WO2017036345A1

WO2017036345A1 - Information input method and device

Info

Publication number: WO2017036345A1
Application number: PCT/CN2016/096787
Authority: WO
Inventors: 严跃; 程刚; 乔丽莎
Original assignee: 阿里巴巴集团控股有限公司; 严跃; 程刚; 乔丽莎
Priority date: 2015-09-02
Filing date: 2016-08-25
Publication date: 2017-03-09
Also published as: CN106485170A

Abstract

An information input method and device. The method comprises: when an input environment of confidential information is detected, activating a secured input keyboard and enabling a security protection function, wherein when the security protection function is enabled, the calling of interfaces for screen capturing and/or screen recording is prohibited. When the input environment of confidential information is detected, the method activates the secured input keyboard and a security protection module to prohibit the calling of the interfaces for screen capturing and/or screen recording, thereby preventing malware from stealing information by screen capturing or recording and improving security when inputting confidential information such as passwords.

Description

Information input method and device

[Technical Field]

The present invention relates to the field of computer application technologies, and in particular, to an information input method and apparatus.

【Background technique】

At present, mobile devices are becoming the main target of cyber attacks. Various phishing applications, free wifi and other bad software steal user information in mobile devices. However, when users use mobile devices, they often need to input some information that needs to be kept secret, such as passwords. How to ensure the security input of these information needs to be solved. The existing solution is mainly to call the input method of the system when the password is input, instead of using the third-party input method. However, this method can only prevent malware from stealing passwords by listening to the input keyboard to a certain extent.

[Summary of the Invention]

In view of this, the present invention provides a method and apparatus for information input to improve the security of information input such as passwords.

The specific technical solutions are as follows:

The invention provides a method for information input, the method comprising:

When the input environment of the secret information is recognized, the security input keyboard is activated and the security protection function is activated;

The interface of the screen capture and/or the screen capture is prohibited after the security protection function is activated.

According to a preferred embodiment of the present invention, an input environment for identifying confidential information includes:

After detecting that the input box obtains the focus, the attribute of the input box is obtained, and the input environment of the secret information is identified according to the attribute of the input box.

According to a preferred embodiment of the present invention, the input environment for identifying the secret information according to the attribute of the input box includes:

If the attribute value of the input box indicates the password password attribute, the input environment of the secret information is identified.

According to a preferred embodiment of the present invention, the security input keyboard is a password keyboard that is included in the system.

According to a preferred embodiment of the present invention, the method further includes:

When the input environment for non-confidential information is recognized, the default input method keyboard is activated.

According to a preferred embodiment of the present invention, before the security input keyboard is activated and the security protection function is activated, the method further includes:

Determining whether the input environment of the secret information belongs to a legitimate application, and if so, continuing to perform the step of starting the secure input keyboard and starting the security protection function.

If it is determined that the input environment of the secret information is not a legitimate application, it is prohibited to activate any input method keyboard, and/or prompt the user to have an input risk.

According to a preferred embodiment of the present invention, the interface for prohibiting the invoking of the screen capture and/or the screen recording comprises:

Get the system window and disable the interface for capturing screenshots and/or screens by setting the flag flag of the system window.

According to a preferred embodiment of the present invention, the interface for prohibiting the invoking of the screen capture and/or the screen recording by setting the flag flag of the system window includes:

The flag of the window is set to flag_secure by the WindowManager.LayoutParams parameter.

After identifying the input environment exiting the secret information, the secure input keyboard is closed and the security protection function is turned off.

According to a preferred embodiment of the present invention, the input environment for identifying the exit of the secret information includes:

After detecting that the input box loses focus, an input environment that exits the secret information is identified.

The invention also provides an apparatus for information input, the apparatus comprising:

An environment identification module for identifying an input environment;

a function startup module, configured to start a security input keyboard and activate a security protection module when the environment identification module recognizes an input environment of the secret information;

The security protection module is configured to prohibit an interface for invoking a screen capture and/or a screen recording after startup.

According to a preferred embodiment of the present invention, the environment identification module is configured to: after detecting that the input box obtains the focus, acquire the attribute of the input box, and identify the secret information according to the attribute of the input box. Enter the environment.

According to a preferred embodiment of the present invention, when the environment identification module identifies the input environment of the secret information according to the attribute of the input box, the environment recognition module specifically executes:

According to a preferred embodiment of the present invention, the function activation module is further configured to activate a default input method keyboard when the environment recognition module recognizes an input environment of non-confidential information.

According to a preferred embodiment of the present invention, the device further comprises:

a determining module, configured to determine, when the environment identification module identifies an input environment of the secret information, whether the input environment of the secret information belongs to a legal application;

The function startup module executes the operation of starting the security input keyboard and starting the security protection module when the determination result of the determination module is YES.

According to a preferred embodiment of the present invention, the function starting module is further configured to prohibit starting any input method keyboard when the judgment result of the determining module is negative, and/or prompting the user to have an input risk.

According to a preferred embodiment of the present invention, the function startup module specifically executes when the interface of the screen capture and/or the screen capture is prohibited from being invoked:

According to a preferred embodiment of the present invention, when the function startup module prohibits invoking the interface of the screen capture and/or the screen recording by setting the flag flag of the system window, the function execution module specifically executes:

And a function closing module, configured to close the security input keyboard and close the security protection module after the environment identification module recognizes an input environment that exits the secret information.

According to a preferred embodiment of the present invention, after detecting that the input box loses focus, the environment recognition module identifies an input environment for exiting the secret information.

It can be seen from the above technical solution that the present invention activates the security input keyboard and activates the security protection module to recognize the interface of the screen capture and/or the screen recording when the input environment of the secret information is recognized. On the one hand, use a secure input keyboard to prevent malware from stealing information by listening to the keyboard. On the other hand, activate security protection to prevent malware from stealing information through screen capture or screen recording, and improve confidential information such as passwords. Input security.

[Description of the Drawings]

FIG. 1 is a flowchart of a method according to an embodiment of the present invention;

2a is a schematic diagram of an application interface according to an embodiment of the present invention;

2b is a diagram showing an example of a non-confidential information input scenario on the application interface shown in FIG. 2a;

2c is a diagram showing an example of an input scenario of secret information on the application interface shown in FIG. 2a;

FIG. 3 is a structural diagram of a device according to an embodiment of the present invention.

【detailed description】

The present invention will be described in detail below with reference to the drawings and specific embodiments.

The core idea of the present invention is to activate a secure input keyboard and activate a security protection function when the input environment of the secret information is recognized, wherein the interface of the screen capture and/or the screen recording is prohibited after the security protection function is activated. This process is mainly performed at the system level.

The identification of the input environment is mainly to judge the input component of this type, that is, the input environment for identifying the confidential information according to the attribute of the input box. For other types of components, if there is also a security requirement, it can be handled in a similar manner. For example, for a button type component, an input environment for identifying confidential information may be identified depending on the attributes of the button (eg, the button's text attribute indicates a button such as "login" or "register"). The following embodiments are described by taking an input box as an example.

The identification of the input environment can be judged from the page in addition to the component. For example, for a page that needs security protection, an execution function (JavaScript) can be inserted in advance, and the page is actively issued when the execution function is executed. Information that requires security. Once the information is received, the input environment identifying the page as confidential information is identified.

FIG. 1 is a flowchart of a method according to an embodiment of the present invention. As shown in FIG. 1, the process may include the following steps:

In 101, after detecting that the input box has obtained the focus, the attribute of the input box is obtained.

When the user clicks on the input box to prepare for input, an onfocus event is generated, so if the onfocus event generated by the input box component is captured, it is determined that the input box is detected to be in focus.

The input box component has a certain type, and if the type value is indicated as a password attribute, the input box is used for password input, which belongs to the input environment of the secret information involved in the present invention. Of course, the present invention is not limited to password input, and can also be used for inputting other secret information. If the input box is used for inputting other secret information, the type value may also indicate other attributes, or a type value may be defined in advance to indicate the need. Enter the confidential information. In the embodiment of the present invention, only the password input is taken as an example for description.

In 102, it is determined whether the attribute value of the input box indicates the password attribute, and if not, execution 103; if yes, execute 104.

The judgment of this step is actually an input environment for judging whether the input environment is confidential information.

In 103, the default input keyboard is activated, ending the current process.

If the current input box is not used to enter a password, that is, an input environment for non-confidential information, no additional security protection is required, and the default input method is used for information input, so the default input method keyboard is activated, so that it is unnecessary In the case of security protection, the user's usage habits are retained and the user's input efficiency is improved. The default input keyboard here can be a third-party input method set by the user, or it can be the input method that comes with the system.

In 104, it is determined whether the application in which the input box is located belongs to a legitimate application, and if not, executes 105; if yes, executes 106.

This step is to determine whether the input environment of the confidential information is a legitimate application. The legal application information may be preset in a whitelist manner, or some illegal application information may be preset by using a blacklist. Then, the input box is obtained. Application information, such as one or any combination of the package name, version, size, etc. of the application, and then using a preset whitelist or blacklist to determine the Whether the application information is legal. Here, the method for judging the validity of the application is only an example. In an actual application, the application may be determined in a plurality of manners, for example, obtaining the publisher information of the application, and determining the blacklist or whitelist of the application publisher. Whether the application is legal; or, obtaining the evaluation information of the application, determining whether the application is legal according to the evaluation information of the application; or determining which applications are used as legitimate applications by the user; or by the system security center or the installed security protection The software scans the application to determine whether the application is legal. If the scan finds that the application has an illegal call to the system function, the application is considered illegal. The main purpose of performing step 104 is to further improve the security of information input. If it is an illegal application, the information input security protection can be further enhanced (as described in step 105 below). Therefore, the present application does not determine whether the application is determined. The legal method is specifically limited. According to the actual situation, the legal or illegal judgment methods of various applications can be defined, and will not be enumerated here.

In 105, it is forbidden to start any input method keyboard, prompting the user to have input risks, and ending the current process.

If the application in which the input box is located is an illegal application, the application may be at risk of stealing user information. It is forbidden to activate any input method keyboard so that the user cannot continue to input information, thereby ensuring that the confidential information is not stolen. Prompting the user to have an input risk may also cause the user to no longer input information, thereby ensuring that the confidential information is not stolen. Therefore, it is possible to adopt any one of prohibiting the activation of any input method keyboard and prompting the user to have an input risk, or as shown in this step, two processes are simultaneously employed.

In 106, the secure input keyboard is activated and the security protection function is activated.

The security input keyboard activated in this step can be the password keyboard that comes with the system, or it can be a third-party input method keyboard that has been safely verified and confirmed to be secure.

The security feature is a system-level feature that, when launched, prohibits any application from invoking the screen capture and/or screen capture interface, and also prohibits any other system-level functions from invoking screenshots and/or screen capture commands and/or screen captures and/or Screen recording interface.

Specifically, the security protection function can disable the interface of the screen capture and/or the screen capture by acquiring the system window and setting the flag of the system window. Where the get system window can pass the function getWindow() is implemented to get the current system window. Setting the flag of the system window can be implemented by the function setFlags() or addFlags(). In the specific setting, the flag of the window can be set to flag_secure through the WindowManager.LayoutParams parameter. which is:

getWindow().addFlags(WindowManager.LayoutParams.FLAG_SECURE) or

getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE,0)

In 107, after detecting that the input box loses focus, the security input keyboard is turned off and the security protection function is turned off.

It is detected that the input box loses focus, indicating that the input environment of the secret information is exited, and it is not necessary to continue the protection of the security input, so the safe input keyboard can be closed and the default input method keyboard can be restored. The security protection function can be turned off, so that the screen capture software or the screen recording software can restore the function, so that the screen capture and screen recording functions are shielded only when the secret information is input, thereby minimizing the normal function of the screen capture software or the screen recording software. The impact.

It should be noted that the foregoing manner provided by the embodiments of the present invention may be applied to a mobile device, and may also be applied to a fixed device such as a PC. Taking the mobile phone as an example, it is assumed that a page as shown in FIG. 2a appears in the application A, and the user needs to fill in the content in the input box corresponding to each item. The information such as the user name, email address, and delivery address are not confidential, and only the password is information that needs to be kept secret. For example, when the user clicks on the input box corresponding to the user name, it is determined according to the attribute of the input box that the password attribute is not indicated, so the default input method keyboard is directly started, as shown in FIG. 2b. When the user clicks the input box corresponding to the password, the password attribute is determined according to the attribute of the input box, that is, the input environment of the secret information, and the information of the application A is further obtained, for example, the package name, version number, size, and the like of the application A, Compare with each application information in the preset whitelist, and add to determine that the application A is a legitimate application, then start the system's own password keyboard and activate the security protection function, as shown in Figure 2c. In the process of user inputting a password, the screen capture and screen recording functions are disabled. When the user completes the password input, the input box corresponding to the password loses focus, then the system's own password keyboard is turned off and the security protection function is turned off.

FIG. 3 is a structural diagram of a device according to an embodiment of the present invention. As shown in FIG. 3, the device may include The environment identification module 01, the function startup module 02, and the security protection module 03 may further include a determination module 04 and a function shutdown module 05. The main functions of each component are as follows:

The environment identification module 01 is responsible for recognizing the input environment. The identification of the input environment is mainly to judge the component of the input frame, that is, the input environment for identifying the confidential information according to the attribute of the input box. For other types of components, if there is also a security requirement, it can be handled in a similar manner.

Specifically, the environment identification module 01 may acquire the attribute of the input box after detecting that the input box obtains the focus, and identify the input environment of the secret information according to the attribute of the input box. If the attribute value of the input box indicates the password attribute, the input environment of the secret information is identified. Wherein, when the user clicks on the input box to prepare for input, an onfocus event is generated, so if the onfocus event generated by the input box component is captured, it is determined that the input box is detected to obtain the focus. Of course, the present invention is not limited to password input, and can also be used for inputting other secret information. If the input box is used for inputting other secret information, the attribute value may also correspond to other attributes.

The function startup module 02 is responsible for starting the security input keyboard and starting the security protection module when the environment identification module 01 recognizes the input environment of the secret information. Among them, the security input keyboard can be the password keyboard that comes with the system, or it can be a third-party input method keyboard that has been safely verified and confirmed to be secure.

If the environment identification module 01 recognizes an input environment of non-confidential information, the function launch module 02 can activate a default input method keyboard. For example, if the current input box is not used to input a password, no additional security protection is required, and the default input method is used for information input, so the default input method keyboard is started. The default input keyboard here can be a third-party input method set by the user, or it can be the input method that comes with the system.

The security protection module 03 is responsible for prohibiting the call screen and/or screen recording interface from being activated after startup. The security protection module 03 is a system-level module that, upon startup, prohibits any application from invoking an interface for screen capture and/or screen recording, and also prohibits any other system-level module from invoking a screen capture and/or after receiving a screen capture and/or screen recording command. / or screen recording interface.

In addition, when the environment identification module 01 recognizes the input environment of the secret information, the determining module 04 may first determine whether the input environment of the secret information belongs to a legitimate application. When the determination result of the determination module 04 is YES, the function startup module 02 performs an operation of starting the security input keyboard and starting the security protection module 03; When the judgment result of the judgment module 04 is NO, the function start module 02 prohibits starting any input method keyboard, and/or prompts the user to have an input risk.

When judging whether the input environment of the secret information is a legitimate application, the determining unit 04 may preset some legal application information by using a white list in advance, or preset some illegal application information by using a blacklist manner; and then obtain an application where the input box is located. The information, for example, one or any combination of the package name, version, size, and the like of the application, and then uses the preset whitelist or blacklist to determine whether the application information is legal.

The function startup module 02 can acquire the system window when the interface for capturing the screen capture and/or the screen recording is prohibited, and the interface of the screen capture and/or the screen capture is prohibited by setting the flag flag of the system window. The get system window can be implemented by the function getWindow() to get the current system window. Setting the flag of the system window can be implemented by the function setFlags() or addFlags(). In the specific setting, the flag of the window can be set to flag_secure through the WindowManager.LayoutParams parameter. which is:

getWindow().addFlags(WindowManager.LayoutParams.FLAG_SECURE) or

getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE,0)

After the environment recognition module 01 recognizes the input environment for exiting the secret information, for example, the environment recognition module 01 detects that the input box loses focus, and recognizes the input environment for exiting the secret information. At this time, the function closing module 05 can close the security input keyboard, and can close the security protection module, so that the screen capture software or the screen recording software can restore the function, so that the screen capture and the screen recording function are actually blocked only when the secret information is input. Minimize the impact on the normal function of screen capture software or screen recording software.

In the several embodiments provided by the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division, and the actual implementation may have another division manner.

In addition, each functional unit in various embodiments of the present invention may be integrated in one processing unit In addition, each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

The above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium. The above software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the methods of the various embodiments of the present invention. Part of the steps. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are made within the spirit and principles of the present invention, should be included in the present invention. Within the scope of protection.

Claims

A method for inputting information, characterized in that the method comprises:

When the input environment of the secret information is recognized, the security input keyboard is activated and the security protection function is activated;

The interface of the screen capture and/or the screen capture is prohibited after the security protection module is started.
The method of claim 1 wherein the input environment for identifying the secret information comprises:

After detecting that the input box obtains the focus, the attribute of the input box is obtained, and the input environment of the secret information is identified according to the attribute of the input box.
The method according to claim 2, wherein the input environment for identifying the secret information according to the attribute of the input box comprises:

If the attribute value of the input box indicates the password password attribute, the input environment of the secret information is identified.
The method of claim 1 wherein said secure input keyboard is a cryptographic keyboard that is included with the system.
The method according to any one of claims 1 to 4, further comprising:

When the input environment for non-confidential information is recognized, the default input method keyboard is activated.
The method according to any one of claims 1 to 4, further comprising: before the enabling the security input keyboard and starting the security protection function, the method further comprising:

Determining whether the input environment of the secret information belongs to a legitimate application, and if so, continuing to perform the step of starting the secure input keyboard and starting the security protection function.
The method of claim 6 further comprising:

If it is determined that the input environment of the secret information is not a legitimate application, it is prohibited to activate any input method keyboard, and/or prompt the user to have an input risk.
The method according to any one of claims 1 to 4, wherein the interface for prohibiting the invoking of the screen capture and/or the screen recording comprises:

Get the system window, disable the call screen capture and / or screen capture by setting the flag flag of the system window interface.
The method according to claim 8, wherein the interface for prohibiting the invoking the screen capture and/or the screen recording by setting the flag flag of the system window comprises:

The flag of the window is set to flag_secure by the WindowManager.LayoutParams parameter.
The method according to any one of claims 1 to 4, further comprising:

After identifying the input environment exiting the secret information, the secure input keyboard is closed and the security protection function is turned off.
The method of claim 10, wherein the identifying an input environment for exiting the secret information comprises:

After detecting that the input box loses focus, an input environment that exits the secret information is identified.
A device for inputting information, characterized in that the device comprises:

An environment identification module for identifying an input environment;

a function startup module, configured to start a security input keyboard and activate a security protection module when the environment identification module recognizes an input environment of the secret information;

The security protection module is configured to prohibit an interface for invoking a screen capture and/or a screen recording after startup.
The device according to claim 12, wherein the environment identification module is configured to: after detecting that the input box obtains the focus, acquire the attribute of the input box, and identify the input of the secret information according to the attribute of the input box; surroundings.
The device according to claim 13, wherein the environment identification module performs: when the input environment of the secret information is identified according to the attribute of the input box, specifically:

If the attribute value of the input box indicates the password password attribute, the input environment of the secret information is identified.
The device according to claim 12, wherein the secure input keyboard is a PIN pad that is included in the system.
The device according to any one of claims 12 to 15, wherein the function activation module is further configured to start a default when the environment recognition module recognizes an input environment of non-confidential information. Input method keyboard.
The device according to any one of claims 12 to 15, wherein the device further comprises:

a determining module, configured to determine, when the environment identification module identifies an input environment of the secret information, whether the input environment of the secret information belongs to a legal application;

The function startup module executes the operation of starting the security input keyboard and starting the security protection module when the determination result of the determination module is YES.
The device according to claim 17, wherein the function activation module is further configured to prohibit activation of any input method keyboard when the determination result of the determination module is negative, and/or prompt the user to have an input risk.
The device according to any one of claims 12 to 15, wherein the function activation module performs: when the interface of the screen capture and/or the screen recording is prohibited from being invoked:

Get the system window and disable the interface for capturing screenshots and/or screens by setting the flag flag of the system window.
The apparatus according to claim 18, wherein the function activation module performs: when the interface of the screen capture and/or the screen capture is prohibited by setting a flag flag of the system window, specifically:

The flag of the window is set to flag_secure by the WindowManager.LayoutParams parameter.
The device according to any one of claims 12 to 15, wherein the device further comprises:

And a function closing module, configured to close the security input keyboard and close the security protection module after the environment identification module recognizes an input environment that exits the secret information.
The device according to claim 21, wherein the environment recognition module detects that the input box loses focus, and recognizes an input environment for exiting the secret information.