WO2017113584A1

WO2017113584A1 - Security control method and system for container of terminal

Info

Publication number: WO2017113584A1
Application number: PCT/CN2016/084103
Authority: WO
Inventors: 邵寿平
Original assignee: 宇龙计算机通信科技(深圳)有限公司
Priority date: 2015-12-31
Filing date: 2016-05-31
Publication date: 2017-07-06
Also published as: CN105550577A

Abstract

A security control method and system for a container of a terminal. The method comprises: determining, in response to a tap instruction on a target application, whether the target application is a portal application for entering a secure container, and if yes, entering the secure container (S101); disconnecting the Internet, and creating and connecting to a VPDN, in response to a VPDN creation instruction (S102); transferring, after determining that the VPDN is successfully connected, information about a SIM card of a terminal to a preset security authentication server by means of a VPDN channel in response to a SIM card information verification instruction, to verify whether the SIM card of the terminal has a registration record in the preset security authentication server (S103); entering the target application after receiving a verification success message from the preset security authentication server and invoking a preset secure container policy (S104). Whereby, a secure container can be provided for applications requiring client privacy protection, and all application programs can be run in a same system, without the need to allocate additional memory and space, such that data security of the terminal user can be protected conveniently and efficiently.

Description

Terminal container security control method and system

This application claims priority to Chinese Patent Application No. 201511031383.X, entitled "Control Method and System for Terminal Container Safety", filed on December 31, 2015, the entire contents of which are hereby incorporated by reference. Combined in this application.

Technical field

The present invention relates to the field of terminal information security, and in particular to a method and system for controlling terminal container security.

Background technique

Since the intelligentization and networked intervention of mobile phones, the increased functionality and efficiency of use have provided great help to mobile phone users, and brought some security risks to people.

There are few existing mobile phone security solutions. Some companies have introduced a dual-system solution to implement mobile phone security policies in independent security systems to ensure the security of users' information. A separate data partition is reserved for the security system, which is independent of the standard system. Come. The method can effectively guarantee the independence of user data and ensure the privacy of user data. However, the simultaneous operation of dual systems not only has high manufacturing cost, but also needs to pre-allocate memory for the security system, increase power consumption, and has high running cost, which cannot be simple and efficient. Secure mobile phone user data.

Summary of the invention

In view of this, the main object of the present invention is to provide a method and system for controlling the security of a terminal container, which can provide a safe container for a mobile phone application and ensure the operational safety of the application in the container.

To achieve the above object, the present invention provides a method for controlling the security of a terminal container, including:

Responding to the click instruction of the target application, determining whether the target application is an entry application to enter the secure container, and if yes, entering the secure container;

Respond to the VPDN creation instruction, disconnect the Internet, create a VPDN and connect;

After confirming that the VPDN connection is successful, the SIM card information of the terminal will be verified in response to the SIM card information. Passing the VPDN channel to the preset security authentication server to verify whether the SIM card of the terminal has a registration record on the preset security authentication server;

After receiving the verification pass message of the preset security authentication server, the target application is entered, and the preset secure container policy is invoked.

Preferably, the secure container policy comprises:

Hide the APN configuration information, disable the data connection path, block the USB function, and disable the terminal's default disable device feature.

Preferably, the determining whether the target application is an entry application to enter the secure container comprises:

Determining whether the package name parameter in the broadcast sent by the click of the target application is an application package name preset by the secure container.

Preferably, the responding to the SIM card information verification instruction, before transmitting the SIM card information of the terminal to the preset security authentication server by using the VPDN channel, further includes:

And acquiring the SIM card information of the terminal in response to the scanning instruction of the two-dimensional code corresponding to the SIM card information of the terminal.

Preferably, the preset disable device functions include a camera function, a pasteboard function, an SD card function, a screen capture function, a screen recording function, and a GPS function.

Preferably, the secure container policy further includes:

Push downloads of preset apps within the target app.

Preferably, the configuration information of the hidden APN includes:

Presetting a hidden field assignment to the configuration information of the APN.

The invention also provides a terminal container safety control system, comprising:

a container internal and external discriminating module, configured to determine whether the target application is an entry application to enter the secure container in response to a click instruction to the target application, and if yes, enter the secure container;

The security authentication module is configured to respond to the VPDN creation command, disconnect the Internet, create a VPDN and connect; after determining that the VPDN connection is successful, respond to the SIM card information verification command, and transmit the SIM card information of the terminal to the preset security authentication server through the VPDN channel. Determining whether the SIM card of the terminal has a registration record on the preset security authentication server;

The in-container policy invoking module is configured to enter the target application after receiving the verification pass message of the preset secure authentication server, and invoke a preset secure container policy.

Preferably, the secure container policy comprises:

A terminal container security control method and system provided by the present invention is used to determine whether a target application is an entry application for entering a secure container, and if so, enter a secure container; disconnect the Internet, create a VPDN and connect; and determine that the VPDN connection is successful, Passing the SIM card information of the terminal to the preset security authentication server through the VPDN channel, and verifying whether the SIM card of the terminal has a registration record on the preset security authentication server; after the verification is passed, entering the target application, At the same time, the preset security policy can be used to provide a secure container for applications that need to protect customer privacy. All applications can run in the same system without having to allocate additional memory and space, which can easily and efficiently protect the data security of the end user.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can obtain other drawings according to the provided drawings without any creative work.

1 is a flowchart of Embodiment 1 of a method for controlling safety of a terminal container according to the present invention;

2 is a schematic diagram showing the detailed principle of a first embodiment of a terminal container security control method according to the present invention;

3 is a schematic diagram of still another detailed principle of a first embodiment of a method for controlling the security of a terminal container according to the present invention;

4 is a schematic diagram of still another detailed principle of a first embodiment of a method for controlling the security of a terminal container according to the present invention;

FIG. 5 is a schematic structural diagram of Embodiment 2 of a terminal container safety control system according to the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, instead of All embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terminal of the present invention includes, but is not limited to, a smartphone, a tablet, and the like.

Embodiment 1:

The present invention provides a method for controlling the security of a terminal container. FIG. 1 is a flow chart showing an embodiment of a method for controlling the security of a terminal container according to the present invention, including:

Step S101: responsive to the click instruction of the target application, determining whether the target application is an entry application to enter the secure container, and if yes, entering the secure container;

A container refers to the operating environment of a group of applications. This group of applications can be distributed to devices from the MDM mobile management platform. By default, the MDM client belongs to the in-container application. The MDM mobile management platform can issue a container policy, that is, when the group of applications runs (the top-level activity is the application), the MDM client applies the policy (such as switching APNs and the like). When the top-level activity changes, a broadcast is sent. The broadcast ACTION is "com.pekall.action.TOP_PACKAGE" with the parameter Intent.putExtra("toppackage", current package name), ie the container change trigger is the top-level activity. The change occurs and the "package name" in the parameter is the broadcast of the "application package name" set by the mobile phone, and it is determined whether the target application is an entry application for entering the secure container, that is, by determining the broadcast sent by the click of the target application. Whether the package name parameter is the application package name preset by the secure container is implemented. The schematic diagram is shown in Figure 2.

Step S102: respond to the VPDN creation instruction, disconnect the Internet, create a VPDN, and connect;

The terminal will preset an application that creates and connects to vpdn. The vpdn configuration information is provided by the client. The network is automatically disconnected before the creation. If the vpdn is created successfully, the user prompts, otherwise the prompt fails, exits the application, and connects to the Internet.

Step S103: After determining that the VPDN connection is successful, responding to the SIM card information verification command, transmitting the SIM card information of the terminal to the preset security authentication server through the VPDN channel, and verifying whether the SIM card of the terminal is in the preset security authentication service. There is a registration record at the end;

The SIM card information can be obtained by scanning the two-dimensional code corresponding to the SIM card information of the terminal. After the vpdn connection is successful, the user is prompted to scan the QR code provided by the SIM vendor, and the scan information is transmitted to the preset security authentication service through the VPDN channel. Performing SIM card information verification comparison, verifying whether the SIM card of the terminal has a registration record on the preset security authentication server, and returning a success message after the verification is passed, and pushing the preset application and policy; otherwise, prompting the SIM card The identity information does not match, the application is quit, and the Internet is connected. The process is shown in Figure 3.

Step S104: After receiving the verification pass message of the preset security authentication server, enter the target application and invoke a preset secure container policy;

The secure container policy can include:

After receiving the verification pass message of the preset security authentication server, the representative completely enters the secure container, enters the target application that is initially clicked, and simultaneously invokes the security container preset policy:

(1) APN security control

To protect the user's vpdn information, you need to hide the configuration information of the APN. When the application enters the inside of the container, the VPDN is already configured and connected. In order to control the display or hiding of the APN, a "Hidden" field is added to all APNs in the TelephonyProvider class, and the value is 0, which means the default display. When configuring the VPDN, assign a value of 1 to the "Hidden" field of the APN, indicating that it is hidden. When the user clicks the setting page to view the APN list, the Setting class will load the apn database. At this time, the "Hidden" field is determined. If the value is 1, it will not be displayed, and the VPDN configuration information is protected.

(2) Data connection security control

In order to prevent user privacy information from being obtained by Trojans, it is necessary to cut off the data connection path of all Trojans, including wifi, Bluetooth, mms, sms.

The control steps are divided into system attribute setting and function control. When entering the inside of the container, the MDM application inside the container will immediately call the interface function that sets the system property value of the data connection. Their interface functions are: boolean allowOutgoingWifi(boolean allow), boolean allowOutgoingBluetooth(boolean allow), boolean allowOutgoingMms(boolean allow), boolean allowOutgoingSms(boolean allow); when the data function is started, it is judged by reading the system attribute value. Whether to carry out the data connection process, such as wifi attribute "persist.yulong.mdm.wifi" = 1, indicating that in the container, data connection is not allowed, and immediately returns, thereby achieving security control of the data connection.

(3) Application installation security control

The inside of the container uses the server push installation application to install the application. By blocking the USB function and the application source, it is judged to prevent the user or the hacker from installing the application inside the container. The USB shielding method is the same as the data connection control, and the system attribute value is set and read. Take the implementation.

(4) Mobile device security control

The security control of the mobile phone device mainly includes the shielding of the camera, the paste version, the SD card, the screen capture, the screen recording, the GPS, etc., and blocks the inflow of the Trojan hacker from the hardware, thereby achieving the purpose of ensuring the security of the user information. In order to facilitate the popularization and expansion of the scheme, the above four modules are encapsulated into corresponding strategies, namely application strategy: ApplicationPolicy getApplicationPolicy(); data connection strategy: PhoneRestrictionPolicy getPhoneRestrictionPolicy(); device control policy: RestrictionPolicy getRestrictionPolicy(); APN control strategy getAnpPolicy(). The solution implementation within the strategy can be implemented according to the user, and has the characteristics of simple and easy to expand. It is suitable for most government and enterprise users. The security container strategy design is shown in Figure 4.

Applying the terminal container security control method provided in this embodiment to determine whether the target application is an entry application for entering the secure container, and if so, entering the secure container; disconnecting the Internet, creating a VPDN and connecting; determining that the VPDN connection is successful, The SIM card information of the terminal is transmitted to the preset security authentication server through the VPDN channel, and the SIM card of the terminal is verified to have a registration record on the preset security authentication server; after the verification is passed, the target application is entered. Call the preset security policy, hide the APN configuration information, disable the data connection path, block the USB function, and disable the terminal's preset disable device function. Secure containers can be provided for applications that need to protect customer privacy. All applications can run on the same system without having to allocate extra memory and space, which can easily and efficiently protect end user data security.

Embodiment 2:

The present invention also provides a control system for terminal container security, and FIG. 5 is a schematic structural view of an embodiment of a control system for terminal container security according to the present invention, including:

The inside and outside of the container discriminating module 101 is configured to determine whether the target application is an entry application to enter the secure container in response to a click instruction to the target application, and if yes, enter the secure container;

The security authentication module 102 is configured to respond to the VPDN creation instruction, disconnect the Internet, create a VPDN and connect; after determining that the VPDN connection is successful, respond to the SIM card information verification instruction, and transmit the SIM card information of the terminal to the preset security authentication service through the VPDN channel. End, verifying whether the SIM card of the terminal has a registration record on the preset security authentication server;

The in-container policy invoking module 103 is configured to enter the target application after receiving the verification pass message of the preset secure authentication server, and simultaneously invoke a preset secure container policy;

The secure container policy can include:

Applying the terminal container security control system provided by this embodiment, the inside and outside container discriminating module 101 determines whether the target application is an entry application into the secure container, and if so, enters the secure container; the security authentication module 102 disconnects the Internet, creates a VPDN and After the VPDN connection is successful, the SIM card information of the terminal is transmitted to the preset security authentication server through the VPDN channel, and the SIM card of the terminal is verified to have a registration record on the preset security authentication server; Afterwards, the target application is entered, and the in-container policy invoking module 103 invokes a preset security policy, hides the APN configuration information, disables the data connection path, shields the USB function, and disables the terminal's preset disabled device function. Secure containers can be provided for applications that need to protect customer privacy. All applications can run on the same system without having to allocate extra memory and space, which can easily and efficiently protect end user data security.

It should be noted that each embodiment in the specification is described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the embodiments are referred to each other. can. For the system class embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

Finally, it is also to be understood that the term "comprises", "comprising" or any other variants thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a plurality of elements includes Those elements, but also other elements not explicitly listed, or elements that are inherent to such a process, method, item or equipment. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

The method and system provided by the present invention are described in detail above, and the principles and embodiments of the present invention are described in detail herein. The description of the above embodiments is only for helping to understand the method and core idea of the present invention. At the same time, the description of the present invention is not limited to the scope of the present invention.

Claims

A method for controlling the security of a terminal container, comprising:

Responding to the click instruction of the target application, determining whether the target application is an entry application to enter the secure container, and if yes, entering the secure container;

Respond to the VPDN creation instruction, disconnect the Internet, create a VPDN and connect;

After determining that the VPDN connection is successful, responding to the SIM card information verification command, transmitting the SIM card information of the terminal to the preset security authentication server through the VPDN channel, and verifying whether the SIM card of the terminal is registered on the preset security authentication server. recording;

After receiving the verification pass message of the preset security authentication server, the target application is entered, and the preset secure container policy is invoked.
The terminal container security control method according to claim 1, wherein the secure container policy comprises:

Hide the APN configuration information, disable the data connection path, block the USB function, and disable the terminal's default disable device feature.
The terminal container security control method according to claim 1, wherein the determining whether the target application is an entry application for entering a secure container comprises:

Determining whether the package name parameter in the broadcast sent by the click of the target application is an application package name preset by the secure container.
The terminal container security control method according to claim 1, wherein the responding to the SIM card information verification instruction, before transmitting the SIM card information of the terminal to the preset security authentication server through the VPDN channel, further includes:

And acquiring the SIM card information of the terminal in response to the scanning instruction of the two-dimensional code corresponding to the SIM card information of the terminal.
The terminal container security control method according to claim 2, wherein the preset disable device function comprises a camera function, an pasteboard function, an SD card function, a screen capture function, a screen recording function, and a GPS function.
The method for controlling the security of a terminal container according to claim 2, wherein the security container policy further comprises:

Push downloads of preset apps within the target app.
The terminal container security control method according to claim 2, wherein the configuration information of the hidden APN comprises:

Presetting a hidden field assignment to the configuration information of the APN.
A terminal container security control system, comprising:

a container internal and external discriminating module, configured to determine whether the target application is an entry application to enter the secure container in response to a click instruction to the target application, and if yes, enter the secure container;

The security authentication module is configured to respond to the VPDN creation command, disconnect the Internet, create a VPDN and connect; after determining that the VPDN connection is successful, respond to the SIM card information verification command, and transmit the SIM card information of the terminal to the preset security authentication server through the VPDN channel. Determining whether the SIM card of the terminal has a registration record on the preset security authentication server;

The in-container policy invoking module is configured to enter the target application after receiving the verification pass message of the preset secure authentication server, and invoke a preset secure container policy.
The terminal container security control system according to claim 8, wherein the secure container policy comprises:

Hide the APN configuration information, disable the data connection path, block the USB function, and disable the terminal's default disable device feature.
The terminal container security control system according to claim 9, wherein the preset disable device function comprises a camera function, an pasteboard function, an SD card function, a screen capture function, a screen recording function, and a GPS function.