WO2020073750A1 - 终端攻击防御方法、装置、终端及云服务器 - Google Patents

终端攻击防御方法、装置、终端及云服务器 Download PDF

Info

Publication number
WO2020073750A1
WO2020073750A1 PCT/CN2019/103044 CN2019103044W WO2020073750A1 WO 2020073750 A1 WO2020073750 A1 WO 2020073750A1 CN 2019103044 W CN2019103044 W CN 2019103044W WO 2020073750 A1 WO2020073750 A1 WO 2020073750A1
Authority
WO
WIPO (PCT)
Prior art keywords
feature information
scene feature
information
terminal
terminal screen
Prior art date
Application number
PCT/CN2019/103044
Other languages
English (en)
French (fr)
Inventor
亢治
徐洋
姚英亮
王濯尘
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020073750A1 publication Critical patent/WO2020073750A1/zh
Priority to US17/003,173 priority Critical patent/US20200387600A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/83—Protecting input, output or interconnection devices input devices, e.g. keyboards, mice or controllers thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2133—Verifying human interaction, e.g., Captcha

Definitions

  • the present application relates to computer technology, in particular to an attack defense technology and various computer equipment applying the attack defense technology.
  • a hacker attack is simply a technique in which a hacker finds defects in a terminal system or a network, and attacks them.
  • the defects mentioned here include software defects, hardware defects, network protocol defects and management defects.
  • address space layout randomization address, layout, randomization, ASLR
  • ASLR address space layout randomization
  • ASLR address, layout, randomization, ASLR
  • ASLR address space layout randomization
  • the ASLR defense method uses a random address generator to The memory address on the stack becomes a randomized address.
  • CFI Control flow integrity
  • this method presets a canary for verification on the initial stack. When a hacker finds a stack overflow vulnerability, the canary will occur after the hacker code is implanted. Variety. Check the canary before the program runs, thus preventing the execution of malicious code by hackers.
  • hackers generally need to repeatedly test the terminal system before implementing a real attack, in order to discover system vulnerabilities, and attack the terminal system according to the discovered system vulnerabilities.
  • the above traditional hacker attack defense methods are all direct defenses when hackers have discovered system vulnerabilities to conduct malicious attacks, and cannot prevent hackers from repeatedly trying to find system vulnerabilities in advance.
  • This application provides a terminal attack defense method, device, terminal, and cloud server to solve the problem that traditional hacker attack defense methods do not prevent hackers from repeatedly trying to discover system vulnerabilities.
  • the present application provides a terminal attack defense method, the method includes: a secure execution environment receives a communication request for communication between a first CA request and a first TA, and the secure execution environment includes a trusted execution environment TEE and a cloud
  • the communication request includes the current first scene feature information of the first CA.
  • the scene is any operation of any CA, and the CA name and CA operation corresponding to each scene are unique.
  • the scene feature information includes any one or more of the following information: terminal screen touch information, terminal screen status information and CA operation information
  • the terminal screen touch information includes any one or more of the following information :
  • the terminal screen status information includes any one or more of the following information: terminal screen bright screen status and terminal screen brightness value
  • the CA operation information is used to indicate whether the CA is running in the foreground.
  • the security execution environment judges whether the first scene feature information is legal, and exemplarily determines whether the pre-stored scene feature information set has second scene feature information matching the first scene feature information, and the pre-stored scene The feature information set contains scene feature information corresponding to all CAs, and if the second scene feature information matching the first scene feature information exists in the scene feature information set, it is considered legal. If the first scene feature information is verified, the secure execution environment establishes communication between the first TA and the first CA.
  • the secure execution environment when the secure execution environment receives any CA request to communicate with the corresponding TA, the secure execution environment obtains the scene feature information corresponding to the current CA from the communication request and verifies whether the information is legal, if not , It indicates that the current CA is not operated by the user, there is a danger of hacker attacks, the communication between the CA and the TA is not established, and then the CA cannot operate normally, blocking the hackers' attempts to discover system vulnerabilities. Judging the scene feature information can effectively avoid non-user-operated hacking attacks and effectively improve the security of the system.
  • the verification of the first scene feature information by the secure execution environment includes: the secure execution environment determining whether a pre-stored set of scene feature information exists with the In the second scene feature information matching the first scene feature information, the pre-stored scene feature information set includes multiple CAs and scene feature information corresponding to multiple operations of the multiple CAs.
  • the secure execution environment determines whether the pre-stored scene feature information set matches the first scene feature information.
  • Two scene feature information including: traversing the scene feature information set to obtain the second scene feature information with the same CA name and CA operation as the first scene feature information; determining the second scene Whether the feature information is consistent with the first scene feature information.
  • the method further includes: the secure execution environment receives scene feature information update data from the REE side; and according to the scene features The information update data updates the scene feature information set.
  • the present application provides a terminal attack defense method, where a REE is deployed on the terminal, the method includes: the REE sends a communication request for communication between a first CA request and a first TA, and the communication request Contains current first scene feature information of the first CA, where the scene feature information includes any one or more of the following information: terminal screen touch information, terminal screen status information, and CA operation information, the terminal screen
  • the touch information includes any one or more of the following information: the number of terminal screen clicks, the terminal screen click position and the terminal screen click method when the CA is operated, and the terminal screen status information includes any one of the following information or Multiple: terminal screen bright state and terminal screen brightness value, the CA operation information is used to indicate whether the CA is running in the foreground; the first CA is controlled according to the communication state of the first CA and the first TA CA is currently operating.
  • the controlling the current operation of the first CA according to the communication status of the first CA and the first TA includes: if the first A CA establishes communication with the first TA, allowing the current operation of the first CA.
  • the method further includes: the REE receiving scene feature information update data from the network side; and converting the scene feature Information update data is sent to the secure execution environment.
  • the present application provides a terminal attack defense device, the device includes: a receiving module, deployed in a secure execution environment, for receiving a communication request of a first client application CA request to communicate with a first security application TA,
  • the secure execution environment includes any one or both of a trusted execution environment TEE and a cloud security environment, and the communication request includes current first scene feature information of the first CA;
  • the scene feature information includes the following information Any one or more of: terminal screen touch information, terminal screen status information and CA operation information
  • the terminal screen touch information includes any one or more of the following information: terminal screen when operating the CA Number of clicks, terminal screen click position and terminal screen click method
  • the terminal screen state information includes any one or more of the following information: terminal screen bright state and terminal screen brightness value
  • the CA operation information is used to indicate Whether the CA is running in the foreground.
  • the processing module is deployed in a secure execution environment, and is used to establish communication between the first TA and the first CA when the verification of the first scene feature information is passed.
  • the processing module includes: a judging unit configured to judge whether a pre-stored scene feature information set has a second that matches the first scene feature information Scene feature information.
  • the pre-stored scene feature information set includes multiple CAs and scene feature information corresponding to multiple operations of the multiple CAs.
  • the judgment unit includes: an acquisition subunit for traversing the scene feature information set to obtain the CA name The second scene feature information that is the same as the CA operation and the first scene feature information; a judgment subunit to determine whether the second scene feature information and the first scene feature information acquired by the acquiring unit Consistent.
  • the receiving module further includes: a receiving unit configured to receive a scene from the REE side of the general execution environment deployed on the terminal Feature information update data; an update unit for updating the scene feature information set according to the scene feature information update data received by the receiving unit.
  • the present application provides a terminal, the terminal including: a sending module for the REE to send a communication request for a first CA request to communicate with a first TA, where the communication request includes the first CA Current first scene feature information, the scene is any operation of any of the CAs, the CA name and CA operation corresponding to each of the scenes are unique; the scene feature information includes any of the following information One or more types: terminal screen touch information, terminal screen status information, and CA operation information.
  • the terminal screen touch information includes: the number of terminal screen clicks when operating the CA, the terminal screen click position, and the terminal screen click method.
  • the terminal screen status information includes: terminal screen bright screen status and terminal screen brightness value, the CA operation information is used to indicate whether the CA is running in the foreground; the control module is used to control the first CA and the first The communication state of the TA controls the current operation of the first CA.
  • control module includes: a control unit configured to allow the first CA to establish communication with the first TA if the first CA establishes communication with the first TA CA's current operation.
  • the method further includes: a receiving unit configured to receive scene feature information update data from the network side by the REE;
  • the sending unit is configured to send the scene feature information update data to the secure execution environment.
  • the present application provides a terminal on which REE and TEE are deployed.
  • the terminal includes: a processor; a memory for storing computer-executable instructions; when the processor executes the computer
  • the TEE executes the method as described in the first aspect and any possible implementation manner of the first aspect
  • the REE executes the method as described in the foregoing second aspect and any possible implementation manner of the second aspect.
  • the present application provides a terminal on which REE is deployed.
  • the terminal includes: a processor; a memory for storing computer-executable instructions; when the processor executes the computer-executable instructions At this time, the REE executes the method according to the foregoing second aspect and any possible implementation manner of the second aspect.
  • an embodiment of the present application provides a cloud server that communicates with a terminal deploying REE.
  • the cloud server includes: a cloud storage for storing an instruction program; the cloud server runs the instruction During the program, a cloud security environment is generated, and the cloud security environment executes the method of executing the first aspect and any possible implementation manner of the first aspect.
  • the present application provides a computer storage medium, which may be non-volatile.
  • the computer storage medium includes a computer program, which when executed by one or more processors implements the method provided by any one of the foregoing aspects or implementation manners.
  • this application provides a computer program or computer program product.
  • the computer program or program product includes a computer program that, when executed by one or more processors, implements the method provided by any one of the foregoing aspects or implementation manners.
  • Figure 1 is a schematic diagram of the ASLR defense method
  • FIG. 2 is a schematic diagram of the CFI defense method
  • Figure 3 is a schematic diagram of a defense method based on stack canaries
  • FIG. 4 is a schematic diagram of a terminal system deployment REE-TEE provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a terminal attack defense method provided by an embodiment of this application.
  • FIG. 6 is a schematic flowchart of another terminal attack defense method provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a terminal attack defense device according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of a communication between a cloud server and a terminal provided by an embodiment of the application.
  • the safe execution environment in this embodiment includes a trusted execution environment (trust execution environment). environment, TEE) and cloud security environment, REE generally refers to the general operating system execution environment, and the applications located in REE are ordinary customer application CAs.
  • the cloud security environment is a virtual execution environment virtualized on the network side, which can be generated by a security module or a security program.
  • TEE is an execution environment that can be deployed in a terminal with a higher security level than REE. In order to ensure the credibility of TEE itself, TEE must be verified and isolated from REE during the secure boot process.
  • the secure execution environment provides authorized security applications, that is, the security application TA, and the confidentiality, integrity, and access rights of the resources and data of the security execution environmental protection TA.
  • each TA is independent of each other and cannot access each other without authorization. Simply put, the secure execution environment has its own execution space. In the secure execution environment, there are TAs corresponding to the CAs in the REE. Each TA in the TEE also needs to be authorized and run independently of each other.
  • FIG. 4 is a schematic diagram of a terminal system deploying REE-TEE provided by the embodiment of the present application.
  • the REE side includes the CA, the perception scheduling platform and the local framework layer, and the perception module is set in the local framework layer.
  • the perception scheduling platform will collect terminal screen status information, terminal screen touch information and CA operation information.
  • the specific terminal screen status information includes: whether the screen is in a bright screen or a black screen state, whether the brightness value of the screen at the current moment has changed compared to the previous moment, etc.
  • the terminal screen touch information is the operation of the terminal screen when the user normally operates the CA, including: the number of clicks on the terminal screen, the click position of the terminal screen, and how to click the terminal screen, whether to click several times in succession, or long press within a certain time Terminal screen.
  • the CA operation information is used to indicate whether the CA is running in the foreground.
  • the perception scheduling platform collects the above scene feature information and sends it to the perception module set in the local framework layer.
  • the perception module encrypts and packages the received scene feature information and sends it to TEE.
  • TEE includes TA and TEE core service layers.
  • the TEE core service layer is provided with a perception decision module.
  • the perception decision module receives scene feature information sent by the perception module in the REE, decompresses the received scene feature information, and is pre-stored in the TEE.
  • the embodiments of the present application provide a terminal attack defense method.
  • the terminal attack defense method includes:
  • the secure execution environment receives a communication request for communication between the first CA request and the first TA, where the communication request includes current first scene feature information of the first CA.
  • the safe execution environment is TEE.
  • the first CA in the REE When the first CA in the REE is ready to start or is running, if safe operation is required in the above process, that is, when TEE support is required, the first CA will request and The first TA communicates, and the first TA is the security application corresponding to the first CA in the TEE.
  • the REE When the first CA requests to communicate with the first TA, the REE does not simply send the communication request. At this time, the REE will collect the first scene feature information corresponding to the first CA.
  • there is a presence-aware scheduling platform in the REE there is a presence-aware scheduling platform in the REE, and the sense-scheduling platform collects scene feature information corresponding to each CA in the REE when the terminal starts.
  • the perception scheduling platform when the first CA requests to communicate with the first TA, the perception scheduling platform also collects the first scene feature information under the current operation of the first CA.
  • the first scene feature information includes: terminal screen status information corresponding to the operation of the first CA, terminal screen touch information, and first CA operation information.
  • the REE sends the collected first scene feature information and the communication request to the TEE, and the TEE receives the communication request sent by the REE and carrying the first scene feature information.
  • the scene feature information in this embodiment may be one or more of terminal screen status information, terminal screen touch information and first CA operation information corresponding to the operation of the first CA. Be specific.
  • the "scene" in the scene feature information is the specific operation of the CA, such as starting the CA and entering a password during the CA operation.
  • the CA name and CA operation corresponding to the scene feature information in each determined scene are also unique.
  • the scene feature information to be obtained at this time is: the screen status information corresponding to the A payment application startup, the terminal screen touch information, and the A payment application running Information
  • the above corresponding scene feature information can be any combination, including: terminal screen touch information, terminal screen status information and terminal screen touch information combination, terminal screen status information and A payment application operation information combination, terminal screen touch information And A payment application running information combination and so on.
  • the terminal screen status information includes: whether the screen is in a bright screen or a black screen state, whether the brightness value of the screen at the current moment has changed compared to the previous moment, etc.
  • the terminal screen touch information is the operation of the terminal screen when the user normally operates the CA, including: the number of clicks on the terminal screen, the click position of the terminal screen, and how to click the terminal screen, whether to click several times in succession, or long press within a certain time Terminal screen.
  • the CA operation information is used to indicate whether the CA is running in the foreground. Therefore, the above scene feature information may also be specific to a combination of possible specific feature information contained in each scene feature information.
  • the scene feature information corresponding to the A payment application may be: click the terminal screen once, the click position is in the middle of the terminal screen, the screen status is bright, and only the A payment application is in the foreground at the current time run.
  • the above is only illustrative, there are many possible combinations, for example, some CAs may need to be clicked twice or more, and the location of each click is also different, the screen will occur between each click Changes in brightness, etc., no longer give examples.
  • the TEE After receiving the communication request for communication between the first CA request sent by the REE and the first TA, the TEE parses the communication request to obtain the first scene feature information carried in the communication request. Then obtain the CA name of the first CA and the current operation on the first CA. Traverse the set of scene feature information pre-stored in the TEE according to the CA name and CA operation of the first CA, obtain the second scene feature information with the same CA name and CA operation, and compare the first scene feature information with the second scene feature information .
  • the scene feature information set in this embodiment includes scene feature information of all CAs in different operations in the REE, and the scene feature information corresponding to different operations is independent. For example, start the A payment application, enter the payment password after the A payment application is started, modify the payment password or bind the mobile phone number and other scene feature information, start the B application, register the user information in the B application, and modify the user information in the B application Corresponding scene feature information, start the C application, set the C application unlock password, and modify the C application unlock password corresponding to the scene feature information. All of the above feature information, corresponding to the scene feature information set and the database, are separated one by one, as shown in Table 1.
  • the A, B, and C applications given in Table 1 and the scene feature information corresponding to different applications under different operations are schematic, and are part of the implementation of the technical solution of the present application.
  • a payment application start up The screen is bright and the application is running in the foreground A payment application Enter payment password
  • the screen is bright, click twice A payment application Change payment password Click twice on the screen and the corresponding position
  • a payment application Bind phone number The screen is bright, click the screen three times B application start up
  • the screen is bright and the application is running in the foreground B application Registered user information
  • the screen is bright, click twice B application Modify user information
  • the screen is bright, click the screen three times C application start up
  • the screen is bright, click the screen once C application Set unlock password
  • the screen is bright, the duration of pressing the screen C application Change unlock password Click on the screen three times and the corresponding position
  • the first CA operation is to modify the payment password. Then, TEE traverses the scene feature information set, and if the second scene feature information is found, the corresponding CA name and CA operation are A payment application and modification of the payment password, respectively. Then, the first scene feature information and the second scene feature information are compared to determine whether the first scene feature information and the second scene feature information match.
  • the matching of the first scene feature information and the second scene feature information is consistent, it indicates that the current operation corresponding to the first scene feature information is a user operation, and the communication between the first TA and the first CA is directly established.
  • TEE obtains the second scene feature information corresponding to the A payment application modifying the payment password from the scene feature information set as follows: the screen is bright and the screen jumps, and the middle screen brightness value occurs Change, tap the screen twice and click the first position of the screen for the first time and the second position for the second click. TEE is from the scene feature information set. If the first scene characteristic information is consistent with the second scene characteristic information, it is determined that the payment password is modified by the user in the A payment application. However, if the obtained first scene feature information is: the screen is bright and the screen jumps, it can be determined that the screen bright and the screen jump are simulated by hacker remote control. At this time, the A payment application and the corresponding A payment are not established Communication between applied TAs.
  • the secure execution environment is TEE.
  • the terminal attack defense method steps are the same as the above. Different from TEE, when the data transmission between REE and TEE can be realized in the terminal, but when the security execution environment is the cloud security environment, when the REE is sent to the cloud security environment, it needs to use the network for transmission and communication, so At this time, the transmitted data channel and the communication signal need to be encrypted to ensure the security of the interaction between the REE and the cloud security environment.
  • secure execution environment is not limited to the secure execution environment TEE and the remote security environment provided in the above embodiments, but can also be any other secure execution environment that can ensure the safe operation of the terminal CA.
  • CAs may change their display position on the terminal screen.
  • the click position will change.
  • the hacker attack technology is upgraded, most of the CA's operation actions can be simulated remotely.
  • the original scene feature information remains unchanged, there will be a misjudgment in the safe execution environment. Occurrence, still can not effectively prevent the hacker's probing behavior, at this time need to refine the steps of CA operation.
  • the embodiments of the present application will also update the scene feature information set in the secure execution environment.
  • the specific scene feature information update can be manual operation or machine autonomous learning, and the specific method is not limited in detail in this application.
  • the scene feature information update data can be sent to the cloud on the network side, and then the terminal can obtain it autonomously or push it manually.
  • the REE deployed in the terminal first obtains scene feature update data, completes the scene feature update of all CAs in the REE according to the scene feature update data, and then sends the scene update data to the secure execution environment.
  • the secure execution environment updates the current set of scene feature information.
  • the secure execution environment is a cloud security environment, while the REE obtains the scene feature update data, the cloud security environment may directly send the REE without sending it. Obtain.
  • the secure execution environment when the secure execution environment receives any CA request to communicate with the corresponding TA, the secure execution environment obtains scene feature information corresponding to the current CA from the communication request , And verify whether the information is legal. If it is not legal, it means that the current CA is not being operated by the user, there is a danger of hacker attack, and the communication between the CA and the TA is not established, and the CA cannot operate normally, blocking the hacker from discovering the system Exploring the vulnerability. Judging the scene feature information can effectively avoid non-user-operated hacking attacks and effectively improve the security of the system.
  • the terminal attack defense method includes:
  • the REE sends a communication request for the first CA request to communicate with the first TA, where the communication request includes the current first scene feature information of the first CA.
  • Scene feature information includes terminal screen status information, terminal screen touch information and CA operation information under different operations of different CAs.
  • the terminal screen status information includes: whether the screen is bright or black, whether the brightness value of the screen at the current moment has changed compared to the previous moment, etc.
  • the terminal screen touch information is the operation of the terminal screen when the user normally operates the CA, including: the number of clicks on the terminal screen, the click position of the terminal screen, and how to click the terminal screen, whether to click several times in succession, or long press within a certain time Terminal screen; CA operation information is used to indicate whether the CA is running in the foreground.
  • the REE packages and sends scene characteristic information corresponding to all the CAs collected under different operations to the safe execution environment.
  • the first CA in the REE is ready to start or is running. If safe operation is required during the operation, that is, when the support of the safe execution environment is required, the REE will communicate the first CA request with the first TA in the safe execution environment. The request is sent to the secure execution environment. When the first CA issues a communication request, the REE does not simply send the communication request. At this time, the REE will collect the first scene feature information corresponding to the first CA. In this embodiment, when the first CA sends a communication request, the perception scheduling platform also collects the first scene feature information.
  • the first scene feature information includes: terminal screen status information corresponding to the operation of the first CA, terminal screen touch information, and first CA operation information. The REE packages the collected first scene feature information with the communication request and sends it to the TEE.
  • S202 Control the current operation of the first CA according to the communication status of the first CA and the first TA.
  • the secure execution environment establishes communication between the first CA and the first TA.
  • the REE learns that the first CA has successfully established communication with the first TA, and then allows the current operation of the first CA.
  • the current operation of the first CA is an operation behavior generated by hacker remote control, and the REE terminates the current operation of the first CA.
  • the A payment application if the A payment application is started, if the A payment application successfully establishes communication with the corresponding TA in the secure execution environment, the A payment application is allowed to start. Otherwise, the A payment application flashes back or closes directly and cannot be started normally. If the A payment application is running, you need to jump to the interface to modify the payment password. If the A payment application successfully establishes communication with the corresponding TA in the secure execution environment, the page will be successfully jumped to enter the next step. However, if the A payment application fails to establish communication with the corresponding TA in the secure execution environment, there may be a danger of a hacker remotely tampering the user's payment password, and the page jump fails, and the operation of modifying the payment password cannot be performed. Or, in order to avoid repeated remote control by the hacker, directly control the A payment application to stop running, so that the hacker cannot find the A payment application for remote operation.
  • the terminal may have system updates, the addition of new CAs, and the uninstallation of old CAs, some CAs may change their display position on the terminal screen.
  • the click position will change.
  • the hacker attack technology is upgraded, most of the CA's operation actions can be simulated remotely.
  • the original scene feature information remains unchanged, there will be a misjudgment in the safe execution environment. Occurred, still can not effectively prevent the hacker's probing behavior, at this time need to refine the steps of the CA operation, update the scene feature information set in the safe execution environment.
  • the specific scene feature information update can be manual operation or machine autonomous learning, and the specific method is not limited in detail in this application.
  • the scene feature information update data can be sent to the cloud on the network side, and then the terminal can obtain it autonomously or push it manually.
  • the REE first obtains scene feature update data, completes the scene feature update of all CAs in the REE according to the scene feature update data, and then sends the scene update data to the safe execution environment.
  • the security execution environment is a cloud security environment
  • the REE obtains scene feature update data the cloud security environment may directly obtain the data without sending the REE.
  • the REE collects scene feature information corresponding to all CAs and sends them to the secure execution environment.
  • the CA in the REE needs to establish communication with the corresponding TA in the safe execution environment during normal operation startup or operation.
  • the REE obtains scene feature information corresponding to the current CA, and sends the scene feature information corresponding to the current CA to the secure execution environment together with the communication request.
  • the secure execution environment cannot find the matching scene feature information in the scene feature information set, it indicates that the current CA is a non-user operation, there is a danger of hacker attack, the communication between the CA and the TA is not established, and the CA cannot operate normally, Blocked the hackers' attempts to discover system vulnerabilities. Judging the scene feature information can effectively avoid non-user-operated hacking attacks and effectively improve the security of the system.
  • the present application also provides an embodiment of a terminal attack defense device.
  • the terminal attack defense device 30 includes: a receiving module 301 and a processing module 302.
  • the receiving module 301 is deployed in a secure execution environment for receiving a communication request for communication between the first client application CA and the first secure application TA.
  • the secure execution environment includes any one of the trusted execution environment TEE and the cloud security environment Or two, the communication request contains the current first scene feature information of the first CA; wherein, the scene feature information includes any one or more of the following information: terminal screen touch information, terminal screen status information And CA operation information, the terminal screen touch information includes any one or more of the following information: the number of terminal screen clicks when operating the CA, the terminal screen click position and terminal screen click method, and the terminal screen status information It includes any one or more of the following information: the terminal screen bright state and the terminal screen brightness value, and the CA operation information is used to indicate whether the CA is running in the foreground.
  • the processing module 302 is deployed in a secure execution environment and is used to establish communication between the first TA and the first CA when the verification of the first scene feature information is passed.
  • the processing module 302 includes a judgment unit for judging whether the pre-stored scene feature information set has second scene feature information matching the first scene feature information, and the pre-stored scene feature information set contains multiple Scene characteristics information corresponding to multiple CAs and multiple operations of the multiple CAs.
  • the judgment unit includes: an acquisition subunit and a judgment subunit.
  • the receiving module 301 in the embodiment of the present application further includes a receiving unit and an updating unit.
  • the receiving unit is configured to receive scene feature information update data from the general execution environment REE side deployed on the terminal.
  • the update unit is configured to update the scene feature information set according to the scene feature information update data received by the receiving unit.
  • the terminal 40 includes: a sending module 401 and a control module 402.
  • the sending module 401 is used for the REE to send a first CA request to communicate with a first TA, and the communication request includes the current first scene feature information of the first CA.
  • the CA name and CA operation corresponding to each of the scenes are unique;
  • the scene feature information includes any one or more of the following information: terminal screen touch information, terminal screen status information and CA operation information, the terminal screen touch information includes: the number of terminal screen clicks, the terminal screen click position and the terminal screen click method when the CA is operated, and the terminal screen state information includes: terminal screen bright screen state and terminal screen brightness Value, the CA operation information is used to indicate whether the CA is running in the foreground.
  • the control module 402 is configured to control the current operation of the first CA according to the communication status of the first CA and the first TA.
  • control module 402 includes a control unit for allowing the current operation of the first CA if the first CA establishes communication with the first TA.
  • the terminal attack defense device 40 provided in this embodiment further includes: a receiving unit and a sending unit.
  • the receiving unit is used by the REE to receive scene characteristic information update data from the network side.
  • the sending unit is used to send scene feature information update data to the receiving module 301 deployed in the secure execution environment.
  • an embodiment of the present application further provides a terminal.
  • REE and TEE are deployed on the terminal 50.
  • the terminal 50 includes a processor 501, a memory 502, and a communication interface 503.
  • the memory 502 is used to store computer executable instructions, and when the processor 501 executes the computer executable instructions,
  • the TEE performs the following operations: receiving a communication request for communication between the first CA request and the first TA, the communication request including the current first scene feature information of the first CA; determining whether a pre-stored scene feature information set exists with the Second scene feature information matching the first scene feature information, the pre-stored scene feature information set includes scene feature information corresponding to all CAs; if there is a match in the scene feature information set with the first scene feature information The second scene feature information, the TEE establishes communication between the first TA and the first CA.
  • the REE performs the following operations: the REE sends a first CA request to communicate with the first TA, and the communication request includes the current first scene feature information of the first CA; according to the first CA and the The communication state of the first TA controls the current operation of the first CA.
  • the processor 501, the memory 502, and the communication interface 503 may be connected to each other through a bus; the bus may be divided into an address bus, a data bus, and a control bus. For ease of representation, only a thick line is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.
  • the processor 501 may be a general-purpose processor, for example, a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP), or a combination of CPU and NP.
  • the processor 401 may also be a microprocessor (MCU).
  • the processor 501 may also include a hardware chip.
  • the above-mentioned hardware chip may be an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the above PLD may be a complex programmable logic device (CPLD), a field programmable logic gate array (FPGA), etc.
  • the memory 502 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable and removable Programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM erasable and removable Programmable read only memory
  • PROM programmable read only memory
  • ROM read only memory
  • magnetic memory magnetic memory
  • flash memory magnetic disk or optical disk.
  • the communication interface 503 is used by the REE to receive scene feature information update data sent by the network side.
  • the communication interface 503 includes a wired communication interface, and may also include a wireless communication interface.
  • the wired communication interface includes a data interface, and may also include an Ethernet interface.
  • the wireless communication interface may be a WLAN interface, a cellular network communication interface, or a combination thereof.
  • the terminal 50 may also include a power supply component for supplying power to various components of the terminal 50.
  • the power supply component may include a power management system and one or more power supplies.
  • an embodiment of the present application further provides a computer storage medium, where the computer storage medium may store an instruction, and when the instruction is executed, it may include some or all of the embodiments of the terminal attack defense method provided by the present application step.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (read-only memory, ROM) or a random access memory (random access memory, RAM), etc.
  • a cloud server 60 communicates with a terminal 70 deploying REE.
  • the cloud server 60 includes a cloud storage 601 for storing instruction programs.
  • a cloud security environment is generated, and the cloud security environment performs the following steps:
  • the terminal 70 includes a processor 701 and a memory 702, where the memory 702 is used to store computer-executable instructions.
  • the processor 701 executes the computer-executable instructions
  • the REE performs the following steps:
  • the REE sends a communication request for the first CA request to communicate with the first TA, where the communication request includes the current first scene feature information of the first CA; the current status of the first CA is controlled according to the communication status of the first CA and the first TA operating.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computing Systems (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Finance (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)
  • User Interface Of Digital Computer (AREA)

Abstract

本申请公开了一种终端攻击防御方法、装置、终端及云服务器，在CA和TA进行通信之前，由安全执行环境，例如TEE,验证当期CA操作对应的场景特征信息，例如屏幕点击信息，由此确定是用户的真实操作还是黑客的攻击行为，若是黑客的攻击行为，则不会有屏幕点击信息。若存在黑客攻击的危险，就不建立CA与TA之间的通信，进而CA无法正常运行，阻断了黑客为发现系统漏洞发起的试探。

Description

终端攻击防御方法、装置、终端及云服务器
本申请要求在2018年10月12日提交中国专利局、申请号201811188595.2、发明名称为“终端攻击防御方法、装置、终端及云服务器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术，尤其涉及一种攻击防御技术、以及应用该攻击防御技术的多种计算机设备。
背景技术
黑客攻击，简单地说，就是黑客发现终端系统或网络的缺陷，针对这些缺陷实施攻击的技术。这里说的缺陷，包括软件缺陷、硬件缺陷、网络协议缺陷和管理缺陷等。
传统技术中为了防御黑客的攻击，一般有以下几种防御方法：地址空间布局随机化(address apace layout randomization，ASLR)防御方法，如图1所示，ASLR防御方法通过一个随机地址发生器将原来栈上的内存地址变成随机化地址，当黑客发现一个栈溢出漏洞时，查找对应栈的地址，植入黑客代码，但是当终端重启后，栈地址发生变化，使得黑客攻击失败。控制流完整性(control flow integrity，CFI)防御方法，如图2所示，CFI防御方法会对运行的程序进行解析，在程序运行时将程序执行的间接转移指令与预先获取的间接转移指令白名单进行对比，如果解析出的间接转移指令不在白名单中，则确定发生了攻击，终止程序运行。基于栈金丝雀的防御方法，如图3所示，该方法在初始栈上预设一个校验用的金丝雀，当黑客发现栈溢出漏洞，植入黑客代码后金丝雀就会发生变化。当程序运行前检查金丝雀，从而防止了黑客恶意代码的执行。
然而黑客一般在实施真正攻击前，需要对终端系统进行反复的试探，才能发现系统漏洞，根据发现的系统漏洞对终端系统进行攻击。但是上述传统的黑客攻击防御方法都是在黑客已经发现系统漏洞进行恶意攻击时进行直接防御，无法阻止黑客提前为发现系统漏洞而进行的反复试探。
发明内容
本申请提供了一种终端攻击防御方法、装置、终端及云服务器，以解决传统的黑客攻击防御方法无阻止黑客反复试探，从而发现系统漏洞的问题。
第一方面，本申请提供了一种终端攻击防御方法，所述方法包括：安全执行环境接收第一CA请求与第一TA通信的通信请求，所述安全执行环境包括可信执行环境TEE和云端安全环境中的任意一个或两个，所述通信请求中包含所述第一CA当前的第一场景特征信息。场景为任一CA的任一操作，每个场景对应的CA名称和CA操作是唯一的。所述场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以 下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行。当所述安全执行环境对所述第一场景特征信息验证通过时,所述安全执行环境建立所述第一TA与所述第一CA之间的通信。
所述安全执行环境判断所述第一场景特征信息是否合法，示例性地，判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含所有CA对应的场景特征信息，如果所述场景特征信息集合中存在与所述第一场景特征信息相匹配的所述第二场景特征信息，则认为合法。若所述第一场景特征信息被验证通过，则所述安全执行环境建立所述第一TA与所述第一CA之间的通信。
采用本实现方式，当安全执行环境接收到任一CA请求与对应TA通信的通信请求时，安全执行环境从通信请求中获取当前CA对应的场景特征信息，并验证该信息是否合法，若不合法，则表明当前CA不是用户在操作，存在黑客攻击的危险，不建立CA与TA之间的通信，进而CA无法正常运行，阻断了黑客为发现系统漏洞发起的试探。通过对场景特征信息的判断能够有效避免非用户操作的黑客攻击行为，有效提升系统的安全性。
结合第一方面，则第一方面第一种可能的实现方式中，所述安全执行环境验证所述第一场景特征信息包括：所述安全执行环境判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含多个CA和所述多个CA的多种操作对应的场景特征信息。
结合第一方面第一种可能的实现方式，在第一方面第二种可能的实现方式中，所述安全执行环境判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，包括：遍历所述场景特征信息集合，以获得所述CA名称和所述CA操作与所述第一场景特征信息相同的所述第二场景特征信息；判断所述第二场景特征信息与所述第一场景特征信息是否一致。
结合第一方面第一或二种可能的实现方式，在第一方面第三种可能的实现方式中，还包括：所述安全执行环境从REE侧接收场景特征信息更新数据；根据所述场景特征信息更新数据更新所述场景特征信息集合。第二方面，本申请提供了一种终端攻击防御方法，所述终端上部署有REE，所述方法包括：所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息，其中，场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行；根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作。
结合第二方面，在第二方面第一种可能的实现方式中，所述根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作，包括：如果所述第一CA与所述第一TA建立通信，则允许所述第一CA的当前操作。
结合第二方面或第二方面第一种可能的实现方式，在第二方面第二种可能的实现方式中，还包括：所述REE从网络侧接收场景特征信息更新数据；将所述场景特征信息更新数据发送给所述安全执行环境。
第三方面，本申请提供了一种终端攻击防御装置，所述装置包括：接收模块，部署在安全执行环境中，用于接收第一客户应用CA请求与第一安全应用TA通信的通信请求，所述安全执行环境包括可信执行环境TEE和云端安全环境中的任意一个或两个，所述通信请求中包含所述第一CA当前的第一场景特征信息；其中，场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行。处理模块，部署在安全执行环境中，用于当所述第一场景特征信息验证通过时,建立所述第一TA与所述第一CA之间的通信。
结合第三方面，在第三方面第一种可能的实现方式中，所述处理模块包括：判断单元，用于判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含多个CA和所述多个CA的多种操作对应的场景特征信息。
结合第三方面第一种可能的实现，在第三方面第二种可能的实现方式中，所述判断单元包括：获取子单元，用于遍历所述场景特征信息集合，以获得所述CA名称和所述CA操作与所述第一场景特征信息相同的所述第二场景特征信息；判断子单元，判断所述获取单元获取的所述第二场景特征信息与所述第一场景特征信息是否一致。
结合第三方面第一或二种可能的实现，在第三方面第三种可能的实现方式中，所述接收模块还包括：接收单元，用于从终端上部署的通用执行环境REE侧接收场景特征信息更新数据；更新单元，用于根据所述接收单元接收的所述场景特征信息更新数据更新所述场景特征信息集合。
第四方面，本申请提供了一种终端，所述终端包括：发送模块，用于所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息，所述场景为任一所述CA的任一操作，每个所述场景对应的CA名称和CA操作是唯一的；所述场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行；控制模块，用于根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作。
结合第四方面，在第四方面第一种可能的实现方式中，所述控制模块包括：控制单元，用于如果所述第一CA与所述第一TA建立通信，则允许所述第一CA的当前操作。
结合第四方面或第四方面第一种可能的实现方式，在第四方面第二种可能的实现方式中，还包括：接收单元，用于所述REE从网络侧接收场景特征信息更新数据；发送单元，用于将所述场景特征信息更新数据发送给所述安全执行环境。
第五方面，本申请提供了一种终端，所述终端上部署有REE和TEE，所述终端包括：处理器；存储器，用于存储计算机可执行指令；当所述处理器执行所述计算机可执行指令时，所述TEE执行如前述第一方面及第一方面任一种可能的实现方式的方法，所述REE执行如前述第二方面及第二方面任一种可能的实现方式的方法。
第六方面，本申请提供了一种终端，所述终端上部署有REE，所述终端包括：处理器；存储器，用于存储计算机可执行指令；当所述处理器执行所述计算机可执行指令时，所述REE执行如前述第二方面及第二方面任一种可能的实现方式的方法。
第七方面，本申请实施例提供了一种云服务器，所述云服务器与部署REE的终端通信，所述云服务器包括：云存储器，用于存储指令程序；所述云服务器内运行所述指令程序时，生成云端安全环境，所述云端安全环境执行执行如前述第一方面及第一方面任一种可能的实现方式的方法。
第八方面，本申请提供一种计算机存储介质，可以是非易失性的。该计算机存储介质中包括计算机程序，该计算机程序在被一个或多个处理器执行时实现前述任意一个方面或实现方式所提供的方法。
第九方面，本申请提供一种计算机程序或计算机程序产品。该计算机程序或程序产品中包括计算机程序，该计算机程序在被一个或多个处理器执行时实现前述任意一个方面或实现方式所提供的方法。
附图说明
为了更清楚地说明本申请的技术方案，下面将对实施例中所需要使用的附图作简单地介绍。
图1为ASLR防御方法示意图；
图2为CFI防御方法示意图；
图3为基于栈金丝雀的防御方法示意图；
图4为本申请实施例提供的终端系统部署REE-TEE的构架图；
图5为本申请实施例提供的一种终端攻击防御方法的流程示意图；
图6为本申请实施例提供的另一种终端攻击防御方法的流程示意图；
图7为本申请实施例提供的一种终端攻击防御装置的结构示意图；
图8为本申请实施例提供的一种终端的结构示意图；
图9为本申请实施例提供的一种终端的结构示意图；
图10为申请实施例提供的一种云服务器与终端通信的示意图。
具体实施方式
为了使本技术领域的人员更好地理解本申请实施例中的技术方案，下面结合附图对本申请实施例中技术方案作进一步详细的说明。
为了能够更好的对本申请实施例提供的技术方案进行说明，首先说明一下安全执行环境和通用执行环境(rich execution environment，REE)，本实施例中的安全执行环境包括可信执行环境(trust execution environment,TEE)和云端安全环境，REE一般指通用的操作系统执行环境，位于REE中应用程序为普通的客户应用CA。云端安全环境为在网络侧虚拟一个安全执行环境，可以通过安全模块或安全程序生成。TEE为可以部署在终端相比REE安全级别更高的执行环境，为了保证TEE自身的可信性，TEE在安全启动过程中要通过验证并且与REE隔离。安全执行环境提供了授权安全应用，也就是安全应用TA，安全执行环境保护TA的资源和数据的保密性、完整性和访问权限。在安全执行环境中，每个TA是相互独立的，而且不能在未授权的情况下相互访问。简单的说，安全执行环境具有其 自身的执行空间，在安全执行环境中有与REE中的CA对应的TA，TEE里的每一个TA也需要授权并相互独立运行。
当本申请实施例是基于终端系统同时部署有REE和TEE，参见图4为本申请实施例提供的一种终端系统部署REE-TEE的构架图。REE侧包括CA、感知调度平台和本地框架层，本地框架层内设置感知模块。终端启动时，感知调度平台会进行采集终端屏幕状态信息、终端屏幕触碰信息和CA运行信息。具体的终端屏幕状态信息包括：屏幕是处于亮屏还是处于黑屏状态、屏幕当前时刻的亮度值相比前一时刻是否发生变化等。终端屏幕触碰信息为用户正常操作CA时对终端屏幕的操作，包括：终端屏幕的点击次数、终端屏幕的点击位置和如何点击终端屏幕，是连续点击数次，还是在一定的时间内长按终端屏幕。CA运行信息则是用于指示CA是否在前台运行。
感知调度平台采集到上述场景特征信息后会发送给设置在本地框架层内的感知模块，感知模块将接收到的场景特征信息进行加密打包发送给TEE。具体地，TEE包括TA和TEE核心服务层。本实施例中的TEE核心服务层内设置有感知决策模块，感知决策模块接收REE中感知模块发送的场景特征信息，并将接收到的场景特征信息进行解压，预存在TEE内。
需要指出的是，上述给出的REE-TEE的构架图只是示意性的，在实际平台实现时，还需要更多的服务组件，例如驱动组件、接口组件等，在本实施例中不做过多描述。
由上述可知，在TEE中有与REE中的CA对应的TA，当REE侧任一CA启动或运行中需要安全操作时，需要请求与TEE中对应的TA建立通信，当CA与TA建立通信成功后，REE才会允许CA正常运行。但是并不是所有的通信请求都是正常的通信请求，在网络环境下会存在少量黑客远程试探产生的通信请求。因此，只有保证CA启动或运行中的操作为用户操作产生的，才能保证当前的通信请求不是黑客远程试探控制生成的。鉴于此，本申请实施例提供了一种终端攻击防御方法。参见图5，所述终端攻击防御方法包括：
S101,安全执行环境接收第一CA请求与第一TA通信的通信请求，所述通信请求中包含第一CA当前的第一场景特征信息。
本实施例中的安全执行环境为TEE，位于REE中的第一CA准备启动运行或正在运行中时，如果在上述过程中需要安全操作，即需要TEE的支持时，第一CA则会请求与第一TA进行通信，第一TA即为在TEE中与第一CA对应的安全应用。当第一CA请求与第一TA进行通信时，REE并不是简单的将通信请求进行发送，此时REE会采集第一CA对应的第一场景特征信息。由上述可知，在本实施例提供的REE-TEE构架中，REE中的存在感知调度平台，感知调度平台在终端启动时对REE中的每个CA对应的场景特征信息进行了采集。本实施例中，当第一CA请求与第一TA进行通信时，感知调度平台也会采集第一CA当前操作下的第一场景特征信息。第一场景特征信息包括：操作第一CA时对应的终端屏幕状态信息、终端屏幕触碰信息和第一CA运行信息。REE将采集到的第一场景特征信息与通信请求一并发送给TEE，TEE接收REE发送的携带第一场景特征信息的通信请求。
需要指出的是，本实施例中的场景特征信息可以为操作第一CA时对应的终端屏幕状态信息、终端屏幕触碰信息和第一CA运行信息中一种或多种，对此本申请不做具体限定。而且场景特征信息中的“场景”为CA的具体操作，例如启动CA、CA运行中输入密码等。而且每个确定的场景下的场景特征信息对应的CA名称和CA操作也是唯一的。比如A支付应用启动，则CA名称为A支付应用，CA操作为启动，因此此时要获取的场景特征信息为： A支付应用启动对应的屏幕状态信息、终端屏幕触碰信息和A支付应用运行信息，以上对应的场景特征信息可以为任意组合，包括：终端屏幕触碰信息，终端屏幕状态信息和终端屏幕触碰信息组合、终端屏幕状态信息和A支付应用运行信息组合、终端屏幕触碰信息和A支付应用运行信息组合等等。
具体地，由于终端屏幕状态信息包括：屏幕是处于亮屏还是处于黑屏状态、屏幕当前时刻的亮度值相比前一时刻是否发生变化等。终端屏幕触碰信息为用户正常操作CA时对终端屏幕的操作，包括：终端屏幕的点击次数、终端屏幕的点击位置和如何点击终端屏幕，是连续点击数次，还是在一定的时间内长按终端屏幕。CA运行信息则是用于指示CA是否在前台运行。因此上述场景特征信息也可以具体到每个场景特征信息包含的可能具体特征信息的组合。同样以A支付应用启动为例，A支付应用对应的场景特征信息可能为：点击终端屏幕1次，点击位置在终端屏幕的中间位置，屏幕状态为亮屏状态，当前时刻只有A支付应用在前台运行。当然，以上只是示意性的，可能的组合有很多种，比如某些CA启动时可能需要点击2次或更多，而且每次点击的位置也是不一样的，在每次点击之间屏幕会发生亮度变化等，具体不再一一举例。
S102,当安全执行环境对场景特征信息验证通过时,安全执行环境建立所述第一TA与所述第一CA之间的通信。
当TEE接收到REE发送的第一CA请求与第一TA通信的通信请求后，解析所述通信请求，获取通信请求携带的第一场景特征信息。然后获取第一CA的CA名称和当前对第一CA的操作。按照第一CA的CA名称和CA操作遍历预存在TEE中的场景特征信息集合，获取CA名称和CA操作一致的第二场景特征信息，将第一场景特征信息与第二场景特征信息进行比对。
本实施例中的场景特征信息集合包含了REE中所有CA不同操作下的场景特征信息，而且不同操作对应的场景特征信息是独立的。例如，启动A支付应用、A支付应用启动后输入支付密码、修改支付密码或绑定手机号等操作对应的场景特征信息，启动B应用、在B应用注册用户信息、在B应用中修改用户信息对应的场景特征信息，启动C应用、设置C应用的解锁密码、修改C应用的解锁密码对应的在场景特征信息。上述所有的特征信息，对应到场景特征信息集合对应到数据库是分别一条条独立出来的，如表1所示。表1中给出的A、B和C应用以及不同应用在不同操作下对应的场景特征信息都是示意性的，为本申请技术方案实现的一部分。
表1场景特征信息集合数据库
应用名称 应用操作 场景特征信息
A支付应用 启动 屏幕亮屏，应用前台运行
A支付应用 输入支付密码 屏幕亮屏，点击两次屏幕
A支付应用 修改支付密码 点击两次屏幕及对应位置
A支付应用 绑定手机号 屏幕亮屏，点击三次屏幕
B应用 启动 屏幕亮屏，应用前台运行
B应用 注册用户信息 屏幕亮屏，点击两次屏幕
B应用 修改用户信息 屏幕亮屏，点击三次屏幕
C应用 启动 屏幕亮屏，点击一次屏幕
C应用 设置解锁密码 屏幕亮屏，按压屏幕时长
C应用 修改解锁密码 点击三次屏幕及对应位置
如果第一场场景特征信息对应的第一CA名称为A支付应用，第一CA操作为修改支付密码。则TEE遍历场景特征信息集合，如果找到了第二场景特征信息对应CA名称和CA操作分别为A支付应用、修改支付密码。则将第一场景特征信息和第二场景特征信息进行比对，以确定第一场景特征信息和第二场景特征信息是否匹配。
如果第一场景特征信息和第二场景特征信息匹配是一致的，则表明当前对应第一场景特征信息的操作为用户操作，直接建立第一TA与第一CA的通信。
一示意性举例，比如A支付应用修改支付密码，TEE从场景特征信息集合中获取到A支付应用修改支付密码对应的第二场景特征信息为：屏幕亮屏且屏幕发生跳转中间屏幕亮度值发生变化、点击屏幕两次且第一次点击屏幕的第一位置、第二次点击的第二位置。TEE从场景特征信息集合中。如果第一场景特征信息与第二场景特征信息一致，则确定此前在A支付应用修改支付密码为用户操作。但是如果获取到的第一场景特征信息为：屏幕亮屏且屏幕发生跳转，则可以确定屏幕亮屏和屏幕发生跳转为黑客远程控制模拟的，此时不建立A支付应用与对应A支付应用的TA之间的通信。
上述是针对安全执行环境为TEE，当安全执行环境为云端安全环境时，终端攻击防御方法步骤与上述是一致的。与TEE不同的是，当REE与TEE进行数据传输时，在终端内就可以实现，但是当安全执行环境为云端安全环境时，REE发送给云端安全环境时，需要借助网络进行传输和通信，因此此时需要对传输的数据通道和通信的信号进行加密，以保证REE与云端安全环境交互的安全性。
需要指出的是，安全执行环境并不仅限于上述实施例提供的安全执行环境TEE和远端安全环境，也可以为其他可以实现保证终端CA安全操作的任意安全执行环境。
由于终端可能会存在系统更新、新CA的添加、旧CA的卸载导致某些CA在终端屏幕显示位置发生变化，此时控制对应CA启动时，点击位置会发生变化。尤其考虑一种特殊情况，如果黑客攻击技术升级，导致可以远程模拟出大部分CA的操作动作，此时如果保持原有场景特征信息不变，则在安全执行环境中就会有误判的情况发生，仍然不能有效防止黑客的试探行为，此时需要对CA操作的步骤进行细化。综上所述，本申请实施例还会对安全执行环境中的场景特征信息集合进行更新。
具体的场景特征信息更新，可以为人工操作或机器自主学习，具体方式本申请不做详细限定。场景特征信息更新数据可以发送到网络侧云端，然后终端自主获取或人工推送。部署在终端中的REE首先获取场景特征更新数据，根据场景特征更新数据完成REE中所有CA的场景特征更新，然后将场景更新数据发送给安全执行环境。安全执行环境接收到场景特征信息后，更新当前的场景特征信息集合，其中当安全执行环境为云端安全环境时，REE获取场景特征更新数据的同时，云端安全环境可以不需要REE的发送，直接进行获取。
由上述实施例可知，本实施例提供的终端攻击防御方法中当安全执行环境接收到任一CA请求与对应TA通信的通信请求时，安全执行环境从通信请求中获取当前CA对应的场景特征信息，并验证该信息是否合法，若不合法，则表明当前CA不是用户在操作，存在黑客攻击的危险，不建立CA与TA之间的通信，进而CA无法正常运行，阻断了黑客为发现系统漏洞发起的试探。通过对场景特征信息的判断能够有效避免非用户操作的黑客攻击行为，有效提升系统的安全性。
参见图6，为本申请实施例提供的另一种终端攻击防御方法，所述终端攻击防御方法包括：
S201,REE发送第一CA请求与第一TA通信的通信请求，通信请求中包含第一CA当前的第一场景特征信息。
终端启动时，REE中的感知调度平台会对REE中所有CA的场景特征信息进行采集。场景特征信息包括不同CA不同操作下的终端屏幕状态信息、终端屏幕触碰信息和CA运行信息。终端屏幕状态信息包括：屏幕是处于亮屏还是处于黑屏状态、屏幕当前时刻的亮度值相比前一时刻是否发生变化等。终端屏幕触碰信息为用户正常操作CA时对终端屏幕的操作，包括：终端屏幕的点击次数、终端屏幕的点击位置和如何点击终端屏幕，是连续点击数次，还是在一定的时间内长按终端屏幕；CA运行信息则是用于指示CA是否在前台运行。REE将上述采集的所有CA在不同操作下对应的场景特征信息打包发送给安全执行环境。
REE中的第一CA准备启动运行或正在运行中，如果运行过程中需要安全操作，即需要安全执行环境的支持时，REE则将第一CA请求与安全执行环境中第一TA进行通信的通信请求发送给安全执行环境。当第一CA发出通信请求时，REE并不是简单的将通信请求进行发送，此时REE会采集第一CA对应的第一场景特征信息。本实施例中，当第一CA发出通信请求的同时，感知调度平台也会采集第一场景特征信息。第一场景特征信息包括：操作第一CA时对应的终端屏幕状态信息、终端屏幕触碰信息和第一CA运行信息。REE将采集到的第一场景特征信息与通信请求进行打包，发送给TEE。
S202,根据第一CA与第一TA的通信状态控制第一CA当前操作。
如果在安全执行环境中预存的场景特征信息集合中遍历到与第一CA场景特征信息对应的CA名称和CA操作一致的第二场景特征信息，且第一场景特征信息与第二场景特征信息进行比对后，第一场景特征信息与第二场景特征信息相匹配，则安全执行环境建立第一CA与第一TA的通信。此时REE获知第一CA与第一TA成功建立通信，则允许第一CA的当前操作。对应地，如果第一CA与第一TA建立通信失败，则第一CA当前的操作为黑客远程控制产生的操作行为，则REE终止当前第一CA的运行。
示意性举例，如果是A支付应用启动，如果A支付应用与安全执行环境中对应的TA成功建立通信，则允许A支付应用启动。否则，A支付应用直接闪退或关闭，无法正常启 动。如果是A支付应用运行中，需要跳转到修改支付密码界面，如果A支付应用与安全执行环境中对应的TA成功建立通信，则顺利跳转页面，进入下一步操作。但是A支付应用与安全执行环境中对应的TA建立通信失败，则可能存在黑客远程篡改用户支付密码的危险，则跳转页面失败，无法进行修改支付密码的操作。或者，为了避免黑客反复的远程控制，直接控制A支付应用终止运行，使得黑客找不到A支付应用进行远程操作。
同样地，由于终端可能会存在系统更新、新CA的添加、旧CA的卸载导致某些CA在终端屏幕显示位置发生变化，此时控制对应CA启动时，点击位置会发生变化。尤其考虑一种特殊情况，如果黑客攻击技术升级，导致可以远程模拟出大部分CA的操作动作，此时如果保持原有场景特征信息不变，则在安全执行环境中就会有误判的情况发生，仍然不能有效防止黑客的试探行为，此时需要对CA操作的步骤进行细化，对安全执行环境中的场景特征信息集合进行更新。
具体的场景特征信息更新，可以为人工操作或机器自主学习，具体方式本申请不做详细限定。场景特征信息更新数据可以发送到网络侧云端，然后终端自主获取或人工推送。REE首先获取场景特征更新数据，根据场景特征更新数据完成REE中所有CA的场景特征更新，然后将场景更新数据发送给安全执行环境。其中当安全执行环境为云端安全环境时，REE获取场景特征更新数据的同时，云端安全环境可以不需要REE的发送，直接进行获取。
由上述实施例可知，终端启动时，REE采集所有CA对应的场景特征信息发送给安全执行环境，REE中的CA正常运行启动或运行过程中需要与安全执行环境中对应TA建立通信。当REE中任一CA需要与安全执行环境中对应的TA建立通信时，REE获取取当前CA对应的场景特征信息，将当前CA对应的场景特征信息与通信请求一起发送给安全执行环境。如果安全执行环境在场景特征信息集合中找不到相匹配的场景特征信息，则表明当前CA是非用户操作，存在黑客攻击的危险，不建立CA与TA之间的通信，进而CA无法正常运行，阻断了黑客为发现系统漏洞发起的试探。通过对场景特征信息的判断能够有效避免非用户操作的黑客攻击行为，有效提升系统的安全性。
与图5所示的终端攻击防御方法相对应，本申请还提供了一种终端攻击防御装置的实施例。参见图7，终端攻击防御装置30包括：接收模块301和处理模块302。
接收模块301，部署在安全执行环境中，用于接收第一客户应用CA请求与第一安全应用TA通信的通信请求，所述安全执行环境包括可信执行环境TEE和云端安全环境中的任意一个或两个，所述通信请求中包含所述第一CA当前的第一场景特征信息；其中，场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行。
处理模块302，部署在安全执行环境中，用于当所述第一场景特征信息验证通过时,建立所述第一TA与所述第一CA之间的通信。
可选地，处理模块302包括：判断单元，用于判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含多个CA和所述多个CA的多种操作对应的场景特征信息。
判断单元包括：获取子单元和判断子单元。获取子单元，用于遍历所述场景特征信息集合，以获得所述CA名称和所述CA操作与所述第一场景特征信息相同的所述第二场景特征信息；判断子单元，判断所述获取单元获取的所述第二场景特征信息与所述第一场景特征信息是否一致。
可选地，本申请实施例中的接收模块301还包括接收单元和更新单元，接收单元，用于从终端上部署的通用执行环境REE侧接收场景特征信息更新数据。更新单元，用于根据接收单元接收的场景特征信息更新数据更新场景特征信息集合。
与图6所示的终端攻击防御方法相对应，本申请还提供了另一种终端的实施例。参见图8，终端40包括：发送模块401和控制模块402。
发送模块401，用于所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息，所述场景为任一所述CA的任一操作，每个所述场景对应的CA名称和CA操作是唯一的；所述场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行。控制模块402，用于根据第一CA与第一TA的通信状态控制第一CA当前操作。
可选地，控制模块402包括：控制单元，用于如果第一CA与第一TA建立通信，则允许第一CA的当前操作。
可选地，本实施例提供的终端攻击防御装置40还包括：接收单元和发送单元。接收单元，用于REE从网络侧接收场景特征信息更新数据。发送单元，用于将场景特征信息更新数据发送给部署在安全执行环境中的接收模块301。
参见图9，本申请实施例还提供了一种终端，终端50上部署有REE和TEE，终端50包括：处理器501、存储器502和通信接口503。
存储器502，用于存储计算机可执行指令，当处理器501执行所述计算机可执行指令时，
TEE执行以下操作：接收第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息；判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含所有CA对应的场景特征信息；如果所述场景特征信息集合中存在与所述第一场景特征信息相匹配的所述第二场景特征信息，则所述TEE建立所述第一TA与所述第一CA之间的通信。
REE执行以下操作：所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息；根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作。
处理器501、存储器502和通信接口503可以通过总线相互连接；总线可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器501可以是通用处理器，例如，中央处理器(英文：central processing unit，缩写：CPU)，网络处理器(英文：network processor，缩写：NP)或者CPU和NP的组合。 处理器401也可以是微处理器(MCU)。处理器501还可以包括硬件芯片。上述硬件芯片可以是专用集成电路(ASIC)，可编程逻辑器件(PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(CPLD)，现场可编程逻辑门阵列(FPGA)等。
存储器502可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
通信接口503用于REE接收网络侧发送的场景特征信息更新数据。所述通信接口503包括有线通信接口，还可以包括无线通信接口。其中，有线通信接口包括数据接口，还可以包括以太网接口。无线通信接口可以为WLAN接口，蜂窝网络通信接口或其组合等。
终端50还可以包括电源组件，用于为终端50的各种组件提供电力。电源组件可以包括电源管理系统，一个或多个电源。具体实现中，本申请实施例还提供一种计算机存储介质，其中，该计算机存储介质可存储有指令，该指令执行时可包括本申请提供的终端攻击防御方法的各实施例中的部分或全部步骤。所述的存储介质可为磁碟、光盘、只读存储记忆体(read-only memory，ROM)或随机存储记忆体(random access memory，RAM)等。
参见图10，一种云服务器60，云服务器60与部署REE的终端70通信，云服务器60包括：云存储器601，用于存储指令程序。
云服务器60内运行所述指令程序时，生成云端安全环境，云端安全环境执行执行以下步骤：
接收第一CA请求与第一TA通信的通信请求，所述通信请求中包含第一CA当前的第一场景特征信息；判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含所有CA对应的场景特征信息；如果所述场景特征信息集合中存在与所述第一场景特征信息相匹配的所述第二场景特征信息，则云端安全环境建立第一TA与第一CA之间的通信。
终端70包括：处理器701和存储器702，存储器702用于存储计算机可执行指令。当处理器701执行所述计算机可执行指令时，REE执行以下步骤：
所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含第一CA当前的第一场景特征信息；根据第一CA与第一TA的通信状态控制第一CA当前操作。
需要说明的是，在本文中，诸如“第一”和“第二”等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本申请说明书中各个实施例之间相同相似的部分互相参见即可。尤其，对于装置、终端、云服务器实施例而言，由于其中的方法基本相似于终端攻击防御方法的实施例，所以描述的比较简单，相关之处参见终端攻击防御方法实施例中的说明即可。
以上所述的本申请实施方式并不构成对本申请保护范围的限定。

Claims (17)

  1. 一种终端攻击防御方法，其特征在于，所述方法包括：
    安全执行环境接收第一客户应用CA请求与第一安全应用TA通信的通信请求，所述安全执行环境包括可信执行环境TEE和云端安全环境中的任意一个或两个，所述通信请求中包含所述第一CA当前的第一场景特征信息；其中，场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行；
    当所述安全执行环境对所述第一场景特征信息验证通过时,所述安全执行环境建立所述第一TA与所述第一CA之间的通信。
  2. 根据权利要求1所述的方法，其特征在于，所述安全执行环境验证所述第一场景特征信息包括：所述安全执行环境判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含多个CA和所述多个CA的多种操作对应的场景特征信息。
  3. 根据权利要求2所述的方法，其特征在于，所述安全执行环境判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，包括：
    遍历所述场景特征信息集合，以获得CA名称和CA操作分别与所述第一CA和所述第一CA的当前操作相同的第二场景特征信息；
    判断所述第二场景特征信息与所述第一场景特征信息是否一致。
  4. 根据权利要求2或3所述的方法，其特征在于，还包括：
    所述安全执行环境从通用执行环境REE侧接收场景特征信息更新数据；
    根据所述场景特征信息更新数据更新所述场景特征信息集合。
  5. 一种终端攻击防御方法，其特征在于，所述终端上部署有REE，所述方法包括：
    所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息，其中，场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行；
    根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作。
  6. 根据权利要求5所述的方法，其特征在于，所述根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作，包括：
    如果所述第一CA与所述第一TA建立通信，则允许所述第一CA的当前操作。
  7. 根据权利要求5或6所述的方法，其特征在于，还包括：
    所述REE从网络侧接收场景特征信息更新数据；
    将所述场景特征信息更新数据发送给安全执行环境。
  8. 一种终端攻击防御装置，其特征在于，所述装置包括：
    接收模块，部署在安全执行环境中，用于接收第一客户应用CA请求与第一安全应用TA通信的通信请求，所述安全执行环境包括可信执行环境TEE和云端安全环境中的任意一个或两个，所述通信请求中包含所述第一CA当前的第一场景特征信息；其中，场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括以下信息中的任意一种或多种：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括以下信息中的任意一种或多种：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行；
    处理模块，部署在安全执行环境中，用于当对所述第一场景特征信息验证通过时,建立所述第一TA与所述第一CA之间的通信。
  9. 根据权利要求8所述的装置，其特征在于，所述处理模块包括：判断单元，用于判断预存的场景特征信息集合是否存在与所述第一场景特征信息匹配的第二场景特征信息，所述预存的场景特征信息集合中包含多个CA和所述多个CA的多种操作对应的场景特征信息。
  10. 根据权利要求9所述的装置，其特征在于，所述判断单元包括：
    获取子单元，用于遍历所述场景特征信息集合，以获得所述CA名称和所述CA操作与所述第一场景特征信息相同的所述第二场景特征信息；
    判断子单元，判断所述获取单元获取的所述第二场景特征信息与所述第一场景特征信息是否一致。
  11. 根据权利要求9或10所述的装置，其特征在于，所述接收模块还包括：
    接收单元，用于从终端上部署的通用执行环境REE侧接收场景特征信息更新数据；
    更新单元，用于根据所述接收单元接收的所述场景特征信息更新数据更新所述场景特征信息集合。
  12. 一种终端，其特征在于，所述终端包括：
    发送模块，用于所述REE发送第一CA请求与第一TA通信的通信请求，所述通信请求中包含所述第一CA当前的第一场景特征信息，所述场景为任一所述CA的任一操作，每个所述场景对应的CA名称和CA操作是唯一的；所述场景特征信息包括以下信息中的任意一种或多种：终端屏幕触碰信息、终端屏幕状态信息和CA运行信息，所述终端屏幕触碰信息包括：操作所述CA时终端屏幕点击次数、终端屏幕点击位置和终端屏幕点击方式，所述终端屏幕状态信息包括：终端屏幕亮屏状态和终端屏幕亮度值，所述CA运行信息用于指示所述CA是否在前台运行；
    控制模块，用于根据所述第一CA与所述第一TA的通信状态控制所述第一CA当前操作。
  13. 根据权利要求12所述的终端，其特征在于，所述控制模块包括：
    控制单元，用于如果所述第一CA与所述第一TA建立通信，则允许所述第一CA的当前操作。
  14. 根据权利要求12或13所述的终端，其特征在于，还包括：
    接收单元，用于所述REE从网络侧接收场景特征信息更新数据；
    发送单元，用于将所述场景特征信息更新数据发送给安全执行环境。
  15. 一种终端，其特征在于，所述终端上部署有REE和TEE，所述终端包括：
    处理器；
    存储器，用于存储计算机可执行指令；
    当所述处理器执行所述计算机可执行指令时，TEE执行如权利要求1-4任一项所述的方法，所述REE执行如权利要求5-7任一项所述的方法。
  16. 一种终端，其特征在于，所述终端上部署有REE，所述终端包括：
    处理器；
    存储器，用于存储计算机可执行指令；
    当所述处理器执行所述计算机可执行指令时，所述REE执行如权利要求5-7任一项所述的方法。
  17. 一种云服务器，其特征在于，所述云服务器与部署REE的终端通信，
    所述云服务器包括：
    云存储器，用于存储指令程序；
    所述云服务器内运行所述指令程序时，生成云端安全环境，所述云端安全环境执行执行如权利要求1-4任一项所述的方法。
PCT/CN2019/103044 2018-10-12 2019-08-28 终端攻击防御方法、装置、终端及云服务器 WO2020073750A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/003,173 US20200387600A1 (en) 2018-10-12 2020-08-26 Attack defense method and apparatus for terminal, terminal, and cloud server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811188595.2A CN111046383B (zh) 2018-10-12 2018-10-12 终端攻击防御方法、装置、终端及云服务器
CN201811188595.2 2018-10-12

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/003,173 Continuation US20200387600A1 (en) 2018-10-12 2020-08-26 Attack defense method and apparatus for terminal, terminal, and cloud server

Publications (1)

Publication Number Publication Date
WO2020073750A1 true WO2020073750A1 (zh) 2020-04-16

Family

ID=70165091

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/103044 WO2020073750A1 (zh) 2018-10-12 2019-08-28 终端攻击防御方法、装置、终端及云服务器

Country Status (3)

Country Link
US (1) US20200387600A1 (zh)
CN (1) CN111046383B (zh)
WO (1) WO2020073750A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115037482A (zh) * 2022-06-10 2022-09-09 维沃移动通信有限公司 欺诈行为检测方法、装置、电子设备及可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105978917A (zh) * 2016-07-19 2016-09-28 恒宝股份有限公司 一种用于可信应用安全认证的系统和方法
CN106936774A (zh) * 2015-12-29 2017-07-07 中国电信股份有限公司 可信执行环境中的认证方法和系统
US20170277869A1 (en) * 2016-03-25 2017-09-28 Mstar Semiconductor, Inc. Computing device and data processing method
CN108540442A (zh) * 2018-02-08 2018-09-14 北京豆荚科技有限公司 一种访问可信执行环境的控制方法
CN108600222A (zh) * 2018-04-24 2018-09-28 北京握奇智能科技有限公司 客户端应用与可信应用的通信方法、系统以及终端

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9299072B2 (en) * 2014-05-29 2016-03-29 Apple Inc. Apparatuses and methods for operating a portable electronic device to conduct mobile payment transactions
CN104125226B (zh) * 2014-07-28 2018-01-26 北京握奇智能科技有限公司 一种锁定和解锁应用的方法、装置及系统
US10382454B2 (en) * 2014-09-26 2019-08-13 Mcafee, Llc Data mining algorithms adopted for trusted execution environment
CN109871717A (zh) * 2016-02-29 2019-06-11 华为技术有限公司 一种数据安全传输装置及方法
WO2017156784A1 (zh) * 2016-03-18 2017-09-21 华为技术有限公司 一种通知消息处理方法、装置及终端
CN105809036B (zh) * 2016-04-01 2019-05-10 中国银联股份有限公司 一种tee访问控制方法以及实现该方法的移动终端
KR102425368B1 (ko) * 2016-05-02 2022-07-27 삼성전자주식회사 가상 sim 운용 방법 및 그 장치
CN108616352B (zh) * 2018-04-13 2022-01-18 北京握奇智能科技有限公司 基于安全元件的动态口令生成方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106936774A (zh) * 2015-12-29 2017-07-07 中国电信股份有限公司 可信执行环境中的认证方法和系统
US20170277869A1 (en) * 2016-03-25 2017-09-28 Mstar Semiconductor, Inc. Computing device and data processing method
CN105978917A (zh) * 2016-07-19 2016-09-28 恒宝股份有限公司 一种用于可信应用安全认证的系统和方法
CN108540442A (zh) * 2018-02-08 2018-09-14 北京豆荚科技有限公司 一种访问可信执行环境的控制方法
CN108600222A (zh) * 2018-04-24 2018-09-28 北京握奇智能科技有限公司 客户端应用与可信应用的通信方法、系统以及终端

Also Published As

Publication number Publication date
CN111046383B (zh) 2023-10-13
CN111046383A (zh) 2020-04-21
US20200387600A1 (en) 2020-12-10

Similar Documents

Publication Publication Date Title
US20180367528A1 (en) Seamless Provision of Authentication Credential Data to Cloud-Based Assets on Demand
US9838398B2 (en) Validating the identity of an application for application management
US9686278B1 (en) Method and system for configuring computing devices
US9871821B2 (en) Securely operating a process using user-specific and device-specific security constraints
US9148413B1 (en) Secured firmware updates
US9100188B2 (en) Hardware-based root of trust for cloud environments
US8370905B2 (en) Domain access system
US8887144B1 (en) Firmware updates during limited time period
KR102407066B1 (ko) 집적 회로를 위한 상이한 엔티티들의 특권들의 관리
US10419900B2 (en) Method and apparatus for managing application terminal remotely in wireless communication system
US10333925B2 (en) Seamless provision of authentication credential data to cloud-based assets on demand
US10177934B1 (en) Firmware updates inaccessible to guests
KR20110069733A (ko) 시스템의 보안 파티션에서 수행되는 컴퓨터로 구현되는 방법, 장치 및 컴퓨터 프로그램 제품
US20180198620A1 (en) Systems and methods for assuring data on leased computing resources
CN108351923B (zh) 与统一可扩展固件接口系统可执行的脚本有关的阈值
US20160147546A1 (en) Managing the Customizing of Appliances
US11165761B2 (en) Methods, devices, and computer program products for service security protection
US20150074759A1 (en) Application trust-listing security service
US9178863B2 (en) Automatic reauthentication in a media device
WO2020073750A1 (zh) 终端攻击防御方法、装置、终端及云服务器
US11989279B2 (en) Method and system for service image deployment in a cloud computing system based on distributed ledger technology
KR102381575B1 (ko) 사용자단말 및 사용자단말과 통신을 수행하는 서버시스템에서 수행되는 선택적 캡쳐방지 기능을 구비한 통신 보안방법
KR102371181B1 (ko) 에이전트어플리케이션이 설치된 사용자단말 및 사용자단말과 통신을 수행하는 서버시스템에서 수행되는 통신 보안방법
O'Leary et al. Network Services
US20190056960A1 (en) Online desktop operating system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19872125

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19872125

Country of ref document: EP

Kind code of ref document: A1