WO2017162081A1

WO2017162081A1 - Method and system for controlling access to clipboard, and storage medium

Info

Publication number: WO2017162081A1
Application number: PCT/CN2017/076858
Authority: WO
Inventors: 俞研; 董振江; 吴家顺; 王蔚
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-03-22
Filing date: 2017-03-15
Publication date: 2017-09-28
Also published as: CN107220555A; CN107220555B

Abstract

A method and system for controlling access to a clipboard, and a storage medium. The method comprises: setting a private clipboard (S201) and a secure clipboard service (S202) for a legitimate application; and storing (S204) obtained (S203) private cut data of the legitimate application in the private clipboard. Thus, data read of the legitimate application from a system clipboard is adjusted to data read from the private clipboard, data monitoring of an illegitimate application to the system clipboard is blocked, and clipboard data in the legitimate application is obtained. The method further comprises: receiving a data obtaining request sent by a requester application (S205); performing a secure clipboard service permission check (S206); and after the check is passed, sending private cut data cached in the secure clipboard service to the requester application (S207).

Description

Clipboard access control method and system, storage medium

Technical field

The invention relates to a mobile terminal security technology, in particular to a clipboard access control method and system, and a storage medium.

Background technique

With the rapid development and wide application of mobile intelligent technologies and intelligent terminal devices, their functions are also showing more and more diversified trends, and mobile applications and services are also increasingly rich. Android is currently the most popular smart terminal platform, and only Google Play provides more than 1 million Android apps. The widespread use of smart terminals and the increasing use of mobile applications have made it possible to enter the mobile office space. BYOD (Bring Your Own Device) has become a research hotspot and a trend of future enterprise development due to its flexible work, efficiency improvement and cost saving.

However, it is precisely because of the wide application of Android applications that it brings convenience to BYOD technology, but it also brings severe security challenges, that is, the employees' own mobile terminals will inevitably run in the external network environment. , vulnerable to malicious attacks, leading to the leakage of sensitive information. In all malicious attacks against the Android system, the attack on the Android clipboard takes advantage of the security flaws inherent in the Android system clipboard. In the BYOD application, the vulnerability of the Android clipboard will lead to greater security risks.

In the existing clipboard access control mechanism, the clipboard has global accessibility, which means that the application used does not require permission to access the clipboard, and even allows the application to monitor the cut by registering the listener. The content of the data changes. When there is an illegal application in the system, the illegal application may obtain data monitoring of the clipboard, or even malicious tampering. Therefore, in the BYOD environment, the user's private information and the company's confidential information may pass. Clipboard The operation caused the information to leak.

Therefore, in order to ensure the use of the clipboard service, especially when using the clipboard service in the BYOD environment, from malicious attacks and unauthorized access by legitimate users, there is no effective solution to enhance the security of the Android clipboard. .

Summary of the invention

The embodiment of the invention provides a clipboard access control method and system, and a storage medium, to solve the technical problem that the illegal application in the related art causes leakage data leakage when monitoring data of the system clipboard.

To solve the above technical problem, an embodiment of the present invention provides a clipboard access control method, including:

Set up a private clipboard for legitimate applications;

Providing a security clipboard service for the private clipboard;

Obtaining private cut data of the legitimate application;

Depositing the private cut data into the private clipboard;

Receiving a data acquisition request sent by the requesting application;

Performing security authentication on the data acquisition request by using the secure clipboard service;

If the authentication is passed, the private cut data requested by the data acquisition request is extracted and sent to the requestor application.

In the above solution, after the private cut data is stored in the private clipboard, before receiving the data acquisition request sent by the requesting application, the method further includes: receiving a data cache request sent by the legitimate application; The secure clipboard service securely authenticates the data cache request; if the authentication passes, the private cut data is extracted from a private clipboard of the legitimate application and sent to the secure cut Cache on the board service.

In the above solution, after the extracting the private cut data is sent to the secure clipboard service for caching, the method further includes: receiving a data acquisition request sent by the requester application, from the The private clipboard data requested by the data acquisition request is extracted from the secure clipboard service and sent to the requestor application.

In the above solution, before the sending the cut data to the security clipboard, the method further includes: performing encryption processing on the cut data according to a preset encryption rule;

After receiving the data acquisition request of the requester application, the obtained ciphertext data is decrypted by the requesting application according to a preset encryption rule.

In the above solution, the setting a private clipboard for a legitimate application includes: setting a private clipboard for each legitimate application;

The storing the private cut data into the private clipboard includes: storing the cut data in a private clipboard of each legitimate application itself.

In the above solution, the method further includes: receiving and monitoring the private cut data to obtain a private clipboard data sending notification from the legitimate application or the secure clipboard service.

The embodiment of the invention further provides a clipboard access control system, comprising:

A private clipboard setting module configured to set up a private clipboard for legitimate applications.

a safety clipboard service setting module configured to set a security clipboard service for the private clipboard;

a data acquisition module configured to acquire private cut data of the legitimate application;

a storage module configured to store the private cut data in the private clipboard;

a receiving module configured to receive a data acquisition request sent by the requesting application;

An authentication module configured to perform security authentication on the data acquisition request;

And a sending module, configured to: after the authentication module passes the authentication, extract the private cut data requested by the data acquisition request, and send the data to the requestor application.

In the above solution, the receiving module is further configured to: after the storage module stores the private cut data into the private clipboard, receive a data cache sent by the legitimate application. request;

The authentication module is further configured to perform security authentication on the data cache request.

The sending module is further configured to: if the receiving module authenticates, extract the private cut data from the private clipboard of the legitimate application, and send the data to the secure clipboard service. Cache.

In the above solution, the receiving module includes a receiving submodule, and the sending module includes a sending submodule;

The receiving submodule is configured to receive a data acquisition request sent by the requesting application after the private shear data is extracted and sent to the secure clipboard service for caching;

The sending submodule is configured to extract private cut data requested by the data acquisition request from the secure clipboard service to the requestor application.

In the above solution, the system further includes:

The encryption module is configured to perform encryption processing on the cut data according to a preset encryption rule;

The decryption module is configured to perform decryption processing on the acquired ciphertext data according to the preset encryption rule by the requesting application after the receiving module receives the data acquisition request of the requesting application.

In the above solution, the private clipboard setting module is further configured to set a private clipboard for each legitimate application;

The storing, by the storage module, the private cut data in the private clipboard includes: storing the cut data in a private clipboard of each legitimate application itself.

In the above solution, the system further includes: a listening module configured to receive and listen to the private cut data to obtain a private clipboard data sending notification from the legitimate application or the secure clipboard service.

a memory and a processor, wherein the memory stores executable instructions for causing the location The processor performs the following operations:

Set up a private clipboard for legitimate applications;

Providing a security clipboard service for the private clipboard;

Obtaining private cut data of the legitimate application;

Depositing the private cut data into the private clipboard;

Receiving a data acquisition request sent by the requesting application;

The embodiment of the present invention further provides a storage medium, which stores executable instructions, and the executable instructions are used to execute the clipboard access control method provided by the embodiment of the present invention.

The beneficial effects of the embodiments of the present invention are:

By setting a private clipboard for a legitimate application and setting a secure clipboard service, the private cut data of the legitimate application is obtained and stored in the private clipboard, thereby effectively blocking illegal application. The program also listens to the private clip data of the legitimate application interaction while listening to the system clipboard.

When private cut data needs to interact between legitimate applications, the legitimate application encrypts the private clipboard data and stores it in the secure clipboard service. The requester application needs to send data to the secure clipboard service. The request, the secure clipboard performs security authentication on the data acquisition request, and if the authentication passes, extracts the private cut data requested by the data acquisition request, and sends the data to the requestor application.

By implementing the method provided by the present invention, even if the illegal application can monitor the system clipboard and even listen to the private cut data between the legitimate applications, the private cut data plaintext data cannot be directly obtained. Thereby ensuring the security of the private shear data, achieving the purpose of data isolation and access control of the clipboard, and also improving the user's Experience the effect.

DRAWINGS

Figure 1 is a flow chart of an illegal application stealing and tampering attack on private clip data on a clipboard;

2 is a flowchart of a method for controlling access to a clipboard according to Embodiment 1 of the present invention;

3 is a flowchart of another method for controlling access to a clipboard according to Embodiment 2 of the present invention;

4 is a schematic structural diagram of a clipboard access control system according to Embodiment 3 of the present invention;

FIG. 5 is a schematic structural diagram of hardware of a clipboard access control system according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings.

In the existing clipboard access control mechanism, the illegal application can monitor the change of the data on the clipboard by registering the system clipboard data change listener with the Android system, thereby obtaining the private cut data, resulting in private Stealing data tampering and tampering attacks. Therefore, the clipboard access control method provided by the embodiment of the present invention implements the interception of an illegal application for a legitimate application by setting a private clipboard, a secure clipboard service, and checking access rights when requesting an application to acquire data. The monitoring of the clipboard used by the program makes it impossible for such applications to monitor changes in the private cut data of legitimate applications, thereby blocking theft and tampering attacks on privately cut data.

An embodiment of the present invention provides a clipboard access control method, including: setting a private clipboard for a legitimate application, and setting a security clipboard service for the private clipboard to obtain a private application of the legitimate application. Cutting the data and storing the private cut data into the private clipboard; when the legitimate application needs to perform the interaction of the private cut data, first receiving the requester application to the secure clipboard data The sent data acquisition request, the secure clipboard service performs security authentication on the data acquisition request, and if the authentication passes, the private cut data is Sent to the requestor application. It should be noted that the legitimate application provided by the present invention refers to such an application that is inserted with the private clipboard provided by the present invention and is securely authenticated, and is not an illegal application if it is inserted; The Secure Clipboard service is used to check the access rights of the application to access clipboard data, as well as to cache private cut data.

Embodiment 1:

Referring to FIG. 1, a flowchart of an illegal application for stealing and tampering attacks on private clip data on a clipboard includes the following steps:

S111. The illegal application 102 acquires a Clipboard Manager object 106 by calling an Activity component 103, for example, by calling the Get method in the Activity component 103 to implement an operation on the Clipboard;

S112, the illegal application 102 creates an object that implements the On Primary Clip Changed Listener interface 105, and rewrites the private cut data change notification method in the clipboard;

S113, the illegal application 102 adds the object created by S112 to the clipboard manager object 106, so that when the private cut data of the clipboard changes, the change notification of the object will be called;

S114, the legitimate application 101 uses the clipboard to perform read and write operations, firstly, the Get method in the Activity component 103 is called to obtain the Clipboard Manager object 106;

S115, the legitimate application 101 creates a private Clip Data object 104, and assigns the private cut data to be written to the clipboard to the private cut data object 104, wherein the Clip Data object 104 is a private cut. Cutting the basic unit of data access;

S116, the legitimate application 101 calls the Set method of the Clipboard Manager object 106 to write the private cut data object 104 created by S115 to the clipboard;

S117, when receiving the notification that the private cut data is changed, the system calls back a corresponding method of the clipboard listener interface 105 registered in the clipboard manager object 106;

S118: The clipboard listener interface 105 calls the Get method of the Clipboard Manager object 106 to obtain the private cut data currently stored in the system clipboard.

S119, the Clipboard Manager object 106 sends the private cut data to the illegal application 102, so that the illegal application can acquire the private cut data stored by the current clipboard, and complete the data stealing attack;

S120. The illegal application 102 may tamper with the obtained private cut data, that is, write code commands, scripts, and the like for implementing the attack;

S121, the illegal application 102 calls the Set method of the Clipboard Manager object 106 to rewrite the falsified data into the system clipboard, completes the data tampering attack, and further implements code injection and the like by using the falsified private clipping data.

It should be noted that the system clipboard in FIG. 1 is an open clipboard without any authority restrictions, and the clipboard temporarily stores data obtained by copying or cutting operations of each legitimate application, and Provided for the same or different applications, because the illegal application can also register the Clipboard Manager object on the system clipboard to listen for changes in the private cut data, and can be accessed without any permissions, so The data stored by each application on the clipboard can be obtained by other unauthorized applications, so the risk of data being compromised when accessed through the BYOD environment. In response to the above problem, the embodiment provides a clipboard access control method, as shown in FIG. 2 .

Please refer to FIG. 2 , which is a flowchart of a method for controlling access to a clipboard according to the embodiment. The specific control steps are as follows:

S201, setting a private clipboard for a legitimate application;

S202. Set a security clipboard service for the private clipboard.

S203. Acquire private cut data of the legal application.

S204, storing the private cut data into the private clipboard.

S205. Receive a data acquisition request sent by the requesting application.

S206. Perform security authentication on the data acquisition request by using the secure clipboard service.

S207. If the authentication is passed, extracting the private cut data requested by the data acquisition request and sending the data to the requestor application.

In this embodiment, a private clipboard is set for the legal application, and the data obtained by cutting or copying is transferred to the private clipboard, which not only ensures the use of the data copy/paste function, but also ensures the use of the data. The security of privately cut data is not intercepted by illegal applications. It should be noted that in this embodiment, the call to the private clipboard and the system clipboard can be implemented through the application interface and the manual operation of the visual control, but both methods are ultimately through the Clipboard Manager. The object operates the clipboard, so the pointer to the Clipboard Manager object in the Android application is redirected to the private clipboard object, which effectively intercepts the illegal application for the clipboard.

In this embodiment, in one embodiment, when a private clipboard is set for the legitimate application, a private clipboard can be set for each legitimate application, and each legitimate application obtains the cut data. After the private data is cut, the cut data private cut data is separately stored in the private clipboard of the legitimate application itself; it is worth noting that the implementation of the private clipboard is the memory area of the process private space. Only for the current process access, a process can not access the private clipboard of other processes, thereby implementing the application's own clipboard access function, or the memory area through the hardware setting feature, thus realizing the private use of the clipboard Chemical.

In an embodiment, in step S202, a secure clipboard service is provided for the private clipboard, and the secure clipboard service is configured to perform security authentication on the received data acquisition request, and may also For temporarily performing data exchange between legitimate applications, temporarily storing private cut data that needs to be exchanged between different applications, and implementing security protection of the data, first receiving the sent by the legitimate application through the secure clipboard service. The data acquisition request is then subjected to security authentication processing on the data acquisition request; if the data acquisition request is authenticated, the private clipping data requested by the data acquisition request is sent to the requestor application.

In this embodiment, after step S204, before step S205, the method further includes: receiving a data cache request sent by the legitimate application; and secureing the data cache request by using the secure clipboard service Authentication; if the authentication is passed, the private cut data is extracted from the private clipboard of the legitimate application and sent to the secure clipboard service for caching.

In this embodiment, the provided clipboard access control method further includes encrypting the private cut data according to a preset encryption rule, that is, before sending the private cut data. Encryption is required to prevent data from being intercepted by an illegal application. In one embodiment, the private clipping may be performed according to a symmetric encryption algorithm based on a provided cipher packet linking mode (such as the SM4 algorithm issued by the National Cryptographic Office of China). The data is encrypted, where its key is derived from the user group defined by the security policy. Then, the ciphertext data obtained by encrypting the encryption algorithm is sent to the requesting application, and after the requesting application receives the ciphertext data, the ciphertext is solved according to the encryption key, and the private hacker can be obtained. Cut the data in clear text.

In this embodiment, when the ciphertext data is sent, the ciphertext data may be broadcast to the legitimate application in a broadcast form, and the private clipboard is also set on the secure clipboard service and the legitimate application. The data listening operation process monitors the data received by the secure clipboard service or the legitimate application.

In the clipboard access control method provided in this embodiment, when the clipboard is used to transfer data between different legitimate applications, the system calls back the pause (on Pause) method of the current activity, and pauses the activity of the current application, so that the activity of the current application is suspended. The conversion to the inactive state, at this time, the current legitimate application calls the preset encryption rule to encrypt the private cut data, and the ciphertext data is broadcasted to the secure clipboard service.

In the clipboard access control method provided in this embodiment, the broadcast sent by the legitimate application to the secure clipboard includes private cut ciphertext data and information of the group to which the application belongs.

In the clipboard access control method provided in this embodiment, when the activity of the private cut data requester application is converted to an active state, the activity recovery (on Resume) method is called back by the system, and at this time, the requester application The program sends a private cut data request broadcast to the secure clipboard service.

In the clipboard access control method provided in this embodiment, the method further includes: receiving and monitoring the private cut data sent to the secure clipboard service to obtain a private clip from a legitimate application. The cache notification of the data is cut, and the receiving interception of the private cut data is also set on the legitimate application to receive the private cut data transmission notification from the secure clipboard service.

Embodiment 2:

FIG. 3 is another method for controlling the access of the clipboard according to the embodiment. In this embodiment, the method for the access control of the clipboard provided by the embodiment is described by using the Android system as an example. Proceed as follows:

S311, registering a broadcast listener on the secure clipboard service 309, and processing a request broadcast for sending private cut data from the legitimate application;

S312, the illegal application 302 acquires the Clipboard Manager object 306 by calling the Get method in the Activity component 303 to implement the operation on the system clipboard.

S313, the illegal application 302 creates an object that implements the On Primary Clip Changed Listener interface 305, and rewrites the cut data change notification method in the system clipboard.

S314, the illegal application 302 adds the object created in step S313 to the clipboard manager object 306 of the system, so that when the cut data changes, the change notification of the object will be called;

S315, registering a broadcast listener on the legitimate application 301, so that the broadcast message from the secure clipboard service 309 can be received, the broadcast message including the data cache request and the ciphertext data of the private cut data;

S316, the legitimate application 301 uses the private clipboard to perform read and write operations, firstly, the Get method in the Activity component 303 is called to obtain the Clipboard Manager object 306;

S317, the legitimate application 301 creates a private cut data object 304, and assigns the private cut data to be written to the private clipboard to the private cut data object 304, wherein the private cut data object 304 is private cut data. Basic unit of access;

S318, the legitimate application 301 redirects the pointer to the Clipboard Manager object 306 to the private clipboard object 307;

S319, the legitimate application 301 calls the Set method of the private clipboard object 307 to write the private cut data object 304 created in step S317 into the private clipboard;

S320. Normally, when the clipboard is used to read data in the legitimate application 301, the legitimate application 301 calls the Get method of the private clipboard object 307 to obtain the private clipping data currently stored in the private clipboard. ;

S321, when the legitimate application in the Android system switches, that is, when the clipboard is used to transfer data between different legitimate applications, the system calls back the onPause method of the current Activity component 303, and suspends the activity of the current application, so that Converted to an inactive state;

S322, the current legitimate application 301 invokes the encryption method of the encryption rule 308 to encrypt the private cut data in the current private clipboard to generate ciphertext data;

S323, the current legitimate application 301 sends a broadcast message to the secure clipboard service 309, where the broadcast message includes the ciphertext data generated in step S322 and the group information and feature information of the current legitimate application;

S324, the secure clipboard service 309 receives the message sent in step S323 and stores the ciphertext data of the private cut data locally;

S325, when the legitimate application 301 of the private cut data requester is activated, and the activity of the legitimate application 301 of the requester is converted into an active state, the onResume method of the Activity component 303 is called back by the system;

S326, the requesting party's legitimate application 301 sends a private cut data request broadcast to the secure clipboard service 309, where the broadcast message includes a request for acquiring the private cut ciphertext data and the group information and the feature information included in step S323;

S327, the secure clipboard service 309 performs a permission check on the request in step S326, and determines whether to allow the private cut ciphertext data including the requested ciphertext data to be sent;

S328, if permitted, the secure clipboard service 309 sends the currently stored ciphertext data to the requesting application 301 in the form of a broadcast ciphertext;

S329, the requesting party application 301 calls the decryption method of the encryption rule 308 to decrypt the privately cut ciphertext data to obtain a private cut data plaintext;

S330, the encryption rule 308 sends the recovered private cut data plaintext to the requesting party's legitimate application 301;

S331, the requesting legitimate application 301 writes the private cut data plaintext to its own private clipboard object 307, thereby completing the private cut data data acquisition across the application.

It should be noted that in this embodiment, a private clipboard and an encryption/decryption rule are set in each legitimate application, and the security cutout service can be a system service shared by the legitimate application, and any legitimate application is Have access rights.

In this embodiment, the secure clipboard service may also be set in each legitimate application, that is, each legitimate application is provided with its own independent secure clipboard service, when a private clipping is required. When the data exchange is performed, each legitimate application first encrypts the private cut data that needs to be sent, and then sends it to the secure clipboard service of the legitimate application itself, and finally the encrypted secret is broadcasted. The text data is broadcast to the required legitimate application; in one embodiment, before the broadcast ciphertext data is sent, the data acquisition request from the requesting application is also required to be received, and the security authentication is performed. If passed, the corresponding data is The ciphertext data is broadcast to the requester application.

Embodiment 3:

FIG. 4 is a clipboard access control system 40 according to the embodiment. In the present embodiment, the clipboard access control system includes:

A private clipboard setting module 401 configured to set a private clipboard for a legitimate application; in one embodiment, when setting a private clipboard, a private clipboard can be set for each legitimate application for legal purposes. The application stores its own private clipping data.

a secure clipboard service setting module 402 configured to set a security clipboard service for the private clipboard;

The data obtaining module 403 is configured to acquire private cut data of the legitimate application;

The storage module 404 is configured to store the private cut data into the private clipboard. When each legal application sets its own independent private clipboard, the storage module 404 is specifically used for legal application. The private cut data of the program itself is stored on its own corresponding private clipboard.

The receiving module 405 is configured to receive a data acquisition request sent by the requesting application;

The authentication module 406 is configured to perform security authentication on the data acquisition request.

The sending module 407 is configured to: after the authentication module passes the authentication, extract the private cut data requested by the data acquisition request, and send the data to the requester application.

In this embodiment, the private shearing board is used to store the private clipping data, thereby realizing the isolation of the data storage, and ensuring that the illegal application obtains the private clipping when performing data monitoring on the system clipboard. Cut data and even tamper with the data.

In this embodiment, the receiving module 405 includes a receiving submodule, and the sending module 407 includes a sending submodule, and the receiving submodule is configured to store the private cut data in the storage module 404. After the private clipboard is received, before the receiving module 405 receives the data acquisition request sent by the requesting application, receiving a data transmission request data cache request sent by the legitimate application; the authentication module 406 sends the data to the data Requesting a data cache request for security authentication; if the authentication is passed, the sending submodule extracts from the private clipboard The private cut data is sent to the secure clipboard service for caching.

In this embodiment, the clipboard access control system 40 further includes:

The encryption module 408 is configured to perform encryption processing on the private cut data according to a preset encryption rule; the sending module 407 sends the ciphertext data obtained through the encryption process to the requester application;

The decryption module 409 is configured to, after the receiving module 405 receives the data acquisition request of the requesting application, the requesting application decrypts the ciphertext data according to a preset encryption rule.

In this embodiment, the clipboard access control system 40 further includes: a listening module 410, configured to set a security clipboard service for the legitimate application in the private clipboard setting module 401. Then, the private shear data is received and monitored to obtain a private clipboard data transmission notification from the secure clipboard service or the private clipboard.

FIG. 5 is a schematic structural diagram of hardware of a clipboard access control system according to an embodiment of the present invention, including:

A processor 510, an input/output interface 530 (such as one or more of a display, a keyboard, a touch screen, a speaker microphone), a storage medium 540, and a network interface 520 (using various wired or wireless communication technologies), components Communication can be connected via system bus 550.

The storage medium 540 may be a ROM (eg, a read only memory, a FLASH memory, a transfer device, etc.), a magnetic storage medium (eg, a magnetic tape, a magnetic disk drive, etc.), an optical storage medium (eg, a CD-ROM, a DVD-ROM, a paper card). , a tape, etc., and other well-known types of program memory; the storage medium 540 stores computer-executable instructions that, when executed, cause the processor 510 to perform the scissors shown in any of Figures 1, 2, and 3. Cutting board access control method.

The embodiment of the present invention further provides a non-volatile storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used in at least one of the foregoing mobile terminal anti-error touch methods. , for example, the clipboard access control shown in Figures 1, 2 and 3. At least one of the methods. The storage medium of this embodiment may be a storage medium such as an optical disk, a hard disk, or a magnetic disk, and may be a non-transitory storage medium.

In summary, through the embodiments of the present invention, at least the following beneficial effects exist:

Setting a private clipboard for a legitimate application, and setting a secure clipboard service, and then acquiring private cut data of the legitimate application, and storing it in the private clipboard, when other applications need to obtain the private clipboard When the data is cut, the data acquisition request needs to be sent, and the permission check is performed. If the data is obtained, the access of the data can be obtained, so that the method provided by the present invention can effectively intercept the interception of the privately-cut data by the illegal application and avoid The dangerous situation that the private cut data is stolen solves the security risk of data leakage when the user accesses the clipboard in the BYOD environment, and enhances the user experience of using the application in the BYOD environment.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in a storage medium (ROM/RAM, diskette, optical disk) by a computing device, and in some cases The steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of the modules or steps may be implemented as a single integrated circuit module. Therefore, the invention is not limited to any particular combination of hardware and software.

The above is a further detailed description of the present invention in connection with the specific embodiments, and the specific embodiments of the present invention are not limited to the description. It will be apparent to those skilled in the art that the present invention may be made without departing from the spirit and scope of the invention.

Industrial applicability

The invention discloses a clipboard access control method and system, and a storage medium, which realizes that the pointing of reading data from a legitimate clipboard by a legitimate application is adjusted to read from a private clipboard, thereby blocking illegal application. The program acquires the clipboard data in the legitimate application for the data interception of the system clipboard; receives the data acquisition request sent by the requester application, and checks the permission through the secure clipboard service, and after the pass, the security cutter is The private cut data cached in the board service is sent to the requester application, which solves the security risk of data leakage when the user accesses the clipboard in the BYOD environment, thereby ensuring the security of the cut data. Sex, but also improve the user experience.

Claims

A clipboard access control method includes:

Set up a private clipboard for legitimate applications;

Providing a security clipboard service for the private clipboard;

Obtaining private cut data of the legitimate application;

Depositing the private cut data into the private clipboard;

Receiving a data acquisition request sent by the requesting application;

Performing security authentication on the data acquisition request by using the secure clipboard service;

If the authentication is passed, the private cut data requested by the data acquisition request is extracted and sent to the requestor application.
The clipboard access control method according to claim 1, wherein, after the private cut data is stored in the private clipboard, before receiving the data acquisition request sent by the requesting application, the method further includes:

Receiving a data cache request sent by the legitimate application; performing security authentication on the data cache request by using the secure clipboard service; and if the authentication is passed, extracting from the private clipboard of the legitimate application The private cut data is sent to the secure clipboard service for caching.
The clipboard access control method of claim 2, wherein after the extracting the private cut data is sent to the secure clipboard service for caching, the method further comprises:

Receiving a data acquisition request sent by the requestor application, extracting private cut data requested by the data acquisition request from the secure clipboard service, and transmitting the data to the requestor application.
The clipboard access control method according to claim 3, further comprising: before transmitting the cut data to the secure clipboard:

Encrypting the cut data according to a preset encryption rule;

After receiving the data acquisition request of the requester application, the obtained ciphertext data is decrypted by the requesting application according to a preset encryption rule.
A clipboard access control method according to any one of claims 1 to 4, wherein

The setting of a private clipboard for a legitimate application includes:

Set a private clipboard for each legitimate application;

The storing the private cut data into the private clipboard includes:

The cut data is stored in the private clipboard of each legitimate application itself.
The clipboard access control method according to claim 5, further comprising:

Receiving and listening to the private cut data to obtain a private clipboard data transmission notification from the legitimate application or the secure clipboard service.
A clipboard access control system comprising:

A private clipboard setting module configured to set up a private clipboard for legitimate applications.

a safety clipboard service setting module configured to set a security clipboard service for the private clipboard;

a data acquisition module configured to acquire private cut data of the legitimate application;

a storage module configured to store the private cut data in the private clipboard;

a receiving module configured to receive a data acquisition request sent by the requesting application;

An authentication module configured to perform security authentication on the data acquisition request;

The sending module is configured to: after the authentication module passes the authentication, extract the private cut data requested by the data obtaining request and send the data to the requesting application.
A clipboard access control system according to claim 7, wherein

The receiving module is further configured to: after the storage module stores the private cut data into the private clipboard, receive a data cache request sent by the legitimate application;

The authentication module is further configured to perform security authentication on the data cache request.

The sending module is further configured to: if the receiving module authenticates, pass the legal response The private cut data is extracted from the private clipboard of the program and sent to the secure clipboard service for caching.
The clipboard access control system according to claim 8, wherein the receiving module comprises a receiving submodule, and the transmitting module comprises a transmitting submodule;

The receiving submodule is configured to receive a data acquisition request sent by the requesting application after extracting the private cut data to be sent to the secure clipboard service for caching;

The sending submodule is configured to extract private cut data requested by the data acquisition request from the secure clipboard service and send the data to the requestor application.
The clipboard access control system of claim 9 further comprising:

The encryption module is configured to perform encryption processing on the private cut data according to a preset encryption rule;

The decryption module is configured to perform decryption processing on the acquired ciphertext data according to the preset encryption rule by the requesting application after the receiving module receives the data acquisition request of the requester application.
A clipboard access control system according to any of claims 7-10, wherein

The private clipboard setting module is further configured to set a private clipboard for each legitimate application;

The storage module is further configured to store the cut data in a private clipboard of each legitimate application itself.
The clipboard access control system of claim 11 further comprising:

The listening module is configured to receive and listen to the private cut data to obtain a private clipboard data sending notification from the legitimate application or the secure clipboard service.
A clipboard access control system comprising:

a memory and a processor, wherein the memory stores executable instructions for causing the processor to perform the following operations:

Set up a private clipboard for legitimate applications;

Providing a security clipboard service for the private clipboard;

Obtaining private cut data of the legitimate application;

Depositing the private cut data into the private clipboard;

Receiving a data acquisition request sent by the requesting application;

Performing security authentication on the data acquisition request by using the secure clipboard service;

If the authentication is passed, the private cut data requested by the data acquisition request is extracted and sent to the requestor application.
A storage medium storing executable instructions for performing the clipboard access control method according to any one of claims 1 to 6.