Method and system for detecting and repairing user privacy compliance of mobile application software

Abstract

The present invention provides a method and system for detecting and repairing the privacy compliance of mobile application software users, including: generating inspection items and compliance interfaces according to the compliance specifications of user privacy formulated by the state or the industry; during the process of generating mobile application software, traversing the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items; replacing the interface calls that meet the inspection items with compliance interface calls; generating a user privacy system interface call report according to the replacement records; when the mobile application software is running, generating a user privacy system interface call operation report according to the call log records generated by calling the compliance interfaces. The present invention solves the problem of difficult positioning of system interface calls, especially the positioning problem of system interface calls of third-party libraries and third-party implementation classes introduced in mobile application software, and provides a repair direction for system calls that do not meet the compliance specifications of user privacy.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile software detection. Specifically, it relates to a method and system for detecting and repairing the privacy compliance of mobile application software users, and particularly to a system for detecting and repairing the privacy compliance of Android mobile application software users. Background Art

[0002] With the popularization and promotion of intelligent mobile terminals, mobile application software has also entered a stage of rapid development, and users are using more and more application software on intelligent mobile terminals. Mobile application software will more or less involve user privacy during use. For example, reading the album information, address book information, etc. of intelligent mobile terminals. If this information is obtained by illegal software vendors, it may cause serious losses to users.

[0003] In the patent document with the publication number CN114611132A, a method, device, computer device, and readable storage medium for detecting the privacy compliance of mobile application software are disclosed. The method includes the following steps: responding to a privacy compliance detection command, obtaining the mobile application software to be detected; running the mobile application software based on sandbox technology, and collecting the privacy information collection and usage behaviors generated during the running of the mobile application software; detecting the privacy information collection and usage behaviors, and determining whether the privacy information collection and usage behaviors are compliant; obtaining the privacy protocol policy text in the mobile application software, and identifying the semantic content in the privacy protocol policy text; detecting the semantic content, and determining whether the privacy protocol policy text is compliant.

[0004] Regarding the above related technologies, the inventor believes that currently, Android mobile application software completely relies on third-party detection agencies for detection, resulting in low detection efficiency and inaccurate detection accuracy. Therefore, a new technical solution is needed to improve the above technical problems. Summary of the Invention

[0005] Aiming at the deficiencies in the prior art, the purpose of the present invention is to provide a method and system for detecting and repairing the privacy compliance of mobile application software users.

[0006] According to a method for detecting and repairing the privacy compliance of mobile application software users provided by the present invention, the method includes the following steps:

[0007] Step S1: Generate inspection items and compliance interfaces according to the compliance specifications of user privacy;

[0008] Step S2: During the process of generating mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items;

[0009] Step S3: Replace the interface calls that meet the inspection entries with compliant interface calls;

[0010] Step S4: Generate a user privacy system interface call report based on the replacement records;

[0011] Step S5: When the mobile application software is running, generate a user privacy system interface call running report based on the call log records generated by calling the compliant interface;

[0012] Step S6: The user privacy interface call running report summarizes the call running report through a local protocol or a network protocol, providing a repair direction for system calls that do not meet the compliance specifications of user privacy.

[0013] Preferably, the step S1 includes the following steps:

[0014] Step S1.1: Extract the detection description according to the compliance specifications of user privacy;

[0015] Step S1.2: Search for relevant Android system call interfaces according to the compliance specifications of user privacy and the detection description;

[0016] Step S1.3: Generate corresponding compliant interfaces according to the compliance specifications of user privacy. For the system interface calls of the personal privacy agreement collected before the user agrees to the privacy agreement, the compliant interface returns null and does not call the system interface; for the silent collection of device information by the mobile software in the foreground and the silent collection of device information by the mobile software in the background, when the number of times or time limit or the device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications.

[0017] Preferably, according to the compliance specifications in the step S1.1, the detection description is divided into the personal privacy agreement collected before the user agrees to the privacy agreement, the silent collection of device information by the mobile software in the foreground, and the silent collection of device information by the mobile software in the background.

[0018] Preferably, the content of the user privacy system interface call report in the step S4 includes the compliance inspection entries of user privacy, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, and method name.

[0019] Preferably, the content of the user privacy system interface call running report in the step S5 includes the compliance inspection entries of user privacy, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, method name, and call stack.

[0020] The present invention also provides a mobile application software user privacy compliance detection and repair system, and the system includes the following modules:

[0021] Module M1: Generate inspection items and compliance interfaces according to the compliance specifications of user privacy;

[0022] Module M2: During the process of generating a mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items;

[0023] Module M3: Replace the interface calls that meet the inspection items with compliance interface calls;

[0024] Module M4: Generate a user privacy system interface call report according to the replacement records;

[0025] Module M5: When the mobile application software is running, generate a user privacy system interface call operation report according to the call log records generated by calling the compliance interface;

[0026] Module M6: The user privacy interface call operation report summarizes the call operation report through the local protocol or the network protocol, providing a repair direction for system calls that do not meet the compliance specifications of user privacy.

[0027] Preferably, the module M1 includes the following modules:

[0028] Module M1.1: Extract detection descriptions according to the compliance specifications of user privacy;

[0029] Module M1.2: Find relevant Android system call interfaces according to the compliance specifications of user privacy and the detection descriptions;

[0030] Module M1.3: Generate corresponding compliance interfaces according to the compliance specifications of user privacy. For system interface calls of personal privacy agreements collected before the user agrees to the privacy agreement, the compliance interface returns null and does not call the system interface; for the mobile software to silently collect device information in the foreground and the mobile software to silently collect device information in the background, when the number of times or time limit or the device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications.

[0031] Preferably, according to the compliance specifications, the detection descriptions of the module M1.1 are divided into personal privacy agreements collected before the user agrees to the privacy agreement, the mobile software to silently collect device information in the foreground, and the mobile software to silently collect device information in the background.

[0032] Preferably, the content of the user privacy system interface call report in the module M4 includes the compliance inspection items of user privacy, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, and system name.

[0033] Preferably, the content of the operation report of the user privacy system interface call in the module M5 includes the compliance check items of user privacy, and the class information of the system interface call. The class information of the system interface call includes the package name, class name, system name, and call stack.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. Through the user privacy system interface call report and the operation report of the user privacy system interface call, the present invention solves the problem of difficult positioning of system interface calls, especially the positioning problem of system interface calls introduced by third-party libraries and third-party implementation classes in Android mobile application software, and provides a solution for fixing system calls that do not meet the compliance specifications of user privacy;

[0036] 2. By operating on Java bytecode without modifying the implementation classes of Android mobile application software, third-party libraries, and third-party implementation classes, the present invention solves the problem of fixing system calls that do not meet the compliance specifications of user privacy;

[0037] 3. The present invention responds quickly to the compliance specifications of user privacy, does not rely on the modification of the implementation classes of Android mobile application software, and does not require the re-release of third-party libraries and third-party implementation classes; it has the effects of being fast and non-invasive;

[0038] 4. The present invention provides an inspection system that does not rely on third-party inspection agencies, realizes real-time detection of Android mobile application software, and provides a solution for early problem discovery;

[0039] 5. By traversing and searching for system interface calls that meet the inspection items of the user privacy protocol specification during the process of Android mobile application software, the present invention replaces the system interface calls with compliance interfaces; at the same time, it records the class information of the system interface calls, including the package name, class name, method name, etc., and generates a user privacy system interface call report, providing a direction for developers to troubleshoot and solve problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] By reading the detailed description of the non-restrictive embodiments with reference to the following drawings, other features, objects, and advantages of the present invention will become more apparent:

[0041] Figure 1 is the flow schematic diagram of the present invention;

[0042] Figure 2 is the flow schematic diagram of the compliance interface call of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0043] The present invention will be described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present invention, several changes and improvements can still be made. These all belong to the protection scope of the present invention.

[0044] Example 1:

[0045] A method for detecting and repairing the privacy compliance of mobile application software users provided by the present invention, the method comprising the following steps:

[0046] Step S1: Generate inspection items and compliance interfaces according to the privacy compliance specifications formulated by the state or the industry;

[0047] Step S1.1: Extract detection descriptions according to the privacy compliance specifications formulated by the state or the industry; according to the compliance specifications, the detection descriptions are divided into personal privacy agreements collected before the user agrees to the privacy agreement, mobile software foreground silent collection of device information, and mobile software background silent collection of device information.

[0048] Step S1.2: Search for relevant Android system call interfaces according to the privacy compliance specifications of users and the detection descriptions;

[0049] Step S1.3: Generate corresponding compliance interfaces according to the privacy compliance specifications of users. For the system interface calls of the personal privacy agreement collected before the user agrees to the privacy agreement, the compliance interface returns null and does not call the system interface; for the mobile software foreground silent collection of device information and the mobile software background silent collection of device information, when the number of times or time limit or the device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications.

[0050] Step S2: During the process of generating the mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find the interface calls that meet the inspection items;

[0051] Step S3: Replace the interface calls that meet the inspection items with compliance interface calls;

[0052] Step S4: Generate a user privacy system interface call report according to the replacement records; the content of the user privacy system interface call report includes the privacy compliance inspection items of the user, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, and method name.

[0053] Step S5: When the mobile application software is running, generate a user privacy system interface call operation report based on the call logs generated by invoking the compliance interface; the content of the user privacy system interface call operation report includes the compliance check items of user privacy, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, method name, and call stack.

[0054] Step S6: The user privacy interface call operation report summarizes the call operation report through the local protocol or network protocol, providing a repair direction for system calls that do not meet the compliance specifications of user privacy.

[0055] The present invention also provides a mobile application software user privacy compliance detection and repair system, which can be implemented by executing the process steps of the mobile application software user privacy compliance detection and repair method, that is, those skilled in the art can understand the mobile application software user privacy compliance detection and repair method as the preferred implementation manner of the mobile application software user privacy compliance detection and repair system.

[0056] Example 2:

[0057] Embodiment 2 is a preferred example of Embodiment 1 to more specifically illustrate the present invention.

[0058] The present invention also provides a mobile application software user privacy compliance detection and repair system, and the system includes the following modules:

[0059] Module M1: Generate check items and compliance interfaces according to the compliance specifications of user privacy formulated by the state or industry;

[0060] Module M1.1: Extract detection descriptions according to the compliance specifications of user privacy formulated by the state or industry; according to the compliance specifications, the detection descriptions are divided into personal privacy agreements collected before the user agrees to the privacy agreement, mobile software foreground silent collection of device information, and mobile software background silent collection of device information.

[0061] Module M1.2: Search for relevant Android system call interfaces according to the compliance specifications of user privacy and the detection descriptions;

[0062] Module M1.3: Generate corresponding compliance interfaces according to the compliance specifications of user privacy. For system interface calls of personal privacy agreements collected before the user agrees to the privacy agreement, the compliance interface returns null and does not call the system interface; for mobile software foreground silent collection of device information and mobile software background silent collection of device information, when the number or time limit or device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications.

[0063] Module M2: During the process of generating a mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items.

[0064] Module M3: Replace the interface calls that meet the inspection items with compliant interface calls.

[0065] Module M4: Generate a user privacy system interface call report based on the replacement records; the content of the user privacy system interface call report includes the compliance inspection items for user privacy, the class information of the system interfaces called, and the class information of the system interfaces called includes the package name, class name, and system name.

[0066] Module M5: During the operation of the mobile application software, generate a user privacy system interface call operation report based on the call log records generated by calling the compliant interfaces; the content of the user privacy system interface call operation report includes the compliance inspection items for user privacy, the class information of the system interfaces called, and the class information of the system interfaces called includes the package name, class name, system name, and call stack.

[0067] Module M6: The user privacy interface call operation report summarizes the call operation reports through the local protocol or network protocol, providing a repair direction for system calls that do not meet the compliance specifications of user privacy.

[0068] Example 3:

[0069] Embodiment 3 is a preferred example of Embodiment 1 to more specifically illustrate the present invention.

[0070] According to the compliance specifications of user privacy formulated by the country or industry, corresponding inspection items are generated. During the generation of an Android mobile application software, relevant interfaces are replaced with compliant interfaces according to the inspection items. The compliant interfaces record the inspection items and interface information according to the regulations that meet the inspection items, and generate a user privacy compliance detection report for the Android mobile application software. At the same time, if the compliant interfaces meet the regulations that meet the inspection items, relevant interfaces are called, otherwise the interfaces are not called, realizing the repair of user privacy compliance for the Android mobile application software.

[0071] By adopting the means of operating Java bytecode to modify the bytes of the implementation classes, third-party libraries, and third-party implementation classes of the Android mobile application software according to the user privacy compliance inspection items, the purpose of detecting and repairing the user privacy compliance of the Android mobile application software is realized.

[0072] The implementation steps of this system are as follows:

[0073] Step 1: According to the compliance specifications of user privacy formulated by the country or industry, generate inspection items and compliant interfaces.

[0074] Step 2: During the process of generating an Android mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items.

[0075] Step 3: Replace the interface calls that meet the inspection items with compliant interface calls.

[0076] Step 4: Generate a user privacy system interface call report according to the replacement records. The report content includes the compliance inspection items of user privacy, and class information of the system interface calls, including package name, class name, method name, etc.

[0077] Step 5: When the Android mobile application software is running, generate a user privacy system interface call running report according to the call log records generated by calling the compliant interface. The report content includes the compliance inspection items of user privacy, and class information of the system interface calls, including package name, class name, method name, and call stack.

[0078] Step 6: The user privacy interface call running report can summarize the call running report through the local protocol or network protocol, providing a repair direction for solving system calls that do not meet the compliance specifications of user privacy.

[0079] The said Step 1 has the following steps:

[0080] Step 1.1: According to the compliance specifications of user privacy formulated by the country or industry, extract the detection descriptions. According to the current compliance specifications, the detection descriptions can be divided into three categories, namely "personal privacy agreements collected before the user agrees to the privacy agreement", "mobile software silently collects device information in the foreground", and "mobile software silently collects device information in the background".

[0081] Step 1.2: According to the compliance specifications of user privacy formulated by the country or industry, find the relevant Android system call interfaces.

[0082] Step 1.3: Generate corresponding compliant interfaces according to the compliance specifications. For the system interface calls of personal privacy agreements collected before the user agrees to the privacy agreement, the compliant interface returns null and does not call the system interface. For mobile software silently collecting device information in the foreground and mobile software silently collecting device information in the background, when the number of times or time limit or the device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications.

[0083] Through the user privacy compliance detection and repair system for Android mobile application software, the present invention quickly responds to the compliance specifications of user privacy formulated by the country or industry, and solves the technical problem that Android mobile application software completely relies on third-party testing agencies for testing.

[0084] The present invention solves the problem of difficult positioning of system interface calls through the user privacy system interface call report and the user privacy system interface call operation report, especially the positioning problem of third-party libraries and third-party implementation class system interface calls introduced in Android mobile application software, and provides a repair direction for system calls that do not meet the compliance specifications of user privacy.

[0085] By operating on Java bytecode, the present invention solves the problem of repairing system calls that do not meet the compliance specifications of user privacy without modifying the implementation classes of Android mobile application software, third-party libraries, and third-party implementation classes.

[0086] The present invention responds quickly to the compliance specifications of user privacy formulated by the state or the industry, does not rely on the modification of the implementation classes of Android mobile application software, and does not require the re-release of third-party libraries and third-party implementation classes. It has the effects of being fast and non-invasive.

[0087] The present invention provides an inspection system that does not rely on third-party inspection agencies, and realizes a solution for detecting Android mobile application software in real time and discovering problems as early as possible.

[0088] In the process of Android mobile application software, the present invention traverses and searches for system interface calls that meet the inspection item specifications of the user privacy protocol, replaces the system interface calls with compliance interfaces, and simultaneously records the class information of the system interface calls, including package names, class names, method names, etc., to generate a user privacy system interface call report, providing a direction for developers to troubleshoot and solve problems.

[0089] The compliance interface is flexible and highly extensible. It provides the call stack during the operation of Android mobile application software and provides system call interfaces according to the user privacy inspection items. The specific process is as follows:

[0090] Step 1: Record the package name, class name, method name, and call stack of the caller that calls the compliance interface.

[0091] Step 2: Determine whether the compliance interface requires the user to agree to the personal privacy agreement. If so, return null; otherwise, execute Step 3.

[0092] Step 3: Check whether the system interface information is empty. If so, execute Step 7; otherwise, execute Step 4.

[0093] Step 4: Check whether the system interface information has changed. If so, execute Step 7; otherwise, execute Step 5.

[0094] Step 5: Check whether the system interface information is valid, including valid time, valid number of times, etc. If so, execute Step 6; otherwise, execute Step 7.

[0095] Step 6: Return of the memory data of the system interface information.

[0096] Step 7: Invoke the return of the system interface information.

[0097] Those skilled in the art can understand this embodiment as a more specific illustration of Embodiment 1 and Embodiment 2.

[0098] Those skilled in the art know that in addition to implementing the system and its various devices, modules, and units provided by the present invention in the form of pure computer-readable program code, the method steps can be logically programmed to enable the system and its various devices, modules, and units provided by the present invention to be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers, etc. to achieve the same functions. Therefore, the system and its various devices, modules, and units provided by the present invention can be regarded as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be regarded as the structures within the hardware component; the devices, modules, and units for implementing various functions can also be regarded as both software modules for implementing the method and the structures within the hardware component.

[0099] The specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Without conflict, the embodiments of the present application and the features in the embodiments can be arbitrarily combined with each other.

Claims

1. A method for detecting and repairing the privacy compliance of mobile application software users, characterized in that, The method includes the following steps: Step S1: Generate inspection items and compliance interfaces according to the compliance specifications of user privacy; Step S2: During the process of generating a mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items; Step S3: Replace the interface calls that meet the inspection items with compliance interface calls; Step S4: Generate a user privacy system interface call report according to the replacement records; Step S5: During the operation of the mobile application software, generate a user privacy system interface call operation report according to the call log records generated by calling the compliance interface; Step S6: The user privacy interface call operation report summarizes the call operation reports through a local protocol or a network protocol, providing a repair direction for system calls that do not meet the compliance specifications of user privacy; The said Step S1 includes the following steps: Step S1.1: Extract detection descriptions according to the compliance specifications of user privacy; Step S1.2: Find relevant Android system call interfaces according to the compliance specifications of user privacy and the detection descriptions; Step S1.3: Generate corresponding compliance interfaces according to the compliance specifications of user privacy. For the system interface calls of the personal privacy agreement collected before the user agrees to the privacy agreement, the compliance interface returns null and does not call the system interface; For the mobile software to silently collect device information in the foreground and the mobile software to silently collect device information in the background, when the number or time limit is reached or the device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications; The content of the user privacy system interface call report in the said Step S4 includes the compliance inspection items of user privacy, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, and method name; The content of the user privacy system interface call operation report in the said Step S5 includes the compliance inspection items of user privacy, the class information of the called system interface, and the class information of the called system interface includes the package name, class name, method name, and call stack; 2. The method for detecting and repairing the privacy compliance of mobile application software users according to claim 1, wherein According to the compliance specifications in the said Step S1.1, the detection descriptions are divided into the personal privacy agreement collected before the user agrees to the privacy agreement, the mobile software to silently collect device information in the foreground, and the mobile software to silently collect device information in the background; 3. A mobile application software user privacy compliance detection and repair system, characterized in that, The said system includes the following modules: Module M1: Generate inspection items and compliance interfaces according to the compliance specifications of user privacy; Module M2: During the process of generating a mobile application software, traverse the implementation classes, third-party libraries, and third-party implementation classes to find interface calls that meet the inspection items; Module M3: Replace the interface calls that meet the inspection items with compliance interface calls; Module M4: Generate a user privacy system interface call report according to the replacement records; Module M5: During the operation of the mobile application software, generate a user privacy system interface call operation report according to the call log records generated by calling the compliance interface; Module M6: The user privacy interface call operation report summarizes the call operation reports through a local protocol or a network protocol, providing a repair direction for system calls that do not meet the compliance specifications of user privacy; The module M1 includes the following modules: Module M1.1: Extract the detection description according to the compliance specifications of user privacy; Module M1.2: Find relevant Android system call interfaces according to the compliance specifications of user privacy and the detection description; Module M1.3: Generate corresponding compliance interfaces according to the compliance specifications of user privacy. For the system interface calls of the personal privacy agreement collected before the user agrees to the privacy agreement, the compliance interface returns null and does not call the system interface; For the silent collection of device information by the mobile software in the foreground and the silent collection of device information by the mobile software in the background, if the number of times or time limit is reached or the device information has not changed, return the relevant device information in the device memory, otherwise implement the system interface call according to the regulations of the specifications; The content of the user privacy system interface call report in the module M4 includes the compliance check items of user privacy, and the class information of the called system interface. The class information of the called system interface includes the package name, class name and system name; The content of the user privacy system interface call operation report in the module M5 includes the compliance check items of user privacy, and the class information of the called system interface. The class information of the called system interface includes the package name, class name, system name and call stack; 4. The mobile application software user privacy compliance detection and repair system according to claim 3, characterized in that According to the compliance specifications, the module M1.1 divides the detection description into the personal privacy agreement collected before the user agrees to the privacy agreement, the silent collection of device information by the mobile software in the foreground and the silent collection of device information by the mobile software in the background.

Images