CN117932594A - Terminal protection method, terminal, and computer-readable medium - Google Patents

Abstract

The present disclosure provides a terminal protection method, the method comprising: in response to the terminal being in a risky operation state, detecting an input signal of the input hardware of the terminal corresponding to the risky operation; the risky operation state is a state of waiting for a risky operation; in response to the input hardware having an input signal corresponding to the risky operation, allowing the risky operation; in response to the input hardware not having an input signal corresponding to the risky operation, prohibiting the risky operation. The present disclosure also provides a terminal and a computer-readable medium.

Description

Terminal protection method, terminal, and computer-readable medium

Technical Field

The present disclosure relates to the technical field of terminal protection, and in particular to a terminal protection method, a terminal, and a computer-readable medium.

Background technique

Currently, mobile phones, tablet computers and other terminals (smart terminals) may be implanted with malicious codes or Trojan programs, which may control the terminals and perform certain operations without the user's knowledge, posing risks.

Summary of the invention

The present disclosure provides a terminal protection method, a terminal, and a computer-readable medium.

In a first aspect, an embodiment of the present disclosure provides a terminal protection method, including:

In response to the terminal being in a risky operation state, detecting an input signal of the input hardware of the terminal corresponding to the risky operation; the risky operation state is a state in which a risky operation is to be performed;

In response to the input hardware having an input signal corresponding to the risk operation, allowing the risk operation;

In response to the input hardware not having an input signal corresponding to the risky operation, the risky operation is prohibited.

In a second aspect, an embodiment of the present disclosure provides a terminal, which includes one or more input devices, one or more memories, and one or more processors; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, it implements any terminal protection method of the embodiment of the present disclosure.

In some embodiments, the terminal includes at least one of the following: a mobile phone, a tablet computer, a laptop computer, and a desktop computer.

In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, any terminal protection method of the embodiment of the present disclosure is implemented.

In the embodiment of the present disclosure, when the terminal is about to perform an operation that may bring risks (is in a risky operation state), it is detected whether the input hardware entity of the terminal receives the input signal corresponding to the risky operation, that is, it is detected whether there is really a "person" operating the terminal to perform the risky operation. If there is no human operation, it can be considered that the terminal system is affected by malicious code, Trojan program, etc. and attempts to perform the risky operation, which can be prohibited to avoid the risk. Since any malicious code, Trojan program, etc. can only directly generate operation signals from the terminal system level, but cannot make the input hardware entity actually receive the input signal, the embodiment of the present disclosure can effectively identify the operations generated by malicious code and Trojan program, greatly improving security. At the same time, in the case where the user is indeed performing the operation, the embodiment of the present disclosure allows the operation to proceed, so as not to affect the normal operation of the terminal. In addition, the embodiment of the present disclosure is only performed in the risky operation state, so under normal circumstances, the terminal system can still operate without affecting the normal system operation.

BRIEF DESCRIPTION OF THE DRAWINGS

In the accompanying drawings of the embodiments of the present disclosure:

FIG1 is a flow chart of a terminal protection method provided by an embodiment of the present disclosure;

FIG2 is a flow chart of another terminal protection method provided by an embodiment of the present disclosure;

FIG3 is a block diagram of a terminal provided by an embodiment of the present disclosure;

FIG4 is a block diagram of a computer-readable medium provided by an embodiment of the present disclosure;

FIG5 is a logic process diagram of some steps in another terminal protection method provided by an embodiment of the present disclosure;

FIG6 is a logic process diagram of some steps in another terminal protection method provided by an embodiment of the present disclosure;

FIG. 7 is a logic process diagram of some steps in another terminal protection method provided in an embodiment of the present disclosure.

Detailed ways

In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the terminal protection method, terminal, and computer-readable medium provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

The present disclosure will be described more fully below with reference to the accompanying drawings, but the embodiments shown may be embodied in different forms, and the present disclosure should not be construed as being limited to the embodiments set forth below. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and will enable those skilled in the art to fully understand the scope of the present disclosure.

The accompanying drawings of the embodiments of the present disclosure are used to provide a further understanding of the embodiments of the present disclosure, and constitute a part of the specification, and are used together with the detailed embodiments to explain the present disclosure, and do not constitute a limitation of the present disclosure. By describing the detailed embodiments with reference to the accompanying drawings, the above and other features and advantages will become more apparent to those skilled in the art.

The present disclosure may be described with reference to plan views and/or cross-sectional views by means of ideal schematic views of the present disclosure. Therefore, the exemplary illustrations may be modified according to manufacturing techniques and/or tolerances.

In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

The terms used in the present disclosure are only used to describe specific embodiments and are not intended to limit the present disclosure. The term "and/or" as used in the present disclosure includes any and all combinations of one or more related enumerated items. The singular forms "one" and "the" as used in the present disclosure are also intended to include plural forms, unless the context clearly indicates otherwise. The terms "including", "made of..." as used in the present disclosure specify the presence of the features, wholes, steps, operations, elements and/or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and/or groups thereof.

Unless otherwise defined, all terms (including technical and scientific terms) used in this disclosure have the same meaning as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined in this disclosure.

The present disclosure is not limited to the embodiments shown in the drawings, but includes modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the drawings have schematic properties, and the shapes of the regions shown in the drawings illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

For mobile phones, tablet computers and other terminals (smart terminals), fault analysis can be performed through adb shell commands during the R&D and debugging stages and after mass production. At the same time, some pre-installed applications also have the permission to execute adb shell commands. Through adb shell commands, the terminal can perform some operations through the software command control system without actually receiving input signals from input hardware such as the touch screen.

Since most terminals have networking functions, they may be implanted with malicious code or Trojan programs. Malicious code or Trojan programs may obtain permission to execute adb shell commands, and thus perform risky operations on the terminal without the user's knowledge, such as downloading some applications, paying some fees, following other social accounts, sending information to other terminals, etc., which may lead to the leakage of user privacy information or cause loss of user property, etc., causing security issues.

In some technologies, terminal security can be improved by installing security software, anti-virus software, etc. in the terminal. However, since malicious codes and Trojan programs are constantly updated, no security software or anti-virus software can effectively prevent all malicious codes and Trojan programs.

In a first aspect, an embodiment of the present disclosure provides a terminal protection method.

The method of the embodiment of the present disclosure is used to ensure the security of the terminal (smart terminal) during its operation; wherein, referring to Figure 3, the terminal of the terminal protection method applicable to the embodiment of the present disclosure can be connected to input hardware, that is, the user can input information to the terminal through the input hardware to operate the terminal.

Therefore, the terminal of the embodiment of the present disclosure can be any device that can receive user instructions through input hardware and perform corresponding data processing, and its specific form includes but is not limited to mobile phones, tablet computers, laptops, desktop computers, etc.

1 , the terminal protection method of the embodiment of the present disclosure includes:

S101 . In response to a terminal being in a risky operation state, detecting an input signal of an input hardware of the terminal corresponding to the risky operation.

Among them, the risk operation status is the status of the risk operation to be performed.

In the embodiment of the present disclosure, when the terminal receives an instruction to perform an operation that may bring risks (i.e., it is in a risky operation state), it detects the operation instruction from its input hardware and determines whether the operation instruction is an operation instruction for implementing the risky operation (i.e., an input signal corresponding to the risky operation).

S102: In response to an input signal from the input hardware corresponding to a risky operation, allowing the risky operation.

S103 . In response to an input signal indicating that the input hardware has no corresponding risky operation, prohibiting the risky operation.

Therefore, if the input hardware receives an input signal corresponding to a risky operation, it indicates that the risky operation is indeed an operation performed by the user on the terminal, rather than an operation generated by a system that controls the terminal, such as malicious code or Trojan programs. Therefore, the risky operation can be allowed to proceed so that the terminal can achieve the required functions.

However, if the input hardware does not receive the input signal corresponding to the risk operation (the terminal is not connected to the input hardware, or the terminal is connected to the input hardware but the input hardware has no input signal, or the input hardware has an input signal but the input signal does not correspond to the risk operation), it indicates that the risk operation may be generated by malicious code, Trojan programs, etc., which is an "abnormal" system that controls the terminal, so it should be prohibited and the operation should not be allowed to avoid risks.

Among them, when the risk operation is prohibited because the input hardware does not receive the input signal corresponding to the risk operation, other tasks such as prompt alarms can also be performed, which will not be described in detail here.

In the embodiment of the present disclosure, when the terminal is about to perform an operation that may bring risks (is in a risky operation state), it is detected whether the input hardware entity of the terminal receives the input signal corresponding to the risky operation, that is, it is detected whether there is really a "person" operating the terminal to perform the risky operation. If there is no human operation, it can be considered that the terminal system is affected by malicious code, Trojan program, etc. and attempts to perform the risky operation, which can be prohibited to avoid the risk. Since any malicious code, Trojan program, etc. can only directly generate operation signals from the terminal system level, but cannot make the input hardware entity actually receive the input signal, the embodiment of the present disclosure can effectively identify the operations generated by malicious code and Trojan program, greatly improving security. At the same time, in the case where the user is indeed performing the operation, the embodiment of the present disclosure allows the operation to proceed, so as not to affect the normal operation of the terminal. In addition, the embodiment of the present disclosure is only performed in the risky operation state, so under normal circumstances, the terminal system can still operate without affecting the normal system operation.

In some embodiments, the risk operation includes at least one of the following: inputting a verification code, inputting a password, the download amount exceeds a first threshold, the upload amount exceeds a second threshold, clicking to log in, sending information, and copying verification information.

As one method of an embodiment of the present disclosure, risk operations (operations that may cause risks) that will trigger entry into a risk operation state may specifically include entering a verification code into a certain interface, entering a password into a certain interface, the amount of data downloaded or uploaded within a certain period of time exceeds a preset threshold, clicking to log in to a certain interface, sending certain information through social software or text messages, copying the content of certain verification information received (such as text messages), etc.

In some embodiments, the input hardware includes at least one of the following: a touch screen, a mouse, and a keyboard.

As one embodiment of the present disclosure, the specific form of the input hardware may be a touch screen, a mouse, a keyboard, etc.

In some embodiments, the input hardware includes a touch screen; detecting an input signal of the input hardware of the terminal corresponding to the risk operation (S101) includes:

S1010: Detect a change in capacitance and/or resistance of the touch screen, and determine an input signal corresponding to a risky operation of input hardware according to the change in capacitance and/or resistance.

As one mode of the embodiment of the present disclosure, the input hardware may include a touch screen, and the touch screen may be in the form of a capacitive touch screen, a resistive touch screen, etc. Therefore, when someone touches the touch screen, the capacitance, resistance, etc. of the touch screen will change, such as the capacitance and resistance at the touch position will change, so that by detecting whether the capacitance and resistance values on the touch screen actually change, it can be determined whether there is an operation on the touch screen, and the position of the operation can be further determined to determine whether there is an input signal corresponding to the risk operation.

In some embodiments, referring to FIG. 2 , the method of the embodiment of the present disclosure further includes:

S100 , in response to the presence of an input signal in input hardware, writing an input signal record into a preset operation register.

Detecting an input signal of a terminal input hardware corresponding to a risk operation (S101) includes:

S1011. Read the input signal record in the operation register, and determine the input signal of the corresponding risk operation of the input hardware according to the input signal record.

As a method of an embodiment of the present disclosure, when someone operates the input hardware (there is an input signal in the input hardware), an input signal record may be written into a preset operation register (such as writing 1 into the operation register) to record the above operations, such as recording that a certain operation is performed on a certain input hardware at a certain moment, which may specifically be touching a certain position on the touch screen, clicking a certain key of the mouse, pressing a certain key on the keyboard, etc.; and when no one operates the input hardware, no content may be written into the operation register, or other records may be written into the operation register (such as writing 2 into the operation register).

Thus, in response to the terminal being in a risky operation state, the input signal record in the operation register may be read to determine whether the input hardware has an input signal corresponding to the risky operation (eg, determining whether the value in the operation register is 1).

In some embodiments, detecting an input signal of an input hardware of a terminal corresponding to a risk operation (S101) includes:

S1012: Detect input signals of input hardware within a predetermined time.

As one method of an embodiment of the present disclosure, since human operations on input hardware should usually be completed within a certain time, it is possible to detect whether there is an input signal in the input hardware within a predetermined time (such as 1s) to determine whether there is an input signal corresponding to a risky operation.

In some embodiments, detecting an input signal of an input hardware of a terminal corresponding to a risk operation (S101) includes:

S1013: Detect operation information of an input signal of the input hardware, and determine an input signal of the input hardware corresponding to the risk operation according to the operation information of the input signal.

As a method of an embodiment of the present disclosure, when detecting whether the input hardware has an input signal, its specific operation information can be further detected, that is, the input signal can be detected as a signal for what specific operation is performed, such as which position of the touch screen is touched, which key of the mouse is clicked, which key of the keyboard is pressed, etc., and then it can be determined whether the operation information matches the risk operation that needs to be performed (for example, determining whether the touch position of the touch screen is the position of the "OK" button in the interface, etc.), so as to determine whether there is an input signal corresponding to the risk operation.

Among them, the above-mentioned method of storing input signal records in the operation register, the method of determining whether there is an input signal within a predetermined time, and the method of detecting the operation information of the input signal may be only one or multiple at the same time. For example, the operation register may store the operation information of the input signal within a predetermined time, so as to determine whether there is an input signal corresponding to the risk operation based on it.

In the second aspect, referring to Figure 3, an embodiment of the present disclosure provides a terminal, which includes one or more input devices, one or more memories, and one or more processors; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, it implements any terminal protection method of the embodiment of the present disclosure.

In some embodiments, the terminal includes at least one of the following: a mobile phone, a tablet computer, a laptop computer, and a desktop computer.

In a third aspect, referring to FIG. 4 , an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, any terminal protection method of the embodiment of the present disclosure is implemented.

Among them, the processor is a device with data processing capabilities, including but not limited to the central processing unit (CPU); the memory is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I/O interface (read-write interface) is connected between the processor and the memory, and can realize information exchange between the memory and the processor, including but not limited to the data bus (Bus), etc.

By way of example, a terminal protection method according to an embodiment of the present disclosure is specifically introduced.

The terminal protection method of the embodiment of the present disclosure is used for a mobile phone terminal with a capacitive touch screen (input hardware).

There are multiple intersecting transmitting electrodes (transmitting signals in turn) and receiving electrodes in a capacitive touch screen. When a certain position of the touch screen is touched, the finger forms a coupling capacitor at the corresponding position, which is equivalent to connecting the human body's electric field to the touch position, so that the capacitance between the intersecting transmitting electrodes and receiving electrodes at the corresponding position changes. Therefore, when a certain transmitting electrode transmits a signal, if the signal sensed by a certain receiving electrode changes, it can be determined that a touch occurs at the intersection of the transmitting electrode and the receiving electrode, that is, there is an input signal; by continuously performing the above process, the touch can be monitored and the touch trajectory can be recorded. When the system is working, the touch screen will also detect whether the capacitance value of its screen surface has changed, and report the collected data to the system.

5, according to the terminal protection method of the embodiment of the present disclosure, when the system is working, if the touch screen detects a change in the capacitance value of the screen surface, it can be determined that someone is touching the screen (the input hardware has an input signal), so that the state value 1 (input signal record) can be written to the state register (operation register); if the touch screen does not detect a change in the capacitance value, the state value 2 is written to the state register. Thus, the state register can store all the state values within a certain period of time before, that is, if there is a touch at a certain moment, the state value corresponding to the moment is 1, and if there is no touch at a certain moment, the state value corresponding to the moment is 2.

Referring to FIG6, when the system inputs information into the verification code input field (risk operation), the data of the most recent predetermined time (such as 1s) in the status register is read. If the status value 1 appears within the predetermined time, it is determined to be a normal user operation, and the system performs the corresponding input operation, that is, allows information to be input into the input field; if the status value is always 2 within the predetermined time, it is determined that an abnormality has occurred, and the system intercepts the corresponding input operation, that is, does not allow information to be input into the input field. At the same time, the system log records this operation abnormality and gives the user an abnormal prompt through the prompt bar. For example, some APPs (applications) will require the sending of a verification SMS (verification information) and perform operations such as logging in according to the verification code in the verification SMS. If the APP is implanted with malicious code and has obtained the permission to read SMS, the APP can directly control the sending of the verification SMS to the mobile phone without user confirmation, and then directly copy the verification code in the SMS and fill in the verification information. This situation may cause illegal login without the user's knowledge, etc., which brings security risks, and the method of the disclosed embodiment can intercept it.

For another example, referring to FIG7, when the system performs a large-volume upload or download (risk operation), if the amount of data uploaded or downloaded exceeds a preset threshold, it is also necessary to read the data of the most recent predetermined time (such as 2s) in the status register. If the status value 1 appears within the predetermined time, it is determined to be a normal user operation, and the download or upload continues; if the status value is always 2 within the predetermined time, it is determined that an abnormality has occurred, which may be malicious code that is downloaded without the user's permission, so the network connection can be closed. When it is determined that an abnormality has occurred, a prompt bar requiring the user to click to confirm can also be popped up. If the user clicks to confirm on the touch screen, the latest status value in the status register will be 1, so the system can read the new status value in the status register, and find that there is a status value 1, so the network connection is reopened to continue the previous upload or download; and if the user does not click to confirm on the touch screen, the status value in the status register is always 2, and the network is continuously closed.

Those skilled in the art will appreciate that all or some of the steps, systems, and functional modules/units in the apparatus disclosed above may be implemented as software, firmware, hardware, or a suitable combination thereof.

In hardware implementations, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation.

Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit (CPU), a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-temporary medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH) or other disk storage; read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical disk storage; magnetic cassettes, magnetic tapes, disk storage or other magnetic storage; any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

The present disclosure has disclosed example embodiments, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and/or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and/or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims (10)

1. A method of terminal protection, comprising:

Detecting an input signal of input hardware of the terminal corresponding to the risk operation in response to the terminal being in a risk operation state; the risk operation state is a state to be subjected to risk operation;

allowing the risky operation in response to the input hardware having an input signal corresponding to the risky operation;

And prohibiting the risk operation in response to the input hardware having no input signal corresponding to the risk operation.

2. The method of claim 1, wherein the risk operation comprises at least one of:

Inputting verification codes, inputting passwords, enabling the downloading amount to exceed a first threshold value, enabling the uploading amount to exceed a second threshold value, clicking login, sending information and copying verification information.

3. The method of claim 1, wherein the input hardware comprises at least one of:

Touch screen, mouse, keyboard.

4. The method of claim 1, wherein,

The input hardware comprises a touch screen;

The detecting the input signal of the input hardware of the terminal corresponding to the risk operation includes: and detecting capacitance change and/or resistance change of the touch screen, and determining an input signal of the input hardware corresponding to the risk operation according to the capacitance change and/or the resistance change.

5. The method of claim 1, wherein,

The method further comprises the steps of: writing an input signal record in a preset operation register in response to the existence of an input signal by the input hardware;

The detecting the input signal of the input hardware of the terminal corresponding to the risk operation includes: and reading an input signal record in the operation register, and determining an input signal of the input hardware corresponding to the risk operation according to the input signal record.

6. The method of claim 1, wherein the detecting the input signal of the input hardware of the terminal corresponding to the risky operation comprises:

An input signal to the input hardware is detected for a predetermined time.

7. The method of claim 1, wherein the detecting the input signal of the input hardware of the terminal corresponding to the risky operation comprises:

And detecting operation information of an input signal of the input hardware, and determining the input signal of the input hardware corresponding to the risk operation according to the operation information of the input signal.

8. A terminal comprising one or more input devices, one or more memories, one or more processors; the memory stores a computer program executable by a processor, which when executed by the processor implements the method of terminal protection according to any one of claims 1 to 7.

9. The terminal of claim 8, wherein the terminal comprises at least one of:

Cell phones, tablet computers, notebook computers, desktop computers.

10. A computer readable medium having stored thereon a computer program which, when executed by a processor, implements the method of terminal protection of any of claims 1 to 7.