Data tracking method, device and electronic equipment

Abstract

The present invention discloses a data tracking method, comprising: replacing an entry program for starting a Java program in a target terminal with a preset program, the preset program is used to monitor functions related to sensitive permissions of the target terminal; the functions related to sensitive permissions can obtain private data stored in the target terminal; running the preset program to monitor the function; when monitoring that the function is called, outputting the stack information of the call; based on the stack information, judging whether the private data obtained by calling the function is returned. The present invention also discloses a data tracking device, an electronic device and a computer-readable storage medium.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data tracking method, device and electronic equipment. Background Art

[0002] In the era of mobile Internet, applications have become a necessity for many people, and they support people's daily life. At the same time, a large amount of user information stored on smart mobile terminals is coveted by various applications, and the legitimate rights and interests of users in cyberspace are challenged. In order to fully protect the privacy and property security of users and promote the development of smart mobile devices, how to track data to identify whether the private data obtained by calling sensitive permissions is transmitted back to the application operator's server has become a problem of concern.

[0003] In the related technology, a data flow tracking control method is usually used to track data. This method mainly sets a taint label for the private data and dynamically monitors the data with the taint label at the instruction set level, thereby tracking the flow of private data based on the taint label to identify whether the private data obtained by calling sensitive permissions is returned to the operator's server of the application.

[0004] However, when the above method is adopted, it is difficult to implement because the source code of the operating system needs to be modified during the process of setting the taint label for the privacy data and the monitoring. Summary of the invention

[0005] The embodiment of the present application provides a data tracking method to solve the problem that the data tracking method in the prior art is difficult to implement.

[0006] Embodiments of the present application also provide a data tracking device, an electronic device, and a computer-readable storage medium.

[0007] The present application embodiment adopts the following technical solutions:

[0008] In a first aspect, an embodiment of the present application provides a data tracking method, comprising:

[0009] The entry program for starting the Java program in the target terminal is replaced by a preset program, wherein the preset program is used to monitor functions related to sensitive permissions of the target terminal; functions related to sensitive permissions can obtain private data stored in the target terminal;

[0010] Run preset programs to monitor functions;

[0011] When a function is detected to be called, the call stack information is output;

[0012] Based on the stack information, determine whether the private data obtained by the calling function is returned.

[0013] Optionally, based on the stack information, determine whether the private data obtained by the calling function is returned, including:

[0014] Determine, based on the stack information, a first software development kit that calls the function, and first data acquired when the first software development kit calls the function;

[0015] Acquire second data transmitted / stored by calling the data transmission function / data storage function by the first software development kit;

[0016] By judging whether the second data includes the first data, it is determined whether the private data obtained by calling the function is returned.

[0017] Optionally, based on the stack information, determining a first software development kit that calls the function includes:

[0018] Delete the common information related to the stack itself in the stack information to obtain the remaining stack information, the common information includes program code information starting with java or android;

[0019] Based on the remaining stack information, a first software development kit that called the function is determined.

[0020] Optionally, based on the stack information, determining the first software development kit that calls the function includes:

[0021] Based on the stack information, determine the target IP address and target port number of the private data obtained by calling the function;

[0022] Determine the software development kit that calls the function based on the target IP address, the target port number and a preset mapping relationship; wherein the preset mapping relationship includes a mapping relationship between the software development kit and the data recipient information of the data sent by the software development kit; the data recipient information includes an IP address and a port number.

[0023] Optionally, the method further includes:

[0024] If it is determined that the private data obtained by calling the preset function related to the sensitive permission is returned, then determining the return path of the private data;

[0025] Among them, determining the return path of private data includes:

[0026] Determine a second software development kit for transmitting / storing the second data according to the second data transmitted / stored by the data transmission function / data storage function;

[0027] Based on the first software development kit and the second software development kit, a return path for the private data is determined.

[0028] Optionally, replacing an entry program for starting a Java program in a target terminal with a preset program code includes:

[0029] Based on the preset program code, the entry program for starting the Java program in the target terminal is replaced by hooking technology.

[0030] Optional preset functions related to sensitive permissions, including at least one of the following:

[0031] A function for obtaining the geographic location of a target terminal;

[0032] A function used to obtain the operator configuration information of the target terminal;

[0033] Function used to obtain the network type of the target terminal;

[0034] A function for obtaining the international mobile equipment identity code of the target terminal;

[0035] Function used to obtain the device information of the target terminal.

[0036] In a second aspect, an embodiment of the present application provides a data tracking device, including:

[0037] A replacement module, used to replace an entry program for starting a Java program in a target terminal with a preset program, wherein the preset program is used to monitor functions of the target terminal related to sensitive permissions; functions related to sensitive permissions can obtain private data stored in the target terminal;

[0038] The running module is used to run the preset program to monitor the function;

[0039] The output module is used to output the call stack information when the function is detected to be called;

[0040] The judgment module is used to judge whether the private data obtained by calling the function is returned based on the stack information.

[0041] Optional, judgment module, including:

[0042] A determination unit, configured to determine, based on the stack information, a first software development kit that calls the function and first data acquired when the first software development kit calls the function;

[0043] An acquiring unit, used for acquiring second data transmitted / stored by the first software development kit calling the data transmission function / data storage function;

[0044] The processing unit is used to determine whether the private data obtained by calling the function is returned by judging whether the second data includes the first data.

[0045] Optionally, determine the unit, including:

[0046] A deletion subunit is used to delete the common information related to the stack itself in the stack information to obtain the remaining stack information, wherein the common information includes program code information starting with java or android;

[0047] The determination subunit is used to determine the first software development kit that calls the function based on the remaining stack information.

[0048] Optionally, determine the unit, including:

[0049] A first determination subunit is used to determine, based on the stack information, a target IP address and a target port number of the private data acquired by calling the function;

[0050] The second determination subunit is used to determine the software development kit that calls the function based on the target IP address, the target port number and a preset mapping relationship; wherein the preset mapping relationship includes the mapping relationship between the software development kit and the data recipient information of the data sent by the software development kit; the data recipient information includes the IP address and the port number.

[0051] Optionally, the device further includes: a path determination module, configured to determine a return path for the privacy data if it is determined that the privacy data obtained by calling a preset function related to sensitive permissions is returned.

[0052] The path determination module is used to:

[0053] Determine a second software development kit for transmitting / storing the second data according to the second data transmitted / stored by the data transmission function / data storage function;

[0054] Based on the first software development kit and the second software development kit, a return path for the private data is determined.

[0055] Optional, replacement module for:

[0056] Based on the preset program code, the entry program for starting the Java program in the target terminal is replaced by hooking technology.

[0057] Optional preset functions related to sensitive permissions, including at least one of the following:

[0058] A function for obtaining the geographic location of a target terminal;

[0059] A function used to obtain the operator configuration information of the target terminal;

[0060] Function used to obtain the network type of the target terminal;

[0061] A function for obtaining the international mobile equipment identity code of the target terminal;

[0062] Function used to obtain the device information of the target terminal.

[0063] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the steps of the above data tracking method are implemented when the computer program is executed by the processor.

[0064] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the data tracking method as described above are implemented.

[0065] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0066] By adopting the method provided in the embodiment of the present application, the entry program for starting the Java program in the target terminal can be replaced with a preset program, and the preset program can be run to monitor the functions related to sensitive permissions of the target terminal. In this way, when it is monitored that the function related to sensitive permissions is called, the call stack information can be output, and based on the stack information, it can be determined whether the privacy data obtained by the calling function is returned. Compared with the data tracking method in the prior art, there is no need to modify the source code of the operating system, thereby reducing the difficulty of implementing data tracking. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0068] Figure 1a A schematic diagram of an implementation flow of a data tracking method provided in an embodiment of the present application;

[0069] Figure 1b A schematic diagram of an implementation flow of a method for determining whether private data obtained by calling a function is returned based on stack information provided in an embodiment of the present application;

[0070] Figure 2 A schematic diagram of an implementation flow of a data tracking method in an actual application scenario provided by an embodiment of the present application;

[0071] Figure 3 A specific structural diagram of a data tracking device is provided for an embodiment of the present application;

[0072] Figure 4A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0074] The technical solutions provided by various embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0075] Example 1

[0076] In order to fully protect the privacy and property security of users and promote the development of smart mobile devices, how to track data to identify whether the privacy data obtained by calling sensitive permissions is returned to the application operator's server has become a problem of concern.

[0077] In the related technology, a data flow tracking control method is usually used to track data. This method mainly sets a taint label for the private data and dynamically monitors the data with the taint label at the instruction set level, thereby tracking the flow of private data based on the taint label to identify whether the private data obtained by calling sensitive permissions is returned to the operator's server of the application.

[0078] However, when the above method is adopted, it is difficult to implement because the source code of the operating system needs to be modified during the process of setting the taint label for the privacy data and the monitoring.

[0079] In order to solve the problem that data tracking methods in the prior art are difficult to implement, an embodiment of the present application provides a data tracking method.

[0080] The execution subject of the method may be various types of computing devices, or may be an application or application (Application, APP) installed on the computing device. The computing device may be, for example, a user terminal such as a mobile phone, a tablet computer, a smart wearable device, or a server, etc. The server may be a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of computers and network servers.

[0081] For ease of description, the present application embodiment takes the execution subject of the method as an example of a server to introduce the method. Those skilled in the art can understand that the present application embodiment takes the server as an example to introduce the method, which is only an exemplary description and does not limit the scope of protection of the claims corresponding to the present solution.

[0082] Specifically, the implementation process of the method provided in the embodiment of the present application is as follows: Figure 1a As shown, the following steps are included:

[0083] Step 11, using a preset program to replace the entry program for starting the Java program in the target terminal.

[0084] For the convenience of explanation, before introducing this step, the terms involved in this step are first explained.

[0085] The preset program can be used to monitor the functions related to sensitive permissions of the target terminal. The functions related to sensitive permissions can obtain the private data stored in the target terminal.

[0086] In an embodiment of the present application, the privacy data stored in the target terminal can be understood as data related to the security of user information, such as data related to the geographic location of the target terminal, data related to the operator configuration of the target terminal, data related to the network type of the target terminal, data related to the international mobile equipment identity code of the target terminal, data related to the device information of the target terminal, the contact list of the target terminal, the inbox short messages of the target terminal, the outbox short messages of the target terminal, the draft box short messages of the target terminal, and the SD card storage files of the target terminal and other information.

[0087] Correspondingly, functions related to sensitive permissions can be understood as functions that can obtain, call or process user privacy data, such as a function that can obtain the geographic location of the target terminal, a function that can obtain the operator configuration of the target terminal, a function that can obtain the network type of the target terminal, a function that can obtain the international mobile equipment identity code of the target terminal, a function that can obtain the device information of the target terminal, a function that can obtain the contact list of the target terminal, a function that can obtain the inbox short messages of the target terminal, a function that can obtain the outbox short messages of the target terminal, a function that can obtain the draft box short messages of the target terminal, and a function that can obtain information such as the SD card storage files of the target terminal.

[0088] Among them, the function for obtaining the geographic location of the target terminal may include a function for obtaining current location information, a function for obtaining last location information / historical location information, a function for requesting location information, a function for requesting single location information, etc.

[0089] Optionally, the function for obtaining the current location information may be, for example, the getCurrentLocation function, the function for obtaining the last location information / historical location information may be, for example, the getLastKnownLocation function, the function for requesting location information may be, for example, the requestLocationUpdates function, and the function for requesting single location information may be, for example, the requestSingleUpdate function.

[0090] Optionally, the function used to obtain the operator configuration information of the target terminal may include a getCarrierConfig function; the function used to obtain the network type of the target terminal may include a getDataNetworkType function; the function used to obtain the international mobile equipment identity code of the terminal may include a getDeviceId function; the function used to obtain the device information of the terminal device may include a getDeviceSoftwareVersion function.

[0091] It should be noted that the above-mentioned privacy data and functions related to sensitive data are merely exemplary descriptions of the embodiments of the present application and do not impose any limitation on the embodiments of the present invention.

[0092] In an optional implementation, the privacy data may also be, for example, a Bluetooth MAC address, a WIFI MAC address, log information, or call records, etc. The corresponding functions related to sensitive data may also include a function for obtaining a Bluetooth MAC address, a function for obtaining a WIFI MAC address, a function for obtaining log information, or a function for obtaining call records, etc.

[0093] In actual applications, considering that there may be a lot of privacy data related to user information security stored on the target terminal, if all functions related to sensitive permissions on the target terminal that can obtain, call or process privacy data are monitored, it may cause a large monitoring burden on the preset program during the monitoring process, affecting the monitoring effect. Therefore, in an optional implementation, when monitoring functions related to sensitive permissions, some functions that can obtain privacy data that have a greater impact on user information security can be selected for monitoring, for example, functions for obtaining the geographic location of the target terminal, functions for obtaining the operator configuration information of the target terminal, functions for obtaining the network type of the target terminal, functions for obtaining the international mobile equipment identity code of the target terminal, and functions for obtaining the device information of the target terminal can be selected for monitoring.

[0094] The entry program used to start the Java program can run independently in the Java process. The Android system can call the program through the shell command to solve the problem of permission denial. The entry program can be, for example, app-process.

[0095] The following describes the replacement process of step 11 in detail.

[0096] In an embodiment of the present application, one or a batch of preset application programs to be tested can be pre-installed in the target terminal, and then a program code for implementing a detection function can be installed in the target terminal, and an entry program for starting a Java program of the target terminal can be replaced according to the program code for implementing the detection function; finally, the preset program is introduced before the preset application program to be tested is started, and the installed preset application programs to be tested are opened one by one.

[0097] Alternatively, in an optional implementation, it is also possible to consider replacing the entry program for starting the Java program of the target terminal through a hooking technology based on a preset program code.

[0098] Among them, hook technology, also known as HOOK technology, enables applications to filter all messages and events at the system level by setting "hooks" and access messages that are inaccessible under normal circumstances.

[0099] In an embodiment of the present application, the "hook" can be first hung into the system through a system call, and then the entry program for starting the Java program of the target terminal is replaced according to the preset program code for monitoring the functions related to sensitive permissions of the target terminal. In this way, whenever the preset application to be tested issues an instruction to call a function related to sensitive permissions, the hook program can capture the instruction before the instruction reaches the destination window.

[0100] Step 12, run the preset program to monitor the function.

[0101] Normally, considering that once the preset application to be tested calls a function related to sensitive permissions, there may be a possibility of transmitting the privacy data stored in the target terminal obtained by calling the function related to sensitive permissions back to the corresponding operator server, therefore, in an embodiment of the present application, after replacing the entry program for starting the Java program in the target terminal with the preset program, the preset program can be run to monitor the functions related to sensitive permissions. In this way, it can be known at any time whether the functions related to sensitive permissions are called by the preset application to be tested.

[0102] Furthermore, when it is detected that a function related to sensitive permissions is called by a preset application to be tested, the following steps 13 and 14 may be executed to further determine whether the private data obtained by calling the function is returned.

[0103] Step 13: When it is detected that a function is called, the call stack information is output.

[0104] In actual applications, considering that the stack can track the functions running in the program, and when a function is called, a stack frame can be created to support the execution of the function, wherein the stack frame contains management information, allowing the called function to safely return to the caller, therefore, in an embodiment of the present application, when it is monitored that a function related to sensitive permissions is called, the stack information of the call can be output so as to determine whether the privacy data obtained by calling the function related to sensitive permissions is returned based on the stack information.

[0105] The specific steps of determining whether the private data obtained by calling a function related to sensitive permissions is returned according to the stack information can refer to the following step 14.

[0106] It should be noted that, in the embodiment of the present application, there is no limitation on the method of outputting the call stack information. For example, the call stack information can be obtained through the throwable class.

[0107] Step 14: Based on the stack information, determine whether the private data obtained by calling the function is returned.

[0108] Among them, the return can be understood as returning the acquired private data to the preset operator server corresponding to the application to be tested. In this application, based on the stack information, it is determined whether the private data acquired by the calling function is returned, that is, based on the stack information, it is determined whether the private data acquired by the calling function is returned to the preset operator server corresponding to the application to be tested.

[0109] Based on the above definition of "return", it can be known that if the preset application to be tested returns the privacy data to the corresponding operator server, or other operator servers, the privacy data must be transmitted or stored. Therefore, in the embodiment of the present application, the first software development kit that calls the function can be determined first, and then by judging whether the first software development kit transmits or stores the obtained privacy data, it can be judged whether the privacy data obtained by calling the function is returned.

[0110] In an optional embodiment, if Figure 1b As shown, based on the stack information, judging whether the private data obtained by calling the function is returned may include the following steps:

[0111] Step 141: Determine, based on the stack information, a first software development kit that calls the function and first data obtained when the first software development kit calls the function.

[0112] Step 142: Obtain second data transmitted / stored by the first software development kit calling the data transmission function / data storage function.

[0113] Step 143, determining whether the private data obtained by calling the function is returned by judging whether the second data includes the first data.

[0114] When determining the first software development kit that calls the function based on the stack information, the first software development kit that calls the function may be determined according to the stack information related to the function.

[0115] In actual applications, the stack information may contain a lot of program codes, but not all program codes are related to the called function. Therefore, if the program code in progress is analyzed line by line based on the stack information when determining the first software development kit that calls the function based on the stack information, it is easy to reduce the processing efficiency. In order to avoid this problem, in an embodiment of the present application, when determining the first software development kit that calls the function based on the stack information, some program codes in the stack information that are not related to the called function can be deleted first, and then based on the remaining stack information, it is determined whether the private data obtained by the calling function is returned. In this way, since the number of program codes that need to be determined is reduced, the judgment efficiency can be improved.

[0116] Optionally, the common information related to the stack itself in the stack information can be deleted to obtain the remaining stack information, where the common information includes program code information starting with java or android; then, based on the remaining stack information, the first software development kit that calls the function is determined.

[0117] For example, suppose the output call stack information is as follows:

[0118] (1)java.lang.Exception

[0119] (2)at android.telephony.TelephonyManager.getDeviceId(Native Method)

[0120] (3) at

[0121] (4)com.u.commonsdk.statistics.common.DeviceConfig.

[0122] getIMEI(DeviceConfig.java:1186)

[0123] (5)at

[0124] (6)com.u.commonsdk.statistics.common.DeviceConfig.

[0125] getDeviceIdForGeneral(DeviceConfig.java:1070)

[0126] (7)at

[0127] (8)com.u.commonsdk.statistics.common.DeviceConfig.

[0128] getDeviceId(DeviceConfig.java:402)

[0129] (9)at com.u.commonsdk.stateless.c.a(UMSLEnvelopeManager.java:73)

[0130] (10)at

[0131] (11)com.u.commonsdk.stateless.UMSLEnvelopeBuild.

[0132] constructEnvelope(UMSLEnvelopeBuild.java:495)

[0133] (12)at

[0134] (13)com.u.commonsdk.stateless.UMSLEnvelopeBuild.

[0135] buildSLEnvelope(UMSLEnvelopeBuild.java:412)

[0136] (14)at

[0137] (15)com.u.message.common.impl.json.JUtrack.

[0138] trackAppLaunch(JUtrack.java:101)

[0139] (16)at com.u.message.UTrack$9.run(UTrack.java:493)

[0140] (17)at

[0141] (18)java.util.concurrent.Executors$RunnableAdapter.call

[0142] (Executors.java:457)

[0143] (19)at java.util.concurrent.FutureTask.run(FutureTask.java:266)

[0144] (20)at

[0145] (21)java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFuture

[0146] Task.run(ScheduledThreadPoolExecutor.java:301)

[0147] (22)at

[0148] (23)java.util.concurrent.ThreadPoolExecutor.runWorker

[0149] (ThreadPoolExecutor.java:1162)

[0150] (24)at

[0151] (25)java.util.concurrent.ThreadPoolExecutor$Worker.run

[0152] (ThreadPoolExecutor.java:636)

[0153] (26)at java.lang.Thread.run(Thread.java:764)

[0154] You can first delete the common information related to the stack itself that starts with java or android and has serial numbers (1)(17)(18)(19)(20)(21)(22)(23)(24)(25)(26) in the stack information, and then based on the remaining stack information, get the package name of the last line of program code at the bottom of the stack, and determine the first software development kit that calls the function based on the package name.

[0155] For example, using the above example, the remaining stack information includes the following:

[0156] (2)at android.telephony.TelephonyManager.getDeviceId(Native Method)

[0157] (3) at

[0158] (4)com.u.commonsdk.statistics.common.DeviceConfig.

[0159] getIMEI(DeviceConfig.java:1186)

[0160] (5) at

[0161] (6)com.u.commonsdk.statistics.common.DeviceConfig.

[0162] getDeviceIdForGeneral(DeviceConfig.java:1070)

[0163] (7) at

[0164] (8)com.u.commonsdk.statistics.common.DeviceConfig.

[0165] getDeviceId(DeviceConfig.java:402)

[0166] (9)at com.u.commonsdk.stateless.ca(UMSLEnvelopeManager.java:73)

[0167] (10) at

[0168] (11)com.u.commonsdk.stateless.UMSLEnvelopeBuild.

[0169] constructEnvelope(UMSLEnvelopeBuild.java:495)

[0170] (12) at

[0171] (13)com.u.commonsdk.stateless.UMSLEnvelopeBuild.

[0172] buildSLEnvelope(UMSLEnvelopeBuild.java:412)

[0173] (14) at

[0174] (15)com.u.message.common.impl.json.JUtrack.

[0175] trackAppLaunch(JUtrack.java:101)

[0176] (16)at com.u.message.UTrack$9.run(UTrack.java:493)

[0177] According to the above stack information, the last line of program code at the bottom of the stack is at com.u.message.UTrack$9.run(UTrack.java:493). It should be noted that three digits can be reserved as the package name, such as com.u.message, so it can be determined that the first software development kit that calls the function is com.u.message.

[0178] In an optional implementation, considering that different first software development kits usually use different IP addresses and port numbers when calling a function to obtain private data, in an embodiment of the present application, the target IP address and target port number of the private data obtained by calling the function can also be determined based on the stack information; then, the software development kit that calls the function is determined based on the target IP address, the target port number and a preset mapping relationship; wherein the preset mapping relationship includes a mapping relationship between the software development kit and the data recipient information of the data sent by the software development kit; the data recipient information includes an IP address and a port number.

[0179] For example, assuming that according to the preset mapping relationship, the first software development kit A usually uses IP address A1 and port number A2 when calling a function to obtain privacy data, and the first software development kit B usually uses IP address B1 and port number B2 when calling a function to obtain privacy data. Therefore, when determining the first software development kit that calls the function, it can be determined whether the target IP address of the privacy data obtained by calling the function is A1 or B1, and whether the target port number is A2 or B2, and then determine whether the first software development kit that calls the function is A or B.

[0180] After determining the first software development kit that calls the function and the first data obtained when the first software development kit calls the function according to the above method, the second data transmitted / stored by the first software development kit calling the data transmission function / data storage function can be obtained, and by judging whether the second data includes the first data, it can be determined whether the private data obtained by calling the function is returned.

[0181] Specifically, when the second data includes the first data, it is determined that the private data obtained by calling the function is returned; when the second data does not include the first data, it is determined that the private data obtained by calling the function is not returned.

[0182] In an optional implementation, if it is determined that the private data obtained by calling a preset function related to sensitive permissions is returned, the return path of the private data can also be determined, that is, the location where the private data is returned can be determined.

[0183] Determining the return path of private data may include the following steps:

[0184] Determine a second software development kit for transmitting / storing the second data according to the second data transmitted / stored by the data transmission function / data storage function; and determine a return path for the private data based on the first software development kit and the second software development kit.

[0185] Specifically, if the first software development kit and the second software development kit are the same, that is, the software development kit that calls the function to obtain private data and the software development kit that transmits / stores private data are the same, then it can be determined that the first software development kit has obtained the private data and returned the private data to its own operator server.

[0186] Alternatively, if the first software development kit and the second software development kit are different, that is, the software development kit that calls the function to obtain private data and the software development kit that transmits / stores private data are not the same, then it can be determined that the first software development kit has obtained the private data and returned the private data to other operator servers.

[0187] For example, assuming that based on the stack information, the first software development kit that calls the function is determined to be A, and then based on the second data transmitted / stored by the data transmission function / data storage function, the second software development kit that transmits / stores the second data is determined to be B, it can be determined that software development kit A has collected the user's private data and sent the private data to software development kit B.

[0188] By adopting the method provided in the embodiment of the present application, the entry program for starting the Java program in the target terminal can be replaced with a preset program, and the preset program can be run to monitor the functions related to sensitive permissions of the target terminal. In this way, when it is monitored that the function related to sensitive permissions is called, the call stack information can be output, and based on the stack information, it can be determined whether the privacy data obtained by the calling function is returned. Compared with the data tracking method in the prior art, there is no need to modify the source code of the operating system, thereby reducing the difficulty of implementing data tracking.

[0189] Example 2

[0190] The following describes how the method provided in the embodiment of the present application is applied in practice in combination with actual scenarios.

[0191] See also Figure 2 , is a schematic diagram of an application process of the method provided in the embodiment of the present application in practice. The process specifically includes the following steps:

[0192] In the embodiment of the present application, it is assumed that the actual scenario is: a software development tool kit calls a function (getDeviceId function) for obtaining the international mobile equipment identity code of a terminal, obtains the international mobile equipment identity code of the target terminal and sends it out.

[0193] Step 21, when it is detected that a function related to sensitive permissions is called, the call stack information is output.

[0194] Before executing step 21, functions related to sensitive permissions may be monitored in advance. In the embodiment of the present application, the method for monitoring functions related to sensitive permissions is not limited. In an optional implementation, the method shown in steps 11 to 12 in the above embodiment may be used to monitor functions related to sensitive permissions.

[0195] In an embodiment of the present application, assuming that a software development kit is monitored to call a function (get DeviceId function) for obtaining the international mobile equipment identity code of a terminal, and obtain the international mobile equipment identity code of the target terminal, the call stack information can be output.

[0196] Step 22: Determine the first software development kit that calls the function based on the stack information.

[0197] Among them, the detailed steps of determining the first software development kit that calls the function based on the stack information can refer to the relevant content of step 14 in Example 1, which will not be repeated here.

[0198] Step 23: The first software development kit calls the function, and the obtained privacy data is recorded as a preset value.

[0199] Continuing with the example of step 14 in the above-mentioned embodiment 1, it is assumed that the first software development kit that calls the function is com.u.message, and the international mobile equipment identity code of the target terminal obtained by the software development kit com.u.message can be recorded as a preset value, such as 312645, and the association between com.u.message and 312645 is recorded.

[0200] Step 24, determining whether the acquired private data is sent out / returned.

[0201] In the embodiment of the present application, assuming that the first software development kit calls the function getOutputStream to send the acquired private data externally, after executing step 14, it can be determined that the acquired private data is sent externally / returned.

[0202] By adopting the method provided in the embodiment of the present application, the entry program for starting the Java program in the target terminal can be replaced with a preset program, and the preset program can be run to monitor the functions related to sensitive permissions of the target terminal. In this way, when it is monitored that the function related to sensitive permissions is called, the call stack information can be output, and based on the stack information, it can be determined whether the privacy data obtained by the calling function is returned. Compared with the data tracking method in the prior art, there is no need to modify the source code of the operating system, thereby reducing the difficulty of implementing data tracking.

[0203] Example 3

[0204] In order to solve the problem that the data tracking method in the prior art is difficult to implement, the embodiment of the present application provides a data tracking device, the specific structural diagram of the device is as follows: Figure 3 As shown, it includes a replacement module 31, an operation module 32, an output module 33 and a judgment module 34. The functions of each module are as follows:

[0205] A replacement module 31 is used to replace an entry program for starting a Java program in a target terminal with a preset program, wherein the preset program is used to monitor functions of the target terminal related to sensitive permissions; functions related to sensitive permissions can obtain private data stored in the target terminal;

[0206] An operation module 32 is used to run a preset program to monitor a function;

[0207] The output module 33 is used to output the call stack information when monitoring the function being called;

[0208] The judgment module 34 is used to judge whether the private data obtained by calling the function is returned based on the stack information.

[0209] Optional, judgment module, including:

[0210] A determination unit, configured to determine, based on the stack information, a first software development kit that calls the function and first data acquired when the first software development kit calls the function;

[0211] An acquiring unit, used for acquiring second data transmitted / stored by the first software development kit calling the data transmission function / data storage function;

[0212] The processing unit is used to determine whether the private data obtained by calling the function is returned by judging whether the second data includes the first data.

[0213] Optionally, determine the unit, including:

[0214] A deletion subunit is used to delete the common information related to the stack itself in the stack information to obtain the remaining stack information, wherein the common information includes program code information starting with java or android;

[0215] The determination subunit is used to determine the first software development kit that calls the function based on the remaining stack information.

[0216] Optionally, determine the unit, including:

[0217] A first determination subunit is used to determine, based on the stack information, a target IP address and a target port number of the private data acquired by calling the function;

[0218] The second determination subunit is used to determine the software development kit that calls the function based on the target IP address, the target port number and a preset mapping relationship; wherein the preset mapping relationship includes the mapping relationship between the software development kit and the data recipient information of the data sent by the software development kit; the data recipient information includes the IP address and the port number.

[0219] Optionally, the device further includes: a path determination module, configured to determine a return path for the privacy data if it is determined that the privacy data obtained by calling a preset function related to sensitive permissions is returned.

[0220] The path determination module is used to:

[0221] Determine a second software development kit for transmitting / storing the second data according to the second data transmitted / stored by the data transmission function / data storage function;

[0222] Based on the first software development kit and the second software development kit, a return path for the private data is determined.

[0223] Optional, replacement module for:

[0224] Based on the preset program code, the entry program for starting the Java program in the target terminal is replaced by hooking technology.

[0225] Optional preset functions related to sensitive permissions, including at least one of the following:

[0226] A function for obtaining the geographic location of a target terminal;

[0227] A function used to obtain the operator configuration information of the target terminal;

[0228] Function used to obtain the network type of the target terminal;

[0229] A function for obtaining the international mobile equipment identity code of the target terminal;

[0230] Function used to obtain the device information of the target terminal.

[0231] By using the device provided in the embodiment of the present application, the entry program for starting the Java program in the target terminal can be replaced with a preset program based on the replacement module, and the preset program can be run through the running module to monitor the functions related to sensitive permissions of the target terminal. In this way, when it is monitored that the function related to sensitive permissions is called, the output module can output the stack information of the call, and then the judgment module can judge whether the privacy data obtained by the calling function is returned based on the stack information. Compared with the data tracking method in the prior art, there is no need to modify the source code of the operating system, thereby reducing the difficulty of implementing data tracking.

[0232] Example 4

[0233] Figure 4 The hardware structure diagram of an electronic device for implementing each embodiment of the present invention is shown in FIG. 4 , wherein the electronic device 400 includes but is not limited to: a radio frequency unit 401, a network module 402, an audio output unit 403, an input unit 404, a sensor 405, a display unit 406, a user input unit 407, an interface unit 408, a memory 409, a processor 410, and a power supply 411. Those skilled in the art will appreciate that Figure 4The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In the embodiments of the present application, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0234] Among them, the processor 410 is used to replace the entry program for starting the Java program in the target terminal with a preset program, and the preset program is used to monitor the functions related to sensitive permissions of the target terminal; the functions related to sensitive permissions can obtain privacy data stored in the target terminal; run the preset program to monitor the function; when it is monitored that the function is called, output the call stack information; based on the stack information, determine whether the privacy data obtained by calling the function is returned.

[0235] Optionally, based on the stack information, determine whether the private data obtained by the calling function is returned, including:

[0236] Determine, based on the stack information, a first software development kit that calls the function, and first data acquired when the first software development kit calls the function;

[0237] Acquire second data transmitted / stored by calling the data transmission function / data storage function by the first software development kit;

[0238] By judging whether the second data includes the first data, it is determined whether the private data obtained by calling the function is returned.

[0239] Optionally, based on the stack information, determining a first software development kit that calls the function includes:

[0240] Delete the common information related to the stack itself in the stack information to obtain the remaining stack information, the common information includes program code information starting with java or android;

[0241] Based on the remaining stack information, a first software development kit that called the function is determined.

[0242] Optionally, based on the stack information, determining the first software development kit that calls the function includes:

[0243] Based on the stack information, determine the target IP address and target port number of the private data obtained by calling the function;

[0244] Determine the software development kit that calls the function based on the target IP address, the target port number and a preset mapping relationship; wherein the preset mapping relationship includes a mapping relationship between the software development kit and the data recipient information of the data sent by the software development kit; the data recipient information includes an IP address and a port number.

[0245] Optionally, the method further includes: if it is determined that the private data obtained by calling a preset function related to sensitive permissions is returned, determining a return path for the private data.

[0246] Among them, determining the return path of private data includes:

[0247] Determine a second software development kit for transmitting / storing the second data according to the second data transmitted / stored by the data transmission function / data storage function;

[0248] Based on the first software development kit and the second software development kit, a return path for the private data is determined.

[0249] Optionally, replacing an entry program for starting a Java program in a target terminal with a preset program code includes:

[0250] Based on the preset program code, the entry program for starting the Java program in the target terminal is replaced by hooking technology.

[0251] Optional preset functions related to sensitive permissions, including at least one of the following:

[0252] A function for obtaining the geographic location of a target terminal;

[0253] A function used to obtain the operator configuration information of the target terminal;

[0254] Function used to obtain the network type of the target terminal;

[0255] A function for obtaining the international mobile equipment identity code of the target terminal;

[0256] Function used to obtain the device information of the target terminal.

[0257] The memory 409 is used to store a computer program that can be run on the processor 410. When the computer program is executed by the processor 410, the above functions implemented by the processor 410 are realized.

[0258] It should be understood that in the embodiment of the present application, the radio frequency unit 401 can be used for receiving and sending signals during information transmission or calls. Specifically, after receiving downlink data from the base station, it is sent to the processor 410 for processing; in addition, the uplink data is sent to the base station. Generally, the radio frequency unit 401 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 401 can also communicate with the network and other devices through a wireless communication system.

[0259] The electronic device provides users with wireless broadband Internet access through the network module 402, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0260] The audio output unit 403 can convert the audio data received by the RF unit 401 or the network module 402 or stored in the memory 409 into an audio signal and output it as sound. Moreover, the audio output unit 403 can also provide audio output related to a specific function performed by the electronic device 400 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 403 includes a speaker, a buzzer, a receiver, etc.

[0261] The input unit 404 is used to receive audio or video signals. The input unit 404 may include a graphics processor (GPU) 4041 and a microphone 4042, and the graphics processor 4041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 406. The image frame processed by the graphics processor 4041 can be stored in the memory 409 (or other storage medium) or sent via the radio frequency unit 401 or the network module 402. The microphone 4042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 401 in the case of a telephone call mode.

[0262] The electronic device 400 also includes at least one sensor 405, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 4061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 4061 and / or the backlight when the electronic device 400 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 405 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0263] The display unit 406 is used to display information input by the user or information provided to the user. The display unit 406 may include a display panel 4061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0264] The user input unit 407 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 407 includes a touch panel 4071 and other input devices 4072. The touch panel 4071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 4071 or near the touch panel 4071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 4071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the contact point coordinates, and then sends it to the processor 410, receives the command sent by the processor 410 and executes it. In addition, the touch panel 4071 can be implemented using various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 4071, the user input unit 407 may also include other input devices 4072. Specifically, other input devices 4072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail here.

[0265] Furthermore, the touch panel 4071 may be overlaid on the display panel 4061. When the touch panel 4071 detects a touch operation on or near it, it is transmitted to the processor 410 to determine the type of the touch event. Then, the processor 410 provides a corresponding visual output on the display panel 4061 according to the type of the touch event. Figure 4 In the figure, the touch panel 4071 and the display panel 4061 are two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 4071 and the display panel 4061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0266] The interface unit 408 is an interface for connecting an external device to the electronic device 400. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 408 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 400 or may be used to transmit data between the electronic device 400 and an external device.

[0267] The memory 409 can be used to store software programs and various data. The memory 409 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 409 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0268] The processor 410 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 409, and calling data stored in the memory 409, so as to monitor the electronic device as a whole. The processor 410 may include one or more processing units; preferably, the processor 410 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 410.

[0269] The electronic device 400 may also include a power supply 411 (such as a battery) for supplying power to each component. Preferably, the power supply 411 may be logically connected to the processor 410 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0270] In addition, the electronic device 400 includes some functional modules not shown, which will not be described in detail here.

[0271] Preferably, an embodiment of the present application also provides an electronic device, including a processor 410, a memory 409, and a computer program stored in the memory 409 and executable on the processor 410. When the computer program is executed by the processor 410, each process of the above-mentioned data tracking method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0272] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned data tracking method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0273] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0274] The present invention is described with reference to the flowchart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0275] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0276] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0277] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0278] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0279] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0280] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0281] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A data tracking method, characterized in that: include: Replacing an entry program for starting a Java program in a target terminal with a preset program, wherein the preset program is used to monitor functions of the target terminal related to sensitive permissions; The function related to the sensitive permission can obtain the private data stored in the target terminal; Running the preset program to monitor the function; When it is detected that the function is called, the call stack information is output; Based on the stack information, determining whether the private data obtained by calling the function is returned; Wherein, judging whether the private data obtained by calling the function is returned based on the stack information includes: Determine, based on the stack information, a first software development kit that calls the function, and first data acquired when the first software development kit calls the function; Acquire second data transmitted / stored by calling the data transmission function / data storage function by the first software development kit; By judging whether the second data includes the first data, it is determined whether the private data obtained by calling the function is returned.

2. The method according to claim 1, characterized in that Determining a first software development kit that calls the function based on the stack information includes: Deleting the common information related to the stack itself in the stack information to obtain the remaining stack information, wherein the common information includes program code information starting with java or android; Based on the remaining stack information, a first software development kit that calls the function is determined.

3. The method according to claim 1, characterized in that Determining a first software development kit that calls the function based on the stack information includes: Based on the stack information, determine the target IP address and target port number of the private data acquired by calling the function; Determine the first software development kit that calls the function based on the target IP address, the target port number and a preset mapping relationship; wherein the preset mapping relationship includes a mapping relationship between the software development kit and the data recipient information of the data sent by the software development kit; the data recipient information includes an IP address and a port number.

4. The method according to claim 1, characterized in that The method further comprises: If it is determined that the private data obtained by calling the preset function related to the sensitive permission is returned, determining the return path of the private data; Determining the return path of the private data includes: Determine a second software development kit for transmitting / storing the second data according to the second data transmitted / stored by the data transmission function / the data storage function; Based on the first software development kit and the second software development kit, a return path for the private data is determined.

5. The method according to claim 1, characterized in that The entry program for starting the Java program in the target terminal is replaced by the preset program code, including: Based on the preset program code, the entry program for starting the Java program in the target terminal is replaced by hooking technology.

6. The method according to any one of claims 1 to 5, characterized in that: Preset functions related to sensitive permissions, including at least one of the following: A function for obtaining the geographic location of the target terminal; A function for obtaining the operator configuration information of the target terminal; A function for obtaining the network type of the target terminal; A function for obtaining the international mobile equipment identity code of the target terminal; A function used to obtain the device information of the target terminal.

7. A data tracking device, characterized in that: It includes a replacement module, an operation module, an output module and a judgment module, among which: A replacement module, used to replace an entry program for starting a Java program in a target terminal with a preset program, wherein the preset program is used to monitor functions of the target terminal related to sensitive permissions; the functions related to sensitive permissions can obtain private data stored in the target terminal; An operation module, used for running the preset program to monitor the function; An output module, used for outputting the call stack information when monitoring that the function is called; A judgment module, used to judge whether the private data obtained by calling the function is returned based on the stack information; Wherein, the judgment module includes: A determination unit, configured to determine, based on the stack information, a first software development kit that calls the function and first data acquired when the first software development kit calls the function; An acquiring unit, used for acquiring second data transmitted / stored by the first software development kit calling the data transmission function / data storage function; The processing unit is used to determine whether the private data obtained by calling the function is returned by judging whether the second data includes the first data.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the data tracking method according to any one of claims 1 to 6 when executed by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data tracking method according to any one of claims 1 to 6 are implemented.

Images