An Android file transparent encryption and decryption method based on a hook

Abstract

The invention provides an Android file transparent encryption and decryption method based on a hook. Security protection such as checking prevention, scanning prevention and leakage prevention is carried out on a sensitive file. Inline-is used in the invention. According to the hook technology, a code instruction in a memory is directly modified to skip a hook function, so that the problem of a PLT hook is well solved; Combination inline The hook technology is used for re-packaging the file operation interface; and the file is encrypted in combination with the national cryptographic block symmetric cryptographic algorithm SM4, so that various attacks for the block cryptographic algorithm can be effectively resisted, and meanwhile, the whole platform architecture of Android can be well supported.

Description

technical field [0001] The invention belongs to the field of mobile Internet security, in particular to a method for transparently encrypting and decrypting Android files based on hooks. Background technique [0002] The current transparent encryption and decryption systems are mainly implemented on the PC side of Windows and Linux, and most of them are encryption and decryption in user mode, which is cumbersome to operate and the encryption effect is not ideal. However, with the development of the mobile Internet and the rapid growth of mobile terminal users, the demand for file security on the mobile terminal is becoming more and more urgent. [0003] Since the Android platform is based on the Linux kernel, the corresponding file operation interfaces are the same, so using the hook technology under the Linux platform can be used to realize the secondary packaging of these interfaces, and then provide support for file encryption and decryption operations. [0004] At prese...

AI Technical Summary

Problems solved by technology

[0004] At present, most hook schemes are implemented by PLT hook (ELF-hook), and the hook is implemented based on replacing the function address in the PLT table, which cannot support the hook called between ELF internal functions and the situation where the optimized compiler directly calls the function address

Moreover, this solution does not support dynamic loading very well. Since the timing of ELF loading cannot be determined, the program must constantly monitor whether there is a new ELF loading, and then perform frequent hook operations.

[0005] In addition, in terms of platform support, currently only a single armeabi and armeabi-v7a platform is supported, which cannot satisfy other platforms such as x86 and x86_64

Images