WO2016165674A1

WO2016165674A1 - Trusted environment operating method and device for terminal

Info

Publication number: WO2016165674A1
Application number: PCT/CN2016/080392
Authority: WO
Inventors: 刘小锐
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-10-21
Filing date: 2016-04-27
Publication date: 2016-10-20
Also published as: CN106612504A

Abstract

Provided are a trusted environment operating method and device for a terminal, and the trusted environment operating method for a terminal provided by the present application comprises: monitoring an application run by a terminal system in real time; judging whether the application run by the terminal system meets a pre-set scenario; and if the application run by the terminal system meets the pre-set scenario, intervening with the current operating environment of the terminal in order to ensure that the terminal is in a trusted operating environment when receiving key information input by a user.

Description

Method and device for operating terminal trusted environment

Technical field

The present application relates to, but is not limited to, the field of communications, and in particular, to a terminal trusted environment operating method and apparatus.

Background technique

Terminals that are currently able to access the network through wireless communication technologies, such as mobile phones, are becoming personal information centers, carrying more and more functions. In addition to traditional circuit-based voice services, mobile Internet applications based on data services have been involved. Every aspect of life. In the fields of mobile payment, media transmission, information browsing, resource sharing, etc., people's traditional lifestyle has been changed. While the mobile Internet is developing rapidly, the information security of the mobile Internet is also threatened. As the entrance and node of the mobile Internet, the security of the operating environment has become the focus of the industry.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The present application proposes a method and a device for operating a terminal trusted environment, and performs real-time intervention when a user accesses the network through the WLAN to ensure that key information of the user is not captured by the WLAN provider, thereby improving the security of the terminal.

According to an aspect of the present application, a method for operating a terminal trusted environment is provided, including:

Real-time monitoring of applications running on the terminal system;

Determining whether the application running by the terminal system meets a preset scenario;

When the application running by the terminal system conforms to the preset scenario, the terminal currently operates the environment to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.

Optionally, the preset scenario is preset by the system and/or preset by the user, and includes at least one of the following:

Specific application types, including bank-related applications, package name for payment-related applications.

Specific operating scenarios, including the interface when entering the account password.

Optionally, if the preset scenario is preset by the user, the preset scenario includes: a specific application type preset by the user in the whitelist and a specific running scenario.

Optionally, the step of determining whether the application running by the terminal system meets a preset scenario comprises: determining whether a package name of an application running by the terminal system is in a white list, and if it is in a white list, determining that the The application running on the terminal system conforms to the preset scenario.

Optionally, when the application running by the terminal system meets the preset scenario, the step of intervening the current running environment of the terminal includes: when the application running by the terminal system meets the preset scenario, Open a WLAN connection, initiate a data connection to the mobile communication network, and forcefully terminate all running non-system applications.

Optionally, after the step of intervening in the current operating environment of the terminal when the application running by the terminal system meets the preset scenario, the method for operating the terminal trusted environment further includes determining the current terminal system. Whether the running application conforms to the preset scenario, if the preset scenario is not met, the mobile network data network connection is disconnected, and the disconnected WLAN connection is connected.

The application further provides a computer readable storage medium storing computer executable instructions that are implemented when the computer executable instructions are executed.

According to another aspect of the present application, a terminal trusted environment running apparatus is further provided, including:

The application monitoring module is configured to perform real-time monitoring on the application running on the terminal system;

The scenario determining module is configured to determine whether the application running by the terminal system conforms to the preset scenario;

The environment intervention module is configured to intervene in the current running environment of the terminal when the application running by the terminal system meets the preset scenario, so as to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.

Optionally, the apparatus further includes a whitelist setting module configured to preset a specific application type and a specific running scenario in the whitelist.

Optionally, the scenario determining module is configured to: determine whether the package name of the application running by the terminal system is in the whitelist, and if it is in the whitelist, consider that the application running by the terminal system conforms to the preset scenario.

Optionally, the environment intervention module is configured to: when the application running by the terminal system conforms to the preset scenario, disconnect the WLAN connection, initiate a data connection of the mobile communication network, and forcefully terminate all running non-operations. system applications.

Optionally, the device further includes an environment recovery module, where the environment recovery module is configured to determine whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, disconnect the mobile network data network. And connecting the disconnected WLAN connection.

In the embodiment of the present invention, the method for operating the trusted environment of the terminal is used to perform real-time intervention when the user accesses the network through the WLAN, so as to ensure that the key information of the user is not captured by the WLAN provider, and the security of the terminal is improved.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a flowchart of a method for operating a trusted environment of a terminal according to an embodiment of the present invention;

2 is a flowchart of an optional embodiment of a method for operating a trusted environment of a terminal according to an embodiment of the present invention;

3 is a flowchart of a method for using a whitelist in a method for operating a trusted environment of a terminal according to an embodiment of the present invention;

4 is a flowchart of a method for forcibly ending a non-system application of all running terminal systems in a terminal trusted environment operation method according to an embodiment of the present invention;

FIG. 5 is a structural diagram of a terminal trusted environment running device according to an embodiment of the present invention.

Preferred embodiment of the invention

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings.

Now, when a user uses a terminal for mobile payment, if the network is accessed through the WLAN, the payment information can be captured by the WLAN provider, causing the account and password to be leaked, posing a major security risk. Real-time intervention in the process of users shopping by using WLAN to access the network, so as to ensure that the user's key information is not captured by the WLAN provider, no effective solution has been proposed yet.

FIG. 1 is a flowchart of a method for operating a trusted environment of a terminal according to an embodiment of the present invention. As shown in FIG. 1, the method includes: Step S102 to Step S106, where

S102: Perform real-time monitoring on an application running on the terminal system;

In the embodiment of the present invention, the step is preset by the terminal system manufacturer, and has system-level authority to perform real-time monitoring on the application running on the terminal system.

S104: Determine whether the application running by the terminal system meets a preset scenario.

In the embodiment of the present invention, the preset scenario is preset by the system and/or preset by the user, and includes at least one of the following items:

Specific application types, including bank-related applications, package name for payment-related applications, etc.

The specific running scenario includes an interface when the account password is input, and the like, where a specific application type in the preset scenario is applied when a specific running scenario in the preset scenario is applied.

The preset scenario is preset by the user, including: a specific application type and a specific running scenario preset by the user in the whitelist, and the application type and the specific running scenario in the whitelist may be added, deleted, or modified. The terminal can determine whether the application name of the application running in the terminal system is in the white list. If the application is in the white list, the application that the terminal system runs is consistent with the preset scenario.

FIG. 3 is a flowchart of a method for using a whitelist in a method for operating a trusted environment of a terminal according to an embodiment of the present invention, as shown in FIG. 3:

Step S303: The terminal system reads a whitelist built in the terminal system;

Step S304: After the built-in whitelist is read, a whitelist queue is generated, and each time the terminal system starts the application, the package name of the application started this time and the package name of the application in the whitelist queue are compared. .

It should be noted that the user can add, delete, and modify the application type and running scenario in the whitelist in the whitelist configuration window provided by the system, and update the modified whitelist of the user, and the modified result is reflected in the whitelist queue.

S106: When the application running by the terminal system meets the preset scenario, intervene in the current operating environment of the terminal to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.

Optionally, when the application running by the terminal system meets the preset scenario, the step of intervening the current running environment of the terminal includes: when the application running by the terminal system meets the preset scenario, Open a WLAN connection, initiate a data connection to the mobile communication network, and forcefully terminate all running non-system applications. 4 is a flowchart of a method for forcibly ending a non-system application of all running terminal systems in a method for operating a terminal trusted environment according to an embodiment of the present invention. As shown in FIG. 4, the method includes the following steps:

S402: determining, according to the package name of the application that is started this time, whether the terminal system needs to enter the trusted environment: if it is required to enter the trusted environment, step S403 is performed;

S403: End all non-system applications of the terminal system;

S404: detecting whether the result of the cleaning meets the requirement: if the requirement is met, determining that all running non-system applications have been forcibly terminated; if the requirement is not met, executing step S406;

S406: After the policy level of the terminal system application end is raised, the non-system application of the terminal system is ended, and the process returns to step S404.

Optionally, after the step S106, the terminal trusted environment running method further includes: determining whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, Disconnect the mobile network data network connection and connect the disconnected WLAN connection.

FIG. 2 is a flowchart of an optional embodiment of a method for operating a trusted environment of a terminal according to an embodiment of the present invention; as shown in FIG. 2, the embodiment includes the following steps:

S203: determining whether the terminal system needs to enter the trusted environment, if it is determined that the trusted environment needs to be entered, step S204 is performed;

S204: Switch the data channel of the terminal from the WLAN to the mobile communication network.

S205: Terminate all terminal system non-system applications, and determine whether to complete the data transmission; if it is determined that the data transmission has been completed, step S207 is performed;

S207: determining whether to exit the trusted environment; if it is necessary to exit the trusted environment, proceed to step S208;

S208: After the terminal exits the trusted environment, enable the terminal to re-access the network through the WLAN.

In addition, the terminal indicates the direction in which the mobile terminal should move according to the location of the base station where the cell with the best signal strength is located, and the direction is the position coordinate from the location coordinate of the mobile terminal to the optimal base station of the signal strength.

Embodiments of the present invention further provide a computer readable storage medium storing computer executable instructions that are implemented when the computer executable instructions are executed.

In this embodiment, a structural diagram of the terminal trusted environment running device is also provided, which is used to implement the foregoing embodiment and the optional implementation manner. The descriptions of the modules involved in the system are omitted. . As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated. FIG. 5 is a structural diagram of a terminal trusted environment running device according to an embodiment of the present invention. As shown in Figure 5, the device includes:

The application monitoring module 50 is configured to perform real-time monitoring on an application running on the terminal system;

The scenario determining module 51 is configured to determine whether the application running by the terminal system meets a preset scenario;

The scenario determining module 51 determines whether the application running by the terminal system conforms to the preset scenario, where The preset scene is preset by the system and/or preset by the user, and includes at least one of the following:

Specific application types, including bank-related applications, package name for payment-related applications, and more.

The device further includes a whitelist setting module, configured to preset the specific application type and the specific running scenario in the whitelist, and add, delete, or modify the whitelist.

The scenario judging module 51 determines whether the type of the application running in the terminal system is in the whitelist. If the application running in the terminal system is in the whitelist, the application running on the terminal system is considered to be in the preset scenario.

The environment intervention module 52 is configured to intervene in the current operating environment of the terminal to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.

Optionally, the environment intervention module 52 is further configured to: when the application running by the terminal system conforms to the preset scenario, automatically disconnect the WLAN connection, initiate a data connection of the mobile communication network, and forcefully terminate all running non-operations. system applications.

The device further includes an environment recovery module, configured to determine whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, automatically disconnect the mobile network data network connection, and automatically connect the disconnected Wi-Fi connection.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function. Embodiments of the invention are not limited to any specific form of combination of hardware and software.

Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device, or distributed. Alternatively, on a network of computing devices, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, The steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of the modules or steps may be implemented as a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.

The above is only an alternative embodiment of the present application, and is not intended to limit the application, and various changes and modifications may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application are intended to be included within the scope of the present application.

Industrial applicability

The terminal operates in a trusted environment to perform real-time intervention when the user accesses the network through the WLAN, ensuring that the key information of the user is not captured by the WLAN provider, thereby improving the security of the terminal.

Claims

A method for operating a terminal trusted environment, comprising:

Real-time monitoring of applications running on the terminal system;

Determining whether the application running by the terminal system meets a preset scenario;

When the application running by the terminal system conforms to the preset scenario, the terminal currently operates the environment to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.
The method for operating a trusted environment of a terminal according to claim 1, wherein the preset scenario is preset by a system and/or preset by a user, and includes at least one of the following:

Specific application types, including bank-related applications, package name for payment-related applications;

Specific operating scenarios, including the interface when entering an account password.
The method for operating a trusted environment of a terminal according to claim 2, wherein, if the preset scenario is preset by a user, the preset scenario includes: a specific application type and a specific preset by the user in the whitelist. Running scenario.
The method for operating a terminal trusted environment according to claim 3, wherein the step of determining whether the application running by the terminal system conforms to a preset scenario comprises: determining whether a package name of an application running by the terminal system is in a white list If the application is in the whitelist, the application running on the terminal system is considered to be in the preset scenario.
The method for operating a terminal trusted environment according to claim 1, wherein when the application running by the terminal system conforms to the preset scenario, the step of intervening the current operating environment of the terminal includes: when the terminal system When the running application conforms to the preset scenario, the WLAN connection is disconnected, the data connection of the mobile communication network is started, and all running non-system applications are forcibly terminated.
The method for operating a terminal trusted environment according to claim 5, wherein said terminal system is After the step of performing the intervention on the current running environment of the terminal, the method for operating the trusted environment of the terminal further includes: determining whether the application running by the terminal system meets the preset scenario, if If the preset scenario is not met, the mobile network data network connection is disconnected and the disconnected WLAN connection is connected.
A terminal trusted environment running device includes:

The application monitoring module is configured to perform real-time monitoring on the application running on the terminal system;

The scenario determining module is configured to determine whether the application running by the terminal system conforms to the preset scenario;

The environment intervention module is configured to intervene in the current running environment of the terminal when the application running by the terminal system meets the preset scenario, so as to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.
The terminal trusted environment running device according to claim 7, wherein the preset scenario is a system default setting and/or a user preset, and includes at least one of the following:

Specific application types, including bank-related applications, package name for payment-related applications;

Specific operating scenarios, including the interface when entering an account password.
The terminal trusted environment running apparatus according to claim 8, further comprising a whitelist setting module configured to preset a specific application type and a specific running scenario in the whitelist.
The terminal trusted environment running device according to claim 9, wherein the scenario determining module is configured to include determining whether a package name of the application running by the terminal system is in a white list, and if in the white list, The application running on the terminal system conforms to the preset scenario.
The terminal trusted environment running device according to claim 7, wherein the environment intervention module is configured to: when the application running by the terminal system conforms to the preset scenario, disconnect the WLAN connection and start the mobile communication network. Data connection and forcefully end all running Non-system applications.
The terminal trusted environment running device according to claim 11, further comprising an environment recovery module, wherein the environment recovery module is configured to determine whether the application currently running by the terminal system conforms to a preset scenario, and if the preset scenario is not met, Disconnect the mobile network data network connection and connect the disconnected WLAN connection.