Device security analyzation method and electronic device

Abstract

A device security analysis method and an electronic device are disclosed. The method includes: in response to an external device being connected to the electronic device, maintaining the external device in an isolated state and determining whether the external device meets the de-isolation conditions; if the external device does not meet the de-isolation conditions, performing a security analysis on the external device through a sandbox analysis module during the period when the external device is in the isolated state; and determining whether to switch the external device to a connected state based on the execution result of the security analysis.

Description

[Technical Field]

[0001] This invention relates to an information security protection technology, and more particularly to a device security analysis method and an electronic device. [Previous Technology]

[0002] With the advancement of technology, the threat to information security is also increasing. In daily life, users' electronic devices (such as smartphones, personal computers, or servers) are often connected to external devices to read data from external devices, store data on external devices, or perform extended functions through external devices. However, if the external device carries malware with the ability to actively spread or infect, when the external device is connected to the electronic device, the electronic device may be implanted with malware, thus becoming a botnet controlled by hackers or a target for hackers to steal secrets. [Summary of the Invention]

[0003] The present invention provides a device security analysis method and an electronic device, which can improve the above-mentioned problems and enhance the security of the electronic device accessing external devices.

[0004] Embodiments of the present invention provide a device security analysis method for an electronic device, the electronic device running a sandbox analysis module, and the device security analysis method includes: in response to an external device being connected to the electronic device, maintaining the external device in an isolated state and determining whether the external device meets the de-isolation conditions; if the external device does not meet the de-isolation conditions, performing security analysis on the external device through the sandbox analysis module during the period when the external device is in the isolated state; and determining whether to switch the external device to a connected state based on the execution result of the security analysis.

[0005] An embodiment of the present invention further provides an electronic device, which includes a connection interface circuit, a storage circuit, and a processor. The connection interface circuit is used to connect to an external device. The storage circuit is used to store a sandbox analysis module. The processor is connected to the connection interface circuit and the storage circuit. The processor is used to: maintain the external device in an isolated state in response to the external device being connected to the electronic device through the connection interface circuit, and determine whether the external device meets the de-isolation conditions; if the external device does not meet the de-isolation conditions, perform a security analysis on the external device through the sandbox analysis module during the period when the external device is in the isolated state; and determine whether to switch the external device to a connected state based on the execution result of the security analysis.

[0006] Based on the above, after the electronic device is connected to an external device, the external device will initially be kept in an isolated state. Simultaneously, the electronic device can determine whether the external device meets the de-isolation conditions. If the external device does not meet the de-isolation conditions, during the period the external device is in the isolated state, the electronic device can perform a security analysis on the external device through a sandbox analysis module, and decide whether to switch the external device to a connected state based on the results of the security analysis. In this way, the security of the electronic device accessing the external device can be effectively improved without significantly affecting the working performance of the electronic device.

Implementation Method

[0008] FIG1 is a schematic diagram of a device security analysis system according to an embodiment of the present invention. Referring to FIG1, the device security analysis system may include an electronic device 10 and an external device 100. The electronic device 10 may be a smartphone, tablet computer, desktop computer, industrial computer, game console, server, wearable device (e.g., head-mounted display, watch, bracelet, etc.) or a computer device installed in a specific carrier (e.g., vehicle, aircraft or ship), and the type of electronic device 10 is not limited thereto.

[0009] The external device 100 may also be a smartphone, tablet computer, desktop computer, industrial computer, game console, server, wearable device (e.g., head-mounted display, watch, bracelet, etc.), or a computer device or information storage device (e.g., USB flash drive or external hard drive) installed in a specific carrier (e.g., vehicle, aircraft, or ship), and the type of external device 100 is not limited thereto. Furthermore, the number of external devices 100 may be one or more, and this invention is not limited thereto.

[0010] The electronic device 10 may include a connection interface circuit 11, a processor 12, and a storage circuit 13. The connection interface circuit 11 is used to connect to an external device 100. For example, the connection interface circuit 11 can connect the electronic device 10 to the external device 100 via wired or wireless means. For example, the connection interface circuit 11 may support wireless communication standards such as WiFi, Bluetooth, Near-Field Communication (NFC), 3G, 4G, or 5G, or wired communication standards such as Universal Serial Bus (USB) to communicate with the external device 100 (e.g., to transmit signals between the electronic device 10 and the external device 100). Alternatively, the connection interface circuit 11 may also support other communication standards, which is not limited by the present invention. Furthermore, the present invention does not limit the number and type of the connection interface circuits 11.

[0011] The processor 12 is connected to the connection interface circuitry 11 and the storage circuitry 13. The processor 12 may include a central processing unit (CPU), a graphics processing unit (GPU), or other programmable general-purpose or special-purpose microprocessors, digital signal processors (DSPs), programmable controllers, application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or other similar devices or combinations thereof.

[0012] In one embodiment, the processor 12 may further include processors dedicated to assisting in performing logical operations (e.g., neural network operations and / or image processing), such as a vision processing unit (VPU), a neural network processing unit (NPU), and / or a tensor processing unit (TPU). However, the present invention does not limit the number or type of processor 12.

[0013] The storage circuit 13 is used to store data. For example, the storage circuit 13 may include volatile storage circuits and non-volatile storage circuits. The volatile storage circuit is used to store data volatilely. For example, the volatile storage circuit may include random access memory (RAM) or similar volatile storage media. The non-volatile storage circuit is used to store data non-volatilely. For example, the non-volatile storage circuit may include read-only memory (ROM), solid-state disk (SSD), hard disk drive (HDD), or similar non-volatile storage media. However, the present invention does not limit the number and type of storage circuits 13.

[0014] In one embodiment, the storage circuit 13 is used to store the kernel system 101 and the sandbox analysis module 102. The kernel system 101 is used to control the overall operation of the electronic device 10. For example, the kernel system 101 may include the operating system (OS) of the electronic device 10. In one embodiment, the processor 12 may run the kernel system 101 to control the overall operation of the electronic device 10.

[0015] In one embodiment, the sandbox analysis module 102 can operate independently of the core system 101. Specifically, the sandbox analysis module 102 can be used to perform security analysis on the external device 100 when the core system 101 cannot access the external device 100. In other words, in one embodiment, when the core system 101 cannot access the external device 100, the processor 12 can run the sandbox analysis module 102 to perform security analysis on the external device 100 without affecting the operation of the core system 101.

[0016] In one embodiment, the electronic device 10 may further include various input / output devices such as a power management circuit, a mouse, a keyboard, a display, a speaker and / or a microphone, and the type of input / output interface is not limited thereto.

[0017] In one embodiment, the processor 12 can detect whether the external device 100 is connected to the electronic device 10 via the connection interface circuit 11. In one embodiment, if the external device 100 is connected to the connection interface circuit 11 via a wired connection, the processor 12 can determine whether the external device 100 is connected to the electronic device 10 by detecting the potential state of at least one electrical pin of the connection interface circuit 11. For example, when the potential state of at least one electrical pin of the connection interface circuit 11 is a certain potential state (also referred to as the first potential state), the processor 12 can determine that the external device 100 is connected to the electronic device 10. However, when the potential state of at least one electrical pin of the connection interface circuit 11 is another potential state (also referred to as the second potential state), the processor 12 can determine that the external device 100 is not connected to the electronic device 10. The first potential state may be different from the second potential state. For example, the first potential state may be logic high, while the second potential state may be logic low. However, the first potential state and the second potential state can be adjusted according to practical needs, and the present invention does not limit them.

[0018] In one embodiment, if the external device 100 is connected to the connection interface circuit 11 via a wireless connection, the processor 12 can determine whether the external device 100 is connected to the electronic device 10 by using a flag reflecting the connection status between the external device 100 and the electronic device 10. For example, when the flag reflecting the connection status between the external device 100 and the electronic device 10 is in a certain bit state (also called the first bit state), the processor 12 can determine that the external device 100 is connected to the electronic device 10. However, when the flag reflecting the connection status between the external device 100 and the electronic device 10 is in another bit state (also called the second bit state), the processor 12 can determine that the external device 100 is not connected to the electronic device 10. The first bit state may be different from the second bit state. For example, the first bit state may be bit "1", while the second bit state may be bit "0". However, the first bit state and the second bit state may be adjusted according to practical needs, and the present invention does not limit them.

[0019] In one embodiment, in response to the external device 100 being connected to the electronic device 10 (as shown in FIG. 1), the processor 12 may automatically maintain the external device 100 in an isolated state. In one embodiment, the isolated state is also referred to as the unbinded state. It should be noted that in the isolated state, the core system 101 cannot access the external device 100. In one embodiment, while the external device 100 is in the isolated state, the processor 12 may prevent the core system 101 from accessing the external device 100.

[0020] In one embodiment, in response to the external device 100 being connected to the electronic device 10 (as shown in FIG. 1), the processor 12 may further determine whether the external device 100 meets the de-isolation condition. In one embodiment, the de-isolation condition is also referred to as the bind condition.

[0021] In one embodiment, if the processor 12 determines that the external device 100 meets the de-isolation condition, the processor 12 can switch the external device 100 from the isolated state to the connected state. In one embodiment, the connected state is also called the bonded state. It should be noted that in the connected state, the core system 101 can access the external device 100. In one embodiment, if the external device 100 is in the connected state, the processor 12 can allow the core system 101 to access the external device 100. For example, if the external device 100 is in the connected state, the core system 101 can read data from the external device 100, store data in the external device 100, and / or perform specific operations through the external device 100.

[0022] In one embodiment, after the external device 100 is connected to the electronic device 10, the processor 12 can obtain device identification information of the external device 100. For example, this device identification information can be used to uniquely identify the external device 100. For example, this device identification information may include the device name, device type and / or other information that can be used to uniquely identify the external device 100.

[0023] In one embodiment, after obtaining the device identification information of the external device 100, the processor 12 can compare the device identification information with a device list. For example, this device list can be used to record the device identification information of one or more external devices. The processor 12 can determine whether the external device 100 meets the de-isolation conditions based on the comparison result.

[0024] In one embodiment, the processor 12 may employ a whitelist filtering mechanism to determine whether the external device 100 meets the de-isolation conditions. For example, in the whitelist filtering mechanism, if the aforementioned comparison result reflects that the device identification information of the external device 100 is recorded in the device list, then the processor 12 may determine that the external device 100 meets the de-isolation conditions. However, if the aforementioned comparison result reflects that the device identification information of the external device 100 is not recorded in the device list, then the processor 12 may determine that the external device 100 does not meet the de-isolation conditions.

[0025] In one embodiment, the processor 12 may also employ a blacklist filtering mechanism to determine whether the external device 100 meets the de-isolation conditions. For example, in the blacklist filtering mechanism, if the aforementioned comparison result reflects that the device identification information of the external device 100 is recorded in the device list, the processor 12 may determine that the external device 100 does not meet the de-isolation conditions. However, if the aforementioned comparison result reflects that the device identification information of the external device 100 is not recorded in the device list, the processor 12 may determine that the external device 100 meets the de-isolation conditions. In one embodiment, the processor 12 may employ a whitelist filtering mechanism and / or a blacklist filtering mechanism as needed to determine whether the external device 100 meets the de-isolation conditions; this invention does not impose any limitations on this.

[0026] In one embodiment, if the processor 12 determines that the external device 100 does not meet the de-isolation conditions, the processor 12 can maintain the external device 100 in an isolated state (i.e., not switch the external device 100 from the isolated state to the connected state). Simultaneously, while the external device 100 is in the isolated state, the processor 12 can perform security analysis on the external device 100 through the sandbox analysis module 102. For example, the processor 12 can monitor the behavior of the external device 100 through the sandbox analysis module 102 to determine whether the external device 100 has a security risk. Then, the processor 12 can decide whether to switch the external device 100 from the isolated state to the connected state based on the execution result of the security analysis. In one embodiment, the sandbox analysis module 102 can monitor the behavior of the external device 100 and determine whether the external device 100 has a security risk through various common security analysis techniques (e.g., malware detection techniques). Related operational details can be set according to practical needs, and this invention does not limit them.

[0027] In one embodiment, while the external device 100 is in an isolated state, if the processor 12 determines, based on the execution result of the security analysis, that the external device 100 poses a security risk (for example, the execution result of the security analysis reflects that the external device 100 has a high probability of carrying malware), then the processor 12 can maintain the external device 100 in an isolated state (i.e., not switch the external device 100 from the isolated state to the connected state). This effectively prevents the electronic device 10 (or the core system 101) from being infected by malware carried by the external device 100.

[0028] In one embodiment, while the external device 100 is in an isolated state, if the processor 12 determines, based on the execution result of the security analysis, that the external device 100 does not pose a (significant) security risk (e.g., the execution result of the security analysis reflects that the external device 100 has a high probability of not carrying malware), then the processor 12 can switch the external device 100 from the isolated state to the connected state. Subsequently, in the connected state, the core system 101 can access the external device 100. This effectively improves the security of the electronic device 10's access to the external device 100 without significantly affecting the operating performance of the electronic device 10 (or the core system 101).

[0029] In one embodiment, while the external device 100 is in an isolated state, the processor 12 may associate the external device 100 with a specific container (also referred to as the first container). Then, while the external device 100 is in an isolated state, the sandbox analysis module 102 may monitor the behavior of the external device 100 through the first container.

[0030] In one embodiment, the first container is a sandbox container. Therefore, the operation of the external device 100 within the first container (i.e., the sandbox container) will not affect the core system 101. Thus, even if the external device 100 carries malware, by running the external device 100 within the first container (i.e., the sandbox container), the malware carried by the external device 100 can be prevented from infecting the core system 101.

[0031] In one embodiment, if the external device 100 is in a connected state, the processor 12 can associate the external device 100 with another container (also referred to as the second container). It should be noted that the second container is a general container type compared to the first container. In this way, while the external device 100 is in a connected state, the core system 101 can access the external device 100 through the second container.

[0032] FIG2 is a schematic diagram illustrating access to an external device in a connected state according to an embodiment of the present invention. Referring to FIG1 and FIG2, in one embodiment, it is assumed that the external device 100 is connected to the electronic device 10. After switching the external device 100 to a connected state (i.e., a bound state), the processor 12 can associate the external device 100 with the container 21. For example, the container 21 is a general container. Subsequently, the core system 101 can access the external device 100 through the container 21. For example, the processor 12 can run the core system 101 and use the container 21 to read data from the external device 100, store data in the external device 100, and / or perform specific operations through the external device 100.

[0033] Figure 3 is a schematic diagram illustrating the security analysis of an external device performed through a sandbox analysis module in an isolated state according to an embodiment of the present invention. Referring to Figures 1 and 3, in one embodiment, it is assumed that the external device 100 is connected to the electronic device 10. During the period when the external device 100 is in an isolated state (i.e., an unbound state), the processor 12 can associate the external device 100 with a container 31. For example, the container 31 is a sandbox container. Subsequently, the processor 12 can run the sandbox analysis module 102 and perform security analysis on the external device 100 through the container 31. Based on the execution result of the security analysis, the processor 12 can decide whether to keep the external device 100 in an isolated state or switch the external device 100 from an isolated state to a connected state. It should be noted that during the period when the external device 100 is in an isolated state (i.e., an unbound state), the processor 12 can prohibit the core system 101 from accessing the external device 100 to avoid the core system 101 being infected by malware that may be carried by the external device 100.

[0034] Figure 4 is a flowchart illustrating a device security analysis method according to an embodiment of the present invention. Referring to Figure 4, in step S401, in response to an external device being connected to an electronic device, the external device is maintained in an isolated state. In step S402, it is determined whether the external device meets the de-isolation condition. If the external device meets the de-isolation condition, in step S403, the external device is switched from the isolated state to the connected state.

[0035] However, if the external device does not meet the de-isolation conditions, in step S404, during the period when the external device is in the isolated state, a security analysis is performed on the external device through the sandbox analysis module. In step S405, based on the execution result of the security analysis, it is determined whether the external device has a security risk. If the external device has a security risk (e.g., the external device has a relatively high probability of carrying malware), then in step S406, the external device is kept in the isolated state. Alternatively, if the external device does not have a security risk (e.g., the external device has a relatively low probability of carrying malware), then step S403 can be entered to switch the external device from the isolated state to the connected state.

[0036] However, the steps in Figure 4 have been described in detail above, and will not be repeated here. It is worth noting that each step in Figure 4 can be implemented as multiple pieces of code or circuits, and the present invention does not limit this. In addition, the method in Figure 4 can be used in conjunction with the above exemplary embodiments, or it can be used alone, and the present invention does not limit this.

[0037] In summary, the device security analysis method and electronic device proposed in the embodiments of the present invention can temporarily keep the external device in an isolated state (i.e., an unbound state) when it is first connected to an external device of unknown security, so as to avoid malware that may be carried by the external device from infecting the core system of the electronic device. After determining that the external device is trustworthy, the external device can be switched to a connected state (i.e., a bound state) to facilitate the core system of the electronic device to access the external device. In this way, the security of the electronic device accessing the external device can be effectively improved without affecting the working performance of the electronic device as much as possible.

[0038] Although the present invention has been disclosed above by way of embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims. [Simplified Explanation of the Diagram]

[0007] Figure 1 is a schematic diagram of a device security analysis system according to an embodiment of the present invention. Figure 2 is a schematic diagram of accessing an external device in a connected state according to an embodiment of the present invention. Figure 3 is a schematic diagram of performing security analysis on an external device through a sandbox analysis module in an isolated state according to an embodiment of the present invention. Figure 4 is a flowchart of a device security analysis method according to an embodiment of the present invention.

Claims

1. A device security analysis method for an electronic device, the electronic device running a sandbox analysis module, and the device security analysis method comprising: In response to an external device connecting to the electronic device, the external device is kept in an isolated state, and it is determined whether the external device meets the de-isolation conditions. The step of determining whether the external device meets the de-isolation conditions includes: obtaining device identification information of the external device; comparing the device identification information with a device list before performing security analysis on the external device through the sandbox analysis module; and determining whether the external device meets the de-isolation conditions based on the comparison result; if it is confirmed that the device identification information is not recorded in the device list, during the period when the external device is in the isolated state, performing security analysis on the external device through the sandbox analysis module, including associating the external device with a first container, and having the sandbox analysis module monitor the behavior of the external device through the first container, wherein the behavior of the external device within the first container does not affect the core system of the electronic device; determining whether to switch the external device to a connected state based on the execution result of the security analysis; and if the external device is in the connected state, associating the external device with a second container, and having the core system access the external device through the second container.

2. The device security analysis method as described in claim 1, wherein in the isolated state, the core system of the electronic device cannot access the external device.

3. The device security analysis method as described in claim 1, wherein in the connected state, the core system of the electronic device can access the external device.

4. The device security analysis method as described in claim 1 further includes: If the external device meets the deisolation condition, switch the external device to the connected state.

5. An electronic device comprising: Connection interface circuitry, used to connect to external devices; Storage circuitry for storing sandbox analysis modules; The processor is connected to the connection interface circuit and the storage circuit, wherein the processor is configured to: maintain the external device in an isolated state in response to the external device being connected to the electronic device through the connection interface circuit, and determine whether the external device meets the de-isolation condition, wherein the processor's operation of determining whether the external device meets the de-isolation condition includes: obtaining the device identification information of the external device; Before performing security analysis on the external device through the sandbox analysis module, the device identification information is compared with the device list; and based on the comparison result, it is determined whether the external device meets the deisolation conditions; if it is confirmed that the device identification information is not recorded in the device list, during the period when the external device is in the isolated state, the security analysis is performed on the external device through the sandbox analysis module, including associating the external device with a first container, and the sandbox analysis module monitoring the behavior of the external device through the first container, wherein the behavior of the external device in the first container does not affect the core system of the electronic device; based on the execution result of the security analysis, it is determined whether to switch the external device to a connected state; and if the external device is in the connected state, the external device is associated with a second container, and the core system accesses the external device through the second container.

6. The electronic device as claimed in claim 5, wherein in the isolated state, the core system of the electronic device cannot access the external device.

7. The electronic device as claimed in claim 5, wherein in the connected state, the core system of the electronic device can access the external device.

8. The electronic device as claimed in claim 5, wherein the processor is further configured to: switch the external device to the connected state if the external device meets the deisolation condition.

Images