WO2019090702A1

WO2019090702A1 - Terminal security protection method and device

Info

Publication number: WO2019090702A1
Application number: PCT/CN2017/110479
Authority: WO
Inventors: 涂永峰; 龙水平
Original assignee: 华为技术有限公司
Priority date: 2017-11-10
Filing date: 2017-11-10
Publication date: 2019-05-16
Also published as: CN111316269A

Abstract

The present application relates to the field of terminals, and in particular, to a terminal security protection method. In the terminal security protection method, secure-mode information is configured according to potential risks in respect of the terminal, and the secure mode of the terminal is established according to the configured secure-mode information. The terminal security protection method comprises a secure switch-off method, that is, setting a secure switch-off period during which the terminal does not accept switch-on operations. Through the solution provided by the present application, it is possible to effectively ensure terminal security in cases where the terminal is out of the control of the user.

Description

Terminal security protection method and device

Technical field

The present application relates to the field of communications, and in particular, to a security protection method and apparatus for a terminal.

Background technique

With the development of information technology, the rise of smart terminals represented by mobile phones has greatly facilitated people's lives. Currently, the terminal can store various information of the user, such as contact information, financial information, work materials, personal privacy, and the like. However, in daily life and work, there are often situations in which the terminal leaves the user (such as lost, swimming, or bathing). In this case, the terminal faces a variety of risks (such as the lock screen password is cracked, the message Being eavesdropped, etc.).

At present, in order to prevent the terminal from being threatened by the above risks, when the terminal is lost, the information of the terminal can be remotely destroyed. It is also possible to set more complicated security information for the terminal and cooperate with the fingerprint password to improve the security of the terminal. However, using the above method may result in a large loss of information. At the same time, the risk of the terminal being cracked cannot be completely eliminated.

Summary of the invention

The embodiments of the present invention provide a security protection method and device for a terminal. By enabling the terminal to enter a security mode, the security performance of the terminal when the user is in control is improved, and the information loss risk of the terminal is reduced.

In a first aspect, an embodiment of the present invention provides a method for securing a terminal, which is used to protect terminal information security, and includes the following steps:

The terminal detects a first operation of the user, the first operation is for causing the terminal to enter a security mode; the security mode includes at least one of the following options: the terminal enters a screen lock state, in a first time period The screen cannot be unlocked, the terminal cannot perform a shutdown or restart operation; the terminal does not allow the flight mode to be activated; and the terminal is powered off, and the power-on operation is not allowed in the second time period. Therefore, the terminal can effectively ensure the security of the terminal under the control of the user in the security mode, thereby greatly reducing the security risk.

In a possible implementation manner, the method further includes: when the terminal enters a screen lock state for a time greater than or equal to a first threshold, the terminal automatically enters the security mode.

In another possible implementation manner, the method further includes: verifying the first security information before the terminal enters the security mode; the first security information includes at least one of the following options: a number, a graphic Password, and biometrics.

In another possible implementation manner, the method further includes: the first operation includes at least one of the following: a voice, a specific gesture, selecting a touch button, and operating a physical button.

In another possible implementation manner, the method further includes: in the security mode, at least one of a software function or a hardware function of the terminal is disabled. Through this implementation, the security of the terminal device can be better improved, and the user can be personalized.

In another possible implementation, the method further includes: the terminal device can be according to user requirements The user can set the protection of the security risks that the user pays attention to. In this way, the terminal security can be enhanced, the efficiency is improved, and the user is personalized.

In another possible implementation manner, the method further includes: the terminal detects a second operation, and the terminal exits the security mode.

In another possible implementation manner, the method further includes: before exiting the security mode, the terminal verifies the second security information, where the second security information is different from the first security information; the second security The information includes at least one of the following options: numbers, graphical passwords, and biometrics. The second security information has a higher operational authority than the first security information, and the second security information needs to be verified when the terminal is powered on during the second time period. The implementation manner can effectively improve the security of the terminal, and can also facilitate the operation of the user.

In another possible implementation manner, the method further includes: if the terminal performs the operation prohibited in the security mode during the first time period or the second time period, the second verification is required. Security Information.

In another possible implementation manner, the method further includes: if the terminal does not set the second security information, the operation of the terminal in the security mode is prohibited.

In another possible implementation manner, the method further includes: before entering the security mode, the terminal verifies the first security information, otherwise the security mode cannot be entered.

In another possible implementation manner, the method further includes: the terminal may preset a time point, and when the preset time point is reached, the terminal automatically enters a security mode, and the terminal may also be improved in this manner. Equipment security.

In another possible implementation manner, the method further includes: the terminal has an intelligent mode, and the terminal may enter the security mode according to the smart mode state, so that the flexibility of the terminal security protection may be improved.

In another possible implementation manner, the method further includes: the terminal recording the security log in the security mode, so that the user can query any event in the security mode to improve security.

In another possible implementation manner, the method further includes: when the terminal detects an abnormality, the terminal sends information to the matched terminal, and the user may process in time to reduce the loss.

In a second aspect, an embodiment of the present invention provides a terminal, including: a detecting module, configured to detect a first operation of a user, where the first operation is used to enter the security mode; the security mode includes the following At least one of the options: the terminal enters a screen lock state, the screen cannot be unlocked during the first time period, the terminal cannot perform a shutdown or restart operation; the terminal does not allow the flight mode to be activated; and, the terminal Shutdown, the boot operation is not allowed during the second time period.

In a possible implementation manner, the terminal further includes: a verification module, configured to verify the first security information; the first security information includes at least one of the following options: a number, a graphic password, and a biometric.

In another possible implementation manner, the terminal further includes: a prohibiting module, configured to disable at least one of a software function or a hardware function of the terminal.

In a third aspect, an embodiment of the present invention provides a terminal, including: one or more processors; one or more memories, where one or more computer programs are stored in the one or more memories, the one or more The computer program includes instructions that, when executed by the one or more processors, cause the terminal to perform any of the methods described in the first aspect above.

In a fourth aspect, an embodiment of the present invention provides a computer program product including instructions, when the computer program The serial product, when run on an electronic device, causes the electronic device to perform the method described in the first aspect above.

In a fifth aspect, an embodiment of the present invention provides a computer readable storage medium, including instructions, when the instruction is run on an electronic device, causing the electronic device to perform the method described in the first aspect above.

In a sixth aspect, an embodiment of the present invention further provides a data processing system, including a module for performing the methods provided by the foregoing first aspect.

Compared with the prior art, the solution provided by the present invention has better security performance, more applicable scenarios, and higher degree of personalization. If the user can customize the settings according to their own needs, the security risks that need to be concerned, and the software and hardware functions required for the restrictions. When the user leaves the terminal, the user can set a safe shutdown time to ensure that the terminal cannot be turned on after the user leaves for a period of time. At the same time, the user can also set a safe shutdown password. After the security shutdown state is completed or after the end, only the security shutdown password verification succeeds, the terminal can boot normally.

These and other aspects of the invention will be more apparent from the following description of the embodiments.

DRAWINGS

1 is a block diagram showing a partial structure of a terminal according to an embodiment of the present invention;

2 is a flowchart of a method for a terminal to enter a security mode according to an embodiment of the present invention;

FIG. 3(a) is a flowchart of a method for a terminal to activate a security mode according to an embodiment of the present invention;

FIG. 3(b) is a schematic diagram of a special gesture activation security mode according to an embodiment of the present invention;

FIG. 3(c) is a schematic diagram of a lock screen of a terminal in a secure mode according to an embodiment of the present invention;

4 is a flowchart of a method for a self-activation security mode of a terminal according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for detecting an abnormality of a terminal according to an embodiment of the present invention;

FIG. 6 is a flowchart of a method for shutting down a terminal in a secure mode according to an embodiment of the present invention;

FIG. 6(b) is a schematic diagram of a shutdown interface in a secure mode according to an embodiment of the present invention;

FIG. 7 is a flowchart of a method for determining whether a user configures second security information according to an embodiment of the present invention;

FIG. 8 is a flowchart of a method for verifying second security information in a terminal security mode shutdown according to an embodiment of the present invention;

FIG. 9 is a flowchart of a method for setting a second time period according to an embodiment of the present invention;

FIG. 10 is a flowchart of a method for booting in a second time period according to an embodiment of the present invention;

FIG. 11 is a block diagram of a terminal according to an embodiment of the present invention.

Detailed ways

Embodiments of the present invention will be described below with reference to the accompanying drawings.

The terms used in the embodiments of the present invention are for the purpose of describing particular embodiments only and are not intended to limit the invention. The singular forms "a", "the" and "the" It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The character "/" in this article generally indicates that the contextual object is an "or" relationship.

It should be understood that although the terms first, second, third, etc. may be used to describe various messages, requests, and terminals in the embodiments of the present invention, these messages, requests, and terminals should not be limited to these terms. These terms are only used to Messages, requests, and terminals are distinguished from one another. For example, a first terminal may also be referred to as a second terminal without departing from the scope of the embodiments of the present invention. Similarly, the second terminal may also be referred to as a first terminal.

The security protection method provided by the embodiment of the present invention is used to protect terminal information security. The terminal can be, for example, a mobile phone, a tablet computer, a laptop computer, a digital camera, a personal digital assistant (PDA), a navigation device, a mobile Internet device (MID), or a wearable device. .

FIG. 1 is a block diagram showing a partial structure of a terminal according to an embodiment of the present invention. The terminal is described by taking the mobile phone 100 as an example. Referring to FIG. 1 , the mobile phone 100 includes: a radio frequency (RF) circuit 110, a power source 120, a processor 130, a memory 140, an input unit 150, a display unit 160, a sensor 170, and audio. The circuit 180, and a component such as a wireless fidelity (Wi-Fi) module 190. It will be understood by those skilled in the art that the structure of the handset shown in FIG. 1 does not constitute a limitation to the handset, and may include more or less components than those illustrated, or some components may be combined, or different components may be arranged.

The components of the mobile phone 100 will be specifically described below with reference to FIG. 1 :

The RF circuit 110 can be used to send and receive information or to receive and transmit signals during a call. For example, the RF circuit 110 may send downlink data received from the base station to the processor 130 for processing, and send the uplink data to the base station. Generally, RF circuits include, but are not limited to, RF chips, antennas, at least one amplifier, transceiver, coupler, Low Noise Amplifier (LNA), duplexer, RF switch, and the like. In addition, RF circuitry 110 can also communicate wirelessly with networks and other devices. The wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CodeDivision). Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), E-mail, Short Messaging Service (SMS), and the like.

The memory 140 can be used to store software programs and modules, and the processor 130 executes various functional applications and data processing of the mobile phone 100 by running software programs and modules stored in the memory 140. The memory 140 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to The data created by the use of the mobile phone 100 (such as audio data, phone book, etc.) and the like. Moreover, memory 140 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. The memory 140 can also store a knowledge base, a tag library, and an algorithm library.

The input unit 150 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the handset 100. Specifically, the input unit 150 may include a touch panel 151 and other input devices 152. The touch panel 151, also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like on the touch panel 151 or near the touch panel 151. Operation), and drive the corresponding connecting device according to a preset program. Optionally, the touch panel 151 may include two parts: a touch detection device and a touch controller. Wherein, the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information. The processor 130 is provided and can receive commands from the processor 130 and execute them. In addition, resistive, capacitive, infrared, and table can be used. The touch panel 151 is implemented in various types such as surface acoustic waves. In addition to the touch panel 151, the input unit 150 may also include other input devices 152. Specifically, other input devices 152 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.

The display unit 160 can be used to display information input by the user or information provided to the user and various menus of the mobile phone 100. The display unit 160 may include a display panel 161. Alternatively, the display panel 161 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like. Further, the touch panel 151 can cover the display panel 161. When the touch panel 151 detects a touch operation on or near the touch panel 151, the touch panel 151 transmits to the processor 130 to determine the type of the touch event, and then the processor 130 according to the touch event. The type provides a corresponding visual output on display panel 161. Although the touch panel 151 and the display panel 161 are two independent components to implement the input and input functions of the mobile phone 100 in FIG. 1, in some embodiments, the touch panel 151 may be integrated with the display panel 161. The input and output functions of the mobile phone 100 are implemented.

The handset 100 can also include at least one type of sensor 170, such as a light sensor, motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 161 according to the brightness of the ambient light, and the proximity sensor may close the display panel 161 when the mobile phone 100 moves to the ear. / or backlight. As a kind of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity. It can be used to identify the gesture of the mobile phone (such as horizontal and vertical screen switching, related Game, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping). The mobile phone 100 can also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, and will not be described herein.

The audio circuit 180, the speaker 181, and the microphone 182 can provide an audio interface between the user and the handset 100. The audio circuit 180 can transmit the converted electrical data of the received audio data to the speaker 181 for conversion to the sound signal output by the speaker 181; on the other hand, the microphone 182 converts the collected sound signal into an electrical signal by the audio circuit 180. After receiving, it is converted into audio data, and then the audio data is output to the RF circuit 110 for transmission to, for example, another mobile phone, or the audio data is output to the memory 140 for further processing.

Wi-Fi is a short-range wireless transmission technology. The mobile phone 100 can help users to send and receive emails, browse web pages, and access streaming media through the Wi-Fi module 190, which provides users with wireless broadband Internet access. Although FIG. 1 shows the Wi-Fi module 190, it can be understood that it does not belong to the essential configuration of the mobile phone 100, and may be omitted as needed within the scope of not changing the essence of the invention.

The processor 130 is the control center of the handset 100, which connects various portions of the entire handset using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 140, and recalling data stored in the memory 140, The various functions and processing data of the mobile phone 100 are executed, thereby realizing various services based on the mobile phone. Optionally, the processor 130 may include one or more processing units; preferably, the processor 130 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like. The modem processor primarily handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 130.

In the embodiment of the present invention, the processor 130 may execute program instructions stored in the memory 140 to implement the method shown in the following embodiments.

The mobile phone 100 also includes a power source 120 (such as a battery) that supplies power to various components, and the power source can pass through the power tube. The system is logically coupled to the processor 130 to manage functions such as charging, discharging, and power consumption through a power management system.

Although not shown, the mobile phone 100 may further include a camera, a Bluetooth module, and the like, and details are not described herein.

The embodiment of the present invention provides a method for security protection of a terminal. As shown in FIG. 2, the method in this embodiment includes:

Step 201: The terminal detects the first operation;

Step 202 verifies the first security information, and the terminal enters a security mode.

Step 203, after the terminal enters the security mode, detecting the second operation;

Step 204, if the time to enter the security mode exceeds the first time period, the process proceeds to step 205; if the time to enter the security mode is within the first time period, the process proceeds to step 206;

Step 205, the terminal outputs the exit security mode;

Step 206: The terminal inputs the second security information, and exits the security mode after the verification succeeds.

The execution subject of the embodiment of the present invention is a terminal, and the terminal includes an electronic device having communication capability, such as a smart phone, a tablet computer, and a navigation device.

Further, in the embodiment of the present invention, the first operation described in step 201 includes at least one of the following options: voice, specific gesture, selection of touch button, and operation of physical button. The voice and specific gestures can be preset by the terminal or can be customized by the user. The physical button can be operated as a single button or a combination of buttons. The touch button can be a virtual button on the display of the terminal.

Specifically, in some embodiments, the user simultaneously presses the power button and volume button of the terminal, and the terminal enters a safe mode.

Further, in the embodiment of the present invention, the first security information in step 202 includes at least one of the following options: a number, a graphic password, and a biometric (including but not limited to fingerprint, iris recognition, face recognition) At least one of them. The first security information is used to verify that the terminal enters a security mode. For example, when the terminal detects the first operation, the user is required to input a fingerprint, and when the fingerprint verification is correct, the terminal enters a screen lock state.

Specifically, in step 204, the first time period may be a certain length of time, for example, 10 minutes. After the terminal enters the security mode for more than 10 minutes, after receiving the instruction to exit the security mode, the terminal exits. Safe mode. If the terminal enters the security mode for less than 10 minutes, after receiving the instruction to exit the security mode, the terminal needs to successfully verify the second security information before exiting the security mode.

Specifically, in step 204, the first time period may also be a specific time period, for example, a time period of 14:10 to 14:30, after receiving the instruction to exit the security mode, if the current time is At 14:35, the terminal exits the security mode. After receiving the instruction to exit the security mode, if the current time is 14:20, the terminal needs to successfully verify the second security information before exiting the security mode.

Further, in the embodiment of the present invention, the security mode described in step 201 includes at least one of the following options: the terminal enters a screen lock state, and in the first time period, the screen cannot be unlocked, and the terminal cannot Perform a shutdown or restart operation; or do not allow to start the flight mode; or do not allow the power on operation during the second time period.

Similarly, the second time period may be a certain length of time, or may be a specific time period, and the second time period may be the same as or different from the first time period.

Further, in the embodiment of the present invention, the security mode further includes that at least one of a software function or a hardware function of the terminal is disabled. For example, the restriction software function includes, but is not limited to, the terminal cannot change the mute setting (including mute, vibration, or normal volume), cannot use any payment software, turn off the lock screen camera and camera function, and the like. The limiting hardware functions include, but are not limited to, turning off the communication module, the GPS/Beidou satellite positioning module, not performing the mobile network location area update or the different system switching, and prohibiting the automatic connection of the open Wi-Fi hotspot or the saved Wi-Fi hotspot saved by itself. Turn off the mobile network data service function, close the audio interface, close the SD card interface, and turn off the Universal Serial Bus (USB) or other data line interface.

Optionally, in some embodiments, the terminal is in a secure mode to enhance security risk protection by disabling software and hardware functions. The security risks include, but are not limited to, the flight mode of the third-party activated terminal, shutdown or restart (which may result in the terminal not being in the network, unable to call in), and the third party resets the terminal to the vibration or normal volume (when the call is incoming) The vibration or ringing is regarded as an interference. The third party uses Near Field Communication (NFC) to repeatedly charge the card. The attacker attracts the terminal through the pseudo base station or Wi-Fi hotspot (the attacker may take the opportunity to take the opportunity). Scam or harass text messages, or eavesdrop on sensitive information (such as short messages, WeChat messages, financial software messages, etc.), or trick the terminal to download updates with viruses or listeners), the attacker sends a strong forged satellite signal to suppress normal Satellite positioning signals such as Global Positioning System (GPS)/Beidou induce terminals to generate incorrect positioning results or personal activity tracks. Attackers invade terminals through wired or wireless interfaces, use software and hardware design loopholes or normal function installation. Monitor software or steal sensitive information.

Optionally, in some embodiments, the terminal may set a risk option to select when configuring the security mode information, and the risk option may include the risks described in the foregoing embodiments, such as property risk, communication risk, and the like.

Further, in the embodiment of the present invention, the second security information in step 204 is different from the first security information, and the second security information includes at least one of the following options: a number, a graphic password, and a biometric. The second security information is used by the terminal to exit the security mode. The second security information has a higher operational authority, and can enable the terminal to exit the security mode in advance.

Optionally, in some embodiments, the terminal has a record security log function in the security mode, where the security log record content includes, but is not limited to, operations and abnormalities of the terminal. The security log is stored in the terminal and can be viewed by a user.

Optionally, in some embodiments, the security log may be customized by a user, including but not limited to a SIM/SD card being pulled out, the terminal repeatedly unlocking, reading, copying or sending out sensitive information, installing software .

Specifically, FIG. 3(a) is a specific example of the first operation provided on the basis of the foregoing step 201. As shown in Figure 3(a), the method steps include:

Step 301: The user clicks the security mode switch on the screen or draws a specific gesture on the terminal screen, and sends instruction information for activating the security mode to the terminal;

Step 302, the terminal determines whether to set the first security information, if the setting jumps to step 304, if not set, then jump to step 303;

Step 303: If the first security information is not set, the user is required to configure the first security information, and the terminal enters the security mode after configuring the first security information.

In step 304, the terminal directly enters a security mode.

Specifically, in the embodiment of the present invention, the terminal acquires a specific gesture drawn by the user on the screen of the terminal in step 301, when the specific gesture is the same as the specific gesture stored in the terminal, The terminal enters safe mode.

Optionally, in some embodiments, the specific gesture of the activation security mode may also be changed by the user through the operating system, and when the new specific gesture is successfully set, the original specific gesture is invalid.

Optionally, in some embodiments, the user may also choose not to set the first security information, and after detecting the first operation of the user, the terminal directly enters the security mode.

Further, FIG. 3(b) is a flowchart of an implementation method for activating a security mode using a specific gesture according to another embodiment of the present invention. As shown in FIG. 3(b), the terminal presents an interface 305, and the interface 305 is in a screen unlock state. When the user draws a specific “S” gesture 306 on the terminal interface 305, the terminal receives activation security. The mode command, the terminal enters the security mode.

Further, as shown in FIG. 3(c), the interface 307 presented by the terminal is that the terminal enters a screen lock state in the security mode.

Further, FIG. 4 is a flowchart of a self-activation method of a terminal security mode according to another embodiment of the present invention. As shown in FIG. 4, the method in this embodiment includes:

Step 401, the terminal enters a screen lock state;

Step 402: The time when the terminal screen is locked is greater than or equal to the first threshold;

In step 403, the terminal enters a security mode.

Optionally, in some embodiments, the first threshold in step 402 is set by the terminal, and when the time to enter the screen lock state is greater than or equal to the first threshold, the terminal activates itself and enters a safe mode state. .

Optionally, in some embodiments, when the screen locking time reaches the first threshold, the terminal needs to input security information for verification before entering the security mode.

FIG. 5 is a flowchart of a method for detecting an interface anomaly according to another embodiment of the present invention. As shown in FIG. 5, the method in this embodiment includes:

Step 501: The terminal matches another terminal.

Step 502, after entering the security mode, detecting that an abnormality occurs on the interface;

Step 503: The terminal sends notification information to the matched terminal.

Specifically, the terminal in step 501 of this embodiment includes, but is not limited to, a mobile phone, a tablet computer, a smart wearable device, and the like. The method for configuring the matching terminal in this embodiment includes pre-storing the identifier of the configured terminal in the terminal to implement matching. The identifier includes, but is not limited to, a telephone number or an International Mobile Subscriber Identification Number (IMSI)/International Mobile Equipment Identity (IMEI).

Optionally, in some embodiments, the terminal matching method further includes performing, by using a wireless communication manner such as Bluetooth, Wi-Fi, or NFC. Further, the terminal can match one or more other terminals.

Specifically, in some embodiments, the terminal turns on Bluetooth and pairs with another terminal, and the two terminals complete the matching.

Further, in step 503, the notification information includes, but is not limited to, an abnormal code, location information, and time information.

Optionally, in some embodiments, when the terminal detects that the SIM/SD card is unplugged, the notification is immediately sent. The information is sent to the matching terminal, for example, by using a short message or a data service, and the user can immediately report the lost SIM card after receiving the notification information, or recover the mobile phone as much as possible according to the notification information.

Optionally, in some embodiments, in the security mode, when the terminal detects that a USB device is inserted, the terminal immediately sends the notification information to the matching terminal.

Optionally, in some embodiments, the terminal may be associated with a software or network platform account, an email account, and in the secure mode, when the terminal detects an abnormality, sending the notification information to the corresponding account.

Specifically, the manner in which the terminal sends the notification information to the matching terminal includes, but is not limited to, a short message, and the message is sent through social software or instant messaging software, and the email is sent.

Optionally, in some embodiments, in the security mode, when the terminal detects that the interface part is damaged or modified, the terminal sends notification information to the matching terminal.

Optionally, in some embodiments, in the security mode, the terminal records all the detected interface abnormalities into the security log, and the recorded content includes but is not limited to the abnormal type, the time when the abnormality occurs, and the location information.

Further, the embodiment of the present invention provides a terminal shutdown method in a security mode. As shown in FIG. 6(a), the method in this embodiment includes:

Step 601, the terminal sets a second time period;

Step 602: The terminal detects a first operation;

In step 603, the terminal is shut down, and the booting operation is not allowed in the second time period;

Step 604 reaches a second period of time, and the terminal can normally perform power on/off.

The second time period may be preset when the terminal is shipped from the factory or manually set by the user. Specifically, if the user does not set the second time period when the user is turned off, the terminal prompts the user to perform the setting before the shutdown operation.

Specifically, FIG. 6(b) is a schematic diagram of a specific operation interface for shutting down in the safe mode. As shown in FIG. 6(b), 605 is a power button, 606 is a terminal entering a flight mode option, and 607 is a terminal entering a mute option, and 608 is a terminal. Terminal restart option, 609 is the shutdown option, and 610 is the shutdown option in safe mode.

Optionally, in some embodiments, the terminal detects that the power button 605 is pressed or pressed or other physical buttons are pressed in combination, and after reaching the preset time of the terminal, the terminal presents the image shown in FIG. 6(b). In the interface shown, after the user clicks the safe shutdown option 610, the terminal enters the safe mode and shuts down.

Further, based on the foregoing embodiment, FIG. 7 provides a specific method for determining whether the user configures the first security information in the security mode, the user is shut down. The method includes:

Step 701: The terminal detects the first operation, where the first operation may be a click security shutdown option 610, and the terminal receives an instruction to initiate a safe shutdown.

Step 702: The terminal determines whether the first security information is set.

Step 703: The security information is not set, and the terminal requires the user to configure the first security information.

In step 704, the terminal is powered off.

Further, based on the above embodiment, FIG. 8 provides a method for requiring the first security information verification to perform shutdown. The method includes:

Step 801, the terminal detects the first operation, and the first operation may be a click security shutdown option 610, at which time the terminal receives an instruction to initiate a safe shutdown;

Step 802: Verify the first security information, and if the verification fails, re-enter the verification;

Step 803, verifying that the first security information is correct, and the terminal is powered off.

Optionally, in some embodiments, the security information input limit may be set. After the input error exceeds a certain limit, the terminal enters a locked state, and when the locked state limited time is reached, the terminal may perform a re-operation.

Further, based on the above embodiment, FIG. 9 provides a terminal security protection method. The method includes:

Step 901, in the security mode, the terminal is powered off;

Step 902, it is determined whether the time when the terminal enters the safe shutdown state is in the second time period, if the second time period jumps to step 904, if not in the second time period, the process proceeds to step 903;

Step 903, exiting the safe shutdown mode, and the terminal may perform a booting operation when receiving the booting instruction;

Step 904, the terminal is not allowed to perform a booting operation and maintain a safe shutdown state;

Optionally, in some embodiments, the terminal sets a timer to set a safe shutdown time. During the safe shutdown time, the timer does not overflow, and the power-on signal cannot be sent, only after the second time period is reached. The timer overflows, the power-on signal can be sent normally, and the terminal can be powered on normally.

Further, based on the above embodiment, FIG. 10 provides a method for the user to boot in the second time period. The method includes:

Step 1001: The terminal receives a booting instruction within a second time period;

Step 1002: Verify the second security information. If the verification is incorrect, go to step 1003. If the verification is correct, go to step 1005.

Step 1003: When the second security information is incorrect and does not exceed the limited number of times, the process jumps to step 1002. If the number of times exceeds the limit, the process jumps to step 1004.

In step 1004, the terminal continues to be in the security mode and prohibits the booting operation;

In step 1005, the terminal exits the security mode, and the terminal starts up normally.

Further, in step 1004, if the user verifies that the second security information is incorrect more than a certain number of times (for example, three times), the terminal screen is locked and the power-on operation is no longer accepted.

The embodiment of the present invention provides a terminal 1100. As shown in FIG. 11, the terminal 1100 includes a detection module 1101, a verification module 1102, and a prohibition module 1103. The detecting module 1101 is configured to detect a first operation and a second operation of the user, where the first operation is used to enter the security mode, and the second operation is used to enable the terminal to exit the security mode; 1102. The first security information and the second security information are used for verification. The prohibition module 1103 is configured to disable at least one of a software function or a hardware function of the terminal.

Optionally, in some embodiments, the detection and detection module 1101 is connected to the verification module 1102. When the detection module 1101 detects a user operation, the verification module 1102 responds to request the user to perform security information verification.

Optionally, in some embodiments, the forbidden module 1103, in the security mode, prohibits the terminal from being shut down or restarted during the first time period; in the second time period, prohibiting the When the terminal security information error exceeds a certain threshold, the prohibition module 1103 locks the terminal and prohibits the operation.

The embodiment of the present invention further provides a computer storage medium for storing the computer software instructions used in the foregoing method and apparatus for implementing terminal security protection shown in FIG. 1-11, which is configured to perform the foregoing method embodiment. code.

The embodiment of the invention also provides a computer program product. The computer program product includes computer software instructions that are loadable by a processor to implement the methods of the above method embodiments.

Although the present invention has been described herein in connection with the embodiments of the present invention, it will be understood by those skilled in the <RTIgt; Other variations of the disclosed embodiments are achieved. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill several of the functions recited in the claims. Certain measures are recited in mutually different dependent claims, but this does not mean that the measures are not combined to produce a good effect.

The present application is described with reference to flowchart illustrations and/or block diagrams of the methods, apparatus, and computer program products of the embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Those skilled in the art will appreciate that in one or more examples described above, the functions described herein can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

A method for securing a terminal for protecting terminal information security, characterized in that the method comprises:

The terminal detects a first operation of the user, where the first operation is used to enter the security mode of the terminal;

The security mode includes at least one of the following options:

The terminal enters a screen lock state, in which the screen cannot be unlocked during the first time period, and the terminal cannot perform a shutdown or restart operation;

The terminal is not allowed to start the flight mode; and,

The terminal is powered off, and the booting operation is not allowed in the second time period.
The method of claim 1 further comprising:

When the terminal enters the screen lock state for a time greater than or equal to the first threshold, the terminal automatically enters the security mode.
The method according to claim 1 or 2, wherein the method further comprises:

Before the terminal enters the security mode, verifying the first security information;

The first security information includes at least one of the following options: a number, a graphical password, and a biometric.
The method of any of claims 1-3, wherein the first operation comprises at least one of the following: voice, a particular gesture, selecting a touch button, and operating a physical button.
Method according to claim 1 or 2, characterized in that

After the terminal enters the security mode, at least one of a software function or a hardware function of the terminal is disabled.
The method of any of claims 1-3, wherein the method further comprises:

The terminal detects a second operation of the user, and the second operation is used to cause the terminal to exit the security mode.
The method of claim 6 wherein:

Before exiting the security mode, the terminal verifies the second security information, where the second security information is different from the first security information;

The second security information includes at least one of the following options: a number, a graphical password, and a biometric.
A terminal, comprising:

a detecting module, configured to detect a first operation of the user, where the first operation is used to enter the security mode of the terminal;

The security mode includes at least one of the following options:

The terminal enters a screen lock state, in which the screen cannot be unlocked during the first time period, and the terminal cannot perform a shutdown or restart operation;

The terminal is not allowed to start the flight mode; and,

The terminal is powered off, and the booting operation is not allowed in the second time period.
The terminal according to claim 8, wherein the terminal further comprises:

a verification module, configured to verify the first security information;

The first security information includes at least one of the following options: a number, a graphical password, and a biometric.
The terminal according to claim 8 or 9, wherein the terminal further comprises:

A prohibition module for disabling at least one of a software function or a hardware function of the terminal.
A terminal according to any one of claims 8 to 10, characterized in that

The detecting module is further configured to detect a second operation of the user, and the second operation is used to cause the terminal to exit the security mode.
The terminal according to claim 9, wherein

The verification module is further configured to verify second security information, where the second security information is different from the first security information;

The second security information includes at least one of the following options: a number, a graphical password, and a biometric.
A terminal, comprising:

One or more processors;

One or more memories, the one or more memories having one or more computer programs, the one or more computer programs comprising instructions, when the instructions are executed by the one or more processors, The terminal is caused to perform the method of any of claims 1-7.
A computer program product comprising instructions, wherein the computer program product, when run on an electronic device, causes the electronic device to perform the method of any one of claims 1-7.
A computer readable storage medium comprising instructions, wherein the instructions, when executed on an electronic device, cause the electronic device to perform the method of any of claims 1-7.