WO2023124811A1 - 移动终端安全校验方法、移动终端及计算机可读存储介质 - Google Patents

移动终端安全校验方法、移动终端及计算机可读存储介质 Download PDF

Info

Publication number
WO2023124811A1
WO2023124811A1 PCT/CN2022/136652 CN2022136652W WO2023124811A1 WO 2023124811 A1 WO2023124811 A1 WO 2023124811A1 CN 2022136652 W CN2022136652 W CN 2022136652W WO 2023124811 A1 WO2023124811 A1 WO 2023124811A1
Authority
WO
WIPO (PCT)
Prior art keywords
mobile terminal
key
parameters
key parameters
key parameter
Prior art date
Application number
PCT/CN2022/136652
Other languages
English (en)
French (fr)
Inventor
杨玥
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2023124811A1 publication Critical patent/WO2023124811A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/72—Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
    • H04M1/724—User interfaces specially adapted for cordless or mobile telephones
    • H04M1/72448—User interfaces specially adapted for cordless or mobile telephones with means for adapting the functionality of the device according to specific conditions
    • H04M1/72463—User interfaces specially adapted for cordless or mobile telephones with means for adapting the functionality of the device according to specific conditions to restrict the functionality of the device
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Definitions

  • Embodiments of the present invention relate to but are not limited to the field of mobile terminal security, and specifically, relate to but are not limited to a method for verifying security of a mobile terminal, a mobile terminal, and a computer-readable storage medium.
  • the embodiments of the present invention provide a mobile terminal security verification method, a mobile terminal and a computer-readable storage medium, which solve the technical problem that the current mobile terminal does not have a relatively reliable security function for identifying whether the terminal is stolen.
  • An embodiment of the present invention provides a mobile terminal security verification method, and the mobile terminal security verification method includes:
  • the regional configuration file includes key parameter information and non-key parameter information.
  • the key parameter information is used to determine whether the mobile terminal can be powered on.
  • the key parameter information is used to determine the functions that can be used by the mobile terminal;
  • the state of the mobile terminal is adjusted.
  • the embodiment of the present invention also provides a mobile terminal, and the mobile terminal includes: a processor, a memory, and a communication bus;
  • the communication bus is configured to realize connection and communication between the processor and the memory
  • the processor is configured to execute one or more computer programs stored in the memory, so as to realize the steps of the above-mentioned method for verifying the security of a mobile terminal.
  • An embodiment of the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores one or more computer programs, and the one or more computer programs can be executed by one or more processors to implement The steps of the above-mentioned security verification method for a mobile terminal.
  • FIG. 1 is a schematic flowchart of a mobile terminal security verification method provided by Embodiment 1 of the present invention
  • FIG. 2 is a schematic flowchart of another mobile terminal security verification method provided in Embodiment 2 of the present invention.
  • FIG. 3 is a schematic flowchart of another mobile terminal security verification method provided in Embodiment 2 of the present invention.
  • Fig. 4 is a schematic diagram of a mobile terminal according to an embodiment of the present invention.
  • this embodiment provides a method for verifying the security of mobile terminals, which verifies the first power-on of mobile terminals. Normal startup, if the verification fails, it cannot be started normally, thus effectively ensuring the safety of the mobile terminal.
  • FIG. 1 is a schematic flowchart of a mobile terminal security verification method provided in this embodiment.
  • the mobile terminal safety checking method comprises the following steps:
  • the area configuration file is written into the mobile terminal when the mobile terminal leaves the factory.
  • the area configuration file can only be triggered when the mobile terminal is turned on for the first time after leaving the factory. Generally, after the mobile terminal is turned on for the first time, the area configuration file The file is no longer effective, but in some special cases, such as when the user repairs the mobile terminal, the after-sales maintenance point and the after-sales maintenance manufacturer can still restore the regional configuration file to ensure the safety of the mobile terminal.
  • the area configuration file includes key parameter information and non-key parameter information.
  • the key parameter information determines whether the mobile terminal can be turned on and used, and the non-key parameter information determines which functions the mobile terminal can use.
  • the parameters can be verified according to the preset verification rules, and information such as the location of the mobile terminal, the network status and the network operator can be verified and authenticated.
  • corresponding key parameters and non-key parameters are acquired, including:
  • the mobile terminal cannot be turned on.
  • the key parameter is the most important parameter.
  • the mobile terminal can be directly unable to start.
  • adjusting the state of the mobile terminal includes: when the key parameter check fails, the mobile terminal cannot be powered on; when the key parameter check passes, the non-key parameter check When the test fails, the mobile terminal enters a restricted state; when both the key parameters and the non-key parameters pass, the mobile terminal enters a normal state.
  • the key parameter is the most important parameter, so when the key parameter fails to pass the test, the mobile terminal will not be turned on directly.
  • the non-critical parameters belong to the secondary parameters.
  • the mobile terminal can be turned on normally, but the functions of the mobile terminal will be restricted, allowing the mobile terminal to enter a restricted state.
  • the restricted status includes, but is not limited to, the status of being unable to turn on the screen, unable to connect to the network independently, and unable to locate independently.
  • the verifying the key parameters and non-key parameters according to the preset verification rules includes: verifying the key parameters when only the key parameters are obtained; When the key parameter and the non-key parameter are acquired, the key parameter and the non-key parameter are verified.
  • non-critical parameters are non-essential parameters, it may not be possible to obtain non-critical parameters in time in some cases, so the verification of non-critical parameters during startup is not a necessary process.
  • after completing the verification of the key parameters it further includes: performing identity verification; if the identity verification fails, the device cannot be turned on; if the identity verification passes, the non-key parameters are verified.
  • identity verification includes but not limited to terminal identity verification and personnel identity verification.
  • the non-key parameters include at least two parameters, and when checking the non-key parameters, it is judged whether the parameters in the non-key parameters are completely obtained;
  • the mobile terminal enters the restricted state, and when obtaining parameters in the non-key parameters, identity verification is required until the non-key parameters in the non-key parameters
  • the normal state is entered when all the parameters pass the verification.
  • the complete non-critical parameters are not obtained at startup, it is only necessary to verify the non-critical parameters that have been obtained. After the verification is passed, the remaining non-critical parameters can be obtained and verified gradually until the verification is completely passed. . At the same time, in order to further ensure security, the identity needs to be verified each time when verifying the non-key parameters obtained subsequently. Of course, it can be understood that when one of the non-key parameters fails to pass the verification, the verification of the subsequent non-key parameters can be stopped.
  • the mobile terminal when the mobile terminal is turned on for the first time after leaving the factory, it also includes: detecting whether the mobile terminal is connected to the network; when connected to the network, querying whether the area configuration file is updated through the network; whether there is an update , download the update zone configuration file.
  • the regional configuration file of the mobile terminal can be updated, so as to avoid the problem of boot failure caused by normal buyers due to the failure of the regional configuration file.
  • the regional configuration file it is also possible to remotely lock the reporting terminal in a timely manner, and obtain information such as its location information and recording information, which is conducive to recovering the mobile terminal and reducing losses.
  • the area configuration file is used to specify the activation area of the mobile terminal and/or the access operator of the mobile terminal.
  • a method for verifying security of a mobile terminal includes: when the mobile terminal is turned on for the first time after leaving the factory, read the built-in area configuration file, the area configuration file shown includes key parameter information and non-key parameter information; according to the area configuration file, obtain the current key parameters and non-key parameters of the mobile terminal, and verify the key parameters and non-key parameters according to the preset verification rules; adjust the state of the mobile terminal according to the verification results.
  • the area configuration file can be obtained when the mobile terminal is turned on for the first time after leaving the factory, and the current key parameters and non-key parameters of the mobile terminal can be obtained according to the area configuration file, and then verified according to the preset The rules are verified, and the state of the mobile terminal is determined according to the verification result, thereby effectively ensuring the safety of the mobile terminal when it is turned on for the first time, and playing a role in preventing theft.
  • This embodiment takes a mobile phone as an example.
  • the mobile phone is based on a device that supports a radio frequency module on the hardware and supports GPS and WIFI chips.
  • a mobile terminal security verification method provided by the embodiment of the present invention is described in detail, including the following steps :
  • ProfileVersion Indicates the version number information of the profile file. By comparing the profile version number during the boot process of the mobile phone, it can be judged whether the configuration file needs to be updated. If there is a configuration file corresponding to the updated version number on the server, it can be judged as necessary Update zone configuration files.
  • Device Information Defined as the version number information of the corresponding project. Through this field, the mobile phone can be matched to the corresponding software version number of the corresponding project after connecting to the server during the boot process.
  • Control Policy Define specific area configuration policy parameters.
  • the configuration parameters can be multiple parameters, and the number of configuration parameters can be increased or decreased according to the requirements of the project.
  • Each set of configuration parameters defines name (parameter name), Value (a parameter needs to contain specific configuration information, which can be a value, or a group or multiple groups of values), Key or Not (for Define whether each configuration parameter is key information. If it is defined as Yes, it means that this parameter is a key parameter. During the entire startup process, after the key parameters are obtained, the key parameters need to be calibrated one by one during the verification process of the protection area. If all checks are passed, then the next step of identity verification will be performed. If it is defined as No, it means that this parameter information is not key information, and the machine can be stuck when the actual location area parameters are not obtained during the boot process. After a parameter message, start the verification.)
  • the first parameter is MCC as the country code, and the value is 460 to represent China. This parameter is key information and needs to be verified during the boot process, otherwise it cannot be booted.
  • One or more pieces of configuration information are preset when the mobile phone leaves the factory. For example, preset the MCC MNC parameters of a certain selling country or operator.
  • Parameter1 the the the name MCC the value 420 the Key or Not Yes
  • the second parameter is the operator code, the value is 01 for China Mobile, and 02 for China Unicom.
  • This parameter is non-critical information, that is, if the MNC information is obtained during the boot process, it will be compared. If this information is not obtained, the verification of this parameter information can be started again after the boot.
  • the third parameter is GPS information
  • the name is GEO
  • the parameter content is composed of multiple sets of parameters.
  • Each set of parameters includes latitude, longitude and radius information. Configuring multiple sets of parameters will cover some ranges, and the location information of the mobile phone can be judged by turning on the phone. Whether it is within this range to determine whether the user is in the protected area. Key or Not configured as No means that this parameter is non-key information. If this information is not obtained during the boot process, it does not affect the normal boot process. After booting, this information is obtained to check whether it is in the protection area.
  • the regional configuration file can be updated after the mobile phone is connected to the network (data network or WIFI). If there is one, the configuration file is updated. After the update is successful, it will be detected according to the latest configuration file policy. If the configuration file is not updated, the configuration file information preset by the mobile phone is used for detection.
  • the detection process is mainly divided into the following two embodiments according to the situation of the location area information of the network where the mobile phone is located after being turned on:
  • the location information obtained after the mobile phone is turned on, the key parameter information defined in it must be successfully obtained, if the acquisition is not successful, it cannot be turned on. If the acquisition is successful, verify the area information obtained successfully, and compare it with the information in the configuration file one by one. After the verification is successful, enter the identity verification. You can call the unlock key generation function by enabling the terminal, according to the IMEI number, etc. The information generates a secret key, which is compared with the password entered by the user to complete the identity authentication process. If the identity verification is successful, it will enter the boot process. After booting, judge whether there are non-key parameters that have not been successfully obtained. If not, it means that both key parameters and non-key parameters have been verified during the entire boot process, and enter the normal standby process. , the phone can be turned on normally.
  • the mobile phone After booting as shown in Figure 3, if it is judged that there is still unacquired non-key parameter information, the mobile phone enters standby mode but can only use some functions, for example, some functions related to network usage cannot be used.
  • key parameters are acquired again.
  • GPS parameter information is a non-key parameter, which may not be obtained during the first boot process.
  • the user uses the GPS function after booting, it will trigger to acquire non-key parameters again.
  • Key parameters after the acquisition is successful, check whether the non-key parameters are in the protected area. If it is in the protected area, it will enter the identity verification process again. After the verification is passed, the mobile phone will enter normal standby use. If the identity verification is unsuccessful after obtaining the non-key parameters, the mobile phone will enter the unusable state.
  • the mobile phone can also enter the normal standby state, and start the non-key parameter verification process when the corresponding non-key parameters are automatically obtained in the background, and the above In the embodiment, the mobile phone is in the state of using some functions to distinguish.
  • the entire process needs to complete all verification of key parameters and non-key parameters. After all verification is successful, it means that the mobile phone is sold to the corresponding region according to the factory configuration strategy, and the mobile phone can be used normally.
  • This embodiment also provides a mobile terminal, as shown in FIG. 4, which includes a processor 41, a memory 42, and a communication bus 43, wherein:
  • the communication bus 43 is configured to realize connection and communication between the processor 41 and the memory 42;
  • the processor 41 is configured to execute one or more computer programs stored in the memory 42, so as to implement the steps of a mobile terminal security verification method in the above-mentioned Embodiment 1 and Embodiment 2.
  • the present embodiment also provides a computer-readable storage medium, including any method or technology for storing information, such as computer-readable instructions, data structures, computer program modules, or other data.
  • volatile or nonvolatile, removable or non-removable media include but are not limited to RAM (Random Access Memory, random access memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, electrically erasable programmable read-only memory ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory, compact disk read-only memory), digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tapes, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store desired information and that can be accessed by a computer.
  • the computer-readable storage medium in this embodiment can be used to store one or more computer programs, and the one or more computer programs stored in it can be executed by a processor to realize a mobile in the above-mentioned Embodiment 1 and Embodiment 2.
  • the steps of the terminal security verification method can be used to store one or more computer programs, and the one or more computer programs stored in it can be executed by a processor to realize a mobile in the above-mentioned Embodiment 1 and Embodiment 2.
  • the functional modules/units in the system and the device can be implemented as software (the computer program code executable by the computing device can be used to realize ), firmware, hardware, and appropriate combinations thereof.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components. Components cooperate to execute.
  • Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit .
  • communication media typically embodies computer readable instructions, data structures, computer program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery medium. Therefore, the present invention is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Human Computer Interaction (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

根据本发明实施例提供的一种移动终端安全校验方法、移动终端及计算机可读存储介质，其中移动终端安全校验方法包括：移动终端出厂后首次开机时，读取内置的区域配置文件，所示区域配置文件包括关键参数信息和非关键参数信息；根据区域配置文件，获取移动终端当前的关键参数和非关键参数，根据预设校验规则对关键参数和非关键参数进行校验；根据校验结果，调整移动终端的状态。

Description

移动终端安全校验方法、移动终端及计算机可读存储介质
相关申请的交叉引用
本申请基于2021年12月31日提交的发明名称为“移动终端安全校验方法、移动终端及计算机可读存储介质”的中国专利申请CN202111662868.4，并且要求该专利申请的优先权，通过引用将其所公开的内容全部并入本申请。
技术领域
本发明实施例涉及但不限于移动终端安全领域，具体而言，涉及但不限于一种移动终端安全校验方法、移动终端及计算机可读存储介质。
背景技术
随着电子技术的发展，电子设备的集成度越来越高，电子设备的价值也变得越来高，同时电子设备的体积和重量却在降低，这导致很多盗窃团伙将盗窃目标转移到了这部分高价值的电子设备上，例如手机，对于一些盗窃比价猖獗的地区，盗窃团伙甚至将目标对准了各种手机销售店，这些手机销售店里面往往会储存大量的高价值手机，盗窃得手以后为了躲避调查往往会将手机带到异地再进行出售。
在一些情形下，正常开机流程里面没有安全配置相关的内容，也没有通过识别区域来对移动终端的开机流程进行安全验证并对移动终端进行限制的功能。
发明内容
本发明实施例提供的一种移动终端安全校验方法、移动终端及计算机可读存储介质，解决的技术问题是目前的移动终端没有比较可靠的识别终端是否被盗的安全功能。
本发明实施例提供一种移动终端安全校验方法，所述移动终端安全校验方法包括：
移动终端出厂后首次开机时，读取内置的区域配置文件，所述区域配置文件包括关键参数信息和非关键参数信息，所述关键参数信息用于决定所述移动终端是否可以开机，所述非关键参数信息用于决定所述移动终端可以使用的功能；
根据所述区域配置文件，获取所述移动终端当前的关键参数和非关键参数，根据预设校验规则对所述关键参数和非关键参数进行校验；
根据校验结果，调整所述移动终端的状态。
本发明实施例还提供一种移动终端，所述移动终端包括：处理器、存储器及通信总线；
所述通信总线设置为实现处理器和存储器之间的连接通信；
所述处理器设置为执行存储器中存储的一个或者多个计算机程序，以实现上述所述的一种移动终端安全校验方法的步骤。
本发明实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个计算机程序，所述一个或者多个计算机程序可被一个或者多个处理器执行，以实现上述所述的一种移动终端安全校验方法的步骤。
本发明其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当理解，至少部分有益效果从本发明说明书中的记载变的显而易见。
附图说明
图1为本发明实施例一提供的一种移动终端安全校验方法的流程示意图；
图2为本发明实施例二的提供的另一种移动终端安全校验方法的流程示意图；
图3为本发明实施例二的提供的另一种移动终端安全校验方法的流程示意图；
图4为本发明实施例的一种移动终端的示意图。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本发明实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
实施例一：
为了加强移动终端的安全性，保障销售商家的权益，同时打击偷盗行为，本实施例提供了一种移动终端安全校验方法，对移动终端的首次开机进行校验，只有校验通过时才可以正常开机，校验不通过无法正常开机，从而有效的保证了移动终端的安全。
请参见图1，图1为本实施例提供的一种移动终端安全校验方法的流程示意图。移动终端安全校验方法包括以下步骤：
S101、移动终端出厂后首次开机时，读取内置的区域配置文件，所述区域配置文件包括关键参数信息和非关键参数信息。
在本实施例中，区域配置文件在移动终端出厂时写入到移动终端中，该区域配置文件只有在移动终端出厂后首次开机时才可触发，一般在移动终端完成首次开机以后，该区域配置文件就不再生效，但是在一些特殊情况下，例如用户对移动终端进行维修时，售后维修点和售后维修厂家依然可以恢复区域配置文件来保证移动终端的安全。
区域配置文件中包括了关键参数信息和非关键参数信息，关键参数信息决定了移动终端是否可以开机使用，非关键参数信息决定了移动终端可以使用那些功能。
S102、根据所述区域配置文件，获取所述移动终端当前的关键参数和非关键参数，根据预设校验规则对所述关键参数和非关键参数进行校验。
读取到内置的区域配置文件后，就可以根据区域配置文件中的关键参数信息和非关键参数信息，确定需要获取那些参数，为了保证参数的有效性，获取的参数都必须是当前实时的参数，避免被钻空子。
当获取到关键参数和非关键参数以后，就可以根据预设校验规则对参数进行校验，对移动终端的位置、联网状态和联网运营商等信息进行校验和认证。
S103、根据校验结果，调整所述移动终端的状态。
在另一实施例中，根据所述区域配置文件，获取对应的关键参数和非关键参数，包括：
当无法获取到所述关键参数时，所述移动终端无法开机。
关键参数是最重要的参数，当无法获取到关键参数时就可以直接让移动终端无法开机。
在另一实施例中，调整所述移动终端的状态，包括：当所述关键参数校验未通过时，所述移动终端无法开机；当所述关键参数校验通过，所述非关键参数校验未通过时，所述移动终端进入受限状态；当所述关键参数和所述非关键参数均通过时，所述移动终端进入正常状态。
关键参数是最重要的参数，因此当关键参数检验不通过时，会让移动终端直接不开机。而非关键参数属于次要参数，关键参数验证通过，非关键参数验证未通过时，移动终端可以正常开机，但是移动终端的功能会被限制，让移动终端进入受限状态，在本实施例中，受限状态包括但不限于，无法点亮屏幕、无法自主连接网络和无法自主进行定位等状态。
在另一实施例中，所述根据预设校验规则对所述关键参数和非关键参数进行校验，包括：当只获取到所述关键参数时，对所述关键参数进行校验；当获取到所述关键参数，以及所述非关键参数时，对所述关键参数和非关键参数进行校验。
由于非关键参数属于非必要参数，在一些情况下可能无法及时获取到非关键参数，因此开机时对非关键参数的验证不是必要过程。
在另一实施例中，在完成所述关键参数校验以后还包括：进行身份验证；身份验证不通过，无法开机；身份验证通过，对所述非关键参数进行校验。
在对关键参数完成校验以后，为了进一步增加安全性，还可以增加身份验证，身份验证包括但不限于对终端的身份验证和对人员的身份验证。
在另一实施例中，所述非关键参数包括至少两个参数，对所述非关键参数进行校验时，判断所述非关键参数中的参数是否完全获取到；
为否时只校验已获取到的非关键参数，所述移动终端进入所述受限状态，在后续获取非关键参数中的参数时，均需进行身份验证，直到所述非关键参数中的参数全部通过校验时进入所述正常状态。
在开机时没有获取到完整的非关键参数时，只需要对已经获取到的非关键参数进行验证即可，验证通过以后还可以继续获取剩余的非关键参数，逐渐进行验证，直到完全通过验证为止。同时为了进一步的保证安全性，在验证后续获取的非关键参数时每次都需要对身份进行验证。当然可以理解的是，当非关键参数中的其中一个参数验证不通过时可以停止后续非 关键参数的验证。
在另一实施例中，所述移动终端出厂后首次开机时，还包括：检测所述移动终端是否接入网络；当接入网路时通过网络查询所述区域配置文件是否有更新；存在更新时，下载更新区域配置文件。
通过增加联网功能，能够对移动终端的区域配置文件进行更新，避免正常买家由于区域配置文件失效造成开机失败的问题。同时通过对区域配置文件进行更新，还可以及时的对报案终端进行远程锁定，获取其位置信息和录音信息等信息，有利于追回移动终端，降低损失。
在另一实施例中，所述区域配置文件用于规定所述移动终端的激活区域和/或所述移动终端接入运营商。
本发明实施例提供的一种移动终端安全校验方法包括：移动终端出厂后首次开机时，读取内置的区域配置文件，所示区域配置文件包括关键参数信息和非关键参数信息；根据区域配置文件，获取移动终端当前的关键参数和非关键参数，根据预设校验规则对关键参数和非关键参数进行校验；根据校验结果，调整移动终端的状态。通过出厂前在移动终端中内置区域配置文件，从而在移动终端出厂后首次开机时获取区域配置文件，并根据区域配置文件，获取移动终端当前的关键参数和非关键参数，在按照预设校验规则进行校验，根据校验结果确定移动终端的状态，从而有效的保障了移动终端首次开机时的安全性，起到了防盗的作用。
实施例二：
本实施例以手机为例，该手机是基于在硬件上支持射频模块，支持GPS和WIFI芯片组成的设备，对本发明实施例提供的一种移动终端安全校验方法进行详细的说明，包括以下步骤：
S10、在手机中写入是否需要验证的标志位，针对用户拿到手机后首次开机过程中进行判断，如果已启动过身份验证并通过，修改相应的标志信息。避免手机在恢复出厂设置时读取相应标志位信息，导致手机无法开机。
S20、在手机出厂时手机中是预置区域配置文件，区域配置文件的作用是保证手机在配置的区域内进行售卖后开机校验后正常开机，如果校验不成功则不能正常开机，防止手机在非正常情况下(例如遭到盗抢后)也能使用。区域配置文件在开机联网后，在蜂窝网或者连接WIFI下可以进行配置文件更新，区域配置文件参数的设置见下表结构描述。
表1
Figure PCTCN2022136652-appb-000001
Figure PCTCN2022136652-appb-000002
ProfileVersion：表示改profile文件的版本号信息，通过手机在开机流程中对profile版本号的比对，可以判断是否需要更新配置文件，如果服务器上有更新的版本号对应的配置文件，可以判断为需要更新区域配置文件。
Device Information：定义为对应项目的版本号信息，通过此字段可以让手机在开机过程中链接服务器后匹配到对应项目的对应软件版本号。
Control Policy：定义具体的区域配置策略参数。其中配置参数可以是多个参数，根据项目的要求，可以增加和减少配置参数的数量。每一组配置参数中，定义了name(参数名)，Value(某一个参数中需要包含具体配置信息内容，可以是一个数值，也可以是一组或者多组数值)，Key or Not(用于定义每一配置参数是否是关键信息，如果定义为Yes，表示此参数是关键参数，在整个开机流程中，获取到关键参数以后，在保护区域的校验过程中需要逐个对关键参数进行依次校验，全部校验通过则进行下一步的身份验证。如果定义为No，表示此参数信息不是关键信息，可以在开机过程中在没有获取到实际位置区域参数的情况下卡机，等获取到这一参数信息后启动校验。)
举例说明：
第一个参数是MCC为国家码，value值为460代表中国。此参数是关键信息，需要在开机过程中进行校验，否则无法开机。
在手机出厂时预置一条或者多条配置信息。例如预置某一个售卖国家或者运营商的MCC MNC参数。
表2
Parameter1：    
  Name MCC
  Value 420
  Key or Not Yes
第二个参数为运营商码，value值为01表示中国移动，02为中国联通。此参数为非关键信息，即开机过程中如果获取到MNC信息，则进行比对，如果没有获取到这一信息，可以在开机后再次启动此参数信息的校验。
表3
Figure PCTCN2022136652-appb-000003
第三个参数为GPS信息，名称为GEO，参数内容由多组参数组成，每一组参数包含纬度，经度和半径信息，配置多组参数即覆盖一些范围，通过开机获取到手机的位置信息判断是否在这一范围内，来判断用户是否在保护区域内。Key or Not配置为No表示这一个参数为非关键信息，如果开机过程中没有获取到这一信息，可以不影响正常开机过程，在开机后获取到这一信息校验是否在保护区域内。
表4
Figure PCTCN2022136652-appb-000004
上述表1-4那些作为关键参数，那些作为非关键参数，可以根据实际情况处理。
在上述内容的基础上，当手机首次开机过程中，可以在手机连接网络(数据网络或者连 接WIFI)后对区域配置文件进行更新，例如手机联网后通过OTA检测是否有可更新的配置文件，如果有则更新配置文件，更新成功后根据最新的配置文件策略进行检测。如果没有更新配置文件，则使用手机出厂预置的配置文件信息进行检测。检测过程主要是根据开机后获取的手机所在网络的位置区域信息的情况分为以下两个实施例：
1)手机开机后获取的位置信息，其中定义的关键参数信息必须获取成功，如果获取不成功，则无法开机。如果获取成功，对获取成功的区域信息进行校验，逐一的和配置文件中的信息进行比对，校验成功后进入到身份验证，可以通过启用终端调用解锁秘钥生成函数，根据IMEI号等信息生成秘钥，通过和用户输入密码进行比对，完成身份认证流程。身份验证成功则进入到开机流程，开机后判断是否有未获取成功的非关键参数，如果没有，则说明整个开机流程中无论是关键参数还是非关键参数都进行校验完成，进入到正常待机流程，手机可以正常开机使用。
2)如图3所示中开机后，判断还有未获取的非关键参数信息，则手机进入到待机但是只能使用部分功能，例如某些和网络使用相关的功能不能使用。当设置的条件满足时，再次对关键参数进行获取，例如GPS参数信息是非关键参数，在第一次开机过程中可能获取不到，那么在开机后用户在使用GPS功能时，则触发再次获取非关键参数，获取成功后对非关键参数进行校验是否在保护区域内，如果在保护区域内，则再次进入到身份验证流程，验证通过，手机进入正常待机使用。如果获取非关键参数后身份校验不成功，则进入到手机无法使用状态。
说明：
1.关键参数验证完成后，如果非关键参数还没有获取成功的情况，也可以让手机能够进入到正常待机使用状态，在后台自动获取到相应非关键参数时启动非关键参数验证流程，和上述实施例中让手机处于部分功能使用状态进行区分。
2.流程图2中获取到开机区域参数后，判断关键参数是否获取成功，此时如果非关键参数也已经获取成功，那么获取到的参数都会进行校验，判断是否在保护区域内，如果在保护区域内，则进入身份验证后开机，不在保护区域内，则无法开机。
整个流程需要完成的对关键参数和非关键参数进行全部的校验，全部校验成功后，说明手机是按照出厂配置的策略售卖到相应地区，手机可以正常使用。
实施例三：
本实施例还提供了一种移动终端，参见图4所示，其包括处理器41、存储器42及通信总线43，其中：
通信总线43设置为实现处理器41和存储器42之间的连接通信；
处理器41设置为执行存储器42中存储的一个或者多个计算机程序，以实现上述实施例 1和实施例2中的一种移动终端安全校验方法的步骤。
本实施例还提供了一种计算机可读存储介质，该计算机可读存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、计算机程序模块或其他数据)的任何方法或技术中实施的易失性或非易失性、可移除或不可移除的介质。计算机可读存储介质包括但不限于RAM(Random Access Memory，随机存取存储器)，ROM(Read-Only Memory，只读存储器)，EEPROM(Electrically Erasable Programmable read only memory，带电可擦可编程只读存储器)、闪存或其他存储器技术、CD-ROM(Compact Disc Read-Only Memory，光盘只读存储器)，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。
本实施例中的计算机可读存储介质可用于存储一个或者多个计算机程序，其存储的一个或者多个计算机程序可被处理器执行，以实现上述实施例1和实施例2中的一种移动终端安全校验方法的步骤。
可见，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的计算机程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。
此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、计算机程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本发明不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本发明实施例所作的进一步详细说明，不能认定本发明的具体实施只局限于这些说明。对于本发明所属技术领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本发明的保护范围。

Claims (10)

  1. 一种移动终端安全校验方法，所述移动终端安全校验方法包括：
    移动终端出厂后首次开机时，读取内置的区域配置文件，所述区域配置文件包括关键参数信息和非关键参数信息，所述关键参数信息用于决定所述移动终端是否可以开机，所述非关键参数信息用于决定所述移动终端可以使用的功能；
    根据所述区域配置文件，获取所述移动终端当前的关键参数和非关键参数，根据预设校验规则对所述关键参数和非关键参数进行校验；
    根据校验结果，调整所述移动终端的状态。
  2. 如权利要求1所述的移动终端安全校验方法，其中，根据所述区域配置文件，获取对应的关键参数和非关键参数，包括：
    当无法获取到所述关键参数时，所述移动终端无法开机。
  3. 如权利要求1所述的移动终端安全校验方法，其中，根据校验结果，调整所述移动终端的状态，包括：
    当所述关键参数校验未通过时，所述移动终端无法开机；
    当所述关键参数校验通过，所述非关键参数校验未通过时，所述移动终端进入受限状态；
    当所述关键参数和所述非关键参数均通过时，所述移动终端进入正常状态。
  4. 如权利要求3所述的移动终端安全校验方法，其中，所述根据预设校验规则对所述关键参数和非关键参数进行校验，包括：
    当只获取到所述关键参数时，对所述关键参数进行校验；
    当获取到所述关键参数，以及所述非关键参数时，对所述关键参数和非关键参数进行校验。
  5. 如权利要求4所述的移动终端安全校验方法，其中，在完成所述关键参数校验以后还包括：
    进行身份验证；
    身份验证不通过，无法开机；
    身份验证通过，对所述非关键参数进行校验。
  6. 如权利要求5所述的移动终端安全校验方法，其中，所述非关键参数包括至少两个参数，对所述非关键参数进行校验时，判断所述非关键参数中的参数是否完全获取到；
    为否时只校验已获取到的非关键参数，所述移动终端进入所述受限状态，在后续获取非关键参数中的参数时，均需进行身份验证，直到所述非关键参数中的参数全部通过校验时进入所述正常状态。
  7. 如权利要求1-6任一项所述的移动终端安全校验方法，其中，所述移动终端出厂后首次开机时，还包括：检测所述移动终端是否接入网络；
    当接入网路时通过网络查询所述区域配置文件是否有更新；
    存在更新时，下载更新区域配置文件。
  8. 如权利要求1-6任一项所述的移动终端安全校验方法，其中，所述区域配置文件用于规定所述移动终端的激活区域和/或所述移动终端接入运营商。
  9. 一种移动终端，所述移动终端包括：处理器、存储器及通信总线；
    所述通信总线设置为实现处理器和存储器之间的连接通信；
    所述处理器设置为执行存储器中存储的一个或者多个计算机程序，以实现如权利要求1至8中任一项所述的一种移动终端安全校验方法的步骤。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个计算机程序，所述一个或者多个计算机程序可被一个或者多个处理器执行，以实现如权利要求1至8中任一项所述的一种移动终端安全校验方法的步骤。
PCT/CN2022/136652 2021-12-31 2022-12-05 移动终端安全校验方法、移动终端及计算机可读存储介质 WO2023124811A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111662868.4A CN116419236A (zh) 2021-12-31 2021-12-31 移动终端安全校验方法、移动终端及计算机可读存储介质
CN202111662868.4 2021-12-31

Publications (1)

Publication Number Publication Date
WO2023124811A1 true WO2023124811A1 (zh) 2023-07-06

Family

ID=86997598

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/136652 WO2023124811A1 (zh) 2021-12-31 2022-12-05 移动终端安全校验方法、移动终端及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN116419236A (zh)
WO (1) WO2023124811A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090124236A1 (en) * 2007-11-12 2009-05-14 Samsung Electronics Co., Ltd. Mobile terminal and protection method for the same
CN105930749A (zh) * 2016-05-09 2016-09-07 广东欧珀移动通信有限公司 移动终端防盗处理方法及装置
CN106529232A (zh) * 2016-10-19 2017-03-22 广东欧珀移动通信有限公司 开机启动方法及装置
CN107734176A (zh) * 2017-10-25 2018-02-23 深圳市金立通信设备有限公司 移动终端的丢失保护方法、终端及计算机可读存储介质
CN108038385A (zh) * 2017-11-28 2018-05-15 深圳市金立通信设备有限公司 一种数据处理方法、移动终端及计算机可读介质
CN110598384A (zh) * 2019-09-16 2019-12-20 Oppo（重庆）智能科技有限公司 信息保护方法、信息保护装置及移动终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090124236A1 (en) * 2007-11-12 2009-05-14 Samsung Electronics Co., Ltd. Mobile terminal and protection method for the same
CN105930749A (zh) * 2016-05-09 2016-09-07 广东欧珀移动通信有限公司 移动终端防盗处理方法及装置
CN106529232A (zh) * 2016-10-19 2017-03-22 广东欧珀移动通信有限公司 开机启动方法及装置
CN107734176A (zh) * 2017-10-25 2018-02-23 深圳市金立通信设备有限公司 移动终端的丢失保护方法、终端及计算机可读存储介质
CN108038385A (zh) * 2017-11-28 2018-05-15 深圳市金立通信设备有限公司 一种数据处理方法、移动终端及计算机可读介质
CN110598384A (zh) * 2019-09-16 2019-12-20 Oppo（重庆）智能科技有限公司 信息保护方法、信息保护装置及移动终端

Also Published As

Publication number Publication date
CN116419236A (zh) 2023-07-11

Similar Documents

Publication Publication Date Title
US10372914B2 (en) Validating firmware on a computing device
EP3522059B1 (en) Perform security action based on inventory comparison
US20200327260A1 (en) Theft detector
US9720782B2 (en) Authenticating a backup image with bifurcated storage
EP2829978B1 (en) Mobile terminal detection method and mobile terminal
US9794784B2 (en) Techniques for preventing unauthorized users from controlling modem of mobile device
US10360396B2 (en) Token-based control of software installation and operation
US9262631B2 (en) Embedded device and control method thereof
WO2012083823A1 (zh) 对终端进行锁网的方法和装置
WO2019233022A1 (zh) 防回滚方法及系统
CN110245495B (zh) Bios校验方法、配置方法、设备及系统
US10594693B2 (en) Electronic device identification
US11347858B2 (en) System and method to inhibit firmware downgrade
CN114707147A (zh) 业务请求处理方法及电子设备
US11251976B2 (en) Data security processing method and terminal thereof, and server
WO2023124811A1 (zh) 移动终端安全校验方法、移动终端及计算机可读存储介质
US20210345101A1 (en) LiFi Location Services as a Prerequisite to System Activation
CN115828225A (zh) 基于可信计算的白名单度量方法、系统及介质、客户端
US10268823B2 (en) Device, system, and method for securing executable operations
US10496598B2 (en) Data access control based on storage validation
US11216552B2 (en) System and method for verifying first time use of an information handling system
CN112114908A (zh) 硬件平台及其启动方法、装置和电子设备
US20210021990A1 (en) Detection and communication of locking configuration information modification
KR20150043954A (ko) 모바일 단말의 보안 엔진의 접근 제어 시스템 및 방법
US20230297724A1 (en) Hardware identity restoration post-device repair

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22914066

Country of ref document: EP

Kind code of ref document: A1