Mobile terminal security aspect protection method and device, storage medium and electronic equipment

Abstract

This invention relates to a mobile security aspect protection method, apparatus, storage medium, and electronic device. The mobile device has a virtual machine for running mobile security aspects. The method includes: after the mobile application starts, the virtual machine determines whether the mobile security aspect meets the security operation conditions; if so, it obtains the encrypted aspect configuration, decrypts it, and injects the aspect program into the application according to the decrypted aspect configuration through a preset aspect base, so as to execute the security aspect business through the aspect program; otherwise, the application exits. The mobile security aspect protection method and apparatus of this invention use a virtual machine to determine whether the mobile security aspect meets the security operation conditions, and start the mobile security aspect if the security operation conditions are met; if the security operation conditions are not met, the mobile security aspect is not started, and the application exits, preventing attacks on the mobile security aspect and the application.

Description

Technical Field

[0001] This invention relates to the field of security cut-off protection technology, and more specifically to a mobile device security cut-off protection method, apparatus, storage medium, and electronic device. Background Technology

[0002] Security aspect is a system concept that applies the concept of aspect-oriented programming (AOP) to the construction of security systems, building a security parallel space (parallel cabin) that is orthogonally integrated with business operations, and achieving higher-dimensional security protection without modifying the normal business logic.

[0003] Mobile security aspect is a super-management framework for mobile devices, and its own security defenses are crucial. Unlike server-side applications that run on controllable servers, mobile security aspect runs on the user's terminal device, and the runtime environment is not trustworthy.

[0004] Therefore, how to ensure that the mobile security aspect is not attacked on the mobile device is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One of the objectives of this invention is to provide a mobile security aspect protection method to prevent mobile security aspects from being attacked on mobile devices.

[0006] To achieve the above objectives, the present invention provides a mobile security aspect protection method, which is applied to a virtual machine set up on a mobile device, the virtual machine being used to run mobile security aspects, and the method includes the following steps:

[0007] After the business application installed on the mobile device is started, the virtual machine determines whether the security aspect of the mobile device meets the security operation conditions;

[0008] If so, the encrypted aspect configuration is obtained and decrypted. The aspect program is then injected into the business application through the preset aspect base according to the decrypted aspect configuration, so as to execute secure aspect business through the aspect program.

[0009] Otherwise, exit the business application.

[0010] Furthermore, in some implementations, the virtual machine determines whether the mobile terminal security aspect meets the security operation conditions, specifically including:

[0011] The virtual machine performs an integrity check on the mobile security aspect. If the check passes, the mobile security aspect meets the security operation conditions; otherwise, the mobile security aspect does not meet the security operation conditions.

[0012] Furthermore, in some implementations, determining whether the mobile terminal security aspect meets the security operation conditions through the virtual machine specifically includes:

[0013] The virtual machine determines whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If so, the mobile device's security aspect meets the security operation conditions; otherwise, the mobile device's security aspect does not meet the security operation conditions.

[0014] Furthermore, in some embodiments, after the slicing procedure is injected into the business application, it further includes:

[0015] The object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with. If so, the business application is exited; otherwise, the aspect program continues to execute the secure aspect business.

[0016] Furthermore, in some implementations, the object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with, specifically including:

[0017] The hash value of the object corresponding to the decrypted aspect configuration is compared with the pre-stored standard hash value at regular intervals. If they match, the object has not been tampered with; otherwise, the object has been tampered with.

[0018] Furthermore, in some embodiments, after the slicing procedure is injected into the business application, it further includes:

[0019] By tracing the stack back of the aspect program call, it is determined whether the aspect program was hijacked when executing the security aspect business. If so, the business application is made to exit; otherwise, the aspect program is made to continue executing the security aspect business.

[0020] Another objective of this invention is to provide a mobile security profile protection device to prevent mobile security profiles from being attacked on mobile devices.

[0021] To achieve the above objectives, another aspect of the present invention provides a mobile security profile protection device, wherein the mobile security profile protection device is disposed within a virtual machine on a mobile device, the virtual machine being used to run the mobile security profile, and the device includes:

[0022] The judgment module is configured to determine, through the virtual machine, whether the security aspect of the mobile terminal meets the security operation conditions after the business application on the mobile terminal starts.

[0023] The startup module is configured to, when the judgment result of the judgment module is yes, obtain the encrypted aspect configuration, decrypt the encrypted aspect configuration, and inject the aspect program into the business application through the preset aspect base according to the decrypted aspect configuration, so as to execute the secure aspect business through the aspect program;

[0024] The exit module is configured to cause the business application to exit when the judgment result of the judgment module is negative.

[0025] Furthermore, in some implementations, determining whether the mobile terminal security aspect meets the security operation conditions through the virtual machine specifically includes:

[0026] The mobile security aspect is verified by the virtual machine. If the verification passes, the mobile security aspect meets the security operation conditions; otherwise, the mobile security aspect does not meet the security operation conditions.

[0027] Furthermore, in some implementations, determining whether the mobile terminal security aspect meets the security operation conditions through the virtual machine specifically includes:

[0028] The virtual machine determines whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If so, the mobile device's security aspect meets the security operation conditions; otherwise, the mobile device's security aspect does not meet the security operation conditions.

[0029] Furthermore, in some embodiments, the startup module is further configured as follows:

[0030] After the aspect program is injected into the business application, the object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with. If so, the business application is made to exit; otherwise, the aspect program continues to execute the secure aspect business.

[0031] Furthermore, in some implementations, the object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with, specifically including:

[0032] The hash value of the object corresponding to the decrypted aspect configuration is compared with the pre-stored standard hash value at regular intervals. If they match, the object has not been tampered with; otherwise, the object has been tampered with.

[0033] Furthermore, in some embodiments, the startup module is further configured as follows:

[0034] After the aspect is injected into the business application, the stack backtracking of the aspect call is used to determine whether the aspect was hijacked while executing the secure aspect business. If so, the business application is made to exit; otherwise, the aspect continues to execute the secure aspect business.

[0035] Another object of the present invention is to provide a storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the steps of the mobile terminal security aspect protection method as described above.

[0036] Another object of the present invention is to provide an electronic device including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it performs the steps of the mobile terminal security aspect protection method as described above.

[0037] The mobile security aspect protection method and apparatus of the present invention determine whether the mobile security aspect meets the security operation conditions through a virtual machine. If the security operation conditions are met, the mobile security aspect is started; if the security operation conditions are not met, the mobile security aspect is not started, and the business application is exited to prevent the mobile security aspect and the business application from being attacked. The aspect configuration is modified from plaintext to encrypted ciphertext and decrypted through a virtual machine to prevent the plaintext aspect configuration from being illegally called by attackers in the operating system. The method and apparatus periodically determine whether the aspect program has been hijacked or whether the object corresponding to the encrypted aspect configuration has been tampered with, thereby protecting the mobile security aspect during its operation. Attached Figure Description

[0038] Figure 1 This is a flowchart of a mobile terminal security aspect protection method according to an embodiment of the present invention;

[0039] Figure 2 This is a structural block diagram of a mobile terminal security cut-off protection device according to another embodiment of the present invention. Detailed Implementation

[0040] The preferred embodiments of the present invention are given below with reference to the accompanying drawings and described in detail.

[0041] Security aspects (or security parallel aspects) refer to the method of dynamically adding or modifying aspect programs to implement security-oriented business logic within the runtime logic of a business application without modifying the application itself. This decouples the program implementing the security aspect from the business application, thus avoiding development iteration problems caused by high coupling.

[0042] The aspect program mentioned here refers to an enhancement program that implements security aspect functionality based on business logic. By using aspect-oriented programming, aspect programs can be injected into corresponding pointcuts in the business application. These aspect programs are triggered and executed during the execution of the business application to achieve the required security aspect functionality.

[0043] When a business application executes its business logic, it typically does so through method calls. Therefore, any method within the business application can be used as a pointcut for an aspect, as mentioned above, and the aspect can be injected into the corresponding pointcut. This ensures that when the business application reaches a pointcut—that is, when it calls a method of the business application corresponding to that pointcut—the injected aspect is executed.

[0044] Typically, the code responsible for injecting aspects into pointcuts is highly reusable. Therefore, the program implementing this process is usually abstracted into a service module, namely the aspect base. The aspect base can obtain the aspects to be deployed and the pointcuts injected into the business application from the server providing secure aspect services. It is then awakened after the application container starts and injects the corresponding aspects at the pointcuts in the business application.

[0045] A business application can be a business application that provides business services on the servers of a business platform. These business services can be services provided by the business platform's servers to users, such as query services and payment services. Business services can also be services provided by one server of the business platform to other servers, such as settlement services.

[0046] Of course, as described above, to decouple the security aspect service program from the business application, this specification employs aspect-oriented programming (AOP) to allow the security aspect service program and the business application to intertwine during business execution, while remaining parallel and independently maintainable. Therefore, unlike the business application provider, the third party providing the security aspect service can manage the content related to the security aspect service through a server, such as configuring security aspect service control policies, iterating aspect program versions, configuring aspect program deployment rules, etc. Of course, the provider of the security aspect service can be either a third party or a business application provider.

[0047] When managing the content related to security aspect services, the server can record various configuration information through configuration files, such as the configuration of various policies and the deployment rules for aspect programs. This allows the aspect platform to deploy aspect programs according to the configuration files, or the server to implement security aspect services according to the configuration files.

[0048] In practical applications, service providers typically set up data centers containing several physical machines or servers, providing the physical resources required by business applications. Of course, a business application may not require all the physical resources of a single physical machine; therefore, virtualization technology is often used to run multiple virtual hosts on a single physical machine. Each virtual host is independent, sharing a portion of the physical resources of the physical machine. Application containers can then be deployed within these virtual hosts, and business applications can run through these containers. Application containers typically contain the physical resources allocated to them, such as CPU and memory, as well as the runtime environment provided to them, such as the operating system (OS) or other runtime environment data (e.g., container serial number, assigned IP address, application name, tenant, environment variables, etc.). Business applications can be deployed within these application containers to execute business logic.

[0049] In scenarios where secure aspect-based business execution is used, the business provider or a third party providing secure aspect services can provide a server to manage the content involved in the secure aspect services and deploy the aspect base in the application container. The aspect program is then injected into the business application in the business application container through the aspect base, thereby providing secure aspect service support for the business provider's application container.

[0050] Therefore, an aspect-based framework can be pre-deployed within the application container of the service provider. Typically, when the application container starts, the operating system provided to the container is invoked, and the pre-deployed aspect-based framework runs. It then obtains aspects and pointcuts for the business application from the server and injects the aspects into the pointcuts of the business application within the application container. Furthermore, the aspect-based framework can also obtain aspects and pointcuts for the business application from the server during the execution of the business application and inject the aspects into the pointcuts of the business application within the application container.

[0051] Of course, how the aspect-based platform obtains the information needed to deploy aspects from the server can be configured as needed. For example, it can actively pull the required information from the server based on the configuration file, or the server can actively send the required information to the aspect-based platform.

[0052] After injecting an aspect into a pointcut of a business application, the business application can trigger the aspect during execution to achieve the corresponding security aspect business function.

[0053] Mobile security aspects are security aspects that run on mobile devices. They are used to inject aspect programs into the pointcuts of mobile business applications (i.e., apps) to perform security control over the mobile application. Unlike server-side applications that run on secure and controllable servers, mobile security aspects run on the user's terminal device, where the runtime environment is untrusted. Mobile security aspects themselves may also be attacked during operation, leading to insecurity.

[0054] To ensure the security of mobile security aspects on mobile devices, such as... Figure 1 As shown, this embodiment of the invention provides a mobile security aspect protection method, which is applied to a virtual machine set up on a mobile device. The virtual machine is used to run mobile security aspects. The method includes the following steps:

[0055] 100: After the business application installed on the mobile terminal starts, the virtual machine determines whether the security aspect of the mobile terminal meets the security operation conditions. If yes, step 200 is executed; otherwise, step 300 is executed.

[0056] In existing technologies, mobile security aspects run within the mobile device's operating system. Their basic functions (such as hash algorithms, memory symbol lookups, encryption / decryption, etc.) all require calls to APIs in the system library. However, the mobile operating system can be hijacked by attackers, leading to the aspect program being hooked or hijacked by a replaced system library during runtime. To address this, a protected custom virtual machine (VMP) can be set up on the mobile device to run the mobile security aspect. The basic functions of the mobile security aspect are implemented by functions in the virtual machine's trusted underlying library, eliminating the need to call APIs in the system library. This way, even if an attacker hijacks the operating system, they cannot attack the virtual machine, thus ensuring the security of the mobile security aspect.

[0057] Once the mobile application is launched, the virtual machine will start running. The virtual machine will then determine whether the mobile security aspect meets the security conditions for operation. If it does, it means that the mobile security aspect's operating environment is secure and it can be launched. Otherwise, it means that the mobile security aspect's operating environment is insecure and may be vulnerable to attack, so it cannot be launched. At the same time, the application also needs to be shut down to prevent attackers from further attacking the application.

[0058] In some embodiments, the virtual machine determines whether the mobile security aspect meets the security operation conditions, specifically including:

[0059] The virtual machine performs integrity verification on the mobile security aspect. If the verification passes, it means that the mobile security aspect meets the security operation conditions; otherwise, the mobile security aspect does not meet the security operation conditions.

[0060] Integrity verification refers to calculating the integrity of a file using various algorithms to prevent its modification. For example, it can determine whether a file has been modified by calculating its CRC32 value or hash value. In some embodiments, integrity verification can be performed by calculating the hash values ​​of various files within a mobile security aspect. For instance, the hash values ​​of the mobile security aspect's signature, configuration file, and package name can be calculated and then compared with pre-stored standard hash values ​​(i.e., the hash values ​​of files that have not been tampered with). If they match, it means the mobile security aspect's signature, configuration file, and package name have not been tampered with, and the integrity verification passes. Otherwise, it means the mobile security aspect's signature, configuration file, and package name have been tampered with, and the integrity verification fails.

[0061] Because integrity verification is performed through a virtual machine, there's no need to call system library APIs. This prevents the operating system from being hijacked by attackers and returning a result set by the attacker instead of the actual result, thus ensuring the integrity of the mobile security aspect before startup and preventing it from starting under tampered conditions. For example, without a virtual machine, integrity verification requires calling APIs in the system library to calculate the file's hash value and match it with a standard hash value. If the operating system is hijacked, the attacker can return a predetermined result instead of the actual result. For instance, the actual result might be a mismatch, causing the integrity verification to fail. However, the attacker can make the system library API return a matching result, allowing the integrity verification to pass and the mobile security aspect to start. This allows the attacker to attack the mobile security aspect and then use it to attack business applications. When integrity verification is performed through a virtual machine, it doesn't need to call system library APIs but relies on the virtual machine's own trusted underlying library. This ensures that even if the operating system is hijacked, the integrity verification will return the correct result, guaranteeing that the mobile security aspect starts under secure operating conditions.

[0062] In other embodiments, determining whether the mobile terminal security aspect meets the security operation conditions specifically includes:

[0063] Determine whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If so, the mobile device's security aspect meets the security operation conditions; otherwise, the mobile device's security aspect does not meet the security operation conditions.

[0064] In some embodiments, an integrity check can be performed first using a virtual machine. If the integrity check passes, then it can be determined whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If the mobile device is not jailbroken / rooted and the mobile device's security aspect has not been injected / hooked, it indicates that the mobile device's security aspect meets the security operation requirements. If the integrity check fails, it can be determined that the mobile device's security aspect does not meet the security operation requirements, without needing to further determine whether the mobile device is jailbroken / rooted or whether the mobile device's security aspect has been injected / hooked. If the integrity check passes, but the mobile device is jailbroken / rooted or the mobile device's security aspect has been injected / hooked, it can be determined that the mobile device's security aspect does not meet the security requirements.

[0065] Jailbreaking / rooting refers to gaining root access to a mobile device's system. After jailbreaking / rooting, attackers can obtain any user information or perform any operation on the device, leading to risks such as privacy breaches. After jailbreaking / rooting, attackers often leave many high-risk files in the device's memory to store configuration information. Therefore, the presence of these high-risk files can be used to determine if a device is jailbroken / rooted. Specifically, the presence of high-risk files in the device's memory indicates that it is jailbroken / rooted; conversely, the absence of such files indicates that the device is not jailbroken / rooted.

[0066] HOOK, also known as a hook, is a technique that allows the replacement of function call entry addresses. Injection refers to an attacker injecting their own third-party library into the process of a business application. Attackers often combine injection and HOOK techniques to replace the entry address of a target function with the address of a function in the attacker's injected third-party library, thereby altering the original functionality of functions in the business application. To detect the risk of injection / HOOK attacks on mobile security aspects, the entry addresses of all functions (or critical functions) within the mobile security aspect can be traversed. Then, it's checked whether these entry addresses reside in the same memory address space as the mobile security aspect. If a function's entry address is not in the same memory address space as the mobile security aspect, but has been modified to the memory address space of the attacker's third-party library, then that function has been injected / HOOKed, meaning the mobile security aspect has been injected / HOOKed. If the entry addresses of all traversed functions are in the same memory address space as the mobile security aspect, then no function has been injected / HOOKed, meaning the mobile security aspect has not been injected / HOOKed.

[0067] 200: Obtain the encrypted aspect configuration, decrypt the encrypted aspect configuration, and inject the aspect program into the business application according to the decrypted aspect configuration through the preset aspect base, so as to execute secure aspect business through the aspect program.

[0068] If the mobile security aspect meets the security operation conditions, it means that the mobile operating environment is secure and can therefore be started. At this time, the encrypted aspect configuration can be obtained through the virtual machine, and the encrypted aspect configuration can be decrypted to obtain the decrypted aspect configuration. Then, the aspect program is injected into the business application through the preset mobile security aspect aspect base according to the decrypted aspect configuration, so that the security aspect business can be executed through the aspect program.

[0069] In existing technologies, aspect configurations are typically distributed from a server to an aspect-based application, which then injects aspect programs into the business application based on these configurations. Since aspect configurations are usually plaintext JSON files, they may be illegally accessed by attackers during distribution to the aspect-based application, leading to insecurity. Therefore, in some embodiments, the aspect configuration can be encrypted on the server first, using a salted symmetric encryption algorithm or other encryption algorithms. The server then distributes the encrypted aspect configuration to a virtual machine, which decrypts it to obtain the decrypted aspect configuration. This decrypted aspect configuration is then sent to the aspect-based application, where it injects the aspect program into the business application. Because both decryption and the transmission of the decrypted aspect configuration are implemented through a virtual machine, the illegal access of the decrypted aspect configuration to the operating system by attackers can be avoided, thus reducing the attack surface.

[0070] 300: Causes the business application to exit.

[0071] If the mobile security aspect does not meet the security operation conditions, it means that the mobile security aspect's operating environment is insecure and the mobile security aspect may be attacked. Therefore, it cannot be started. In order to prevent attackers from further attacking the business application, the business application can be shut down.

[0072] The decrypted aspect configuration will have a corresponding object in memory. After the decrypted aspect configuration is sent to the aspect base, it will be loaded into memory. Then, when the aspect base performs operations based on the decrypted aspect configuration, it will retrieve the value of the object corresponding to the decrypted aspect configuration. For example, if a certain configuration in the decrypted aspect configuration controls whether a function is on or off, the object corresponding to this configuration in memory has a property that returns a value. If the value is true, it means that the function is on; if the value is false, it means that the function is off. The object corresponding to the decrypted aspect configuration may be tampered with, causing the aspect program to execute operations set by an attacker, resulting in insecurity. Therefore, in some embodiments, after the aspect program is injected into the business application (i.e., when the mobile security aspect runs), the object corresponding to the decrypted aspect configuration can be periodically verified to determine whether the object has been tampered with. If so, the business application is shut down to prevent it from being attacked; otherwise, the aspect program continues to execute the security aspect business.

[0073] In some embodiments, the hash value of the object corresponding to the decrypted aspect configuration can be obtained, and then compared with a pre-stored standard hash value at regular intervals. If they match, it means that the object corresponding to the decrypted aspect configuration has not been tampered with; otherwise, it means that the object corresponding to the decrypted aspect configuration has been tampered with. This achieves timed verification of the object. The frequency of the timed verification can be set as needed, for example, every 10 minutes or any other desired interval.

[0074] After an aspect is injected into a business application, it may be hijacked and used to execute business functions set by the attacker. Therefore, in some embodiments, the stack of aspect calls can be backtracked periodically to determine whether the aspect has been hijacked. If so, the business application is made to exit to prevent it from being attacked; otherwise, the aspect continues to execute the secure aspect business, that is, the mobile secure aspect continues to run.

[0075] Aspect-oriented programming (AOP) calls many methods when performing security tasks. If an AOP is hijacked, it will call functions from an attacker's library, resulting in the attacker's library appearing in the AOP's call stack. Conversely, if the AOP is not hijacked, its library will not appear in the call stack. Therefore, in some embodiments, the AOP's call stack can be backtracked periodically (e.g., every 10 minutes or any other desired interval). If the attacker's library is present in the call stack, it indicates that the AOP has been hijacked; otherwise, it indicates that the AOP has not been hijacked.

[0076] In some embodiments, when a business application exits, the corresponding exit reason can also be reported to the server. For example, when exiting due to an integrity verification failure, this information can be reported to the server; when exiting due to mobile jailbreaking / rooting and / or mobile security aspect injection / hooking, the corresponding information can be reported to the server; when exiting due to the object corresponding to the decrypted aspect configuration being tampered with, the tampered object is reported to the server; when exiting due to the mobile security aspect being hijacked during runtime, this information is reported to the server.

[0077] The mobile security aspect protection method of this invention determines whether the mobile security aspect meets the security operation conditions through a virtual machine. If the security operation conditions are met, the mobile security aspect is started; if the security operation conditions are not met, the mobile security aspect is not started, and the business application is exited to prevent the mobile security aspect and the business application from being attacked. The aspect configuration is modified from plaintext to encrypted ciphertext and decrypted through a virtual machine to prevent the plaintext aspect configuration from being illegally called by attackers in the operating system. The method also periodically determines whether the aspect program has been hijacked or whether the object corresponding to the encrypted aspect configuration has been tampered with, thereby protecting the mobile security aspect during its operation.

[0078] like Figure 2 As shown, another embodiment of the present invention provides a mobile security aspect protection device, wherein a virtual machine for running mobile security aspects is set on the mobile terminal. The device runs within the virtual machine and includes a judgment module 10, a startup module 20, and an exit module 30. After the business application installed on the mobile terminal is started, the judgment module 10 first determines through the virtual machine whether the mobile security aspect meets the security operation conditions. If so, the startup module 20 obtains the encrypted aspect configuration through the virtual machine, decrypts the encrypted aspect configuration, and then injects the aspect program into the business application according to the decrypted aspect configuration through a preset aspect base, so as to execute the security aspect business through the aspect program, thus enabling the mobile security aspect to start. Otherwise, the exit module 30 causes the business application to exit. At this time, the mobile security aspect does not start, and the business application also exits, preventing the business application from being attacked due to the insecurity of the mobile security aspect.

[0079] In some embodiments, the virtual machine determines whether the mobile security aspect meets the security operation conditions, specifically including:

[0080] The virtual machine performs integrity verification on the mobile security aspect. If the verification passes, it means that the mobile security aspect meets the security operation conditions; otherwise, the mobile security aspect does not meet the security operation conditions.

[0081] In some embodiments, integrity verification can be performed by calculating the hash values ​​of various files of the mobile security aspect. For example, the hash values ​​of the mobile security aspect's signature, configuration file, and package name can be calculated and then compared with the pre-stored standard hash values ​​(i.e., the hash values ​​of files that have not been tampered with). If they match, it means that the mobile security aspect's signature, configuration file, and package name have not been tampered with and the integrity verification passes. Otherwise, it means that the mobile security aspect's signature, configuration file, and package name have been tampered with and the integrity verification fails.

[0082] Since integrity verification is performed through a virtual machine, there is no need to call system library APIs. This prevents the operating system from being hijacked by attackers and returning the result set by the attacker instead of the real result. This ensures the integrity of the mobile security aspect before startup and prevents it from starting if it has been tampered with.

[0083] In other embodiments, determining whether the mobile terminal security aspect meets the security operation conditions specifically includes:

[0084] Determine whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If so, the mobile device's security aspect meets the security operation conditions; otherwise, the mobile device's security aspect does not meet the security operation conditions.

[0085] In some embodiments, the judgment module 10 can first perform an integrity check via a virtual machine. If the integrity check passes, it then determines whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If the mobile device is not jailbroken / rooted and the mobile device's security aspect has not been injected / hooked, it indicates that the mobile device's security aspect meets the security operation conditions. If the integrity check fails, it can be determined that the mobile device's security aspect does not meet the security operation conditions, without needing to further determine whether the mobile device is jailbroken / rooted or whether the mobile device's security aspect has been injected / hooked. If the integrity check passes, but the mobile device is jailbroken / rooted or the mobile device's security aspect has been injected / hooked, it can be determined that the mobile device's security aspect does not meet the security conditions.

[0086] Jailbreaking / rooting refers to gaining root access to a mobile device's system. After jailbreaking / rooting, attackers can obtain any user information or perform any operation on the device, leading to risks such as privacy breaches. After jailbreaking / rooting, attackers often leave many high-risk files in the device's memory to store configuration information. Therefore, the judgment module 10 can use a virtual machine to detect the presence of these high-risk files to determine if the device is jailbroken / rooted. Specifically, if high-risk files are detected in the device's memory, it indicates that the device is jailbroken / rooted; otherwise, it indicates that the device is not jailbroken / rooted.

[0087] To detect the risk of injection / hooking in the mobile security aspect, the judgment module 10 can traverse the entry addresses of all functions (or critical functions) in the mobile security aspect using a virtual machine. It then checks if the entry addresses are in the same memory address space as the mobile security aspect. If the entry address of a function is not in the same memory address space as the mobile security aspect, but has been modified to the memory address space of the attacker's third-party library, then that function has been injected / hooked, meaning the mobile security aspect has been injected / hooked. If the entry addresses of all traversed functions are in the same memory address space as the mobile security aspect, then no function has been injected / hooked, meaning the mobile security aspect has not been injected / hooked.

[0088] If the mobile security aspect meets the security operation conditions, it means that the mobile operating environment is secure and can therefore be started. At this time, the startup module 20 can obtain the encrypted aspect configuration through the virtual machine, and decrypt the encrypted aspect configuration to obtain the decrypted aspect configuration. Then, according to the decrypted aspect configuration, the aspect program is injected into the business application through the preset mobile security aspect aspect base to execute the security aspect business through the aspect program.

[0089] In existing technologies, aspect configurations are typically distributed from a server to an aspect base, which then injects aspect programs into the business application based on the configuration. Since aspect configurations are usually plaintext JSON files, they may be illegally accessed by attackers during distribution to the aspect base, leading to insecurity. Therefore, in some embodiments, the aspect configuration can be encrypted on the server first, using a salted symmetric encryption algorithm or other encryption algorithms. The server then distributes the encrypted aspect configuration to the startup module 20, which decrypts it using a virtual machine to obtain the decrypted aspect configuration. The decrypted aspect configuration is then sent to the aspect base, which injects the aspect program into the business application based on the decrypted configuration. Because both decryption and the transmission of the decrypted aspect configuration are implemented through a virtual machine, the illegal access of the decrypted aspect configuration to the operating system by attackers can be avoided, thereby reducing the attack surface.

[0090] If the mobile security aspect does not meet the security operation conditions, it means that the mobile security aspect's operating environment is insecure and the mobile security aspect may be attacked. Therefore, it cannot be started. In order to prevent attackers from further attacking the business application, the exit module 30 can make the business application exit.

[0091] In some embodiments, after the aspect program is injected into the business application (i.e., when the mobile security aspect is running), the startup module 20 can also be configured to periodically verify the object corresponding to the decrypted aspect configuration to determine whether the object has been tampered with. If so, the business application is exited to prevent it from being attacked; otherwise, the aspect program continues to execute the security aspect business.

[0092] In some embodiments, the hash value of the object corresponding to the decrypted aspect configuration can be obtained, and then compared with a pre-stored standard hash value at regular intervals. If they match, it means that the object corresponding to the decrypted aspect configuration has not been tampered with; otherwise, it means that the object corresponding to the decrypted aspect configuration has been tampered with. This achieves timed verification of the object. The frequency of the timed verification can be set as needed, for example, every 10 minutes or any other desired interval.

[0093] After the aspect is injected into the business application, it may be hijacked and execute the business set by the attacker. Therefore, in some embodiments, the startup module 20 can also be set to periodically backtrack the stack of aspect calls to determine whether the aspect has been hijacked. If so, the business application is made to exit to avoid being attacked; otherwise, the aspect continues to execute the secure aspect business, that is, the mobile secure aspect continues to run.

[0094] Aspect-oriented programming (AOP) calls many methods when performing security tasks. If an AOP is hijacked, it will call functions from an attacker's library, resulting in the attacker's library appearing in the AOP's call stack. Conversely, if the AOP is not hijacked, its library will not appear in the call stack. Therefore, in some embodiments, the AOP's call stack can be backtracked periodically (e.g., every 10 minutes or any other desired interval). If the attacker's library is present in the call stack, it indicates that the AOP has been hijacked; otherwise, it indicates that the AOP has not been hijacked.

[0095] In some embodiments, when a business application exits, the corresponding exit reason can also be reported to the server. For example, when exiting due to a failure of integrity verification, the exit module 30 can report this information to the server; when exiting due to mobile jailbreaking / rooting and / or the injection / hooking of mobile security aspects, the exit module 30 can report the corresponding information to the server; when exiting due to the object corresponding to the decrypted aspect configuration being tampered with, the startup module 20 can report the tampered object to the server; when exiting due to the mobile security aspect being hijacked during runtime, the startup module 20 can report this information to the server.

[0096] The mobile security aspect protection device of this invention includes a judgment module 10 that uses a virtual machine to determine whether the mobile security aspect meets the security operation conditions. If the security operation conditions are met, the mobile security aspect is started; if the security operation conditions are not met, the mobile security aspect is not started, and the business application is exited to prevent attacks on the mobile security aspect and the business application. The aspect configuration is modified from plaintext to encrypted ciphertext, and the startup module 20 decrypts it through the virtual machine to prevent the plaintext aspect configuration from being illegally called by attackers in the operating system. The startup module 20 periodically judges whether the aspect program has been hijacked or whether the object corresponding to the encrypted aspect configuration has been tampered with, thereby protecting the mobile security aspect during its operation.

[0097] Another embodiment of the present invention provides a readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the steps of the mobile terminal security aspect protection method in the above embodiments of the present invention.

[0098] Another embodiment of the present invention provides an electronic device, which includes a memory and a processor. The memory stores executable code. When the processor executes the executable code, it performs the steps of the mobile terminal security aspect protection method in the above embodiments of the present invention.

[0099] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0100] For ease of description, the above apparatus is described in terms of its functions, divided into various units. Of course, in implementing this invention, the functions of each unit can be implemented in one or more software and / or hardware components.

[0101] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0103] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0104] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0105] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0106] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0107] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0108] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0109] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0111] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0112] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of the invention. Various variations can be made to the above embodiments of the present invention. That is, all simple and equivalent changes and modifications made based on the claims and description of this invention fall within the protection scope of the claims of this patent. All aspects not described in detail in this invention are conventional technical content.

Claims

1. A mobile security aspect protection method, the method being applied to a virtual machine set up on a mobile device, the virtual machine being used to run mobile security aspects, the method comprising the following steps: After the business application installed on the mobile device is started, the virtual machine determines whether the security aspect of the mobile device meets the security operation conditions; If so, the encrypted aspect configuration is obtained and decrypted. The aspect program is then injected into the business application through the preset aspect base according to the decrypted aspect configuration, so as to execute secure aspect business through the aspect program. Otherwise, exit the business application.

2. The mobile security aspect protection method according to claim 1, wherein the virtual machine determines whether the mobile security aspect meets the security operation conditions, specifically including: The virtual machine performs an integrity check on the mobile security aspect. If the check passes, the mobile security aspect meets the security operation conditions; otherwise, the mobile security aspect does not meet the security operation conditions.

3. The mobile security aspect protection method according to claim 1, wherein determining whether the mobile security aspect meets the security operation conditions through the virtual machine specifically includes: The virtual machine determines whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If so, the mobile device's security aspect meets the security operation conditions; otherwise, the mobile device's security aspect does not meet the security operation conditions.

4. The mobile terminal security aspect protection method according to claim 1, further comprising, after the aspect program is injected into the business application: The object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with. If so, the business application is exited; otherwise, the aspect program continues to execute the secure aspect business.

5. The mobile terminal security aspect protection method according to claim 4, wherein the object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with, specifically including: The hash value of the object corresponding to the decrypted aspect configuration is compared with the pre-stored standard hash value at regular intervals. If they match, the object has not been tampered with; otherwise, the object has been tampered with.

6. The mobile terminal security aspect protection method according to claim 1, further comprising, after the aspect program is injected into the business application: By tracing the stack back of the aspect program call, it is determined whether the aspect program was hijacked when executing the security aspect business. If so, the business application is made to exit; otherwise, the aspect program is made to continue executing the security aspect business.

7. A mobile security profile protection device, wherein the mobile security profile protection device is disposed within a virtual machine on a mobile device, the virtual machine being used to run the mobile security profile, the device comprising: The judgment module is configured to determine, through the virtual machine, whether the security aspect of the mobile terminal meets the security operation conditions after the business application on the mobile terminal starts. The startup module is configured to, when the judgment result of the judgment module is yes, obtain the encrypted aspect configuration, decrypt the encrypted aspect configuration, and inject the aspect program into the business application through the preset aspect base according to the decrypted aspect configuration, so as to execute the secure aspect business through the aspect program; The exit module is configured to cause the business application to exit when the judgment result of the judgment module is negative.

8. The mobile terminal security aspect protection device according to claim 7, wherein determining whether the mobile terminal security aspect meets the security operation conditions through the virtual machine specifically includes: The mobile security aspect is verified by the virtual machine. If the verification passes, the mobile security aspect meets the security operation conditions; otherwise, the mobile security aspect does not meet the security operation conditions.

9. The mobile terminal security aspect protection device according to claim 7, wherein determining whether the mobile terminal security aspect meets the security operation conditions through the virtual machine specifically includes: The virtual machine determines whether the mobile device is jailbroken / rooted and / or whether the mobile device's security aspect has been injected / hooked. If so, the mobile device's security aspect meets the security operation conditions; otherwise, the mobile device's security aspect does not meet the security operation conditions.

10. The mobile terminal security cut-off protection device according to claim 7, wherein the activation module is further configured as: After the aspect program is injected into the business application, the object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with. If so, the business application is made to exit; otherwise, the aspect program continues to execute the secure aspect business.

11. The mobile terminal security aspect protection device according to claim 10, wherein the object corresponding to the decrypted aspect configuration is periodically verified to determine whether the object has been tampered with, specifically including: The hash value of the object corresponding to the decrypted aspect configuration is compared with the pre-stored standard hash value at regular intervals. If they match, the object has not been tampered with; otherwise, the object has been tampered with.

12. The mobile terminal security cut-off protection device according to claim 7, wherein the activation module is further configured as: After the aspect is injected into the business application, the stack backtracking of the aspect call is used to determine whether the aspect was hijacked while executing the secure aspect business. If so, the business application is made to exit; otherwise, the aspect continues to execute the secure aspect business.

13. A storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the steps of the mobile terminal security aspect protection method as described in any one of claims 1-6.

14. An electronic device comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, it performs the steps of the mobile terminal security aspect protection method as described in any one of claims 1-6.

Images