾讯科技（深圳）有限公司 一种实现安全防护的方法
CN102693395B (zh) * 2012-06-07 2015-02-11 北京奇虎科技有限公司 一种用于拦截应用程序对服务的调用的方法和装置
US8893222B2 (en) * 2012-11-13 2014-11-18 Auckland Uniservices Ltd. Security system and method for the android operating system
CN104102358A (zh) * 2014-07-18 2014-10-15 北京奇虎科技有限公司 隐私信息保护的方法及隐私信息保护装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101227630A (zh) * 2008-01-29 2008-07-23 中兴通讯股份有限公司 一种基于窗口平台的应用程序监控方法
CN101373501A (zh) * 2008-05-12 2009-02-25 公安部第三研究所 针对计算机病毒的动态行为捕获方法
CN103778368A (zh) * 2014-01-23 2014-05-07 重庆邮电大学 一种基于系统虚拟化技术的进程安全隔离方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3203406A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106789893A (zh) * 2016-11-22 2017-05-31 北京奇虎科技有限公司 一种用于对信息项进行安全处理的系统及方法
TWI801855B (zh) * 2021-04-30 2023-05-11 精品科技股份有限公司 基於根節點之應用程式控管系統及方法

Also Published As

Publication number Publication date
CN105631326A (zh) 2016-06-01
EP3203406A4 (en) 2018-06-13
EP3203406A1 (en) 2017-08-09

Similar Documents

Publication Publication Date Title
WO2016070623A1 (zh) 敏感信息安全保护方法和装置
Jia et al. ContexloT: Towards providing contextual integrity to appified IoT platforms.
Jang et al. Secret: Secure channel between rich execution environment and trusted execution environment.
US20200125730A1 (en) System and method for vetting mobile phone software applications
US9787681B2 (en) Systems and methods for enforcing access control policies on privileged accesses for mobile devices
US9609020B2 (en) Systems and methods to enforce security policies on the loading, linking, and execution of native code by mobile applications running inside of virtual machines
US9183377B1 (en) Unauthorized account monitoring system and method
You et al. Reference hijacking: Patching, protecting and analyzing on unmodified and non-rooted android devices
CN113569246A (zh) 漏洞检测方法、装置、计算机设备和存储介质
US8782809B2 (en) Limiting information leakage and piracy due to virtual machine cloning
CN113051034A (zh) 一种基于kprobes的容器访问控制方法与系统
WO2023023127A1 (en) System and method for controlling js scripts access to dom/apis
KR20160039234A (ko) 영역 지향 프로그래밍을 통한 모바일 보안 향상 시스템 및 방법
WO2023023135A1 (en) A system and method for realtime js access control to dom/apis
CN113987468A (zh) 安全检查方法和安全检查装置
Sohr et al. Software security aspects of Java-based mobile phones
CN105760164B (zh) 一种用户空间文件系统中acl权限的实现方法
Bousquet et al. Mandatory access control for the android dalvik virtual machine
Chang et al. Towards a multilayered permission‐based access control for extending Android security
CN106856477B (zh) 一种基于局域网的威胁处理方法和装置
CN113836529A (zh) 进程检测方法、装置、存储介质以及计算机设备
Jeong et al. SafeGuard: a behavior based real-time malware detection scheme for mobile multimedia applications in android platform
Salehi et al. Welcome to Binder: A kernel level attack model for the Binder in Android operating system
CN112733091A (zh) 一种应用程序访问外接设备的控制方法及装置
Yang et al. Research on non-authorized privilege escalation detection of android applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15857551

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015857551

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE