WO2018094984A1

WO2018094984A1 - Input event management method and device and mobile terminal

Info

Publication number: WO2018094984A1
Application number: PCT/CN2017/085053
Authority: WO
Inventors: 姚均营
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-11-25
Filing date: 2017-05-19
Publication date: 2018-05-31
Also published as: CN108108636A

Abstract

Disclosed are an input event management method and device, and a mobile terminal. The method comprises: upon receiving an input event from a user, writing a preset interference input event and the input event to a device node file; and after completion of input of the input events, acquiring the device node file, and analyzing the device node file to determine the input event from the user. In the invention, an interference input event is added to prevent a malware from stealing the actual content inputted by a user. In the entire process, all the operations are performed at a back end, and the user only needs to perform an input operation normally without having to memorize anything. The invention can be operated easily by a user, and has favorable theft protection performance, thereby solving a problem in which a smart phone has a low security level because when a user thereof performs an input operation, the inputted content can be stolen easily.

Description

Management method, device and mobile terminal for input event

Technical field

The present invention relates to the field of communications, and in particular, to a method, device, and mobile terminal for managing an input event.

Background technique

With the rapid popularization of smart phones, services such as mobile payment have experienced rapid growth in the service of mobile terminals, and the subsequent theft of information and the loss of funds have become a major security threat for ordinary users.

At present, the security risks of smart terminal keyboard input can be summarized as follows:

The malicious program obtains the input content of the target program through the process injection technology; or obtains the input record through the underlying keyboard event of the operating system to obtain the user input content, completes the intrusion; or, by letting the user use some specific input method to obtain the keyboard input content.

In the prior art, the problem of smart phone input security is severe. When a user uses a smart phone, when the input operation is performed, the input is easily stolen, and the security of the smart phone is low.

Summary of the invention

An embodiment of the present invention provides a method, a device, and a mobile terminal for managing an input event, which are used to solve the following problems in the prior art: when a user uses a smart phone, when the input operation is performed, the input is easily stolen, and the security of the smart phone is used. Lower.

To solve the above technical problem, in one aspect, an embodiment of the present invention provides a method for managing an input event, including: when receiving an input event from a user, writing a preset interference input event and the input event to a device node In the file; after the input event completes the input, the device node file is obtained, and the device node file is parsed to determine the input event from the user.

Optionally, the preset interference input event includes: the interference input event generated in advance according to a predetermined rule; or the interference input event generated according to the predetermined rule when receiving an input event from a user .

Optionally, parsing the device node file to determine the input event from the user, including: determining the interference input event in the device node file according to a predetermined rule; and using the interference input event from the device The node file is deleted to determine the input event from the user.

Optionally, after parsing the input event of the device node file, the method further includes: sending the input event to an application layer program to determine a user input content according to the input event.

Optionally, the interference input event is multiple.

In another aspect, an embodiment of the present invention further provides an input event management apparatus, including: a writing module, configured to write a preset interference input event and the input event when receiving an input event from a user In the device node file, the parsing module is configured to acquire the device node file after the input event completes the input, and parse the device node file to determine the input event from the user.

Optionally, the device further includes: a generating module, configured to generate the preset interference input event; wherein the generating rule comprises: the interference input event generated in advance according to a predetermined rule; or, upon receiving the user from the user The interference input event generated according to the predetermined rule when an event is input.

Optionally, the parsing module includes: a determining unit, configured to determine the interference input event in the device node file according to a predetermined rule; and a deleting unit configured to: use the interference input event from the device node file Delete to determine the input event from the user.

Optionally, the apparatus further includes: a sending module, configured to send the input event to the application layer program to determine the input content of the user according to the input event.

In another aspect, an embodiment of the present invention further provides a mobile terminal, including: the foregoing management device for input events.

When receiving the input event from the user, the present invention writes the preset interference input event and the input event into the device node file, and then parses the user from the device node file before using the device node file. The input event, and then restore to the user's real input, the process to prevent malware from stealing the real content input by the user by increasing the interference input event, the whole process does not require the user to memorize anything, only need to input normally, all work All are completed in the background, the user is easy to operate, and the anti-theft effect is obvious, and the following problems of the prior art are solved: when the user uses the smart phone, when the input operation is performed, the input is easily stolen, and the security of the smart phone is low.

DRAWINGS

1 is a flowchart of a method for managing an input event in a first embodiment of the present invention;

2 is a schematic structural diagram of an apparatus for managing an input event in a second embodiment of the present invention;

3 is a schematic diagram showing a preferred structure of an input event management apparatus in a second embodiment of the present invention;

4 is a schematic diagram of an input frame of a smart terminal and a malicious program intrusion in a fifth embodiment of the present invention;

5 is a schematic diagram showing the meanings of multi-touch protocol input event parameters in the fifth embodiment of the present invention;

6 is a schematic diagram of a framework of a security terminal security input management method in a fifth embodiment of the present invention.

detailed description

In order to solve the problem of the prior art, when the user uses the smart phone, when the input operation is performed, the input is easily stolen, and the security of the smart phone is low; the present invention provides a method, device and mobile terminal for managing input events The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

A first embodiment of the present invention provides a method for managing an input event. The flow of the method is as shown in FIG. 1 and includes steps S102 to S104:

S102. Write a preset interference input event and an input event into the device node file when receiving an input event from the user.

The input event of the user may be generated by a physical button or may be generated by a virtual touch screen. When the input event is detected, the preset interference input event and the input event are written together with the device node file. In this way, when the user inputs text or numbers, there is interference input, interference input events and user input. They are all mixed in the device node file, and when malicious software steals the input content, the stolen content cannot be utilized. In order to further increase the interference, the interference input event can be set to multiple.

In use, more application scenarios need to be protected when entering a password. Therefore, it can be set to turn on the interference function when an input event is detected as an input number.

S104. After inputting the event completion input, acquiring the device node file and parsing the device node file to determine an input event from the user.

When the user input is completed, the device node file at this time has also been written. Because the above interference input event is added to prevent the malware from stealing the content input by the user, however, the user has completed the input at this time, but since the device node file has both the interference input event and the user input event, if directly The device node file is sent to the application layer program, and the application layer program cannot recognize the content actually input by the user. Therefore, at the system architecture layer, the device node file needs to be parsed to analyze what is input by the user.

When receiving the input event from the user, the embodiment of the present invention writes the preset interference input event and the input event into the device node file, and then parses out from the device node file before using the device node file. The input event from the user is restored to the user's real input. This process prevents the malware from stealing the real content input by the user by increasing the interference input event. The whole process does not require the user to memorize anything, but only needs to input normally. All the work is done in the background, the user is easy to operate, and the anti-theft effect is obvious, which solves the following problems in the prior art: when the user uses the smart phone, when the input operation is performed, the input is easily stolen, and the security of the smart phone is low. .

In the process of implementation, for a preset interference input event, which may be an interference input event generated in advance according to a predetermined rule, when the input event of the user is found, the generated input may be directly written into the device node file; It may be generated immediately according to a predetermined rule when receiving an input event from the user, and the generation of the interference input event is also ended with the end of the user's input event.

When parsing the device node file, first determine the interference input event in the device node file according to the predetermined rule; then delete the interference input event from the device node file, and only retain the user input event. In the specific operation, since the interference input event is generated according to a predetermined rule, the generated interference input event has a certain rule. Therefore, when it is desired to find the interference input event, the interference input event is searched according to a predetermined rule.

After parsing the input event of the device node file, the input event of the user in the device node file can be determined, and the input event can be sent to the application layer program to determine the user's input according to the input event.

A second embodiment of the present invention provides a management device for inputting an event. The structure of the device is as shown in FIG. 2, and includes: a writing module 10, configured to preset interference when receiving an input event from a user. The input event and the input event are written into the device node file; the parsing module 20 is coupled to the write module 10 for acquiring the device node file after the input event completes the input, and parsing the device node file to determine an input event from the user .

FIG. 3 is a schematic diagram showing a preferred structure of the foregoing apparatus. The management apparatus may further include: a generating module 30 coupled to the writing module 10 for generating a preset interference input event; wherein the generating rule includes: pre-determining according to a predetermined rule The generated interference input event; or an interference input event generated according to a predetermined rule upon receiving an input event from the user.

The parsing module 20 may include a determining unit and a deleting unit, wherein the determining unit is configured to determine the setting according to a predetermined rule The interference input event in the standby node file; the deletion unit is configured to delete the interference input event from the device node file to determine an input event from the user.

The foregoing management apparatus may further include: a sending module, configured to send the input event parsed by the parsing module 20 to the application layer program, to determine the input content of the user according to the input event.

The third embodiment of the present invention further provides a mobile terminal, where the processor of the mobile terminal can implement the following functions: generating a preset interference input event; and inputting a preset interference input when receiving an input event from the user The event and the input event are written into the device node file; after the input event completes the input, the device node file is obtained, and the device node file is parsed to determine an input event from the user; the interference input event in the device node file is determined according to a predetermined rule; The interference input event is deleted from the device node file to determine an input event from the user; the input event is sent to the application layer program to determine the user's input based on the input event.

Of course, the management device for the input event in the second embodiment described above may exist in the mobile terminal in the form of a separate APP, and the function of the processor to execute the response is invoked by the program instruction.

The fourth embodiment of the present invention provides a method for managing input events by acquiring the security risk of inputting records through keyboard events at the bottom of the operating system.

The principle that a malicious program obtains an input record through the keyboard event of the underlying operating system is to steal and parse the input event, and obtain the character content input by the user. For example, in a Linux kernel-based operating system, it is mainly to monitor and steal the contents of multiple device node files in the /dev/input folder, and all input events made by the user are passed to the upper application layer program through these device node files.

For the stealing method, the specific method for managing the input event proposed by the present invention is as follows:

The terminal system process monitors the content of the input device node file. When the user uses the terminal to perform an input action (that is, when an input event occurs), the input device node file receives a series of input event information that the user inputs normally. At this time, the system process A plurality of interference input events are generated in a certain manner and written into the device node file, so that the device node file contains both normal user input events and interference input events generated by the system process. In this scenario, the malicious program obtains The content of the device node file that is sent contains interference information, and the actual input content of the user cannot be accurately parsed. Specifically, the method of monitoring these device node files is to open these device node files through a program, and read and monitor their content changes.

When the terminal system framework layer obtains the input event passed to the underlying device node file, analyzes the input event, deletes the interference input event generated by the system process, retains only the user input event, and then passes the user input event to the upper layer. Application layer program. In this way, the interference input event that is added to the bottom layer does not affect the normal use of the upload application layer program.

Specifically, the device node file refers to a node file mapped by a physical device such as a touch screen or a physical button in an operating system. For example, an operating system device node file based on a Linux kernel is a file in the /dev/input directory. Specifically, in the smart terminal, the input signals of the physical devices are converted into input events by the driver of the input device such as a touch screen or a physical button, and written into the device node file, and the input event follows the multi-touch protocol (Multi-touch). Protocol).

The various input events specified by the multi-touch protocol are explained as follows:

ABS_MT_POSITION_X, indicating the X-axis coordinate of the contact center; ABS_MT_POSITION_Y, indicating contact Center Y-axis coordinate; ABS_MT_TOUCH_MAJOR, indicating the long axis of the contact ellipse; ABS_MT_TOUCH_MINOR, indicating the short axis of the contact ellipse; ABS_MT_ORIENTATION, indicating the direction of contact with the ellipse; specifically, when the long axis of the ellipse is aligned with the Y coordinate of the screen coordinate system A value of 0 returns a negative value when the ellipse turns to the left and a positive value when it turns to the right.

Specifically, the way in which the system process generates an input interference event is to follow a multi-touch protocol to generate an input event through the program code. The input events generated by the system process have certain characteristics, which are convenient for subsequent parsing to delete these interference input events. For example, the generated interference input events ABS_MT_POSITION_X, ABS_MT_POSITION_Y, ABS_MT_TOUCH_MAJOR, ABS_MT_TOUCH_MINOR ABS_MT_ORIENTATION each value has a relative regularity, which is convenient for subsequent identification of these interference input events.

The system process monitors the content change of each device node file. When the user performs a touch or key operation, the system process automatically writes the generated interference input event into the device node file, thereby performing obfuscated encryption on the content in the device node file. the goal of.

After the confusion of the contents of the input device node file is completed, the terminal system process needs to read the input events in the device node files and parse and distribute them to the upper layer application. In the method, when the content in the device node file is read and parsed, the interference input events are parsed and deleted according to the method used when generating the interference input event, and then the input events normally input by the remaining users are transmitted to the upper application. program.

Based on the above embodiment, in the case where the input device is maliciously invaded, the malicious program cannot accurately collect the real content input by the user, thereby achieving the purpose of secure input.

A fifth embodiment of the present invention provides a method for managing an input event, which is applied to an intelligent terminal. As shown in FIG. 4, the intelligent terminal input framework is divided into three parts: a system kernel layer, a system frame layer, and an application layer.

When the user operates the smart terminal for input operation, such as touch screen operation, physical button operation, etc., each device driver of the system kernel layer converts the input signal generated by each input device into a format specified by a multi-touch protocol (MTP) to Enter the event and write it to the device node file.

At the same time, in the system framework layer, the terminal system reads the input event in the device node file in real time through the input read thread, that is, the InputReader Thread shown in Figure 4, and distributes the thread through the event, that is, the InputDispatch Thread shown in Figure 4. , distribute input events to the system application layer program.

System application layer programs, such as social software, mobile banking software, input method programs, etc., respond to input events and perform corresponding functions, such as character input, screen sliding, and the like.

At this point, the distribution of input events from the bottom to the top is completed.

If the system of the smart terminal is invaded by a malicious program, the input event will be collected and recorded by the malicious program during the distribution process; the malicious program will imitate the function of the input read thread, collect the input event in the record device node file, and parse the input event. Achieve the purpose of recording user input.

As shown in FIG. 5, the meanings of the ABS_MT_POSITION_X, ABS_MT_POSITION_Y, ABS_MT_TOUCH_MAJOR, ABS_MT_TOUCH_MINOR, and ABS_MT_ORIENTATION input event parameters involved in the multi-touch protocol are as shown in the schematic diagram:

The device driver converts the input signal of the physical device into an input event following the multi-touch protocol and writes it to the device node file.

As shown in FIG. 6, in the method for managing input events of the intelligent terminal according to the embodiment of the present invention, an interference event insertion thread is added, and an input modification thread is customized, and the workflow is as follows:

First, the user performs an input operation through a physical input device, and each device driver of the system kernel layer converts the input signal generated by each input device into an input event according to a format specified by a multi-touch protocol (MTP), and writes it to the device node. In the file.

At the same time, the interference event insertion thread will follow the multi-touch protocol, automatically generate interference input events with certain characteristics, and write to the device node file.

Specifically, the interference input event feature generated by the interference event insertion thread may be customized, for example, the ABS_MT_ORIENTATION value of the interference event is fixed to a certain value, such as 0.8; or the sum of the ABS_MT_POSITION_X, ABS_MT_POSITION_Y, ABS_MT_TOUCH_MAJOR, ABS_MT_TOUCH_MINOR in the interference event is a fixed value. Similar features can be defined according to freely and will not be described here.

Before the input event insertion thread inserts the interference input event, the input event insertion thread communicates with the input read thread, and the feature rule of the inserted event is passed to the input read thread (ie, the custom InputReader Thread), and the device node file is read in real time. The input event in the input event is based on the input event event insertion rule provided by the input event, analyzes the input event, filters out the interference input event inserted by the input event insertion thread, and retains only the input event generated by the user input.

The input read thread passes the correct user input event to the upper layer program after filtering out the interference event.

If the smart terminal is invaded by a malicious program, in the framework of the secure input management method shown in FIG. 6, the content of the device node file acquired by the malicious program includes a user input event and an interference input event, so that the malicious program cannot accurately analyze the user's The actual input, so as to achieve the purpose of user safety input.

The input event management method proposed by the invention can protect the malicious program from obtaining user input through the keyboard event on the basis of the existing input system of the intelligent terminal, and reduce the security risk caused by the user input through the process due to improper management of the system authority. , to a greater extent, improve the safety factor of the product.

While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

Industrial applicability

The present disclosure is applicable to the field of communications to solve the following problems in the prior art: when a user uses a smart phone, when an input operation is performed, the input is easily stolen, and the security of the smart phone is low.

Claims

A method of managing input events, including:

When receiving an input event from the user, writing the preset interference input event and the input event into the device node file;

After the input event completes the input, the device node file is obtained and the device node file is parsed to determine the input event from the user.
The management method of claim 1, wherein the preset interference input event comprises:

The interference input event generated in advance according to a predetermined rule; or

The interference input event generated in accordance with the predetermined rule upon receiving an input event from a user.
The management method of claim 1, wherein the parsing the device node file to determine the input event from a user comprises:

Determining the interference input event in the device node file according to a predetermined rule;

The interference input event is deleted from the device node file to determine the input event from the user.
The management method of claim 1, wherein after the input event of the device node file is parsed, the method further comprises:

The input event is sent to an application layer program to determine a user's input based on the input event.
The management method according to any one of claims 1 to 4, wherein the interference input event is plural.
A management device for inputting events, comprising:

Writing to the module, configured to write the preset interference input event and the input event into the device node file when receiving an input event from the user;

The parsing module is configured to acquire the device node file after the input event completes the input, and parse the device node file to determine the input event from the user.
The management device of claim 6, further comprising:

Generating a module, configured to generate the preset interference input event;

The generating rule includes: the interference input event generated in advance according to a predetermined rule; or the interference input event generated according to the predetermined rule when receiving an input event from a user.
The management device of claim 6, wherein the parsing module comprises:

a determining unit, configured to determine the interference input event in the device node file according to a predetermined rule;

A delete unit is configured to delete the interference input event from the device node file to determine the input event from a user.
The management device of claim 6, further comprising:

A sending module is configured to send the input event to an application layer program to determine a user's input content according to the input event.
A mobile terminal includes:

The processor, when receiving an input event from the user, writing the preset interference input event and the input event Entering into the device node file; after the input event completes the input, acquiring the device node file and parsing the device node file to determine the input event from the user.
The mobile terminal of claim 10, wherein

The processor generates the preset interference input event; wherein the generating rule comprises: the interference input event generated in advance according to a predetermined rule; or, when receiving an input event from the user, generating according to the predetermined rule The interference input event.
The management device according to claim 11, wherein

Determining, by the processor, the interference input event in the device node file according to a predetermined rule; deleting the interference input event from the device node file to determine the input event from a user; The event is sent to the application layer program to determine the user's input based on the input event.
A computer storage medium storing execution instructions for performing the method of any one of claims 1 to 5.