WO2018233718A1

WO2018233718A1 - Application program security management method and apparatus, and storage medium

Info

Publication number: WO2018233718A1
Application number: PCT/CN2018/092689
Authority: WO
Inventors: 姚均营
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-06-23
Filing date: 2018-06-25
Publication date: 2018-12-27
Also published as: CN109117623A; CN109117623B

Abstract

The present disclosure provides an application program security management method and apparatus, and a storage medium. The application program security management method comprises: when an operation of entering a password is performed in a current interface, determining the location of an icon of an application program corresponding to the operation is consistent with a preset location; if consistent, processing, according to a preset algorithm, a password entered by a user, and then sending the password to the application program for authentication; and if inconsistent, processing, according to a random algorithm, the password entered by the user, and then sending the password to the application program for authentication.

Description

Application security management method, device and storage medium

Technical field

The present disclosure relates to the field of application security management technologies, and in particular, to an application security management method, apparatus, and storage medium.

Background technique

With the rapid popularization of smart phones, services such as mobile payment have experienced rapid growth in mobile terminal services, and theft of customers and the loss of funds have become major security threats for ordinary users. Users usually need to enter a payment password in public places such as restaurants, stations, shopping malls, etc., and there is a risk of password leakage. In addition, users are also at risk of leaking all kinds of information in mobile payment applications after the loss of smartphones. Therefore, relying on a single password authentication method can no longer meet the security needs of users.

How to provide a safe and convenient application security management method has become an urgent problem for intelligent terminals.

Summary of the invention

According to an aspect of the present disclosure, an application security management method is provided, including: when an operation of inputting a password is performed on a current interface, determining whether a location of an icon of an application corresponding to the operation is consistent with a preset location; If the location of the icon is consistent with the preset location, the password input by the user is processed according to a preset algorithm and sent to the application for authentication; if the location of the icon is inconsistent with the preset location, the user inputs the password. The password is processed according to a random algorithm and sent to the application for authentication.

According to another aspect of the present disclosure, there is provided an application security management apparatus, comprising: a determination module configured to determine whether a location of an icon of an application corresponding to the operation is performed when an operation of inputting a password is performed on a current interface The processing module is configured to: when the judgment result of the determining module is that the position of the icon is consistent with the preset position, the password input by the user is processed according to a preset algorithm, where the determining module is When the judgment result is that the position of the icon is inconsistent with the preset position, the password input by the user is processed according to a random algorithm; and the sending module is configured to send the password processed by the processing module to the application for authentication. .

According to another aspect of the present disclosure, there is provided a storage medium having stored thereon one or more programs, the one or more programs being executed by one or more processors, the one or a virus attack processor executing An application security management method according to the present disclosure.

DRAWINGS

The drawings described herein are provided to provide a further understanding of the present disclosure, and are intended to be a part of the present disclosure. In the drawing:

1 is a flow chart of an application security management method in accordance with an embodiment of the present disclosure;

2 is a schematic diagram of setting a location of a smart terminal desktop icon according to an embodiment of the present disclosure;

3 is a flow chart of a method of setting a security option in accordance with an embodiment of the present disclosure;

4 is a flowchart of a method of password authentication of an application in accordance with an embodiment of the present disclosure;

FIG. 5 is a schematic diagram of a framework of a smart terminal security input system according to an embodiment of the present disclosure; FIG.

6 is a block diagram of a secure input system in accordance with an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of an application security management apparatus according to an embodiment of the present disclosure.

The implementation, functional features and advantages of the present disclosure will be further described with reference to the accompanying drawings.

Detailed ways

The present disclosure will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the disclosure and are not intended to limit the disclosure.

1 is a flow chart of an application security management method in accordance with an embodiment of the present disclosure.

As shown in FIG. 1, an application security management method according to the disclosed embodiment is applied to a smart terminal, and includes steps S101 to S103.

In step S101, when the operation of inputting the password is performed on the current interface, it is determined whether the position of the icon of the application corresponding to the operation is consistent with the preset position, and if so, step S102 is performed; otherwise, step S103 is performed.

In step S102, the password input by the user is processed according to a preset algorithm and sent to the application for authentication.

In step S103, the password input by the user is processed according to a random algorithm and then sent to the application for authentication.

In an embodiment, the step S102 may include: mapping and converting the password input by the user according to a preset password mapping algorithm, and sending the converted password to the application for authentication.

In an embodiment, step S103 may include: randomly converting the password input by the user according to a random password mapping algorithm, and sending the converted password to the application for authentication.

In an embodiment, before the step S101, the method may further include: pre-setting and storing the security option of the application according to the operation of the user. The security options may include location information of the icon, annotation information of the control for secure management of the application, and a preset password mapping algorithm generated according to the correspondence between the temporary password and the real password input by the user.

In an embodiment, the method further includes: monitoring whether the current interface has a control for obtaining an input focus; if a control for obtaining an input focus occurs, determining whether the control is an labeled control according to a control property of the control; The control is an annotated control, and it is determined that the current interface performs an operation of inputting a password.

In one embodiment, a method of setting location information of an icon includes: setting location information of a relative position of the icon, the relative location including a direction of the icon relative to an icon of the reference application (ie, referring to the application), and an icon in the direction The distance from the icon of the reference app.

The user can first select a reference application, set the direction of the icon of the current application (hereinafter also referred to as "application") with respect to the icon of the reference application, and set the distance between the icons of the two applications in the opposite direction.

2 is a schematic diagram of setting a smart terminal desktop icon location according to an embodiment of the present disclosure.

As shown in FIG. 2, the application that needs to be encrypted is the application A. When setting the location information of the location of the icon, first select a reference application B, and set the direction of the icon of the application A relative to the icon of the application B. The set direction can be up, down, left, right, top left, bottom left, top right, bottom right. Finally, the relative distance between the icon of the application A and the icon of the application B is set. The relative distance can be 1, 2, 3, 4, and the like. This completes the setting of the positional information of the relative position of the icon of the application A. For example, the relative position information of the icon of the application A may be set such that the icon of the application A is located on the right side of the icon of the application B, or the icon of the application A is located first of the icon of the application B.

In one embodiment, the method of annotating a control for secure management of an application includes: recording control information of the control. The control information may include at least one of a package name, a class name, an absolute coordinate position of the control, and a relative position of the control.

After completing the application's icon location setting, the password input control for security management in the application is marked, for example, the password input box control of the password input page in the application is marked.

According to an embodiment of the present disclosure, the method of labeling the password input control is to record the control information of the control, including the package name, the class name, the absolute coordinate position of the control, the relative position of the control, and the like, so as to achieve the purpose of uniquely determining the control.

In one embodiment, after the user exits the application, the method further includes randomly adjusting the location of the icon of the application.

Settings can be made such that when the user passes the authentication and exits the application normally, the location of the icon of the application can be randomly adjusted. You can adjust the location of the app's icon by modifying the desktop icon database file.

A policy that randomly adjusts the location of an application's icon can be customized by the user. In order to facilitate the user to quickly restore the icon position to the preset position with one hand, when the position of the icon is randomly adjusted, the position of the icon of the application can be referred to as the center of the circle, so as to conveniently adjust the position of the icon in a circular area with a radius of one-hand operation. . This way, the user can easily restore the position of the icon to the preset position with one hand.

According to an embodiment of the present disclosure, in order to pass the authentication after inputting the password, the user needs to restore the icon of the application to the preset location before starting the application.

Since the location of the icon of the application on the desktop is randomly shuffled each time the application including the labeled control is exited, even if the temporary password is entered without knowing the preset position of the icon of the application Unable to map to generate real passwords through authentication.

According to an embodiment of the present disclosure, the user can preset the location of the icon of each application and the temporary password in advance. When using important applications such as social, banking, and payment in public, even if the password is leaked, others will only get the temporary password, and the temporary password will not be able to complete the payment or login authentication on other devices. On the other hand, when the mobile terminal is lost and the temporary password is leaked, since the location of the icon of the application is randomly disturbed, the other person cannot know the preset position of the icon of each application, and thus the password authentication operation cannot be completed by the temporary password.

According to the application security management method of the embodiment of the present disclosure, the password authentication is associated with the location of the icon of the application, and only when the location and password of the icon of the application are correct, the authentication can be passed, and the temporary password mapping is performed. A true password that reduces the security risks associated with password leakage and/or loss of smart terminals.

3 is a flow chart of a method of setting a security option in accordance with an embodiment of the present disclosure.

Referring to FIG. 3, the method of setting the security option may include the following steps S201 to S205.

In step S201, when the user inputs the system administrator password, the preset function interface is entered.

In step S202, an application that needs to perform security management is determined according to the user's selection, and location information on the desktop of the icon of the application is preset according to the user's operation.

In step S203, the password input control in the application is marked, and the control is located through the control information of the interface layout control.

In step S204, a crypto map algorithm is generated based on the temporary password and the real password input by the user. The temporary password can be used as the password that is entered when the application password is authenticated, and the real password is the password that is actually submitted when the application password is authenticated.

The user enters a temporary password and a real password corresponding to the labeled control. A password mapping algorithm between the temporary password and the real password is generated according to the temporary password and the real password, and the preset password mapping algorithm is saved. According to the algorithm, the temporary password can be mapped to generate a real password.

In step S205, the preset position information of the icon of the application, the control labeling information, and the password mapping algorithm are saved for use in subsequent password authentication.

4 is a flow chart of a method of password authentication of an application in accordance with an embodiment of the present disclosure.

Referring to FIG. 4, the method for the application to perform password authentication may include the following steps S401 to S412.

In step S401, the control that currently obtains the input focus is monitored to obtain control information.

The desktop activity window can be monitored through system services. For example, in the Android system, it is monitored by the Window Manager Service.

In step S402, it is determined according to the control information obtained in step S401 and the control information in the security option whether the control that has obtained the input focus is the already marked control, and if so, step S403 is performed; otherwise, step S402 is continued.

It is possible to determine whether the current focus control is an annotated password input control by information such as a package name, a class name, an absolute coordinate position of the control, and a relative position of the control that have obtained the input focus.

In step S403, location information of an icon of an application to which the current focus control belongs is acquired.

The current location completion information acquisition of the icon of the application can be obtained by reading the database of the icon of the desktop application. For example, in the Android system, the current location of the application's icon can be obtained through the Launcher Provider.

In step S404, it is determined whether the current location of the icon of the application is consistent with the preset location information. If yes, step S405 is performed; otherwise, step S409 is performed.

Check if the current location of the app's icon is the location of the preset icon. The determination may be made by the position information of the preset relative position, that is, by comparing the relative direction and the relative distance of the icon of the current icon and the reference application with the position information of the preset relative position.

In step S405, when the user activates the input keyboard on the password input control, the temporary password input by the user is acquired.

The temporary password of the user input generated by the input method process can be obtained through the Input Method Manager Service.

In step S406, a real password is generated from the temporary password by a preset password mapping algorithm.

In step S407, the obtained real password is passed to the application, and the real password is input on the control.

At step S408, the application successfully completes the password authentication by the real password.

If the user's temporary password is incorrectly entered, the password cannot be generated by the default password mapping algorithm. At this time, the authentication still fails.

In step S409, when the user activates the input keyboard on the password input control, the temporary password input by the user is acquired.

In step S410, the temporary password input by the user is mapped to a random character by using a random cipher mapping algorithm.

In step S411, a random password is passed to the application, and a random password is entered on the control.

In step S412, the application cannot complete the password authentication operation by using a random password, and the authentication fails.

In step S409, even if the correct temporary password is input, since the random password mapping algorithm is used at this time, the real password cannot be mapped, so the authentication still fails.

In the above process, after mapping the user input password, the detailed description of the control generated password input to the control that has obtained the input focus will be described with reference to FIGS. 5 and 6.

A schematic block diagram of a smart terminal security input system in accordance with an embodiment of the present disclosure, and FIG. 6 is a block diagram of a secure input system in accordance with an embodiment of the present disclosure.

Referring to FIG. 5, the input system of the intelligent terminal includes three parts: a target program, a system process, and an input method process. When the target program (for example, social application, mobile banking application) needs to input character content, first apply to the system process to call the open input method process. When the system process receives the application, it binds the input box and displays the interface of the input method. For example, in an Android-based system terminal, an Input Method Manager, an Input Method Manager Service, and an Input Method Service (Input) are respectively performed in a target program, a system process, and an input method process. Method Service) for collaborative interaction.

When the input method process generates characters, the character content is not directly transmitted to the target program, but needs to be processed by the system process before being passed to the target program. The system process receives the temporary password generated by the input method process and maps the characters to the processed characters through the corresponding algorithm. Then, the system process passes the processed characters to the target program, thereby completing the mapping operation of the password.

As shown in Figure 6, a custom input processing thread is added to the input system to complete the mapping of the password. The user performs an input operation through a touch screen, physical buttons, and the like. Drivers such as touch screen drivers, buttons, and the like of the system kernel layer convert physical signals into input events according to event rules defined by the multi-touch protocol, and write them to the device input node file. For example, in a Linux-based intelligent system, the input device node file is in the /dev/input/ directory. The system framework layer input scheduling thread is then responsible for reading the input events in the device input node file and passing them to the upper application to generate the characters. For example, when a user invokes an input method process to enter a character, the input dispatch thread passes the user's input event to the input method process, and the input method process generates a character based on the incoming input event.

In the embodiment of the present disclosure, in addition to completing the conventional input event reading, the system framework layer also customizes the input processing thread, and maps the password generated by the input method to the processed state through the current location of the applied icon and the password mapping algorithm. Password. Finally, the input processing thread passes the processed password to the target program, thereby completing the password input.

As illustrated in FIG. 7, the application security management apparatus according to an embodiment of the present disclosure may include a determination module 701, a processing module 702, and a transmission module 703.

The determining module 701 is configured to determine whether the position of the icon of the application corresponding to the operation is consistent with the preset position when the operation of inputting the password is performed on the current interface.

The processing module 702 is configured to process the password input by the user according to a preset algorithm when the determination result of the determining module 701 is that the position of the icon of the application is consistent with the preset location, and the determination result of the determining module 701 is the application. When the position of the icon of the program does not match the preset position, the password input by the user is processed according to a random algorithm.

The sending module 703 is configured to send the processed password to the application for authentication.

In an embodiment, the application security management apparatus may further include: a setting module configured to preset and store a security option of the application according to an operation of the user, the security option including an icon of the application The location information, the annotation information of the control for securely managing the application, and the preset password mapping algorithm generated according to the correspondence between the temporary password and the real password input by the user.

In one embodiment, the setting module may include: a location setting sub-module configured to set location information of a relative position of the icon of the application, the relative location including an icon of the icon of the application relative to a reference application And a distance between the icon of the application and the icon of the reference application in the direction; and a control labeling sub-module configured to record control information of the control, the control information including a package name, a class At least one of the name, the absolute coordinate position of the control, and the relative position of the control.

In an embodiment, the application security management apparatus may further include: a monitoring module configured to monitor whether a current interface has a control for obtaining an input focus, and when a control that obtains an input focus appears, according to a control attribute of the control Determining whether the control is an labeled control, and when the control is an labeled control, determining that the current interface performs an operation of inputting a password.

The monitoring module can also monitor whether the authentication of the application is successful and whether the application exits normally.

In an embodiment, the application security management apparatus may further include: an icon adjustment module configured to randomly adjust a location of the icon of the application after the user exits the application.

After the user has used and exited the application for a certain period of time, the icon adjustment module can randomly adjust the position of the application's icon to automatically jump to the location of the application's icon. You can adjust the location of the app's icon by modifying the desktop icon database file.

The application security management apparatus according to an embodiment of the present disclosure associates the password authentication with the location of the icon of the application, and only passes the authentication and the temporary password mapping when the location and password of the icon of the application are correct. A true password that reduces the security risks associated with password leakage and/or loss of smart terminals.

The present disclosure also provides a storage medium having stored thereon one or more programs, the one or more programs being executed by one or more processors, the one or the virus attack processor executing according to the present disclosure Application security management method.

The embodiments of the present disclosure have been described above with reference to the drawings, and are not intended to limit the scope of the disclosure. Any modifications, equivalent substitutions and improvements made by those skilled in the art without departing from the scope and spirit of the disclosure are intended to be included within the scope of the disclosure.

Claims

An application security management method, including:

When the operation of inputting the password is performed on the current interface, determining whether the position of the icon of the application corresponding to the operation is consistent with the preset position;

If the location of the icon of the application is consistent with the preset location, the password input by the user is processed according to a preset algorithm and sent to the application for authentication;

If the location of the icon of the application does not match the preset location, the password input by the user is processed according to a random algorithm and then sent to the application for authentication.
The application security management method according to claim 1, wherein before the step of determining whether the location of the icon of the application corresponding to the operation is consistent with the preset location, the method further includes:

Pre-setting and storing security options of the application according to a user's operation, the security options including location information of icons of the application, annotation information of controls for secure management of the application, and temporary input according to user input A preset password mapping algorithm generated by the correspondence between a password and a real password.
The application security management method according to claim 2, wherein the step of setting location information of the icon of the application comprises:

Position information of a relative position of an icon of the application, the relative position including a direction of an icon of the application relative to an icon of a reference application, and an icon of the application and the reference application in the direction The distance of the icon, and wherein the steps to mark the controls that need to be securely managed by the application include:

The control information of the control is recorded, and the control information includes at least one of a package name, a class name, an absolute coordinate position of the control, and a relative position of the control.
The application security management method of claim 3, further comprising:

Monitor the current interface for controls that have input focus;

If a control that obtains an input focus appears, determining whether the control is an labeled control according to a control property of the control;

If the control is an annotated control, it is determined that the current interface performs an operation of inputting a password.
The method of any one of claims 1 to 4, further comprising:

After the user exits the application, the location of the icon of the application is randomly adjusted.
An application security management device includes:

a judging module configured to determine, when the current interface performs an operation of inputting a password, whether the position of the icon of the application corresponding to the operation is consistent with the preset position;

a processing module configured to: when the judgment result of the determining module is that the position of the icon of the application is consistent with the preset position, the password input by the user is processed according to a preset algorithm, and the judgment result of the determining module is When the location of the icon of the application is inconsistent with the preset location, the password input by the user is processed according to a random algorithm;

And a sending module configured to send the processed password of the processing module to the application for authentication.
The application security management device of claim 6, further comprising:

a setting module configured to preset and store a security option of the application according to a user's operation, the security option including location information of an icon of the application, and annotation information of a control for securely managing the application And a preset password mapping algorithm generated according to the correspondence between the temporary password and the real password input by the user.
The application security management device of claim 7, wherein the setting module comprises:

a location setting sub-module configured to set location information of a relative position of an icon of the application, the relative location including a direction of an icon of the application relative to an icon of a reference application and the application in the direction The distance between the icon of the program and the icon of the reference application;

And a control labeling submodule configured to record control information of the control, the control information including at least one of a package name, a class name, an absolute coordinate position of the control, and a relative position of the control.
The application security management device of claim 8 further comprising:

a monitoring module configured to monitor whether the current interface has a control for obtaining an input focus. When a control that obtains an input focus occurs, determining whether the control is an labeled control according to a control property of the control, and the control is When the control has been marked, it is judged that the current interface has performed the operation of inputting a password.
The application security management apparatus according to any one of claims 6 to 9, further comprising:

An icon adjustment module configured to randomly adjust a position of an icon of the application after the user exits the application.
A storage medium having stored thereon one or more programs, the one or more programs being executed by one or more processors, the one or the virus attack processor executing any one of claims 1 to 5 The application security management method described.