WO2016155102A1

WO2016155102A1 - Terminal data protection method, terminal and device

Info

Publication number: WO2016155102A1
Application number: PCT/CN2015/079834
Authority: WO
Inventors: 王会彩
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-03-30
Filing date: 2015-05-26
Publication date: 2016-10-06
Also published as: CN106156645A

Abstract

A terminal data protection method, a terminal and a device. The method comprises: when a terminal accesses a wireless access point (AP), calling a pre-set permission configuration file corresponding to the AP; and performing, according to a security strategy defined by the permission configuration file, security control on the terminal.

Description

Terminal data protection method, terminal and device

Technical field

This document relates to the field of wireless communication technologies, and in particular, to a terminal data protection method, a terminal, and a device.

Background technique

With the widespread use of intelligent terminals and the popularity of wireless networks, WiFi has become an indispensable means of communication in people's lives. What followed was the emergence of privacy and security issues. For example, when a user accesses an unsecured WiFi hotspot (ie, an AP), the criminal can steal the application account and password that the user is using. Once the information is intercepted, the criminal can smoothly access all applications of the user. It even includes banking applications. In addition to the account password, the data being uploaded by the app will also be intercepted, such as photos, shopping information, chat content, and even the address book. The criminals can completely disguise the user based on the content, and then deceive the user's relatives and friends. Cause a wider range of losses.

It can be seen that WiFi security issues cannot be delayed. Therefore, when the terminal accesses the WiFi hotspot (ie, AP) network, how to protect the security of the terminal data becomes a technical problem that needs to be solved.

Summary of the invention

This document provides a terminal data protection method, terminal and device for solving the above problems.

A terminal data protection method includes:

When the terminal accesses the wireless access point AP, the preset permission configuration file corresponding to the AP is invoked;

Perform security control on the terminal according to the security policy defined by the rights profile.

Optionally, in the method, when the terminal accesses the wireless access point AP, the preset permission configuration file corresponding to the AP is invoked, including:

When the terminal accesses the AP, the rights configuration file corresponding to the accessed AP is obtained in the pre-configured AP and the rights configuration file correspondence table, and the obtained rights configuration file is invoked.

Optionally, the method further includes:

When the rights profile corresponding to the accessed AP is not obtained in the pre-configured AP and the rights profile mapping table, the preset default rights profile or the user's newly configured AP is configured. Configuration file.

Optionally, in the method, the security policy includes one or more of the following: setting a specified file, folder, and/or application to a secure mode, automatically terminating a specified application, and disabling The specified terminal system function; wherein the security mode includes: hiding or disabling access.

Optionally, the method further includes: when the terminal disconnects from the accessed AP, stopping the security control and restoring the original state of the terminal.

A terminal comprising:

The file invoking module is configured to: when the terminal accesses the AP, invoke a preset permission configuration file corresponding to the AP;

The security control module is configured to: perform security control on the terminal according to the security policy defined by the rights configuration file.

Optionally, in the terminal, the file invoking module is configured to: when the terminal accesses the AP, obtain the rights configuration file corresponding to the accessed AP in the pre-configured AP and the rights configuration file correspondence table. And call the obtained permission profile.

Optionally, in the terminal, the file invoking module is further configured to: when the rights configuration file corresponding to the accessed AP is not obtained in the pre-configured AP and the rights configuration file correspondence table, obtain the Call the default default rights profile or the user's newly configured rights profile for the AP.

Optionally, in the terminal, the security policy includes one or more of the following: setting a specified file, folder, and/or application to a security mode, automatically terminating the specified application, and disabling the designation. Terminal system function; wherein the security mode includes: hiding or disabling access.

Optionally, the terminal further includes:

The recovery module is set to: when the terminal disconnects from the accessed AP, stop the security control and resume The original state of the terminal.

A terminal data protection device, the device comprising:

Picking up the component and writing the permission profile set by the user to the memory;

The controller reads the memory when the terminal accesses the wireless access point AP, invokes the rights configuration file corresponding to the AP, and performs security control on the terminal according to the security policy defined by the rights configuration file.

A computer readable storage medium storing computer executable instructions for performing the method of any of the above.

When the terminal accesses the WiFi hotspot, the method, the terminal and the device can perform security control on the terminal according to the rights configuration file set by the user, such as automatically hiding files, folders, application icons, etc., and automatically stop running. Applications, disable system features, etc., to protect user privacy and secure user data.

BRIEF abstract

FIG. 1 is a flowchart of a terminal data protection method according to an embodiment of the present invention;

2 is a flowchart of adding a hotspot and configuring a corresponding rights configuration file according to an embodiment of the present invention;

3 is a flowchart of editing a rights configuration file in an embodiment of the present invention;

4 is a flowchart of performing terminal data protection when a terminal accesses a hotspot according to an embodiment of the present invention;

FIG. 5 is a flowchart of an implementation of the present invention when a terminal is disconnected from a hotspot according to an embodiment of the present invention; FIG.

FIG. 6 is a structural block diagram of a terminal according to an embodiment of the present invention;

FIG. 7 is still another structural block diagram of a terminal according to an embodiment of the present invention;

FIG. 8 is a structural block diagram of a terminal data protection device according to an embodiment of the present invention;

FIG. 9 is still another structural block diagram of a terminal data protection device according to an embodiment of the present invention.

Embodiments of the invention

Embodiments of the present invention will be described below with reference to the accompanying drawings.

Embodiment 1

An embodiment of the present invention provides a terminal data protection method, as shown in FIG. 1 , including the following steps:

Step 101: When the terminal accesses the wireless access point AP, the preset permission configuration file corresponding to the AP is invoked;

Step 102: Perform security control on the terminal according to the security policy defined by the rights configuration file.

That is to say, in the method, when the terminal accesses different WiFi hotspots (ie, APs), security control is performed by using different rights configuration files set by the user, so as to protect user privacy and ensure user information security.

Several alternative embodiments are given below. It should be noted that the following features can be arbitrarily combined with each other without conflict.

In the embodiment of the present invention, when the terminal accesses the AP, the rights configuration file corresponding to the accessed AP is obtained in the pre-configured AP and the rights configuration file correspondence table, and the obtained rights configuration file is invoked. That is to say, for different APs, the user can pre-configure multiple rights profiles corresponding to each AP to form a correspondence list between the AP and the rights profile, so that the terminal can invoke the rights profile when accessing the AP.

Of course, due to the wide distribution of APs, it is impossible for a user to predict all APs and configure a rights profile for them. Therefore, the user can set one or more default rights configuration files (that is, not corresponding to the specified AP). If the AP accessed by the terminal is not in the corresponding relationship table, the user can be prompted to use the default rights configuration file. If the user allows, you can directly retrieve the default rights profile. Of course, the user may also configure a corresponding rights configuration file for the AP when the corresponding relationship table does not include the currently accessed AP, and after the configuration, invoke the newly configured rights configuration file.

Optionally, in the embodiment of the present invention, the security policy includes one or more of the following policies: setting a specified file, folder, and/or application to a security mode, automatically terminating a specified application, And disabling the specified terminal system function; wherein the security mode includes: hiding or disabling access, ie hiding the specified file, folder, and/or application map Mark, or, prohibit access to specified files, folders, and/or applications.

It should be noted that the foregoing security policies are merely exhaustive, and those skilled in the art can flexibly set security policies according to their own needs.

Optionally, in the embodiment of the present invention, when the terminal disconnects from the accessed AP, the security control is stopped, and the original state of the terminal is restored.

In summary, the embodiment of the present invention provides that when a terminal accesses different hotspots through WiFi, it can automatically hide user-specified files, folders, application desktop icons, and the like, and automatically terminate terminal designation according to user requirements. The application, disable some system functions, etc., to protect user privacy and ensure user information security. For example, when the user is configured to access a public hotspot "A", the application such as Alipay and the bank client is automatically terminated to ensure the security of the user information. When the operator's hotspot "B" is accessed, the application such as video playback is automatically terminated. The program prevents the loss of a large amount of traffic and causes economic loss; when it is connected to a public hotspot "C" such as a company, or when accessing a hotspot "D" of another person's home, it automatically hides the specified photo, video, etc., and automatically hides the game. Protect the user's privacy from leaks by waiting for the desktop icon of the app.

The implementation process of the method provided by the embodiment of the present invention is described below with reference to FIG. 2 to FIG.

As shown in Figure 2, the flow chart for adding a hotspot and configuring the corresponding rights profile is as follows:

Step 201: The permission configuration function item is enabled.

The opening may be initiated by the user in the terminal setting function, or may be initiated by the terminal when the terminal accesses the hotspot after the user permits.

Step 202: The configuration interface is displayed, and the configuration interface includes: adding a hotspot option and a new configuration file option; if the user selects the hotspot option, the user needs to configure a corresponding rights configuration file for the added hotspot, and step 203 is performed; If the user selects the new configuration file option, the user wants to establish a default permission configuration file, and step 204 is performed;

Step 203, the name of the hotspot added by the user is obtained, and step 204 is performed;

Step 204: Present a list of files, folders, applications, and system functions of the terminal for the user to select;

Step 205: save files, folders, applications, and/or system functions selected by the user;

Step 206: The saved information is matched with the built-in or user-defined security policy to form a rights configuration file. That is, the information selected by the user is information that needs security control, and when the rights configuration file is mobilized. Implement a corresponding security policy for the saved information.

Step 207: If the rights configuration file corresponding to the hot spot is formed, the hotspot and its corresponding rights configuration file are stored in the correspondence table of the hotspot and the rights configuration file; if the default permission configuration file is formed, the default configuration will be configured. The rights profile is stored in the correspondence table.

In this embodiment, when the file, folder, application, and system function list of the terminal are presented, the configured rights configuration file may also be presented for the user to select. That is to say, if the user selects a rights configuration file, indicating that the user wants the same configuration as the rights configuration file, the selected rights configuration file can be directly copied, and the user is not required to select one by one, thereby improving the configuration efficiency.

In this embodiment, the correspondence table between the hotspot and the rights configuration file has editability (such as modification and deletion), and the user can edit the corresponding relationship table, as shown in FIG. 3, which is a flowchart of editing the rights configuration file. Including the following steps:

Step 301: Acquire a rights configuration file selected by the user to be edited;

Step 302: Present a list of files, folders, applications, and system functions of the terminal for the user to select.

Optionally, when the list is presented, the items that have been selected by the current rights profile are marked for display for the user to view the previous selection.

Step 303: save files, folders, applications, and/or system functions reselected by the user;

Step 304: Form a new rights profile based on the saved information.

The above process is the process of modifying the rights profile. Similarly, if the user wants to delete the hotspot and its corresponding permission profile, after deleting the deleted item selected by the user, it can be deleted directly.

As shown in FIG. 4, it is a flowchart for performing terminal data protection when the terminal accesses a hotspot, including, for example, Next steps:

Step 401: The terminal accesses the hotspot;

Step 402: Determine whether the hotspot of the access is a hotspot and a hotspot in the rights configuration list, and if yes, go to step 403; otherwise, go to step 404;

Step 403: Obtain a rights configuration file corresponding to the accessed hotspot in the hotspot and permission list, load and execute the rights configuration file, and end;

Step 404: If the hotspot is not in the list, determine whether the hotspot is the first hotspot; if yes, go to step 405; otherwise, go to step 406;

Step 405, asking the user whether to add to the list; if the user confirms the addition, then add the rights profile according to the process shown in Figure 2 and save the execution, the end; if the user confirms not to add, then step 406;

Step 406: Query whether the user sets the default permission configuration file to be loaded, and if so, loads the default permission configuration file and executes, and ends; if not, directly ends.

When the user has accessed the hotspot and loads the execution permission profile, when the application is enabled, it is determined whether the application is in the permission profile, and if not, it starts normally; if it is, a prompt box is displayed, asking the user to confirm the startup again. If the user confirms, it starts normally; if the user cancels or does not operate, it does not start.

As shown in FIG. 5, it is a flowchart of an embodiment of the present invention when the terminal is disconnected from the hotspot. Including the following steps:

Step 501: The terminal is disconnected from the hotspot;

Step 502: Determine whether the rights configuration file is loaded and executed.

Step 503: If yes, return to the original state, and end; if not, end.

Embodiment 2

An embodiment of the present invention provides a terminal, as shown in FIG. 6, including:

The file invoking module 610 is configured to: when the terminal accesses the AP, invoke a preset permission configuration file corresponding to the AP;

The security control module 620 is configured to perform security control on the terminal according to the security policy defined by the rights configuration file.

In the embodiment of the present invention, the file invoking module 610 obtains the rights configuration file corresponding to the accessed AP in the pre-configured AP and the rights configuration file correspondence table, and invokes the obtained rights configuration file. . That is to say, for different APs, the user can pre-configure multiple rights profiles corresponding to each AP to form a correspondence list between the AP and the rights profile, so that the terminal can invoke the rights profile when accessing the AP.

In the case that the rights profile corresponding to the accessed AP is not obtained in the pre-configured AP and the rights profile correspondence table, the preset default rights profile or the AP that the user accesses may be obtained and invoked. The newly configured rights profile.

Optionally, in the embodiment of the present invention, the security policy includes one or more of the following: setting a specified file, folder, and/or application to a security mode, automatically terminating the specified application, and disabling The specified terminal system function; wherein the security mode includes: hiding or disabling access. It should be noted that the above security policies are merely exhaustive, and those skilled in the art can flexibly set security policies according to their own needs.

Optionally, in the embodiment of the present invention, the terminal further includes:

The recovery module 630 is configured to: when the terminal disconnects from the accessed AP, stop the security control and restore the original state of the terminal.

In summary, it can be seen that the terminal in the embodiment of the present invention performs security control by using different rights configuration files set by the user when the terminal accesses different WiFi hotspots (ie, APs), so as to protect user privacy and protect user information. The purpose of security.

The structure and function of the terminal provided by the embodiment of the present invention are described below with reference to FIG.

An embodiment of the present invention provides a terminal, as shown in FIG. 7, including:

The configuration module 710 is configured to: generate a default rights configuration file, or generate a corresponding rights configuration file for the specified hotspot. Optionally, the configuration module generates the rights configuration file by scanning all current applications of the terminal, and reading all current files, folders, and system functions of the terminal, and forming a list of scanned and read information for the user. select. When the user chooses After the specified file, folder, application, and/or system function, the user-selected information is matched with the built-in or user-defined security policy to generate a rights profile.

The storage module 720 is configured to: store the rights configuration file generated by the record configuration module 710, the correspondence between the rights profile and the hotspot, and the default rights profile. At the same time, the user is provided with an editing interface, so that the user can edit the information therein.

The file invoking module 730 is configured to: when the terminal accesses the hotspot, compare and retrieve the current hotspot with the information in the storage module, and determine whether the hotspot is in the storage module, and if it exists in the storage module, directly invoke the corresponding permission. If the user does not exist in the storage module, the user is prompted to select the default permission profile or the new profile configuration file for the hotspot. If the user chooses to invoke the default permission profile, the corresponding default profile is directly invoked. Selecting a new configuration rights profile for the hotspot triggers the configuration module 710 and invokes the newly configured rights profile.

The cache module 740 is configured to: record an initial state when the terminal accesses the hotspot, including an application running condition, and the like.

The security control module 750 is configured to: perform security control on the terminal according to the invoked rights configuration file.

The recovery module 760 is configured to: when the terminal disconnects from the hotspot, determine whether the terminal applies the rights configuration file, and if yes, read the initial state of the terminal from the cache module 740, and invoke the background program to perform state recovery; otherwise, Do anything.

Embodiment 3

An embodiment of the present invention provides a terminal data protection device. As shown in FIG. 8, the device includes:

Picking component 810, the user-set rights profile is written to the memory 820;

The controller 830 reads the memory 820 when the terminal accesses the AP, invokes the rights configuration file corresponding to the AP, and performs security control on the terminal according to the security policy defined by the rights configuration file.

It can be seen that, when the terminal accesses different WiFi hotspots (ie, APs), the device in the present embodiment performs security control through different rights configuration files set by the user, thereby protecting user privacy and guaranteeing. The purpose of user information security.

The structure and function of the device provided by the embodiment of the present invention are described below with reference to FIG.

As shown in FIG. 9, the terminal data protection device in this embodiment includes a GUI (Graphical User Interface) 910, a pickup component 920, a memory 930, a controller 940, and a buffer 950. among them:

The GUI 910 provides the user with an operation interface for setting a rights profile. The user can set a default permission profile through the GUI, or set a corresponding rights profile for the specified hotspot. The setting process is: the user selects a default permission profile in the GUI or selects a rights profile corresponding to the specified hotspot, and the GUI scans all current applications of the terminal, and reads all current files, folders, and systems of the terminal. Function, which forms a list of scanned and read information for the user to select.

The picking unit 920 is connected to the GUI 910 to collect specified files, folders, applications, and/or system function information selected by the user in the GUI, and matches the information selected by the user with a built-in or user-defined security policy. Relationship, generate a rights configuration file, and store the generated rights configuration file into the memory 930;

The memory 930 is connected to the picking unit 920, and stores a rights profile generated by the picking unit 920, a correspondence between the rights profile and the hotspot, and a default rights profile. At the same time, the user is provided with an editing interface, so that the user can edit the information therein.

The controller 940, when the terminal accesses the hotspot, enables the buffer 950, and compares the current hotspot with the information in the memory 930 to determine whether the hotspot is in the memory 930. If it exists in the memory 930, the controller 940 directly calls Corresponding privilege profile; if it does not exist in the memory 930, the user is prompted to select a default privilege profile or a new privilege profile for the hotspot. If the user chooses to invoke the default privilege profile, the corresponding default privilege profile is directly invoked. If the user selects a new profile configuration file for the hotspot, the GUI 910 is triggered, and the newly configured rights profile is invoked, and the terminal is security controlled according to the invoked rights profile. Moreover, when the terminal disconnects from the hotspot, it is judged whether the terminal applies the rights configuration file, and if so, the initial state of the terminal is read from the buffer 950, and the background program is called to perform state recovery; otherwise, no operation is performed.

The buffer 950, under the enable control of the controller 940, records the initial when the terminal accesses the hotspot Status, including application health, and more.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The method and the terminal of the embodiment of the present invention can perform security control on the terminal according to the rights configuration file set by the user when the terminal accesses the WiFi hotspot, such as automatically hiding files, folders, application icons, etc., and automatically stop running. Applications, disable system features, etc., to protect user privacy and secure user data.

Claims

A terminal data protection method includes:

When the terminal accesses the wireless access point AP, the preset permission configuration file corresponding to the AP is invoked;

Perform security control on the terminal according to the security policy defined by the rights profile.
The method of claim 1, wherein when the terminal accesses the wireless access point AP, the preset permission profile corresponding to the AP is invoked, including:

When the terminal accesses the AP, the rights configuration file corresponding to the accessed AP is obtained in the pre-configured AP and the rights configuration file correspondence table, and the obtained rights configuration file is invoked.
The method of claim 2 further comprising:

When the rights profile corresponding to the accessed AP is not obtained in the pre-configured AP and the rights profile mapping table, the preset default rights profile or the user's newly configured AP is configured. Configuration file.
The method of claim 1, wherein the security policy comprises one or more of the following: setting a specified file, folder, and/or application to a secure mode, automatically terminating a specified application, And disabling the specified terminal system function; wherein the security mode includes: hiding or disabling access.
The method according to any one of claims 1 to 4, further comprising: when the terminal disconnects from the accessed AP, stopping the security control and restoring the original state of the terminal.
A terminal comprising:

The file invoking module is configured to: when the terminal accesses the AP, invoke a preset permission configuration file corresponding to the AP;

The security control module is configured to: perform security control on the terminal according to the security policy defined by the rights configuration file.
The terminal according to claim 6, wherein the file invoking module is configured to: when the terminal accesses the AP, obtain the permission corresponding to the accessed AP in the pre-configured AP and the rights configuration file correspondence table. Profile and call the obtained permission profile.
The terminal according to claim 7, wherein the file invoking module is further configured to: when a rights profile corresponding to the accessed AP is not obtained in the pre-configured AP and the rights profile correspondence table, Obtain and call the default default rights profile or the newly configured rights profile for the AP that the user accesses.
The terminal of claim 6, wherein the security policy comprises one or more of the following: setting a specified file, folder, and/or application to a secure mode, automatically terminating the specified application, and The specified terminal system function is disabled; wherein the security mode includes: hiding or disabling access.
The terminal according to any one of claims 6 to 9, further comprising:

The recovery module is configured to: when the terminal disconnects from the accessed AP, stop the security control and restore the original state of the terminal.
A terminal data protection device, comprising:

Picking up the component and writing the permission profile set by the user to the memory;

The controller reads the memory when the terminal accesses the wireless access point AP, invokes the rights configuration file corresponding to the AP, and performs security control on the terminal according to the security policy defined by the rights configuration file.
A computer readable storage medium storing computer executable instructions for performing the method of any of claims 1-5.