WO2020199035A1 - 一种减少嗅探攻击的方法、装置及集成电路 - Google Patents

一种减少嗅探攻击的方法、装置及集成电路 Download PDF

Info

Publication number
WO2020199035A1
WO2020199035A1 PCT/CN2019/080662 CN2019080662W WO2020199035A1 WO 2020199035 A1 WO2020199035 A1 WO 2020199035A1 CN 2019080662 W CN2019080662 W CN 2019080662W WO 2020199035 A1 WO2020199035 A1 WO 2020199035A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
short message
sniffing
attacked
user
Prior art date
Application number
PCT/CN2019/080662
Other languages
English (en)
French (fr)
Inventor
雷显调
刘涛
祝锂
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/080662 priority Critical patent/WO2020199035A1/zh
Priority to CN201980007257.0A priority patent/CN112020871A/zh
Publication of WO2020199035A1 publication Critical patent/WO2020199035A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • This application relates to the field of communication technology, and in particular to a method, device and integrated circuit for reducing sniffing attacks.
  • a sniffing device is a device that can monitor and obtain network information.
  • illegal persons can use sniffing devices to steal user information to achieve illegal purposes.
  • GSM global system for mobile communication
  • many current financial applications such as banking apps
  • SMS verification codes illegal persons You can log in to the financial account of the terminal user by monitoring the SMS verification code received by the terminal, and then transfer the property.
  • the terminal used by user A resides under the same GSM base station as the sniffing device, then the SMS received by the terminal will be monitored by the sniffing device, and illegal persons can log in according to the verification code in the SMS User A's financial account.
  • Terminal B and pseudo terminal C register with the GSM core network, and sniffing device A and terminal B reside in the same GSM base station.
  • the pseudo terminal C obtains the mobile phone number of the terminal B (for example, purchased through illegal means or obtained through information leakage such as takeaway information or express delivery information), it sends specific content or a certain number of silent short messages to the terminal B.
  • silent short messages are short messages that are not displayed to users in the 3rd generation partnership project (3GPP).
  • the sniffing device A can also monitor the SILENT short message, then the sniffing device A can determine that it resides in the same location as the terminal B based on the content of the SILENT short message or the number of the monitored SILENT short message. Under a GSM base station. At this time, the illegal person can manipulate the pseudo terminal C, use the number of the terminal B to log in to the financial account, and then trigger the network to send the short message containing the verification code to the terminal B. After the verification code short message is sent on the network, both the terminal B and the sniffing device A obtain the verification code short message. Therefore, illegal persons can enter the verification code in terminal C to log in to the financial account of terminal B to transfer property.
  • sniffing device A may not perform the process of determining that it resides under the same GSM base station as terminal B, and the pseudo terminal C uses the number of terminal B to log in to the financial account; if sniffing If device A and terminal B reside under the same GSM base station, the sniffing attack is successful; if sniffing device A and terminal B do not reside under the same GSM base station, the sniffing attack fails.
  • the GSM network uses plaintext transmission or the GSM encryption algorithm is cracked, it is difficult to prevent the sniffing device A from listening to network information; in addition, illegal people usually choose to trigger the attack in the middle of the night or when the terminal B is in a static state.
  • the user may be in a sleep state or the user has not checked the mobile phone, so it is difficult for the user to detect the receipt of the verification code short message, and the illegal person can take advantage of it.
  • the embodiments of the present application provide a method, device, and integrated circuit for reducing sniffing attacks, so as to reduce the probability of a terminal being attacked by sniffing.
  • an embodiment of the present application provides a method for reducing sniffing attacks.
  • the method includes: a terminal receives a designated short message from a base station.
  • the designated short message can be a silent short message or a verification code short message.
  • the verification code of the financial account the terminal judges whether it is attacked by sniffing; the terminal prompts the user if it is determined to be attacked by the sniffing.
  • the terminal after receiving the silent short message or the verification code short message, the terminal can determine whether the terminal has been sniffed or attacked according to the situation of the terminal receiving the specified short message, thereby avoiding the base station from sending other short messages to the terminal again, or preventing the base station from targeting illegal persons to finance In response to the operation of the account, the purpose of preventing illegal persons from transferring the property of the terminal user through SMS + verification code is achieved.
  • the terminal determines whether it has been sniffed and attacked by the following methods: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time is preset Time period; the terminal is currently in a static state. Then, the terminal was determined to be attacked by sniffing.
  • the preset time period can be from zero o'clock to five o'clock in the morning.
  • the time when the silent short message is received and the current motion state of the terminal are combined to determine whether the terminal is being attacked by sniffing.
  • the terminal determines whether it has been sniffed and attacked by the following methods: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time is preset period. Then, the terminal was determined to be attacked by sniffing.
  • the preset time period can be from zero o'clock to five o'clock in the morning.
  • the time of receiving the silent short message is combined to determine whether the terminal is being attacked by sniffing.
  • the terminal determines whether it has been sniffed and attacked. This can be done in the following ways: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time is in the preset Set the time period; the terminal is currently in a static state; the terminal does not request the base station to send the verification code short message within the preset time period; then, the terminal is determined to be attacked by sniffing.
  • the preset time period can be from zero o'clock to five o'clock in the morning.
  • the terminal when the terminal is determined to be currently residing in the GSM standard, the time when the verification code message is received, the current movement state of the terminal, and whether the terminal requests the base station to send the verification code message to determine whether the terminal is sniffed attack.
  • the terminal determines whether it has been sniffed and attacked, which can be implemented in the following ways: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the terminal is preset The base station was not requested to send the verification code SMS within the time period; then, the terminal was determined to be attacked by sniffing.
  • the terminal when the terminal is determined to currently reside in the GSM standard, it is combined with whether the terminal requests the base station to send a verification code short message to determine whether the terminal is being attacked by sniffing.
  • the terminal determines whether it has been sniffed and attacked. This can be done in the following ways: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time is in the preset Set the time period; the terminal does not request the base station to send the verification code SMS within the preset time; then, the terminal is determined to be attacked by sniffing.
  • the preset time period can be from zero o'clock to five o'clock in the morning.
  • the time of receiving the verification code short message and whether the terminal requests the base station to send the verification code short message are combined to determine whether the terminal is under a sniffing attack.
  • the terminal when the terminal prompts the user, it can be specifically implemented in the following manner: if the terminal is in the off-screen state, the terminal prompts the user by vibrating or ringing.
  • the terminal when the terminal prompts the user, it can also be implemented in the following manner: if the terminal is in the on-screen state, the terminal displays a message on the user interface to prompt the user.
  • the terminal can prompt the user in different ways in the off-screen and on-screen states, so that the user can learn about the situation of the terminal being attacked by sniffing.
  • the terminal after the terminal prompts the user, if the terminal is in the off-screen state, the terminal can disable the GSM standard.
  • the terminal may display a message on the user interface to prompt the user whether to disable the GSM mode, and disable the GSM mode according to the user's selection.
  • the terminal after disabling the GSM standard in different ways, the terminal is in an unregistered state under the GSM network, the GSM base station cannot page the terminal, and the GSM base station will not send other short messages to the terminal; illegal persons are manipulating other terminals
  • the GSM base station When logging in to a financial account or performing operations to transfer property, the GSM base station will not respond to related operations, thereby avoiding the terminal user's property loss in the case of terminal sniffing attacks.
  • an embodiment of the present application provides a device for reducing sniffing attacks.
  • the device is applied to a terminal and includes: a transceiver module for receiving a designated short message from a base station.
  • the designated short message is a silent short message or a verification code short message, and the verification code
  • the short message contains the verification code used to log in to the financial account; the processing module is used to determine whether the terminal is attacked by sniffing; and, when it is determined that the terminal is attacked by sniffing, the user is prompted.
  • the processing module determines whether the terminal has been sniffed and attacked, it is specifically used to: determine the following conditions: the terminal currently resides in the GSM standard; the current time is in the preset Set the time period; the terminal is currently in a static state; then, determine that the terminal is attacked by sniffing.
  • the processing module determines whether the terminal has been sniffed and attacked, it is specifically used to: determine the following conditions: the terminal currently resides in the GSM standard; the current time is in the preset Set the time period; then, determine that the terminal is attacked by sniffing.
  • the processing module is specifically used to determine whether the terminal has been sniffed and attacked: to determine the following conditions: the terminal currently resides in the GSM standard; the current time is in The preset time period; the terminal is currently in a static state; the terminal does not request the base station to send a verification code short message within the preset time period; then, it is determined that the terminal is under a sniffing attack.
  • the processing module is specifically used to determine whether the terminal has been sniffed and attacked: to determine the following conditions: the terminal currently resides in the GSM standard; It is assumed that the base station is not requested to send the verification code SMS within the time period; then, it is determined that the terminal is attacked by sniffing.
  • the processing module is specifically used to determine whether the terminal has been sniffed and attacked: to determine the following conditions: the terminal currently resides in the GSM standard; the current time is in The preset time period; the terminal does not request the base station to send the verification code SMS within the preset time period; then, it is determined that the terminal is attacked by sniffing.
  • the processing module when the processing module prompts the user, it is specifically configured to: if the terminal is in the off-screen state, prompt the user by vibrating or ringing.
  • the processing module when the processing module prompts the user, it is specifically used to: if the terminal is in the on-screen state, display a message on the user interface to prompt the user.
  • the processing module is also used to: after prompting the user, if the terminal is in the off-screen state, the GSM standard is disabled.
  • the processing module is also used to: after prompting the user, if the terminal is in the on-screen state, display a message on the user interface to prompt the user whether to disable the GSM mode, and determine whether to disable the GSM mode according to the user's selection.
  • an embodiment of the present application provides an integrated circuit for reducing sniffing attacks, the integrated circuit including:
  • the input/output port is used to receive the designated short message from the base station.
  • the designated short message is a silent short message or a verification code short message.
  • the verification code short message contains a verification code for logging in to a financial account;
  • the processor is used for judging whether the terminal is attacked by sniffing according to the condition of receiving the designated short message; and prompting the user when it is determined that the terminal is attacked by the sniffing.
  • the processor determines that the terminal is currently resident in the GSM standard, the current time is in a preset time period, and the terminal is currently in a static state. Sniffing attacks.
  • the processor determines that the terminal is under a sniffing attack when it is determined that the terminal currently resides under the GSM standard and the current time is within a preset time period.
  • the processor determines that the terminal currently resides in the GSM standard, the current time is in a preset time period, the terminal is currently in a static state, and the terminal is in a preset time period. If the base station is not requested to send the verification code SMS, it is determined that the terminal is attacked by sniffing.
  • the processor determines that the terminal is currently residing under the GSM standard and the terminal does not request the base station to send the verification code short message within a preset time period. Attacked by sniffing.
  • the processor determines that the terminal currently resides in the GSM standard, the current time is in a preset time period, and the terminal does not request the base station to send verification within the preset time period.
  • the terminal is attacked by sniffing.
  • the processor when the processor prompts the user, it is specifically used to: enable the speaker of the terminal where the integrated circuit is located to alert the user; or, enable the linear motor of the terminal where the integrated circuit is located to vibrate to The user is prompted.
  • the processor when the processor prompts the user, it is specifically used to: enable the user interface of the terminal where the integrated circuit is located to display a message to prompt the user.
  • the processor can also disable the GSM system.
  • the processor may enable the user interface of the terminal where the integrated circuit is located to display a message to prompt the user whether to disable the GSM mode, and disable the GSM mode according to the user's selection.
  • the integrated circuit may also include a memory, which may be used to store program code, and when the program code is executed, the processor can execute the third aspect or any one of the third aspect. The operations performed by the processor in your design.
  • the processor when the processor performs the above operations, it may need to determine the content of the designated short message (for example, determine that the designated short message is a silent short message or a verification code short message).
  • the designated short message can be stored in the flash memory of the terminal where the integrated circuit is located.
  • the circuit can read the designated short message stored in the flash memory through the input and output ports.
  • the integrated circuit in combination with the third aspect or any possible design in the third aspect, is a baseband processing chip. In another possible design, the integrated circuit is an application processing chip. In another possible design, the integrated circuit is a system on chip (SoC).
  • SoC system on chip
  • the embodiments of the present application also provide a computer-readable storage medium for storing a program used to execute the functions designed in the first aspect or any one of the first aspects, when the program is executed by the processor , Used to implement the method described in the first aspect or any one of the first aspects.
  • the embodiments of the present application provide a computer program product containing program code.
  • the program code contained in the program code runs on a computer, the computer can execute the design described in the first aspect or any one of the first aspects. Methods.
  • embodiments of the present application provide a wireless communication system, including a base station, and a terminal as described in any one of the first aspect, the second aspect, or the corresponding aspect, or including The chip device described in the third aspect or any one of the possible implementation manners of the third aspect.
  • Figure 1 is a schematic diagram of a sniffing attack scenario provided by the prior art
  • FIG. 2 is a schematic diagram of the flow of a sniffing attack provided by the prior art
  • FIG. 3 is a schematic structural diagram of a communication system provided by an embodiment of this application.
  • FIG. 4 is a schematic flowchart of the first method for reducing sniffing attacks according to an embodiment of the application
  • FIG. 5 is a schematic flowchart of a second method for reducing sniffing attacks according to an embodiment of the application
  • FIG. 6 is a schematic flowchart of a third method for reducing sniffing attacks according to an embodiment of the application.
  • FIG. 7 is a schematic flowchart of a fourth method for reducing sniffing attacks according to an embodiment of the application.
  • FIG. 8 is a schematic flowchart of a fifth method for reducing sniffing attacks according to an embodiment of the application.
  • FIG. 9 is a schematic structural diagram of a device for reducing sniffing attacks provided by an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of a terminal provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of an integrated circuit provided by an embodiment of the application.
  • the terminal is vulnerable to sniffing attacks.
  • the embodiments of the present application provide a method, device and integrated circuit for reducing sniffing attacks, so as to reduce the probability of a terminal being attacked by sniffing.
  • the method and the device are based on the same technical idea. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.
  • the embodiments of this application can be applied to the communication system shown in FIG. 3.
  • the communication system includes terminals, sniffing equipment and GSM base stations.
  • the terminal has the function of receiving short messages.
  • Terminals can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; they can also be deployed on the water (such as ships, etc.); they can also be deployed in the air (such as airplanes, balloons, and satellites, etc.).
  • the terminal may be a mobile phone (mobile phone), a tablet computer (pad), a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, and an industrial control (industrial control) Wireless terminals in, self-driving (self-driving), wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, Wireless terminals in a smart city, wireless terminals in a smart home, etc.
  • VR virtual reality
  • AR augmented reality
  • Wireless terminals in, self-driving (self-driving), wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, Wireless terminals in a smart city, wireless terminals in a smart
  • the embodiments of the present application are applied to a scenario where the terminal resides in a GSM base station.
  • the terminal may be sniffed and attacked.
  • the network standard supported by the terminal is not limited to GSM.
  • the network standards supported by the terminal include but are not limited to GSM, code division multiple access (CDMA), wide-band code division multiple access (WCDMA), and time division synchronization multiple access.
  • Address access time division-synchronous code division multiple access, TD-SCDMA), long term evolution (LTE), fifth generation (5th generation, 5G) communication systems.
  • the GSM base station is a device that provides services under the GSM standard for the terminal. For example, when the terminal is attached, the terminal is provided with network access authentication; when the terminal has a service request, the terminal is allocated network resources; when the terminal is moving, the terminal is updated with network resources; when the terminal is idle, the terminal is provided with fast recovery Mechanism; when the terminal is detached, it releases network resources for the terminal; when the terminal has service data, it provides a data routing function for the terminal.
  • the sniffing device and the terminal reside under the same GSM base station.
  • the short messages (such as verification code short messages) received by the terminal will also be acquired by the sniffing device residing in the same GSM base station.
  • the illegal person can log in to the financial account of the terminal based on the information of the short message intercepted by the sniffing device.
  • the sniffing device has the function of sending and receiving short messages, for example, it can be a mobile phone, a tablet computer, a VR device, an AR device, etc.; it can also be a receiver.
  • FIG. 4 is a method for reducing sniffing attacks provided by an embodiment of this application.
  • the method includes the following steps.
  • S401 The terminal receives a designated short message from the base station.
  • the designated short message can be a silent short message or a verification code short message
  • the verification code short message contains a verification code for logging in to a financial account.
  • SILENT silent short message
  • illegal persons can send silent short messages with specific content to the attacked terminal through a sniffing device or other terminal, or send a certain number of silent short messages. If the sniffing device also listens to the silent text messages of the specific content, or the sniffing device also listens to a certain number of silent text messages, it can be determined that the sniffing device and the attacked terminal reside in the same GSM base station, and then the attacked Terminal attacks.
  • the sniffing device and the terminal reside in the same GSM base station.
  • Unauthorized persons can operate other terminals (it is not restricted that the terminal and the attacked terminal reside in the same GSM base station) to directly log in to the financial account of the attacked terminal, and select the verification code to log in as the login method. Then, the GSM base station will send a verification code SMS to the attacked terminal. If the sniffing device and the attacked terminal reside in the same GSM base station, the sniffing device will also listen to the verification code SMS, and the illegal person can log in to the financial account of the attacked terminal on other terminals according to the obtained verification code.
  • the terminal device will receive a designated short message, such as a silent short message or a verification code short message, during the process of the terminal being sniffed and attacked. Therefore, in the embodiment of the present application, when the terminal receives the designated short message, it can be combined with other information to determine whether the terminal is attacked by sniffing.
  • a designated short message such as a silent short message or a verification code short message
  • the illegal person before sending a silent short message to the terminal or triggering the base station to send a verification code short message to the terminal, the illegal person first needs to obtain the terminal user's number. Specifically, illegal persons may obtain the terminal user's number through illegal channels such as online purchases, or obtain the terminal user's number through information leakage such as takeaway information and express delivery information.
  • S402 The terminal judges whether it is attacked by sniffing.
  • unauthorised persons usually choose the process of triggering a sniffing attack in the middle of the night or when the terminal is in a static state. Then the terminal receives a designated short message in the middle of the night or when the terminal is in a static state, and it is determined that the terminal may be sniffer attacked.
  • the terminal receives the verification code message
  • the verification code message is very It may be triggered by the base station when an illegal person logs in to the user's financial account. Based on this, it can be determined that the terminal may be sniffer attacked.
  • one or more of the above judgment logics can be used according to actual conditions to judge whether the terminal is attacked by sniffing.
  • the terminal determines whether it is sniffed and attacked, which can be implemented in the following manner: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time is in a preset time period; The terminal is currently in a static state. Then, the terminal was determined to be attacked by sniffing.
  • the terminal in S402 determines whether it is sniffed and attacked, which can be implemented in the following manner: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time is in Preset time period. Then, the terminal was determined to be attacked by sniffing.
  • the terminal determines whether it is sniffed and attacked, which can be implemented in the following manner: the terminal determines that the following conditions exist: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; currently The time is in a preset time period; the terminal is currently in a static state; the terminal does not request the base station to send a verification code short message within the preset time period. Then, the terminal was determined to be attacked by sniffing.
  • the terminal in S402 determines whether it has been sniffed and attacked. This can be achieved in the following manner: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; The base station is not requested to send the verification code SMS within the preset time period. Then, the terminal was determined to be attacked by sniffing.
  • the terminal in S402 determines whether it is sniffed and attacked, which can be implemented in the following manner: the terminal determines that the following conditions exist: the terminal currently resides in the GSM standard; the current time In the preset time period; the terminal did not request the base station to send the verification code SMS within the preset time period. Then, the terminal was determined to be attacked by sniffing.
  • the above methods for determining whether the terminal is sniffer attacked are only examples. In practical applications, it is possible to combine one or more of the time when the designated short message is received, the current motion state of the terminal, and whether the terminal requests the base station to send the verification code short message when it is determined that it currently resides in the GSM standard. Determine whether the terminal is attacked by sniffing.
  • S403 The terminal prompts the user when it is determined to be attacked by sniffing.
  • the terminal may prompt the user by vibrating or ringing. If the terminal is in the off-screen state, the user may not check the phone at this time. If a message is displayed to prompt the user through the user interface, the user may not be able to view the prompt information, so the user can be reminded by vibration or ringing
  • the terminal can prompt the user through a message displayed on the user interface. If the terminal is in the bright screen state, the user may be viewing the mobile phone at this time, and a message can be displayed on the user interface to prompt the user.
  • the terminal can disable the GSM standard.
  • the terminal may display a message on the user interface to prompt the user whether to disable the GSM mode, and disable the GSM mode according to the user's selection.
  • the terminal can take corresponding measures (for example, disabling the GSM standard) to avoid the property loss of the terminal user.
  • the GSM standard is disabled, the terminal is in an unregistered state under the GSM network, the GSM base station cannot page the terminal, and the GSM base station will no longer send other short messages to the terminal; illegal persons are manipulating other terminals to log in to financial accounts or transfer property During operation, the GSM base station will not respond to related operations, thus avoiding the terminal user's property loss in the case of the terminal being sniffed and attacked.
  • the terminal can directly disable the GSM standard regardless of whether the terminal is on or off; or, regardless of whether the terminal is on or on, it can prompt the user whether to disable the GSM mode by displaying a message on the user interface, and then perform corresponding operations according to the user's choice.
  • the embodiments of the present application do not specifically limit this.
  • whether the terminal is sniffed or attacked can be determined by the terminal staying mode, the time when the designated short message is received, the current motion state of the terminal, and whether the terminal requests the base station to send the verification code short message. Then, the GSM standard can be disabled in different ways. However, there may be misjudgments when making judgments in the above manner. If a misjudgment occurs, the terminal can also lift the GSM standard or prompt the user whether to lift the GSM standard after a period of time, so as to avoid the situation that the terminal cannot stay in the GSM standard all the time.
  • the terminal can also unban GSM under certain conditions or prompt the user whether to unban the GSM standard. For example, when the mobile distance of the terminal is greater than a preset value, or after the GSM mode is disabled for a preset time, the terminal can unban GSM, or prompt the user whether to unban the GSM system, and unban the GSM system according to the user's selection.
  • the terminal after the terminal receives the silent short message or the verification code short message, it can determine whether the terminal is being sniffer attacked based on the situation of receiving the specified short message, thereby preventing the base station from sending the terminal again Send other short messages, or prevent the base station from responding to the operations of the illegal person on the financial account, so as to prevent the illegal person from transferring the terminal user's property through the SMS + verification code.
  • the execution subject terminal of the method shown in FIG. 4 may include a baseband processor and an application processor.
  • S401 and S402 in the method shown in FIG. 4 may be executed by a baseband processor, and S403 may be executed by an application processor.
  • the method may include the following steps:
  • the baseband processor receives a designated short message from the base station.
  • the designated short message is a silent short message or a verification code short message
  • the verification code short message contains a verification code for logging in to a financial account.
  • S502 The baseband processor determines whether the terminal is attacked by sniffing.
  • the baseband processor may determine that the terminal is under a sniffing attack when the terminal currently resides in the GSM standard, the current time is in a preset time period, and the terminal is currently in a static state.
  • the baseband processor may be the baseband processor when the terminal currently resides in the GSM standard, the current time is in a preset time period, the terminal is currently in a static state, and the terminal does not request the base station to send within the preset time period.
  • verification code SMS it is determined that the terminal is attacked by sniffing.
  • the baseband processor sends to the application processor an indication message used to indicate that the terminal is attacked by sniffing.
  • S504 The application processor prompts that the user terminal is sniffed and attacked.
  • the application processor may prompt the user by vibrating or ringing.
  • the application processor may display a message on the user interface to prompt the user.
  • the application processor may also disable the GSM mode, or the application processor may prompt the user on the user interface whether to disable the GSM mode, and determine whether to disable the GSM mode according to the user's selection.
  • S401 in the method shown in FIG. 4 may be executed by a baseband processor, and S402 and S403 may be executed by an application processor.
  • the method may include the following steps:
  • the baseband processor receives a designated short message from the base station.
  • the designated short message is a silent short message or a verification code short message
  • the verification code short message contains a verification code for logging in to a financial account.
  • the baseband processor sends a designated short message to the application processor.
  • S603 The application processor determines whether the terminal is attacked by sniffing.
  • the application processor may determine that the terminal is under a sniffing attack when the terminal currently resides in the GSM standard, the current time is in a preset time period, and the terminal is currently in a static state.
  • the application processor may when the terminal currently resides in the GSM standard, the current time is in a preset time period, the terminal is currently in a static state, and the terminal has not requested the base station to send within the preset time period.
  • verification code SMS it is determined that the terminal is attacked by sniffing.
  • S604 The application processor prompts the user when it is determined that the terminal has been sniffed and attacked.
  • the application processor may prompt the user by vibrating or ringing.
  • the application processor may display a message on the user interface to prompt the user.
  • the application processor may also disable the GSM mode, or the application processor may prompt the user on the user interface whether to disable the GSM mode, and determine whether to disable the GSM mode according to the user's selection.
  • the specific operations performed by the baseband processor and the application processor can refer to the relevant steps performed by the terminal in the description of FIG. 4 above. For concise description, it will not be repeated here. Repeat.
  • the embodiment of the present application also provides a method for reducing sniffing attacks, which can be regarded as a specific example of the method shown in FIG. 4.
  • the method includes the following steps.
  • Terminal B and pseudo terminal C register with the GSM core network, and sniffing device A and terminal B reside under the same GSM base station.
  • Pseudo terminal C obtains the mobile phone number of terminal B.
  • illegal persons can obtain the mobile phone number of terminal B through illegal purchases or through information leakage such as takeaway information and express delivery information.
  • the pseudo terminal C sends a silent (SILENT) short message of specific content to the terminal B.
  • Sniffer device A has monitored the SILENT short message, and according to the content of the short message, it is determined that terminal B and sniffing device A reside under the same GSM base station.
  • terminal B judges that it is currently in the following state, it judges that terminal B is being sniffer attacked and reminds the user: 1) The current time is midnight (the default is 24 o'clock to 5 o'clock local time, which can also be set by the user); 2) the terminal B currently resides under the GSM standard; 3) Terminal B is currently in a static or jog state.
  • Terminal B judges that it is attacked by sniffing and notifies the network to register.
  • terminal B if terminal B is in the off-screen state, it can notify the user that the user is under attack through vibration, ringtones, and the interface, and automatically turn off the corresponding mobile phone card or the GSM capability of the corresponding mobile phone card; if terminal B is in the on-screen state, you can The interface prompts that the user may be attacked; and the user determines whether to close the card or mobile phone corresponding to the number on the interface.
  • Pseudo terminal C triggers the network to send a short message containing a verification code to terminal B.
  • the network judges that terminal B is in an unregistered state. At this time, the network will not send a verification code short message to terminal B. Therefore, the sniffing device A cannot monitor the user's verification code short message, and the purpose of property transfer cannot be achieved.
  • the terminal receives the SILENT short message at a certain time and state, and thinks it is under a sniffing attack, and then performs corresponding operations to prevent the network from sending the short message to the user again. Eventually, the sniffing device cannot obtain the user. Verification code, the purpose of illegal property transfer.
  • the embodiment of the present application also provides a method for reducing sniffing attacks, which can be regarded as a specific example of the method shown in FIG. 4.
  • the method includes the following steps.
  • Terminal B and pseudo terminal C register with the GSM core network, and sniffing device A and terminal B reside under the same GSM base station.
  • Pseudo terminal C triggers the network to send a short message containing a verification code to terminal B.
  • the sniffer device A monitors the verification code short message, and the illegal person uses the verification code to log in on the pseudo terminal C.
  • step 5 you can also log in to the account directly on the sniffing device A to transfer property.
  • terminal B judges that it is currently in the following state, it judges that terminal B is being sniffer attacked and reminds the user: 1) The current time is midnight (the default is 24 o'clock to 5 o'clock local time, which can also be set by the user); 2) the terminal B currently resides under the GSM standard; 3) Terminal B is currently in a static or jog state; 4) Terminal B has no account login operation.
  • Terminal B judges that it is attacked by sniffing and notifies the network to register.
  • terminal B if terminal B is in the off-screen state, it can notify the user that the user is under attack through vibration, ringtones, and the interface, and automatically turn off the corresponding mobile phone card or the GSM capability of the corresponding mobile phone card; if terminal B is in the on-screen state, you can The interface prompts that the user may be attacked; and the user determines whether to close the card or mobile phone corresponding to the number on the interface.
  • Pseudo terminal C triggers the network to send a short message containing a verification code to terminal B.
  • the network judges that terminal B is in an unregistered state. At this time, the network will not send a verification code short message to terminal B. Therefore, the sniffing device A cannot monitor the user's verification code short message, and the purpose of property transfer cannot be achieved.
  • the terminal receives the verification code text message at a specific time and state, and thinks it is under a sniffing attack, and then performs corresponding operations to prevent the network from sending the text message to the user again, and eventually the sniffing device cannot obtain it.
  • User verification code the purpose of illegal property transfer.
  • both the method shown in FIG. 7 and the method shown in FIG. 8 can be regarded as a specific example of the method shown in FIG. 4, and the implementation methods not described in detail in the method shown in FIG. 7 and the method shown in FIG. 8 can be found in The related description in the method shown in FIG. 4 will not be repeated here.
  • an embodiment of the present application also provides a device for reducing sniffing attacks, and the device is applied to a terminal.
  • the device 900 for reducing sniffing attacks includes: a transceiver module 901 for receiving designated short messages from a base station, where the designated short messages are silent short messages or verification code short messages, and the verification code short messages include verification for logging in to a financial account. Code; processing module 902, used to determine whether the terminal is attacked by sniffing; and prompt the user when it is determined that the terminal is attacked by sniffing.
  • the processing module 902 judges whether the terminal is under a sniffing attack, it is specifically used to: determine that the following conditions exist: the terminal currently resides in the GSM standard; the current time is at a preset time Time period; the terminal is currently in a static state. Then, it is determined that the terminal is attacked by sniffing.
  • the processing module 902 is specifically used to determine whether the terminal is under a sniffing attack, specifically to: determine that the following conditions exist: the terminal currently resides in the GSM standard; Set the time period. Then, it is determined that the terminal is attacked by sniffing.
  • the processing module 902 judges whether the terminal is sniffed and attacked, it is specifically used to: determine that the following conditions exist: the terminal currently resides in the GSM standard; the current time is in The preset time period; the terminal is currently in a static state; the terminal does not request the base station to send a verification code short message within the preset time period. Then, it is determined that the terminal is attacked by sniffing.
  • the processing module 902 is specifically used to determine whether the terminal is sniffed and attacked, specifically to: determine that the following conditions exist: the terminal currently resides under the GSM standard; It is assumed that the base station is not requested to send the verification code SMS within the time period. Then, it is determined that the terminal is attacked by sniffing.
  • the processing module 902 is specifically used to determine whether the terminal is sniffed and attacked, specifically to: determine that the following conditions exist: the terminal currently resides in the GSM standard; the current time is in The preset time period; the terminal does not request the base station to send the verification code SMS within the preset time period; then, it is determined that the terminal is attacked by sniffing.
  • the processing module 902 when the processing module 902 prompts the user, it is specifically configured to: if the terminal is in the off-screen state, prompt the user by vibrating or ringing.
  • the processing module 902 is specifically configured to: if the terminal is in the on-screen state, display a message on the user interface to prompt the user.
  • the processing module 902 is further configured to: after prompting the user, if the terminal is in the off-screen state, disable the GSM standard.
  • the processing module 902 is further configured to: after prompting the user, if the terminal is in the on-screen state, display a message on the user interface to prompt the user whether to disable the GSM mode, and determine whether to disable the GSM mode according to the user's selection.
  • modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • the functional modules in the embodiments of the present application may be integrated into one processing module 902, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.
  • the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .
  • the device 900 for reducing sniffer attacks can be used to perform operations performed by the method terminal provided in the embodiment corresponding to FIG. 4, so the implementation and technical effects that are not described in detail in the device 900 for reducing sniffer attacks can be See the related description in Figure 4.
  • FIG. 10 is a schematic structural diagram of a terminal provided by an embodiment of this application. Taking the terminal as a mobile phone as an example, FIG. 10 shows a block diagram of a part of the structure of a mobile phone 1000 related to an embodiment of this application. 10, the mobile phone 1000 includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and power supply 1090 and other components.
  • RF radio frequency
  • the structure of the mobile phone shown in FIG. 10 does not constitute a limitation on the mobile phone, and may include more or less components than those shown in the figure, or combine some components, or arrange different components.
  • the components of the mobile phone 1000 are specifically introduced below in conjunction with FIG. 10:
  • the RF circuit 1010 can be used for receiving and sending signals during the process of sending and receiving information or talking. In particular, after receiving the downlink information of the base station, it is processed by the processor 1080; in addition, the designed uplink data is sent to the base station.
  • the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like.
  • the RF circuit 1010 can also communicate with the network and other devices through wireless communication.
  • the wireless communication can use any communication standard or protocol, including but not limited to global system for mobile communications (GSM), general packet radio service (GPRS), CDMA system, WCDMA system, TD-SCDMA system, LTE system, NR system, email, short message service (SMS), etc.
  • GSM global system for mobile communications
  • GPRS general packet radio service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • TD-SCDMA Time Division Multiple Access
  • LTE long term evolution
  • NR long message service
  • SMS short message service
  • the memory 1020 may be used to store software programs and modules.
  • the processor 1080 runs the software programs and modules stored in the memory 1020 to execute various functional applications and data processing of the mobile phone 1000.
  • the memory 1020 may mainly include a program storage area and a data storage area, where the program storage area may store an operating system, an application program required for at least one function, and the like; the data storage area may store data created according to the use of the mobile phone 1000, etc.
  • the memory 1020 may include volatile memory, such as nonvolatile random access memory (NVRAM), phase change random access memory (PRAM), magnetoresistive random access memory (magetoresistive ram, MRAM), etc.; the memory 1020 may also include a non-volatile memory, such as at least one disk storage device, an electrically erasable programmable read-only memory (EEPROM), a flash memory device, For example, NOR flash memory (NOR flash memory) or NAND flash memory, semiconductor devices, such as solid state disk (SSD), etc.
  • NVRAM nonvolatile random access memory
  • PRAM phase change random access memory
  • MRAM magnetoresistive random access memory
  • MRAM magnetoresistive random access memory
  • the memory 1020 may also include a non-volatile memory, such as at least one disk storage device, an electrically erasable programmable read-only memory (EEPROM), a flash memory device, For example, NOR flash memory (NOR flash memory) or NAND flash memory, semiconductor devices, such as solid state
  • the input unit 1030 can be used to receive inputted digital or character information, and generate key signal input related to user settings and function control of the mobile phone 1000.
  • the input unit 1030 may include a touch panel 1031 and other input devices 1032.
  • the touch panel 1031 also called a touch screen, can collect the user's touch operations on or near it (for example, the user uses any suitable objects or accessories such as fingers, stylus, etc.) on the touch panel 1031 or near the touch panel 1031. Operation), and drive the corresponding connection device according to the preset program.
  • the touch panel 1031 may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the user's touch position, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it To the processor 1080, and can receive and execute the commands sent by the processor 1080.
  • the input unit 1030 may adopt multiple types such as resistive, capacitive, infrared, and surface acoustic wave to implement the touch panel 1031.
  • the input unit 1030 may also include other input devices 1032.
  • the display unit 1040 may be used to display information input by the user or information provided to the user and various menus of the mobile phone 1000.
  • the display unit 1040 may include a display panel 1041.
  • the display panel 1041 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc.
  • the touch panel 1031 can cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it is sent to the processor 1080 to determine the type of the touch event, and then the processor 1080 responds to the touch event. Type provides corresponding visual output on the display panel 1041.
  • the touch panel 1031 and the display panel 1041 are used as two independent components to implement the input and output functions of the mobile phone 1000, but in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated And realize the input and output functions of the mobile phone 1000.
  • the display unit 1040 can be used to display content, and the content includes a user interface, such as a prompt message, a startup interface of a terminal, and a user interface of an application program. In addition to the user interface, the content may also include information and data.
  • the display unit 1040 may be a built-in screen of the terminal or other external display devices.
  • the mobile phone 1000 may further include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors.
  • the motion sensor includes an acceleration sensor.
  • the acceleration sensor can detect the magnitude of acceleration in various directions (usually three-axis), and can detect the magnitude and direction of gravity when it is stationary, and can be used for applications that recognize the mobile phone posture (such as horizontal and vertical screen switching, Related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, percussion), etc.
  • the audio circuit 1060, the speaker 1061, and the microphone 1062 may provide an audio interface between the user and the mobile phone 1000.
  • the mobile phone 1000 may further include a WiFi module 1070.
  • WiFi technology is a short-distance wireless transmission technology. Through the WiFi module 1070, the mobile phone 1000 can help users send and receive e-mails, browse web pages, and access streaming media. It provides users with wireless broadband Internet access.
  • FIG. 10 shows the WiFi module 1070, it is understandable that it is not a necessary component of the mobile phone 1000, and can be omitted as needed without changing the essence of the invention.
  • the processor 1080 is the control center of the mobile phone 1000. It uses various interfaces and lines to connect various parts of the entire mobile phone. By running or executing software programs and/or modules stored in the memory 1020, and calling data stored in the memory 1020, Perform various functions of the mobile phone 1000 and process data, thereby monitoring the mobile phone as a whole.
  • the processor 1080 may be a central processing unit (CPU), a general-purpose processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (ASIC), a field programmable gate array ( field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof.
  • the processor 1080 may implement or execute various exemplary logical blocks, modules, and circuits described in conjunction with the disclosure of this application.
  • the processor 1080 may also be a combination that implements computing functions, for example, a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the processor 1080 may include one or more processor units.
  • the processor 1080 includes an application processor and a baseband processor.
  • the mobile phone 1000 also includes a power source 1090 (such as a battery) for supplying power to various components.
  • the power source can be logically connected to the processor 1080 through a power management system, so that functions such as charging, discharging, and power management can be managed through the power management system.
  • the mobile phone 1000 may also include a camera, a Bluetooth module and other devices, which are not described here.
  • the memory 1020 is used to store program instructions
  • the processor 1080 is configured to perform the following operations according to program instructions stored in the memory 1020:
  • the designated short message is a silent short message or a verification code short message
  • the verification code short message contains a verification code for logging in to a financial account
  • the notification display panel 1041 displays a message, which is used to remind the terminal user that the terminal is under a sniffing attack.
  • the processor 1080 judges whether the terminal is under a sniffing attack based on receiving a designated short message, and prompts the user if it is determined that the terminal is under a sniffing attack, and can perform corresponding operations spontaneously or according to the user's instructions to avoid base stations Send another short message to the terminal again, or prevent the base station from responding to the operation of the illegal person on the financial account, so as to prevent the illegal person from transferring the terminal user's property through the SMS + verification code.
  • FIG. 11 is a schematic diagram of an integrated circuit for reducing sniffing attacks provided by an embodiment of the application.
  • the integrated circuit 1100 includes an input/output port 1120 and a processor 1110.
  • the input/output port 1120 is used to receive a designated short message from the base station.
  • the designated short message is a silent short message or a verification code short message.
  • the verification code short message contains a verification code for logging in to a financial account.
  • the processor 1110 is used to determine whether the terminal is attacked by sniffing; and to prompt the user when it is determined that the terminal is attacked by sniffing.
  • the integrated circuit 1100 may be a baseband processing chip, and the input/output ports of the baseband processing chip, such as the pins of the chip, receive designated short messages from the base station.
  • the processor of the baseband processing chip determines whether the terminal is attacked by sniffing; and prompts the user if it is determined that the terminal is attacked by sniffing. For specific operations, refer to S402 performed by the terminal in the description of FIG. 4 above. For the sake of brevity, details are not repeated here.
  • the baseband processing chip sends an instruction message to the application processing chip of the same terminal through the input/output port, so that the application processing chip controls the user interface (such as the display screen) of the terminal to display the message.
  • This message is used to alert the terminal user that the terminal is being attacked by sniffing.
  • S403 performed by the terminal in the description of FIG. 4 above. For the sake of brevity, details are not repeated here.
  • the integrated circuit 1100 may be an application processing chip.
  • the application handles the input/output ports of the chip, such as the pins of the chip, and receives designated short messages from the base station.
  • the designated short messages are silent short messages or verification code short messages.
  • the verification code short messages contain a verification code for logging in to a financial account. For specific operations, refer to S401 performed by the terminal in the description of FIG. 4 above. For the sake of brevity, details are not repeated here.
  • the processor of the application processing chip determines whether the terminal is attacked by sniffing according to the situation of receiving the designated short message. For specific operations, refer to S402 performed by the terminal in the description of FIG. 4 above. For the sake of brevity, details are not repeated here.
  • the application processing chip controls the user interface (such as the display screen) of the terminal to display messages. This message is used to alert the terminal user that the terminal is being attacked by sniffing. For specific operations, refer to S403 performed by the terminal in the description of FIG. 4 above. For brevity, details are not repeated here.
  • the application processing chip responds to a user interface of the terminal, such as a touch event of a display screen, to cause the display screen to close a prompt message.
  • a user interface of the terminal such as a touch event of a display screen
  • the touch event is used to indicate that the user confirms to close the prompt message.
  • the integrated circuit 1100 may also be a system chip, which integrates two parts, a baseband processor and an application processor, where the baseband processor and the application processor can execute the relevant algorithm of FIG. 5 or FIG. 6.
  • the processor 1110 may be the various types of processors described above.
  • the integrated circuit 1100 may also include a memory 1130, and the processor 1110 is connected to the memory 1130, and the processor 1110 can execute the instructions stored in the memory 1130, so that the integrated circuit 1100 executes any of the methods shown in FIGS. 4 to 8 .
  • the transceiving module 901 in FIG. 9 can be implemented by the RF circuit 1010 in FIG. 10, which may be an antenna, or may be implemented by the input/output port 1120 in FIG. 11, etc., where the input/output port may also be The pin of the chip.
  • the processing module 902 in FIG. 9 may be implemented by the processor 1080 in FIG. 10, or may be implemented by the processor 1110 in FIG. 11. Further, the processor 1080 may be a baseband processor or an application processor.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种减少嗅探攻击的方法、装置及集成电路，用以减小终端被嗅探攻击的概率。方法包括：终端接收来自基站的指定短信，该指定短信为静默短信或验证码短信，该验证码短信中包含用于登录金融账号的验证码；终端判断是否被嗅探攻击；终端在确定被嗅探攻击的情况下提示用户。

Description

一种减少嗅探攻击的方法、装置及集成电路 技术领域
本申请涉及通信技术领域，尤其涉及一种减少嗅探攻击的方法、装置及集成电路。
背景技术
嗅探设备是一种可以监听获取网络信息的设备，在实际应用中，非法者可以通过嗅探设备来窃取用户信息，从而达到非法目的。比如，终端和嗅探设备驻留在同一个全球移动通信系统(global system for mobile communication，GSM)基站下时，由于当前很多金融应用(如银行APP)可以采用短信验证码的方式登录，非法者可以通过监听终端收到的短信验证码来登录终端用户的金融账号，进而进行财产转移。如图1所示，若用户A所使用的终端与嗅探设备驻留在同一个GSM基站下，那么终端接收到的短信会被嗅探设备监听到，非法者可以根据短信中的验证码登录用户A的金融账号。
具体地，嗅探攻击的过程可以如图2所示。终端B和伪终端C向GSM核心网注册，且嗅探设备A和终端B驻留在同一GSM基站下。伪终端C获取到终端B的手机号码(例如通过非法途径购买或者通过外卖信息、快递信息等信息泄露的方式获取)后，向终端B发送特定内容或者一定数量的静默(SILENT)短信。其中，静默短信为第三代合作伙伴计划(3rd generation partnership project，3GPP)中规定不显示给用户的短消息。GSM基站寻呼终端B发送SILENT短信时，嗅探设备A同样可以监听到该SILENT短信，那么嗅探设备A可以根据SILENT短信的内容或者监听到SILENT短信的数量确定自身与终端B驻留在同一个GSM基站下。此时，非法者可操纵伪终端C，采用终端B的号码登录金融账号，进而触发网络给终端B发送包含验证码的短信。在网络发送验证码短信后，终端B和嗅探设备A均获取到该验证码短信。因而非法者可在终端C中输入验证码登录终端B的金融账户，进行财产转移。
此外，在上述嗅探攻击的流程中，嗅探设备A也可以不执行确定与终端B驻留在同一GSM基站下的流程，直接由伪终端C使用终端B的号码登录金融账号；若嗅探设备A与终端B驻留在同一GSM基站下，则嗅探攻击成功；若嗅探设备A与终端B不驻留在同一GSM基站下，则嗅探攻击失败。
在上述嗅探攻击流程中，由于GSM网络采用明文传输或者GSM加密算法被破解，因而难以阻止嗅探设备A监听网络信息；此外，非法者通常选择半夜或者选择终端B处于静止状态时触发上述攻击流程，此时用户可能处于睡眠状态或者用户未查看手机，因而用户难以察觉接收到验证码短信的情况，给非法者可乘之机。
因此，亟需一种减小嗅探攻击的方案，来减少终端被嗅探攻击的概率。
发明内容
本申请实施例提供了一种减少嗅探攻击的方法、装置及集成电路，用以减小终端被嗅探攻击的概率。
第一方面，本申请实施例提供一种减少嗅探攻击的方法，该方法包括：终端接收来自基站的指定短信，该指定短信可以为静默短信或验证码短信，验证码短信中包含用于登录 金融账号的验证码；终端判断是否被嗅探攻击；终端在确定被嗅探攻击的情况下提示用户。
采用上述方案，终端在接收到静默短信或者验证码短信后，可以根据终端接收指定短信的情况判断终端是否被嗅探攻击，从而避免基站再次向终端发送其他短信，或者避免基站对非法者针对金融账号的操作进行响应，进而达到阻止非法者通过短信+验证码的方式对终端用户的财产进行转移的目的。
在一种可能的设计中，若指定短信为静默短信，终端判断是否被嗅探攻击，具体可通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态。然后，终端确定被嗅探攻击。
其中，预设时间段可以为零点至凌晨五点。
采用上述方案，终端在确定当前驻留在GSM制式的情况下，再结合接收到静默短信的时间以及终端当前的运动状态来确定终端是否被嗅探攻击。
在一种可能的设计中，若指定短信为静默短信，终端判断是否被嗅探攻击，具体可通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段。然后，终端确定被嗅探攻击。
其中，预设时间段可以为零点至凌晨五点。
采用上述方案，终端在确定当前驻留在GSM制式的情况下，再结合接收到静默短信的时间来确定终端是否被嗅探攻击。
在一种可能的设计中，若指定短信为验证码短信，终端判断是否被嗅探攻击，具体可通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态；终端在预设时长内未请求基站发送验证码短信；然后，终端确定被嗅探攻击。
其中，预设时间段可以为零点至凌晨五点。
采用上述方案，终端在确定当前驻留在GSM制式的情况下，再结合接收到验证码短信的时间、终端当前的运动状态以及终端是否请求基站发送验证码短信的情况来确定终端是否被嗅探攻击。
在一种可能的设计中，若指定短信为验证码短信，终端判断是否被嗅探攻击，具体可通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；终端在预设时长内未请求基站发送验证码短信；然后，终端确定被嗅探攻击。
采用上述方案，终端在确定当前驻留在GSM制式的情况下，再结合终端是否请求基站发送验证码短信的情况来确定终端是否被嗅探攻击。
在一种可能的设计中，若指定短信为验证码短信，终端判断是否被嗅探攻击，具体可通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端在预设时长内未请求基站发送验证码短信；然后，终端确定被嗅探攻击。
其中，预设时间段可以为零点至凌晨五点。
采用上述方案，终端在确定当前驻留在GSM制式的情况下，再结合接收到验证码短信的时间以及终端是否请求基站发送验证码短信的情况来确定终端是否被嗅探攻击。
具体地，终端在提示用户时，具体可通过如下方式实现：若终端处于灭屏状态，则终端通过震动或响铃的方式提示用户。
具体地，终端在提示用户时，也可通过如下方式实现：若终端处于亮屏状态，则终端 在用户界面显示消息提示用户。
采用上述方案，终端可以在灭屏和亮屏状态下采用不同的方式提示用户，从而使得用户获知终端被嗅探攻击的情况。
在一种可能的设计中，在终端提示用户之后，若终端处于灭屏状态，则终端可以禁用GSM制式。
在另一种可能的设计中，在终端提示用户之后，若终端处于亮屏状态，则终端可以在用户界面显示消息，提示用户是否禁用GSM模式，并根据用户选择禁用GSM模式。
采用上述方案，在采用不同的方式禁用GSM制式之后，终端在GSM网络下处于未注册状态，GSM基站无法寻呼该终端，GSM基站不会再向该终端发送其他短信；非法者在操纵其他终端登录金融账号或者进行转移财产的操作时，GSM基站也不会对相关操作进行响应，从而在终端被嗅探攻击的情况下避免终端用户的财产损失。
第二方面，本申请实施例提供一种减少嗅探攻击的装置，该装置应用于终端，包括：收发模块，用于接收来自基站的指定短信，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码；处理模块，用于判断终端是否被嗅探攻击；以及，在确定终端被嗅探攻击的情况下提示用户。
在第一种可能的设计中，若指定短信为静默短信，处理模块在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态；然后，确定终端被嗅探攻击。
在第二种可能的设计中，若指定短信为静默短信，处理模块在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；然后，确定终端被嗅探攻击。
在第三种可能的设计中，若指定短信为验证码短信，处理模块在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态；终端在预设时长内未请求基站发送验证码短信；然后，确定终端被嗅探攻击。
在第四种可能的设计中，若指定短信为验证码短信，处理模块在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；终端在预设时长内未请求基站发送验证码短信；然后，确定终端被嗅探攻击。
在第五种可能的设计中，若指定短信为验证码短信，处理模块在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端在预设时长内未请求基站发送验证码短信；然后，确定终端被嗅探攻击。
具体地，处理模块在提示用户时，具体用于：若终端处于灭屏状态，则通过震动或响铃的方式提示用户。
具体地，处理模块在提示用户时，具体用于：若终端处于亮屏状态，则在用户界面显示消息提示用户。
在一种可能的设计中，处理模块还用于：在提示用户之后，若终端处于灭屏状态，则禁用GSM制式。
在一种可能的设计中，处理模块还用于：在提示用户之后，若终端处于亮屏状态，则在用户界面显示消息提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
第三方面，本申请实施例提供了一种用于减少嗅探攻击的集成电路，该集成电路包括：
输入/输出端口，用于接收来自基站的指定短信，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码；
处理器，用于根据接收该指定短信的情况判断终端是否被嗅探攻击；以及在确定终端被嗅探攻击的情况下提示用户。
在一种可能的设计中，若指定短信为静默短信，所述处理器在确定终端当前驻留在GSM制式下、当前时间处于预设时间段以及终端当前处于静止状态的情况下，确定终端被嗅探攻击。
在一种可能的设计中，若指定短信为静默短信，所述处理器在确定终端当前驻留在GSM制式下以及当前时间处于预设时间段的情况下，确定终端被嗅探攻击。
在一种可能的设计中，若指定短信为验证码短信，所述处理器在确定终端当前驻留在GSM制式下、当前时间处于预设时间段、终端当前处于静止状态以及终端在预设时长内未请求基站发送验证码短信的情况下，确定终端被嗅探攻击。
在一种可能的设计中，若指定短信为验证码短信，所述处理器在确定终端当前驻留在GSM制式下以及终端在预设时长内未请求基站发送验证码短信的情况下，确定终端被嗅探攻击。
在一种可能的设计中，若指定短信为验证码短信，所述处理器在确定终端当前驻留在GSM制式下、当前时间处于预设时间段以及终端在预设时长内未请求基站发送验证码短信的情况下，确定终端被嗅探攻击。
在一种可能的设计中，处理器在提示用户时，具体用于：使能该集成电路所在终端的扬声器响铃，以提示用户；或者，使能该集成电路所在终端的线性马达震动，以提示用户。
在一种可能的设计中，处理器在提示用户时，具体用于：使能该集成电路所在终端的用户界面显示消息，以提示用户。
此外，在提示用户之后，处理器还可禁用GSM制式。或者，在提示用户之后，处理器可使能该集成电路所在终端的用户界面显示消息，以提示用户是否禁用GSM模式，并根据用户选择禁用GSM模式。
在一种可能的设计中，所述集成电路中还可以包含存储器，该存储器可用于存储程序代码，当所述程序代码被执行时，处理器可执行第三方面或者第三方面任意一种可能的设计中处理器所执行的操作。
此外，处理器在执行上述操作时，可能需要判断指定短信的内容(例如判断指定短信为静默短信或验证码短信)，该指定短信可存储于所述集成电路所在终端的闪存中，所述集成电路可以通过输入输出端口读取闪存中存储的指定短信。
结合第三方面或第三方面中任一可能的设计，一种可能的设计中，该集成电路为基带处理芯片。另一种可能的设计中，该集成电路为应用处理芯片。再一种可能的设计中，该集成电路为系统芯片(system on chip，SoC)。
第四方面，本申请实施例还提供了一种计算机可读存储介质，用于存储为执行上述第一方面或第一方面的任意一种设计的功能所用的程序，该程序被处理器执行时，用于实现上述第一方面或第一方面的任意一种设计所述的方法。
第五方面，本申请实施例提供了一种包含程序代码的计算机程序产品，当其包含的程序代码在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意一种设计所述 的方法。
第六方面，本申请实施例提供了一种无线通信系统，包括基站，以及如第一方面、第二方面或者相应方面中任意一种可能的实施方式中所述的终端，或者，包含如第三方面或者第三方面中任意一种可能的实施方式中所述的芯片的装置。
另外，第二方面至第六方面中任一种可能设计方式所带来的技术效果可参见第一方面中不同设计方式所带来的技术效果，此处不再赘述。
附图说明
图1为现有技术提供的一种嗅探攻击场景的示意图；
图2为现有技术提供的一种嗅探攻击的流程示意图；
图3为本申请实施例提供的一种通信系统的结构示意图；
图4为本申请实施例提供的第一种减少嗅探攻击的方法的流程示意图；
图5为本申请实施例提供的第二种减少嗅探攻击的方法的流程示意图；
图6为本申请实施例提供的第三种减少嗅探攻击的方法的流程示意图；
图7为本申请实施例提供的第四种减少嗅探攻击的方法的流程示意图；
图8为本申请实施例提供的第五种减少嗅探攻击的方法的流程示意图；
图9为本申请实施例提供的一种减少嗅探攻击的装置的结构示意图；
图10为本申请实施例提供的一种终端的结构示意图；
图11为本申请实施例提供的一种集成电路的结构示意图。
具体实施方式
如背景技术中所述，现有技术中，终端易被嗅探攻击。本申请实施例提供一种减少嗅探攻击的方法、装置及集成电路，用以减小终端被嗅探攻击的概率。其中，方法和装置是基于同一技术构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
下面，首先对本申请实施例的应用场景加以介绍。本申请实施例可应用于图3所示的通信系统中。该通信系统中包含终端、嗅探设备和GSM基站。
其中，所述终端具备接收短信的功能。终端可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
特别地，本申请实施例应用于终端驻留在GSM基站的场景下，终端驻留在GSM基站时可能会发生终端被嗅探攻击的情况。但是终端支持的网络制式并不限于GSM一种。终端支持的网络制式包括但不限于GSM、码分多址接入(code division multiple access，CDMA)、带宽码分多址接入(wide-band code division multiple access，WCDMA)、时分同 步码分多址接入(time division-synchronous code division multiple access，TD-SCDMA)、长期演进(long term evolution，LTE)、第五代(5th generation，5G)通信系统。
在图3所示的通信系统中，GSM基站是为终端提供GSM制式下的服务的设备。例如，在终端附着的时候，为终端提供入网认证；在终端有业务请求时，为终端分配网络资源；在终端移动的时候，为终端更新网络资源；在终端空闲的时候，为终端提供快恢复机制；在终端去附着的时候，为终端释放网络资源；在终端有业务数据时，为终端提供数据路由功能。
在图3所示的通信系统中，嗅探设备和终端驻留在同一GSM基站下。终端接收到的短信(例如验证码短信)也会被驻留在同一GSM基站下的嗅探设备获取。非法者可以根据嗅探设备截获的短信的信息来登录终端的金融账号。其中，嗅探设备具有短信收发功能，例如可以是手机、平板电脑、VR设备、AR设备等设备；也可以是一个接收器。
下面将结合附图对本申请实施例作进一步地详细描述。
需要说明的是，本申请实施例中，多个是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
参见图4，为本申请实施例提供的一种减少嗅探攻击的方法。该方法包括如下步骤。
S401：终端接收来自基站的指定短信。
其中，指定短信可以为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码。
如背景技术中所述，非法者在对终端进行嗅探攻击时，可以通过发送静默(SILENT)短信的方式来判断终端是否与嗅探设备驻留在同一GSM基站下。例如，非法者可以通过嗅探设备或者其他终端给被攻击终端发送特定内容的静默短信，或者发送一定数量的静默短信。若嗅探设备也监听到该特定内容的静默短信，或者嗅探设备也监听到一定数量的静默短信，则可以确定嗅探设备与被攻击终端驻留在同一个GSM基站下，进而对被攻击终端进行攻击。
此外，非法者在对终端进行嗅探攻击时，也可以不事先确定嗅探设备与终端驻留在同一GSM基站下。非法者可以操作其他终端(不限定该终端与被攻击终端驻留在同一GSM基站)直接登录被攻击终端的金融账号，登录方式选择验证码登录。那么，GSM基站会向被攻击终端发送验证码短信。若嗅探设备与被攻击终端驻留在同一GSM基站下，则嗅探设备也会监听到验证码短信，进而非法者可以根据获取到的验证码在其他终端上登录被攻击终端的金融账号，进行转移财产等非法操作(例如进行小额免密支付、验证码支付、验证码转账等操作)；若嗅探设备与被攻击终端未驻留在同一GSM基站下，则嗅探设备监听不到验证码短信，嗅探攻击失败。
结合以上描述可以看出，无论采用何种方式，在终端被嗅探攻击的过程中，终端设备都会接收到指定短信，例如静默短信或者验证码短信。因而，本申请实施例中可以在终端接收到指定短信的情况下结合其他信息来判断终端是否被嗅探攻击。
此外，在向终端发送静默短信或者触发基站向终端发送验证码短信之前，非法者首先需要获取终端用户的号码。具体地，非法者可以通过网上购买等非法渠道获取终端用户的号码，或者通过外卖信息、快递信息等信息泄露的方式获取终端用户的号码。
S402：终端判断是否被嗅探攻击。
通过对现有技术的嗅探攻击过程的介绍可以看出，非法者通常在终端驻留在GSM制式下的时候对终端进行嗅探攻击。那么，若终端在GSM制式下接收到静默短信或者验证码短信，则判断终端可能被嗅探攻击。
再者，非法者通常选择半夜或者选择终端处于静止状态时触发嗅探攻击的流程，那么终端在半夜或者终端在静止状态下接收指定短信，则判断终端可能被嗅探攻击。
此外，对于终端接收到验证码短信的情况，若终端在一定时间内并未登录金融账户(即并未触发基站发送验证码短信)，但终端却接收到了验证码短信，那么该验证码短信很可能是非法者登录该用户的金融账户时触发基站发送的，则可据此判断终端可能被嗅探攻击。
实际应用中，可以根据实际情况采用上述判断逻辑中的一种或几种，来判断终端是否被嗅探攻击。
具体地，若指定短信为静默短信，则S402中终端判断是否被嗅探攻击，可以通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态。然后，终端确定被嗅探攻击。
在另一种实现方式中，若指定短信为静默短信，则S402中终端判断是否被嗅探攻击，可以通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段。然后，终端确定被嗅探攻击。
具体地，若指定短信为验证码短信，则S402中终端判断是否被嗅探攻击，可以通过如下方式实现：终端确定存在如下情况：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态；终端在预设时长内未请求基站发送验证码短信。然后，终端确定被嗅探攻击。
在另一种实现方式中，若指定短信为验证码短信，则S402中终端判断是否被嗅探攻击，可以通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；终端在预设时长内未请求基站发送验证码短信。然后，终端确定被嗅探攻击。
在另一种实现方式中，若指定短信为验证码短信，则S402中终端判断是否被嗅探攻击，可以通过如下方式实现：终端确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端在预设时长内未请求基站发送验证码短信。然后，终端确定被嗅探攻击。
需要说明的是，以上几种判断终端是否被嗅探攻击的方式仅为示例。实际应用中，可以在确定当前驻留在GSM制式的情况下，再结合接收到指定短信的时间、终端当前的运动状态以及终端是否请求基站发送验证码短信的情况中的一种或多种来判断终端是否被嗅探攻击。
S403：终端在确定被嗅探攻击的情况下提示用户。
S403中，终端在提示用户时，可以根据终端是否亮屏而采用不同的提示方式。
具体地，若终端处于灭屏状态，则终端可以通过震动或响铃的方式提示用户。若终端处于灭屏状态，此时用户可能未查看手机，若通过用户界面显示消息提示用户，用户可能无法查看到提示信息，因而可以采用震动或者响铃的方式提示用户
此外，若终端处于亮屏状态，则终端可以通过用户界面显示消息提示用户。若终端处于亮屏状态，此时用户可能正在查看手机，则可通过用户界面显示消息提示用户。
当然，实际应用中，也可以不根据终端是否亮屏的状态而采用不同的提示方式。例如，无论终端是否亮屏，均可采用震动或者响铃的方式提示用户；或者，无论终端是否亮屏，均可通过用户界面显示消息提示用户。本申请实施例中对提示用户的具体方式不做限定。
此外，终端在执行S403提示用户之后，若终端处于灭屏状态，则终端可以禁用GSM制式。
在另一种实现方式中，终端在执行S403提示用户之后，若终端处于亮屏状态，则终端可以在用户界面显示消息提示用户是否禁用GSM模式，并根据用户选择禁用GSM模式。
本申请实施例中，若确定终端被嗅探攻击，则终端可以采取相应措施(例如禁用GSM制式)来避免终端用户的财产损失。在禁用GSM制式之后，终端在GSM网络下处于未注册状态，GSM基站无法寻呼该终端，GSM基站不会再向该终端发送其他短信；非法者在操纵其他终端登录金融账号或者进行转移财产的操作时，GSM基站也不会对相关操作进行响应，从而在终端被嗅探攻击的情况下避免终端用户的财产损失。
当然，实际应用中，也可以不根据终端是否亮屏的状态而采用不同的处理方式。例如，无论终端是否亮屏，终端均可直接禁用GSM制式；或者，无论终端是否亮屏，均可通过用户界面显示消息提示用户是否禁用GSM模式，然后根据用户选择执行相应操作。本申请实施例对此不做具体限定。
需要说明的是，本申请实施例中，可以通过终端驻留制式、接收到指定短信的时间、终端当前的运动状态以及终端是否请求基站发送验证码短信的情况来确定终端是否被嗅探攻击。然后，可以采用不同方式禁用GSM制式。但是，在通过如上方式进行判断时，可能存在误判的情况。若出现误判情况，终端还可以在一段时间之后将GSM制式解禁或者提示用户是否将GSM制式解禁，从而避免出现终端一直无法驻留GSM制式的情况。
此外，在禁用GSM制式之后，终端还可以在特定条件下将GSM解禁或者提示用户是否将GSM制式解禁。例如，在终端的移动距离大于预设值，或者在禁用GSM模式达到预设时间之后，终端可以将GSM解禁，或者提示用户是否将GSM制式解禁，并根据用户选择将GSM制式解禁。
综上，采用本申请实施例提供的减少嗅探攻击的方案，终端在接收到静默短信或者验证码短信后，可以根据接收指定短信的情况判断终端是否被嗅探攻击，从而避免基站再次向终端发送其他短信，或者避免基站对非法者针对金融账号的操作进行响应，进而达到阻止非法者通过短信+验证码的方式对终端用户的财产进行转移的目的。
在一个实施例中，图4所示方法的执行主体终端可以包括基带处理器和应用处理器。
在一个实施例中，图4所示的方法中的S401和S402可由基带处理器执行，S403可由应用处理器执行。具体地，如图5所示，该方法可以包括以下步骤：
S501：基带处理器接收来自基站的指定短信。
其中，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码。
S502：基带处理器判断终端是否被嗅探攻击。
可选地，若指定短信为静默短息，基带处理器可以在终端当前驻留在GSM制式下、当前时间处于预设时间段且终端当前处于静止状态的情况下，确定终端被嗅探攻击。
可选地，若指定短信为验证码短信，基带处理器可以在终端当前驻留在GSM制式下、 当前时间处于预设时间段、终端当前处于静止状态且终端在预设时长内未请求基站发送验证码短信的情况下，确定终端被嗅探攻击。
S503：基带处理器向应用处理器发送用于指示终端被嗅探攻击的指示消息。
S504：应用处理器提示用户终端被嗅探攻击。
可选地，应用处理器可以通过震动或响铃的方式提示用户。
可选地，应用处理器可以在用户界面显示消息提示用户。
此外，在应用处理器提示用户之后，应用处理器还可以禁用GSM制式，或者，应用处理器可以在用户界面提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
在另一实施例中，图4所示的方法中S401可由基带处理器执行，S402和S403可由应用处理器执行。具体地，如图6所示，该方法可以包括以下步骤：
S601：基带处理器接收来自基站的指定短信。
其中，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码。
S602：基带处理器向应用处理器发送指定短信。
S603：应用处理器判断终端是否被嗅探攻击。
可选地，若指定短信为静默短息，应用处理器可以在终端当前驻留在GSM制式下、当前时间处于预设时间段且终端当前处于静止状态的情况下，确定终端被嗅探攻击。
可选地，若指定短信为验证码短信，应用处理器可以在终端当前驻留在GSM制式下、当前时间处于预设时间段、终端当前处于静止状态且终端在预设时长内未请求基站发送验证码短信的情况下，确定终端被嗅探攻击。
S604：应用处理器在确定终端被嗅探攻击的情况下提示用户。
可选地，应用处理器可以通过震动或响铃的方式提示用户。
可选地，应用处理器可以在用户界面显示消息提示用户。
此外，在应用处理器提示用户之后，应用处理器还可以禁用GSM制式，或者，应用处理器可以在用户界面提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
在图5和图6所示的实施例中，基带处理器和应用处理器执行的具体操作可以参照上文针对图4的描述中终端所执行的相关步骤，为简洁描述，在此不再重复赘述。
基于同一构思，本申请实施例还提供一种减少嗅探攻击的方法，该方法可视为图4所示方法的一个具体示例。参见图7，该方法包括如下步骤。
【1】终端B和伪终端C向GSM核心网注册，且嗅探设备A和终端B驻留在同一GSM基站下。
【2】伪终端C获取到终端B的手机号码。其中，非法者可通过非法途径购买或者通过外卖信息、快递信息等信息泄露的方式获取终端B的手机号码。
【3】伪终端C向终端B发送特定内容的静默(SILENT)短信。
【4】终端B和嗅探设备A均接收到SILENT短信。
【5】嗅探设备A监听到了SILENT短信，根据短信内容确定终端B和嗅探设备A驻 留在同一个GSM基站下。
【6】终端B判断当前处于如下状态时，判断终端B被嗅探攻击并提醒用户：1)当前时间为半夜(默认为当地时间24点到5点，也可通过用户设置)；2)终端B当前驻留在GSM制式下；3)终端B当前处于静止或微动状态下。
【7】终端B判断被嗅探攻击，通知网络去注册。
其中，若终端B处于灭屏状态下，则可以通过震动和铃声以及界面提示用户受到攻击，并自动关闭对应手机卡或者对应手机卡的GSM能力；若终端B处于亮屏状态下，则可以在界面上提示用户可能受到攻击；并由用户在界面确定是否关闭号码对应的卡或者手机。
【8】非法者操纵伪终端C，采用终端B的号码登录金融账号。
【9】伪终端C触发网络给终端B发送包含验证码的短信。
【10】网络此时判断终端B处于未注册状态，此时网络将不会给终端B发送验证码短信，因而嗅探设备A无法监听到用户的验证码短信，从而无法达到财产转移的目的。
在图7所示的方法中，终端在特定时间以及状态下收到SILENT短信，认为正在受到嗅探攻击，然后进行相应操作，阻止网络再次给用户发送短信，最终达到嗅探设备无法获取到用户验证码、非法者无法进行财产转移的目的。
基于同一技术构思，本申请实施例还提供一种减少嗅探攻击的方法，该方法可视为图4所示方法的一个具体示例。参见图8，该方法包括如下步骤。
【1】终端B和伪终端C向GSM核心网注册，且嗅探设备A和终端B驻留在同一GSM基站下。
【2】非法者操纵伪终端C，采用终端B的号码登录金融账号。
【3】伪终端C触发网络给终端B发送包含验证码的短信。
【4】终端B和嗅探设备A均接收到验证码短信。
【5】嗅探设备A监听到验证码短信，则非法者使用该验证码在伪终端C上进行登录。
此外，在步骤5中，也可以直接在嗅探设备A上登录账号，以进行财产转移。
【6】终端B判断当前处于如下状态时，判断终端B被嗅探攻击并提醒用户：1)当前时间为半夜(默认为当地时间24点到5点，也可通过用户设置)；2)终端B当前驻留在GSM制式下；3)终端B当前处于静止或微动状态下；4)终端B无账户登录操作。
【7】终端B判断被嗅探攻击，通知网络去注册。
其中，若终端B处于灭屏状态下，则可以通过震动和铃声以及界面提示用户受到攻击，并自动关闭对应手机卡或者对应手机卡的GSM能力；若终端B处于亮屏状态下，则可以在界面上提示用户可能受到攻击；并由用户在界面确定是否关闭号码对应的卡或者手机。
【8】非法者操纵伪终端C，采用终端B的号码登录金融账号。
【9】伪终端C触发网络给终端B发送包含验证码的短信。
【10】网络此时判断终端B处于未注册状态，此时网络将不会给终端B发送验证码短信，因而嗅探设备A无法监听到用户的验证码短信，从而无法达到财产转移的目的。
在图8所示的方法中，终端在特定时间以及状态下收到验证码短信，认为正在受到嗅探攻击，然后进行相应操作，阻止网络再次给用户发送短信，最终达到嗅探设备无法获取到用户验证码、非法者无法进行财产转移的目的。
需要说明的是，图7所示方法和图8所示方法均可以视为图4所示方法的一个具体示 例，图7所示方法和图8所示方法中未详尽描述的实现方式可参见图4所示方法中的相关描述，此处不再赘述。
基于同一构思，本申请实施例还提供一种减少嗅探攻击的装置，该装置应用于终端。参见图9，减少嗅探攻击的装置900包括：收发模块901，用于接收来自基站的指定短信，其中，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码；处理模块902，用于判断终端是否被嗅探攻击；以及，在确定终端被嗅探攻击的情况下提示用户。
在一种实现方式中，若指定短信为静默短信，处理模块902在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态。然后，确定终端被嗅探攻击。
在另一种实现方式中，若指定短信为静默短信，处理模块902在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段。然后，确定终端被嗅探攻击。
若指定短信为验证码短信，在第一种实现方式中，处理模块902在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端当前处于静止状态；终端在预设时长内未请求基站发送验证码短信。然后，确定终端被嗅探攻击。
若指定短信为验证码短信，在第二种实现方式中，处理模块902在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；终端在预设时长内未请求基站发送验证码短信。然后，确定终端被嗅探攻击。
若指定短信为验证码短信，在第三种实现方式中，处理模块902在判断终端是否被嗅探攻击时，具体用于：确定存在如下情况：终端当前驻留在GSM制式下；当前时间处于预设时间段；终端在预设时长内未请求基站发送验证码短信；然后，确定终端被嗅探攻击。
可选地，处理模块902在提示用户时，具体用于：若终端处于灭屏状态，则通过震动或响铃的方式提示用户。
可选地，处理模块902在提示用户时，具体用于：若终端处于亮屏状态，则在用户界面显示消息提示用户。
可选地，处理模块902还用于：在提示用户之后，若终端处于灭屏状态，则禁用GSM制式。
可选地，处理模块902还用于：在提示用户之后，若终端处于亮屏状态，则在用户界面显示消息提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。在本申请的实施例中的各功能模块可以集成在一个处理模块902中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来， 该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
同样需要说明的是，减少嗅探攻击的装置900可用于执行图4对应的实施例提供的方法终端所执行的操作，因此减少嗅探攻击的装置900中未详尽描述的实现方式及技术效果可参见图4中的相关描述。
图10为本申请实施例提供的一种终端的结构示意图，以终端为手机为例，图10示出的是与本申请实施例相关的手机1000的部分结构的框图。参考图10，手机1000包括：射频(radio frequency，RF)电路1010、存储器1020、输入单元1030、显示单元1040、传感器1050、音频电路1060、无线保真(wireless fidelity，WiFi)模块1070、处理器1080、以及电源1090等部件。本领域技术人员可以理解，图10中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图10对手机1000的各个构成部件进行具体的介绍：
RF电路1010可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器1080处理；另外，将设计上行的数据发送给基站。通常，RF电路包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(low noise amplifier，LNA)、双工器等。此外，RF电路1010还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(global system for mobile communications，GSM)、通用分组无线服务(general packet radio service，GPRS)、CDMA系统、WCDMA系统、TD-SCDMA系统、LTE系统、NR系统、电子邮件、短消息服务(short message service，SMS)等。
存储器1020可用于存储软件程序以及模块，处理器1080通过运行存储在存储器1020的软件程序以及模块，从而执行手机1000的各种功能应用以及数据处理。存储器1020可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序等；存储数据区可存储根据手机1000的使用所创建的数据等。此外，存储器1020可以包括易失性存储器，例如非挥发性动态随机存取内存(nonvolatile random access memory，NVRAM)、相变化随机存取内存(phase change ram，PRAM)、磁阻式随机存取内存(magetoresistive ram，MRAM)等；存储器1020还可以包括非易失性存储器，例如至少一个磁盘存储器件、电子可擦除可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、闪存器件，例如反或闪存(NOR flash memory)或是反与闪存(NAND flash memory)、半导体器件，例如固态硬盘(solid state disk，SSD)等。所述存储器1020还可以包括上述种类的存储器的组合。
输入单元1030可用于接收输入的数字或字符信息，以及产生与手机1000的用户设置以及功能控制有关的键信号输入。具体地，输入单元1030可包括触控面板1031以及其他输入设备1032。触控面板1031，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板1031上或在触控面板1031附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板1031可包括 触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器1080，并能接收处理器1080发来的命令并加以执行。此外，输入单元1030可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板1031。除了触控面板1031，输入单元1030还可以包括其他输入设备1032。
显示单元1040可用于显示由用户输入的信息或提供给用户的信息以及手机1000的各种菜单。显示单元1040可包括显示面板1041，可选的，可以采用液晶显示器(liquid crystal display，LCD)、有机发光二极管(organic light-emitting diode，OLED)等形式来配置显示面板1041。进一步的，触控面板1031可覆盖显示面板1041，当触控面板1031检测到在其上或附近的触摸操作后，传送给处理器1080以确定触摸事件的类型，随后处理器1080根据触摸事件的类型在显示面板1041上提供相应的视觉输出。虽然在图10中，触控面板1031与显示面板1041是作为两个独立的部件来实现手机1000的输入和输出功能，但是在某些实施例中，可以将触控面板1031与显示面板1041集成而实现手机1000的输入和输出功能。显示单元1040可用于显示内容，所述内容包括用户界面，比如提示消息，终端的开机界面，应用程序的用户界面。所述内容除了用户界面，还可以包括信息和数据。显示单元1040可以是终端的内置屏幕或者其他外部显示设备。
在一个实施例中，如图10所示，手机1000还可包括至少一种传感器1050，比如光传感器、运动传感器以及其他传感器。具体地，运动传感器包括加速度传感器，加速度传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等。
在一个实施例中，如图10所示，音频电路1060、扬声器1061和麦克风1062(也称传声器)可提供用户与手机1000之间的音频接口。
在一个实施例中，如图10所示，手机1000还可以包括WiFi模块1070。WiFi技术属于短距离无线传输技术，手机1000通过WiFi模块1070可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图10示出了WiFi模块1070，但是可以理解的是，其并不属于手机1000的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
处理器1080是手机1000的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器1020内的软件程序和/或模块，以及调用存储在存储器1020内的数据，执行手机1000的各种功能和处理数据，从而对手机进行整体监控。处理器1080可以是中央处理器(central processing unit，CPU)、通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。处理器1080可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器1080也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等。可选的，处理器1080可包括一个或多个处理器单元。在一个实施例中，处理器1080包括应用处理器和基带处理器。
手机1000还包括给各个部件供电的电源1090(比如电池)，电源可以通过电源管理系统与处理器1080逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
需要说明的是，虽然在图10中未示出，手机1000还可以包括摄像头、蓝牙模块等装置，在此不予赘述。
在本申请实施例中，
存储器1020，用于存储程序指令；
处理器1080，用于根据存储器1020中存储的程序指令执行以下操作：
通过RF电路1010接收来自基站的指定短信，该指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码；
判断终端是否被嗅探攻击；
在确定终端被嗅探攻击的情况下，通知显示面板1041显示消息，该消息用于向终端用户提醒终端被嗅探攻击。
本申请实施例，处理器1080根据接收到指定短信的情况判断终端是否被嗅探攻击，并在确定终端被嗅探攻击的情况下提示用户，进而可自发或根据用户指示执行相应操作，避免基站再次向终端发送其他短信，或者避免基站对非法者针对金融账号的操作进行响应，达到阻止非法者通过短信+验证码的方式对终端用户的财产进行转移的目的。
图11为本申请实施例提供的一种减少嗅探攻击的集成电路示意图。集成电路1100包括输入/输出端口1120和处理器1110。该输入/输出端口1120用于接收来自基站的指定短信，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码。处理器1110用于判断终端是否被嗅探攻击；以及在确定终端被嗅探攻击的情况下提示用户。
在一个实施例中，集成电路1100可以是基带处理芯片，该基带处理芯片的输入/输出端口，例如芯片的管脚，接收来自基站的指定短信。
基带处理芯片的处理器判断终端是否被嗅探攻击；以及在确定终端被嗅探攻击的情况下提示用户。具体操作可以参照上文针对图4的描述中终端执行的S402，为简洁起见，在此不再重复赘述。
基带处理芯片通过输入/输出端口向同一终端的应用处理芯片发送指示消息，使该应用处理芯片控制该终端的用户界面(例如显示屏)显示消息。该消息用于向该终端用户提醒终端被嗅探攻击。具体操作可以参照上文针对图4的描述中终端执行的S403，为简洁起见，在此不再重复赘述。
在一个实施例中，集成电路1100可以是应用处理芯片。该应用处理芯片的输入/输出端口，例如芯片的管脚，接收来自基站的指定短信，指定短信为静默短信或验证码短信，验证码短信中包含用于登录金融账号的验证码。具体操作可以参照上文针对图4的描述中终端执行的S401，为简洁起见，在此不再重复赘述。
该应用处理芯片的处理器根据接收该指定短信的情况判断终端是否被嗅探攻击。具体操作可以参照上文针对图4的描述中终端执行的S402，为简洁起见，在此不再重复赘述。
该应用处理芯片控制该终端的用户界面(例如显示屏)显示消息。该消息用于向该终端用户提醒终端被嗅探攻击。具体操作可以参照上文针对图4的描述中终端执行的S403， 为简洁起见，在此不再重复赘述。
在一个实施例中，该应用处理芯片响应于该终端的用户界面，例如显示屏的触摸事件，使该显示屏关闭提示消息。其中，该触摸事件用于表示用户确认关闭该提示消息。
在一个实施例中，该集成电路1100还可以是系统芯片，集成了基带处理器和应用处理器两部分，其中，该基带处理器和应用处理器可执行图5或图6相关算法。
应理解的是，处理器1110可以是前文所述的各种类型的处理器。集成电路1100中还可以包含存储器1130，处理器1110连接到存储器1130，该处理器1110可以运行存储器1130中存储的指令，以使该集成电路1100执行上述图4～图8任一所示的方法。
应理解的是，上述图9中的收发模块901可以由图10中RF电路1010实现，可以是天线，也可以由图11中的输入/输出端口1120等实现，其中输入/输出端口也可以是芯片的管脚。图9中的处理模块902可以由图10中的处理器1080实现，也可以由图11中的处理器1110实现。进一步地，处理器1080可以是基带处理器也可以是应用处理器。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (32)

  1. 一种减少嗅探攻击的方法，其特征在于，包括：
    终端接收来自基站的指定短信，所述指定短信为静默短信或验证码短信，所述验证码短信中包含用于登录金融账号的验证码；
    所述终端判断是否被嗅探攻击；
    所述终端在确定被嗅探攻击的情况下提示用户。
  2. 如权利要求1所述的方法，其特征在于，若所述指定短信为静默短信，所述终端判断是否被嗅探攻击，包括：
    所述终端确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端当前处于静止状态；
    所述终端确定被嗅探攻击。
  3. 如权利要求1所述的方法，其特征在于，若所述指定短信为静默短信，所述终端判断是否被嗅探攻击，包括：
    所述终端确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；
    所述终端确定被嗅探攻击。
  4. 如权利要求1所述的方法，其特征在于，若所述指定短信为验证码短信，所述终端判断是否被嗅探攻击，包括：
    所述终端确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端当前处于静止状态；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    所述终端确定被嗅探攻击。
  5. 如权利要求1所述的方法，其特征在于，若所述指定短信为验证码短信，所述终端判断是否被嗅探攻击，包括：
    所述终端确定存在如下情况：所述终端当前驻留在GSM制式下；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    所述终端确定被嗅探攻击。
  6. 如权利要求1所述的方法，其特征在于，若所述指定短信为验证码短信，所述终端判断是否被嗅探攻击，包括：
    所述终端确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    所述终端确定被嗅探攻击。
  7. 如权利要求1～6任一项所述的方法，其特征在于，所述终端提示用户，包括：
    若所述终端处于灭屏状态，则所述终端通过震动或响铃的方式提示用户。
  8. 如权利要求1～6任一项所述的方法，其特征在于，所述终端提示用户，包括：
    若所述终端处于亮屏状态，则所述终端在用户界面显示消息提示用户。
  9. 如权利要求1～8任一项所述的方法，其特征在于，在所述终端提示用户之后，还包括：
    若所述终端处于灭屏状态，则所述终端禁用GSM制式。
  10. 如权利要求1～8任一项所述的方法，其特征在于，在所述终端提示用户之后，还包括：
    若所述终端处于亮屏状态，则所述终端在用户界面显示消息提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
  11. 一种减少嗅探攻击的装置，其特征在于，包括：
    收发模块，用于接收来自基站的指定短信，所述指定短信为静默短信或验证码短信，所述验证码短信中包含用于登录金融账号的验证码；
    处理模块，用于判断终端是否被嗅探攻击；以及，在确定所述终端被嗅探攻击的情况下提示用户。
  12. 如权利要求11所述的装置，其特征在于，若所述指定短信为静默短信，所述处理模块在判断终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端当前处于静止状态；
    确定所述终端被嗅探攻击。
  13. 如权利要求11所述的装置，其特征在于，若所述指定短信为静默短信，所述处理模块在判断终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；
    确定所述终端被嗅探攻击。
  14. 如权利要求11所述的装置，其特征在于，若所述指定短信为验证码短信，所述处理模块在判断终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端当前处于静止状态；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    确定所述终端被嗅探攻击。
  15. 如权利要求11所述的装置，其特征在于，若所述指定短信为验证码短信，所述处理模块在判断终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    确定所述终端被嗅探攻击。
  16. 如权利要求11所述的装置，其特征在于，若所述指定短信为验证码短信，所述处理模块在判断终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    确定所述终端被嗅探攻击。
  17. 如权利要求11～16任一项所述的装置，其特征在于，所述处理模块在提示用户时，具体用于：
    若所述终端处于灭屏状态，则通过震动或响铃的方式提示用户。
  18. 如权利要求11～16任一项所述的装置，其特征在于，所述处理模块在提示用户时，具体用于：
    若所述终端处于亮屏状态，则在用户界面显示消息提示用户。
  19. 如权利要求11～18任一项所述的装置，其特征在于，所述处理模块还用于：
    在提示用户之后，若所述终端处于灭屏状态，则禁用GSM制式。
  20. 如权利要求11～18任一项所述的装置，其特征在于，所述处理模块还用于：
    在提示用户之后，若所述终端处于亮屏状态，则在用户界面显示消息提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
  21. 一种用于减少嗅探攻击的集成电路，所述集成电路应用于终端，其特征在于，包括：
    输入/输出端口，用于接收来自基站的指定短信，所述指定短信为静默短信或验证码短信，所述验证码短信中包含用于登录金融账号的验证码；
    处理器，用于判断所述终端是否被嗅探攻击；以及在确定所述终端被嗅探攻击的情况下提示用户。
  22. 如权利要求21所述的集成电路，其特征在于，若所述指定短信为静默短信，所述处理器在判断所述终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端当前处于静止状态；
    确定所述终端被嗅探攻击。
  23. 如权利要求21所述的集成电路，其特征在于，若所述指定短信为静默短信，所述处理器在判断所述终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；
    确定所述终端被嗅探攻击。
  24. 如权利要求21所述的集成电路，其特征在于，若所述指定短信为验证码短信，所述处理器在判断所述终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端当前处于静止状态；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    确定所述终端被嗅探攻击。
  25. 如权利要求21所述的集成电路，其特征在于，若所述指定短信为验证码短信，所述处理器在判断所述终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    确定所述终端被嗅探攻击。
  26. 如权利要求21所述的集成电路，其特征在于，若所述指定短信为验证码短信，所述处理器在判断所述终端是否被嗅探攻击时，具体用于：
    确定存在如下情况：所述终端当前驻留在GSM制式下；当前时间处于预设时间段；所述终端在预设时长内未请求所述基站发送所述验证码短信；
    确定所述终端被嗅探攻击。
  27. 如权利要求21～26任一项所述的集成电路，其特征在于，所述处理器在提示用户时，具体用于：
    若所述终端处于灭屏状态，则使能所述终端的扬声器响铃或使能所述终端的线性马达震动，以提示用户。
  28. 如权利要求21～26任一项所述的集成电路，其特征在于，所述处理器在提示用户时，具体用于：
    若所述终端处于亮屏状态，则使能所述终端的用户界面显示消息，以提示用户。
  29. 如权利要求21～28任一项所述的集成电路，其特征在于，所述处理器还用于：
    在提示用户之后，若所述终端处于灭屏状态，则禁用GSM制式。
  30. 如权利要求21～28任一项所述的集成电路，其特征在于，所述处理器还用于：
    在提示用户之后，若所述终端处于亮屏状态，则在用户界面显示消息提示用户是否禁用GSM模式，并根据用户选择确定是否禁用GSM模式。
  31. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有程序，所述程序被处理器执行时，用于实现如权利要求1～10任一项所述的方法。
  32. 一种计算机程序产品，其特征在于，所述计算机程序产品包含的程序代码在计算机上运行时，使得所述计算机执行如权利要求1～10任一项所述的方法。
PCT/CN2019/080662 2019-03-29 2019-03-29 一种减少嗅探攻击的方法、装置及集成电路 WO2020199035A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2019/080662 WO2020199035A1 (zh) 2019-03-29 2019-03-29 一种减少嗅探攻击的方法、装置及集成电路
CN201980007257.0A CN112020871A (zh) 2019-03-29 2019-03-29 一种减少嗅探攻击的方法、装置及集成电路

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/080662 WO2020199035A1 (zh) 2019-03-29 2019-03-29 一种减少嗅探攻击的方法、装置及集成电路

Publications (1)

Publication Number Publication Date
WO2020199035A1 true WO2020199035A1 (zh) 2020-10-08

Family

ID=72664785

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/080662 WO2020199035A1 (zh) 2019-03-29 2019-03-29 一种减少嗅探攻击的方法、装置及集成电路

Country Status (2)

Country Link
CN (1) CN112020871A (zh)
WO (1) WO2020199035A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338075B (zh) * 2021-11-10 2024-03-12 国网浙江省电力有限公司金华供电公司 基于广泛嗅探的攻击对象防御方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1434408A2 (en) * 2002-12-23 2004-06-30 Authenture, Inc. Authentication system and method based upon random partial pattern recognition
CN102572124A (zh) * 2011-12-16 2012-07-11 西安大唐电信有限公司 利用交换机no.7信令消息进行防范电信诈骗的方法和系统
CN106454845A (zh) * 2016-10-11 2017-02-22 北京元心科技有限公司 移动终端的探测监视方法和系统
CN106803028A (zh) * 2017-01-18 2017-06-06 西安电子科技大学 一种防止安卓手机短信验证码被窃取的方法
CN108076012A (zh) * 2016-11-14 2018-05-25 百度在线网络技术（北京）有限公司 异常登录判断方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104581731A (zh) * 2014-12-25 2015-04-29 中国科学院信息工程研究所 手机终端被伪基站劫持过程的判别方法及系统
CN106507352B (zh) * 2016-10-28 2019-09-17 北京安云世纪科技有限公司 短信验证码的网站识别方法及识别终端

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1434408A2 (en) * 2002-12-23 2004-06-30 Authenture, Inc. Authentication system and method based upon random partial pattern recognition
CN102572124A (zh) * 2011-12-16 2012-07-11 西安大唐电信有限公司 利用交换机no.7信令消息进行防范电信诈骗的方法和系统
CN106454845A (zh) * 2016-10-11 2017-02-22 北京元心科技有限公司 移动终端的探测监视方法和系统
CN108076012A (zh) * 2016-11-14 2018-05-25 百度在线网络技术（北京）有限公司 异常登录判断方法及装置
CN106803028A (zh) * 2017-01-18 2017-06-06 西安电子科技大学 一种防止安卓手机短信验证码被窃取的方法

Also Published As

Publication number Publication date
CN112020871A (zh) 2020-12-01

Similar Documents

Publication Publication Date Title
US10609646B2 (en) Intelligent management of a plurality of communications links
US10880746B2 (en) Network connection method, apparatus, storage medium and terminal
US11088836B2 (en) Key updating method, apparatus, and system
US10708065B2 (en) Service processing method, device and system
EP3200487B1 (en) Message processing method and apparatus
US10269163B2 (en) Method and apparatus for switching real-time image in instant messaging
US20170352090A1 (en) Method, apparatus, and system for processing order information
US10944558B2 (en) Key storing method, key managing method and apparatus
CN104915091B (zh) 一种显示状态栏提示信息的方法和装置
WO2018049897A1 (zh) 数据备份方法及设备
US11176228B2 (en) Application interface display method, apparatus, and terminal, and storage medium
US9660301B2 (en) Methods and devices for battery protection
US9998579B2 (en) Method, apparatus, and system for displaying message in mobile terminal
CN106375478B (zh) 一种移动终端数据的同步方法、装置及系统
CN104348956A (zh) 移动终端的防盗方法及装置
WO2019007371A1 (zh) 一种防止信息被盗的方法、存储设备及移动终端
CN107563158B (zh) 显示隐藏应用图标的方法、设备及计算机可读存储介质
US20170323115A1 (en) Method and apparatus for remotely deleting information
US11582179B2 (en) Information search method, terminal, network device, and system
CN104363590A (zh) 接入点连接方法及装置
CN106713319B (zh) 终端间的远程控制方法、装置、系统及移动终端
CN105721282B (zh) 消息显示方法及装置
CN104753672B (zh) 账号授权的方法、装置及终端
WO2020199035A1 (zh) 一种减少嗅探攻击的方法、装置及集成电路
CN109446435B (zh) 信息显示装置、方法、系统及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19922346

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19922346

Country of ref document: EP

Kind code of ref document: A1