WO2016095671A1

WO2016095671A1 - Method and device for processing application-based message

Info

Publication number: WO2016095671A1
Application number: PCT/CN2015/095452
Authority: WO
Inventors: 张皓秋
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2014-12-16
Filing date: 2015-11-24
Publication date: 2016-06-23
Also published as: CN104484608A

Abstract

A method and a device for processing an application-based message. The method comprises: detecting a message transmitted among applications, the message having types (101); determining whether an application that receives the message is a characteristic application (102); determining, when the application that receives the message is the characteristic application, whether the message type is a characteristic type (103); when the message type is the characteristic type, performing corresponding security processing (104). By calling a corresponding processing method to perform security processing, layer-by-layer filtrations are not required; processing a message is simple; difficulties for the application development are not increased and protection on applications is meanwhile achieved.

Description

Message processing method and device for application

Technical field

The present invention relates to the field of communications technologies, and in particular, to a message processing method for an application and a message processing device for the application.

Background technique

Windows is a Message-driven system that provides a means of communicating between an application and an application, and between an application and a Windows system. The functionality that the application is to implement is triggered by the message and is done by responding to and processing the message.

There are two kinds of message queues in Windows, one is system message queue, and the other is application message queue.

Many applications use messages to operate, for example, some programs use a "copydata" type message in a message to send code for execution, or perform a specific operation based on a particular message, and the control's click is also dependent on the message.

If an application has a message vulnerability and other malicious applications masquerade to send messages to it, there may be unexpected behavior that poses a security risk to the application.

For example, a system management program that functions to delete arbitrary files has no problem in itself and can be authenticated by a secure application. If the malicious program sends a settext message to it to modify the path of the file to be deleted to the main program of the secure application, and then sends a command message to simulate the click of the "Crush" button, the main application of the secure application may be deleted.

If you do not trust such an application with a message vulnerability, filtering all messages will cause the operating system to slow down and require a cumbersome message mechanism to increase the programming threshold.

But without protection, message-driven, vulnerable applications can be exploited with low security.

Summary of the invention

In view of the above problems, the present invention has been made in order to provide an application-based message processing method and a corresponding application-based message processing apparatus that overcome the above problems or at least partially solve or alleviate the above problems.

According to an aspect of the present invention, an application-based message processing method, package Steps:

Detecting messages passed between applications, wherein the messages have a type;

Determining whether the application receiving the message is a feature application;

Determining whether the type of the message is a feature type when the application receiving the message is a feature application;

When the type of the message is a feature type, corresponding security processing is performed.

According to another aspect of the present invention, an application-based message processing apparatus is provided, comprising:

a detection module adapted to detect a message passed between applications, wherein the message has a type;

a first determining module, configured to determine whether the application that receives the message is a feature application;

a second determining module, configured to determine, when the application receiving the message is a feature application, whether the type of the message is a feature type;

The security processing module is adapted to perform corresponding security processing when the type of the message is a feature type.

According to still another aspect of the present invention, a computer program is provided, comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform an application based application as described above Message handling method.

According to still another aspect of the present invention, a computer readable medium is provided, wherein the computer program described above is stored.

The beneficial effects of the invention are:

The embodiment of the present invention detects a message transmitted between applications, and when the application that receives the message is a feature application, and the type of the message is a feature type, it may indicate that the application may have a message vulnerability, and the current message may utilize the message. Vulnerabilities require corresponding security processing. By calling the corresponding processing method for security processing, layer filtering is not required, and the processing of messages is simple, and the application development threshold is not improved, and the protection of the application is realized.

In the embodiment of the present invention, when detecting that the application is started, extracting the first feature information of the application, and receiving, by the receiving server, the application tag and the message type tag returned when the first feature information matches the second feature information, Configuring the application tag for the application effectively ensures the security of the application at runtime, providing the application with comprehensive security protection, enabling the application to be safely launched and running.

The embodiments of the present invention further ensure the security processing is fast and convenient by dividing the risk level, calling the security prompt information corresponding to the application label, removing the security token, and the server detection, and providing accurate and comprehensive security for the application. protection of.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

FIG. 1 is a schematic flow chart showing the steps of Embodiment 1 of an application-based message processing method according to an embodiment of the present invention; FIG.

FIG. 2 is a schematic flow chart showing the steps of Embodiment 2 of an application-based message processing method according to an embodiment of the present invention; FIG.

3 is a block diagram schematically showing an embodiment of an application-based message processing apparatus according to an embodiment of the present invention;

Figure 4 shows schematically a block diagram of a computing device for performing the method according to the invention;

Fig. 5 schematically shows a storage unit for holding or carrying program code implementing the method according to the invention.

Specific embodiment

The invention is further described below in conjunction with the drawings and specific embodiments.

Referring to FIG. 1 , a flow chart of a step 1 of an application-based message processing method according to an embodiment of the present invention is shown, which may specifically include the following steps:

Step 101: Detect a message delivered between applications, wherein the message has a type;

Step 102: Determine whether an application that receives the message is a feature application.

Step 103: When the application of the message is a feature application, determine whether the type of the message is a feature type;

Step 104: When the type of the message is a feature type, perform corresponding security processing.

Referring to FIG. 2, a flow chart of the steps of Embodiment 2 of the application-based message processing method according to an embodiment of the present invention is shown, which may specifically include the following steps:

Step 201: When detecting that the application is started, extracting first feature information of the application;

In the embodiment of the present invention, the currently launched application may be triggered by the operation of the user. For example, the user triggers the startup of the application by double-clicking the shortcut of the mouse; or may be triggered by other applications or services, for example, when downloading When the tool download file is completed, the security tool may be invoked to perform a security scan on the file; the booting may be triggered by other means, which is not limited in the embodiment of the present invention.

In a specific implementation, the system function specified in the operating system, such as PsSetCreateProcessNotifyRoutine, can be called to let the operating system notify the system function to know the start and exit of the application process.

Of course, in the embodiment of the present invention, the system function of the Hook and the like can be used to obtain the timing and information of the process start of the application, which is not limited by the embodiment of the present invention.

The client can extract its first feature information when detecting the application launch, and the first feature information is used to detect whether the application is an application that needs to be protected.

The first feature information may be information that characterizes the currently started application, and may include a process name, a parent process name, a process file summary information (Message-Digest Algorithm 5, MD5), a process file version information, and a fuzzy Hash (hash) and so on.

Step 202: Send the first feature information to a server.

Applying the embodiment of the present invention, different applications may be analyzed in advance. When it is analyzed that the application may have a message vulnerability, it is determined to be a feature application, that is, an application program that may have a message vulnerability; and the second feature information is extracted. , stored in the server's database for subsequent testing.

It should be noted that the message vulnerability may refer to a defect caused by a message, may be illegally used by other applications such as a malicious program, and pose a security risk to the current application, system, user data, and the like.

In many scenarios, the application itself is secure and does not necessarily mean that its behavior is safe. It may have unsafe behaviors caused by message vulnerabilities, such as connecting to the network, turning on the camera, etc., which may be exploited by other malicious programs. .

For example, a payment instrument is secure, it has a bank transfer function, the phishing program can send a normal message to the payment instrument, the payment instrument trusts the message to process the related business, and transfers the funds to the account of the illegal person, resulting in User loss.

In the embodiment of the present invention, the client may send the first feature information to the server, and the server detects whether the current application is an application that needs to be protected.

Step 203: Receive an application label and a message type label returned by the server when determining that the first feature information matches the second feature information, where the second feature information is feature information of the feature application.

The server may receive the first feature information sent by the client, and may be matched with the second feature information that is collected in advance. The second feature information may be information that represents a feature of the feature application, and may include a process name, a parent process name, and Process file summary information (Message-Digest Algorithm 5, MD5), process file version information, fuzzy hash (hash value), and so on.

When the first feature information matches the second feature information, the currently launched application may be considered as a feature application, that is, an application that may have a message vulnerability, and the application may be risky by other applications at runtime. The use of messages (that is, message types of a specified type) is harmful to the performance and personal privacy of the device and needs to be protected.

For example, a message of the command copydata type may instruct the application to copy data, and may be exploited by a malicious program to steal important data such as an account number and a password.

As another example, a settext type message can instruct the application to set textual information that may be exploited by a malicious program to delete a local security tool.

In the embodiment of the present invention, according to the danger degree of the message vulnerability, there may be a message leak. The hole's application is divided into one or more hazard levels. For example, an application with a message vulnerability that completely removes other applications is at the first level, and an application with a message vulnerability that modifies other applications belongs to the second level and has a temporary shutdown. Applications for other applications' message vulnerabilities are at the third level.

Each hazard level can be configured with a corresponding application tag and a message type tag configured for the specified message type that needs to be monitored.

The server match confirms that the currently launched application is a feature application, and can return the application tag and message type tag that the currently launched application matches to the client.

For example, the server can return msg1:1, 2, 3, msg2:4,5,6, msg3:7,8,9 to the client; where msg1, msg2, msg3 can be application tags, followed by a comma after the colon Separated can be a message type tag.

In this example, the msg1 tag contains 1, 2, and 3, which can indicate that the three types of messages 1, 2, and 3 are monitored.

Step 204: Configure the application label to the application.

In the embodiment of the present invention, when the client receives the application tag returned by the server, the application tag may be configured for the application to implement monitoring and protection thereof.

Step 205, detecting a message delivered between applications, wherein the message has a type;

The message can be defined by a structure called MSG, including window handle (HWND), message ID (UINT), parameters (WPARAM, LPARAM), and so on.

An example of a message can be as follows:

In practice, the message itself is passed to the application as a record that contains the type of message and other information.

The message ID is the type identifier of the message, defined by the system or application, and the message ID is typed for the message. The type in the above message example is message.

Messages can be sent by the Windows system or by the application itself.

Further, the sending of the message can be implemented by a message function call. PostMessage(), SendMessage() are commonly used, and some Post* or Send* functions are also used. The caller of the message function can be an application that sends a message.

In an embodiment of the invention, kernel hook functions, such as postmessage, sendmessage, etc., may be distributed to different function handlers based on the system service call ID to intercept messages passed between applications.

Step 206, it is determined whether the application receiving the message has an application tag; if yes, step 207 is performed;

Step 207: Determine that the application that receives the message is a feature application.

If the application receiving the message has an application tag, it can indicate that the application receiving the message may have a message vulnerability.

Step 208, it is determined whether the type of the message matches the message type tag; if yes, step 209 is performed;

Step 209: Determine that the type of the message is a feature type.

If the type of the message matches the message type tag, the message may be considered to exploit the message vulnerability of the application receiving the message, which may be dangerous and requires secure processing.

Step 210: Perform corresponding security processing according to an application tag of an application that receives the message.

With the embodiment of the present invention, a corresponding security processing manner can be configured in advance for each dangerous level application. When the application tag corresponding to the danger level is detected, the security process can be performed according to a preset security processing method.

In an optional embodiment of the present invention, step 210 may include the following sub-steps:

Sub-step S11, when the application tag of the application receiving the message is the first tag, A security alert message is generated for an application that receives the message and an application that sends the message.

In the embodiment of the present invention, the first tag identifies a lower risk level, and accordingly, the user may be prompted that other applications may be exploiting the message vulnerability of the current application.

For example, you can prompt "A software wants to modify the computer configuration, is it allowed?"

Sub-step S21, when the application tag of the application that receives the message is the second tag, the security tag of the application that receives the message is removed.

In the embodiment of the present invention, the application may be scanned by a firewall, a security tool, or the like. When the application passes the security scan, a security token may be configured for the application itself to indicate that the application itself is secure.

Generally, when an application has a security token, a firewall, a security tool, and the like consider it to be trusted, and the frequency and strength of monitoring it are small, so as to reduce the resource occupation of the terminal.

The second tag identifies a higher level of danger, and accordingly, the security flag of the current application can be removed to enhance its monitoring.

Sub-step S31, when the application tag of the application that receives the message is the third tag, the information of the application that receives the message, the information of the application that sends the message, and the message are sent to the server;

Sub-step S32, receiving information returned by the server, for an application that receives the message, information of an application that sends the message, and operation information of the message;

Sub-step S33, security processing is performed in accordance with the operation information.

In the embodiment of the present invention, the hazard level identified by the third tag is unknown, and the corresponding security processing mode is not set locally, and the information of the application that receives the message, the information of the application that sends the message, and the message are required. The content is sent to the server, which is analyzed by the server based on big data, analyzes the results of most behaviors, and returns operational information based on the analysis results.

For example, when the server analyzes that obtaining the current message may read the user's account password, which is highly dangerous, it may return a block (an example of freezing, locking behavior), and the client blocks the message according to the block.

Certainly, the above security processing is only an example. When implementing the embodiment of the present invention, other security processing may be set according to actual conditions, for example, an application for sending a black message, and a virus scanning is started. The embodiment of the present invention does not limit this. In addition, in addition to the security processing described above, other security processes may be employed by those skilled in the art according to actual needs, and the embodiments of the present invention do not limit this.

For the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the embodiments of the present invention are not limited by the described action sequence, because the embodiment according to the present invention Some steps can be performed in other orders or at the same time. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

Referring to FIG. 3, a block diagram of an application-based message processing apparatus according to an embodiment of the present invention is shown. Specifically, the following modules may be included:

The detecting module 301 is adapted to detect a message delivered between applications, wherein the message has a type;

The first determining module 302 is adapted to determine whether the application that receives the message is a feature application;

The second determining module 303 is adapted to determine, when the application of the message is a feature application, whether the type of the message is a feature type;

The security processing module 304 is adapted to perform corresponding security processing when the type of the message is a feature type.

In an optional embodiment of the present invention, the following modules may also be included:

An extracting module, configured to extract first feature information of the application when detecting that the application is started;

a sending module, configured to send the first feature information to a server;

a receiving module, configured to receive an application tag and a message type tag returned by the server when determining that the first feature information matches the second feature information; the second feature information is feature information of the feature application;

A configuration module adapted to configure the application tag for the application.

In an optional embodiment of the present invention, the first determining module 302 is further adapted to:

Determining whether the application receiving the message has an application tag; if so, determining that the application receiving the message is a feature application.

In an optional embodiment of the present invention, the second determining module 303 is further configured to:

Determining whether the type of the message matches the message type tag; if yes, determining that the type of the message is a feature type.

In an optional embodiment of the present invention, the security processing module 304 is further adapted to:

Corresponding security processing is performed in accordance with the application tag of the application that receives the message.

When the application tag of the application receiving the message is the first tag, security prompt information is generated for the application that receives the message and the application that sends the message.

When the application tag of the application receiving the message is the second tag, the security tag of the application receiving the message is removed.

When the application tag of the application receiving the message is the third tag, sending information of the application that receives the message, information of the application that sends the message, and the message to the server;

Receiving, by the server, information about an application that receives the message, information of an application that sends the message, and operation information of the message;

Perform security processing according to the operation information.

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the application-based message processing device in accordance with embodiments of the present invention. . The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present invention may be stored on a computer readable medium or may have one or The form of multiple signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 4 illustrates an application-based message processing computing device, such as an application server, in accordance with the present invention. The computing device conventionally includes a processor 410 and a computer program product or computer readable medium in the form of a memory 420. The memory 420 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. The memory 420 has a storage space 430 that stores program code 431 for performing any of the method steps described above. For example, storage space 430 storing program code may include various program code 431 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units such as those shown in FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 420 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit comprises computer readable code 431' for performing the steps of the method according to the invention, ie code that can be read by a processor such as 410, which causes the calculation when the code is run by the computing device The device performs the various steps in the methods described above.

"an embodiment," or "an embodiment," or "an embodiment," In addition, it is noted that the phrase "in one embodiment" is not necessarily referring to the same embodiment.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be the same A hardware item is embodied. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected for the purpose of readability and teaching, and is not intended to be construed or limited. Therefore, many modifications and changes will be apparent to those skilled in the art without departing from the scope of the invention. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

An application-based message processing method comprising the steps of:

Detecting messages passed between applications, wherein the messages have a type;

Determining whether the application receiving the message is a feature application;

Determining whether the type of the message is a feature type when the application receiving the message is a feature application;

When the type of the message is a feature type, corresponding security processing is performed.
The method of claim 1 wherein said method further comprises the step of: before said detecting a message passed between the applications:

Extracting first feature information of the application when detecting that the application is started;

Sending the first feature information to a server;

Receiving, by the server, the returned application tag and the message type tag when determining that the first feature information matches the second feature information, wherein the second feature information is feature information of the feature application;

Configuring the application tag for the application.
The method of claim 1 or 2, wherein the step of determining whether the application receiving the message is a feature application comprises:

Determining whether the application receiving the message has an application tag;

If so, it is determined that the application receiving the message is a feature application.
The method according to claim 1 or 2, wherein the step of determining whether the type of the message is a feature type comprises:

Determining whether the type of the message matches the message type tag;

If yes, it is determined that the type of the message is a feature type.
The method of claim 1 or 2, wherein the step of performing a corresponding security process comprises:

Corresponding security processing is performed in accordance with the application tag of the application that receives the message.
The method of claim 5 wherein said step of performing corresponding security processing in accordance with an application tag of an application receiving said message comprises:

When the application tag of the application receiving the message is the first tag, security prompt information is generated for the application that receives the message and the application that sends the message.
The method of claim 5 wherein said application in accordance with said receiving said message The steps of the corresponding application tag for corresponding security processing include:

When the application tag of the application receiving the message is the second tag, the security tag of the application receiving the message is removed.
The method of claim 5 wherein said step of performing corresponding security processing in accordance with an application tag of an application receiving said message comprises:

When the application tag of the application receiving the message is the third tag, sending information of the application that receives the message, information of the application that sends the message, and the message to the server;

Receiving, by the server, information about an application that receives the message, information of an application that sends the message, and operation information of the message;

Perform security processing according to the operation information.
An application-based message processing apparatus comprising:

a detection module adapted to detect a message passed between applications, wherein the message has a type;

a first determining module, configured to determine whether the application that receives the message is a feature application;

a second determining module, configured to determine, when the application receiving the message is a feature application, whether the type of the message is a feature type;

The security processing module is adapted to perform corresponding security processing when the type of the message is a feature type.
The apparatus of claim 9 further comprising:

An extracting module, configured to extract first feature information of the application when detecting that the application is started;

a sending module, configured to send the first feature information to a server;

a receiving module, configured to receive an application tag and a message type tag returned by the server when determining that the first feature information matches the second feature information; the second feature information is feature information of the feature application;

A configuration module adapted to configure the application tag for the application.
The apparatus according to claim 9 or 10, wherein the first determining module is further adapted to:

Determining whether the application receiving the message has an application tag; if so, determining The application that receives the message is a feature application.
The apparatus of claim 9 or 10, wherein the second determining module is further adapted to:

Determining whether the type of the message matches the message type tag; if yes, determining that the type of the message is a feature type.
The device of claim 9 or 10, wherein the security processing module is further adapted to:

Corresponding security processing is performed in accordance with the application tag of the application that receives the message.
The apparatus of claim 13 wherein said security processing module is further adapted to:

When the application tag of the application receiving the message is the first tag, security prompt information is generated for the application that receives the message and the application that sends the message.
The apparatus of claim 13 wherein said security processing module is further adapted to:

When the application tag of the application receiving the message is the second tag, the security tag of the application receiving the message is removed.
The apparatus of claim 13 wherein said security processing module is further adapted to:

When the application tag of the application receiving the message is the third tag, sending information of the application that receives the message, information of the application that sends the message, and the message to the server;

Receiving, by the server, information about an application that receives the message, information of an application that sends the message, and operation information of the message;

Perform security processing according to the operation information.
A computer program comprising computer readable code, when said computer readable code is run on a computing device, causing said computing device to perform application based message processing according to any of claims 1-8 method.
A computer readable medium storing the computer program of claim 17.