A method and system for identifying personal information collected by a third-party SDK

Abstract

This invention provides a method and system for identifying third-party SDKs collecting personal information, relating to the field of personal information technology. The method includes: monitoring whether each third-party software development kit (SDK) reads local data packets for all third-party software development kits introduced and installed by an application; when a target third-party SDK reading a local data packet is detected, capturing the local data packet read by the target third-party SDK and extracting a first string from the local data packet; comparing the first string with a preset personal information value for the target third-party SDK; if the first string has the same field content as the personal information value, then determining that the target third-party SDK is collecting personal information. This method enables the detection of whether a third-party SDK is collecting personal information without obtaining the SDK's source code, thus expanding the applicability of third-party SDK detection.

Description

Technical Field

[0001] This invention relates to the field of personal information technology, and specifically to a method and system for identifying personal information collected by a third-party SDK. Background Technology

[0002] During application development, when using third-party login, security risk control, and financial transaction functions from partner companies, it's necessary to integrate these third-party services into the application. To ensure the application can perform these functions, it needs to integrate a third-party Software Development Kit (SDK). To ensure privacy compliance, it's crucial to obtain information about the personal information collected by the third-party SDK. Identifying this information is a critical issue. Current methods for obtaining information about third-party SDK collection include: 1. Obtaining information about the personal information collected by the SDK through its documentation. However, outdated SDK documentation makes it difficult to accurately determine the actual personal information collected in the current SDK version. 2. Some security researchers use static scanning of the application to identify methods of personal information collection by the third-party SDK. This method only identifies static integrations and cannot detect dynamic behavior. 3. Some security researchers perform dynamic detection by instrumenting the app's source code. However, without the app's source code, it's impossible to identify the personal information collected by the third-party SDK, presenting significant limitations. Therefore, current technologies cannot comprehensively identify all aspects of third-party SDK personal information collection. Summary of the Invention

[0003] This invention provides a method and system for identifying personal information collected by a third-party SDK, which can solve the problems in the prior art.

[0004] To achieve the above objectives, in one aspect, embodiments of the present invention provide a method for identifying personal information collected by a third-party SDK, including:

[0005] For all third-party software development kits (SDKs) introduced and installed by the application, monitor whether each third-party SDK reads local data packets. When a target third-party SDK is detected reading local data packets, capture the local data packets read by the target third-party SDK and extract the first string from the local data packets.

[0006] For the target third-party SDK, the first string is compared with a preset personal information value. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK is collecting personal information.

[0007] On the other hand, embodiments of the present invention provide an identification system for third-party SDK-collected personal information, including:

[0008] The first monitoring unit is used to monitor whether each third-party software development kit (SDK) introduced and installed by the application reads local data packets. When a target third-party SDK is detected reading local data packets, the local data packets read by the target third-party SDK are captured.

[0009] The first numerical extraction unit is used to extract the first string from the local data packet;

[0010] The first determination unit is used to compare the first string with a preset personal information value for the target third-party SDK. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK has collected personal information.

[0011] The above technical solution has the following beneficial effects: For all third-party software development kits (SDKs) introduced and installed by the application, it monitors whether each third-party SDK reads local data packets. When a target third-party SDK reading local data packets is detected, the local data packets read by the target third-party SDK are captured, and a first string is extracted from the local data packets. For the target third-party SDK, the first string is compared with a preset personal information value. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK is collecting personal information. This solution can detect whether a third-party SDK is collecting personal information without obtaining the application's source code, expanding the scope of application for third-party SDK detection and achieving complete detection of third-party SDKs collecting personal information. It avoids the limitations of static detection and source code instrumentation-based detection, fills the gap in existing technologies that do not detect personal information in the data transmission of third-party SDKs, and improves the accuracy of detecting third-party SDKs collecting personal information. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a method for identifying personal information collected by a third-party SDK according to an embodiment of the present invention;

[0014] Figure 2 This is a structural diagram of an identification system for collecting personal information using a third-party SDK, according to an embodiment of the present invention.

[0015] Figure 3 This is a schematic diagram illustrating the detection principle of a third-party SDK reading local data packets in an embodiment of the present invention.

[0016] Figure 4 This is a schematic diagram illustrating the detection principle of third-party SDK data transmission in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] SDK: short for Software Development Kit, is a collection of development tools used to build application software, including specific software packages, software frameworks, hardware platforms, and operating systems.

[0019] like Figure 1 As shown, in conjunction with embodiments of the present invention, a method for identifying personal information collected by a third-party SDK is provided, including:

[0020] S101: For all third-party software development kits (SDKs) introduced and installed by the application, monitor whether each third-party SDK reads local data packets. When a target third-party SDK is detected reading local data packets, capture the local data packets read by the target third-party SDK and extract the first string from the local data packets.

[0021] S102: For the target third-party SDK, compare the first string with the preset personal information value. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK has collected personal information.

[0022] Preferably, it further includes S103: setting personal information values ​​in the application's runtime environment; the setting of personal information in the application's runtime environment specifically includes:

[0023] S1031: Modify the device unique identifier information in the operating system file of the application's running environment, and record the device unique identifier information as the first field content of the personal information value;

[0024] S1032: Modify the browsing history in the browser of the application's running environment, and record the browsing history as the content of the second field of personal information value;

[0025] S1033: Set and record the contents of other fields containing personal information values ​​in the application's runtime environment.

[0026] Preferably, in S101: monitoring whether the third-party SDK reads local data packets, and capturing the read local data packets when the monitoring detects that the third-party SDK is reading local data packets, specifically includes:

[0027] S1011: Monitor whether the third-party SDK reads local data packets through a behavior monitoring interface. The behavior monitoring interface is deployed in front of the operating system interface of the application's runtime environment. When it detects that the operating system interface reads a local data packet from the memory of the application's runtime environment to be returned to the third-party SDK, the behavior monitoring interface returns the local data packet to the third-party SDK. Simultaneously with returning the local data packet to the third-party SDK, the behavior monitoring interface captures the local data packet; or...

[0028] S1012: Periodically scan the memory of the application's runtime environment to capture all local data packets read by the third-party SDK within the memory.

[0029] Preferably, it further includes:

[0030] S104: Monitor whether the third-party SDK transmits data packets to the outside. When the third-party SDK transmits data packets to the outside, capture the transmitted data packets and parse the content of the transmitted data packets to extract the second string.

[0031] S105: Compare the second string with the personal information value in sequence. If the second string has the same field content as the personal information value, it is determined that the transmitted data packet contains personal information.

[0032] Preferably, in step S104, monitoring whether the third-party SDK is transmitting data packets externally, and capturing the transmitted data packets when the external transmission of data packets by the third-party SDK is detected, specifically includes:

[0033] Monitor whether the third-party SDK is transmitting data packets. When the third-party SDK is detected transmitting data packets, change the network transmission path of the transmitted data packets to the proxy interface, and capture the data packets transmitted by the third-party SDK through the data packet capture tool in the proxy interface.

[0034] Preferably, it further includes:

[0035] S106: Perform static analysis on the third-party SDK to identify its basic information and associated information; wherein, the basic information of the third-party SDK includes: the third-party entity to which the third-party SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the third-party SDK; the associated information of the third-party SDK includes: the entity to which the third-party entity belongs, and the domain name and IP address used by the third-party SDK when it is introduced into the application;

[0036] The method for identifying personal information collected by the third-party SDK also includes:

[0037] S107: Based on the data packets transmitted by the third-party SDK, extract the receiving entity of the data packets, the domain name and IP address used by the receiving entity;

[0038] S108: Based on the third-party entity to which the third-party SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the third-party SDK, determine whether the receiving entity of the data packet is the third-party entity;

[0039] S109: Based on the entity to which the third-party entity belongs, the domain name and IP address used by the third-party SDK to be imported into the application, determine whether the receiving entity of the data packet is the entity to which the third-party entity belongs;

[0040] S110: If the recipient of the data packet is not the third-party entity or is not the entity to which the third-party entity belongs, then the third-party SDK is determined to have illegally collected personal information.

[0041] Preferably, it further includes:

[0042] S120: When it is determined that the transmitted data packet contains personal information, the scope, content and transmission frequency of the personal information transmitted by the third-party SDK within a preset time period are determined by the value of the transmitted personal information, and the degree of violation of the third-party SDK in illegally collecting personal information is determined.

[0043] like Figure 2 As shown, in conjunction with embodiments of the present invention, an identification system for third-party SDK-collected personal information is provided, comprising:

[0044] The first monitoring unit 21 is used to monitor whether each third-party software development kit (SDK) introduced and installed by the application reads local data packets. When a target third-party SDK that reads local data packets is detected, the local data packets read by the target third-party SDK are captured.

[0045] The first numerical extraction unit 22 is used to extract the first string from the local data packet;

[0046] The first determination unit 23 is used to compare the first string with a preset personal information value for the target third-party SDK. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK has collected personal information.

[0047] Preferably, it further includes a personal information setting unit, used to set personal information values ​​in the application's operating environment; the personal information setting unit is specifically used for:

[0048] Modify the device unique identifier information in the operating system file of the application's runtime environment, and record the device unique identifier information as the first field content of the personal information value;

[0049] Modify the browsing history in the browser of the application's running environment, and record the browsing history as the content of the second field of personal information value;

[0050] Set and record the contents of other fields for personal information values ​​in the application's runtime environment.

[0051] Preferably, the first monitoring unit 21 includes a behavior monitoring interface or a scanning subunit, wherein:

[0052] The behavior monitoring interface is used to monitor whether the third-party SDK reads local data packets. When it is detected that the operating system interface reads local data packets from the memory of the application's runtime environment to return to the third-party SDK, it returns the local data packets to the third-party SDK. At the same time as returning the local data packets to the third-party SDK, it captures the local data packets. The behavior monitoring interface is deployed in front of the operating system interface of the application's runtime environment.

[0053] The scanning subunit is used to periodically scan the memory of the application's runtime environment and capture all local data packets read by the third-party SDK within the memory.

[0054] Preferably, it further includes:

[0055] The second monitoring unit is used to monitor whether the third-party SDK transmits data packets to the outside world, and captures the transmitted data packets when the third-party SDK is detected to be transmitting data packets to the outside world.

[0056] The second numerical extraction unit is used to parse the content of the data packets transmitted by the third-party SDK and extract the second string;

[0057] The second determination unit is used to compare the second string with the personal information value in sequence. If the second string has the same field content as the personal information value, it is determined that the transmitted data packet contains personal information.

[0058] Preferably, the second monitoring unit includes:

[0059] The data packet capture subunit is used to monitor whether the third-party SDK is transmitting data packets. When the third-party SDK is detected transmitting data packets, the network transmission path of the transmitted data packets is changed to the proxy interface, and the data packets transmitted by the third-party SDK are captured by the data packet capture tool in the proxy interface.

[0060] Preferably, it also includes a third-party SDK identification unit, wherein:

[0061] The third-party SDK identification unit is used to perform static analysis on the third-party SDK to identify its basic information and associated information. The basic information includes: the third-party entity to which the third-party SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the third-party SDK. The associated information includes: the entity to which the third-party entity belongs, and the domain name and IP address used by the third-party SDK when it is introduced into the application.

[0062] The second numerical extraction unit is further configured to extract the receiving entity, the domain name and IP address used by the receiving entity from the data packets transmitted by the third-party SDK.

[0063] The second determination unit is further configured to determine whether the receiving entity of the data packet is the third-party entity based on the third-party entity to which the third-party SDK belongs, the domain name and IP used by the third-party entity when transmitting the third-party SDK; and to determine whether the receiving entity of the data packet is the entity to which the third-party entity belongs based on the entity to which the third-party entity belongs, the domain name and IP used by the third-party SDK to be introduced into the application.

[0064] If the recipient of the data packet is not the third-party entity or is not the entity to which the third-party entity belongs, then the third-party SDK is deemed to have illegally collected personal information.

[0065] Preferably, the second determination unit is further configured to:

[0066] Once it is determined that the transmitted data packet contains personal information, the scope, content, and transmission frequency of the personal information transmitted by the third-party SDK within a preset time period are determined based on the transmitted personal information value, thereby determining the degree of violation of the third-party SDK in illegally collecting personal information.

[0067] The technical solutions of the present invention will be described in detail below with reference to specific application examples. For technical details not described in the implementation process, please refer to the relevant descriptions above.

[0068] This invention provides a method and system for identifying third-party SDKs that collect personal information. By identifying third-party SDK information, setting personal information, and detecting third-party SDK behavior, the system identifies the third-party SDK's behavior of collecting personal information from multiple detection dimensions, including information characteristics, data reading, and data transmission. This achieves comprehensive detection of third-party SDKs collecting personal information. It avoids the limitations of static detection and source code instrumentation-based detection, fills the gap in existing technologies that do not detect personal information during third-party SDK data transmission, and improves the accuracy of detecting third-party SDKs collecting personal information.

[0069] The method for collecting personal information identification using a third-party SDK according to embodiments of the present invention includes the following steps:

[0070] 1. Identify the third-party SDKs introduced by the application.

[0071] Commonly used third-party SDK basic information includes: the name of the software development kit used by the third-party SDK, the domain name and IP address used by the third-party entity to transmit the third-party SDK, and the third-party entity to which the third-party SDK belongs. Static parsing is performed on the software development kit (installation package) installed in the application. Through code logic, the software development kit name and version information of the software development kit introduced by the application are identified. Based on the name characteristics of the software development kit, the third-party entity to which the SDK belongs is marked, and the domain name and IP network information owned by the third-party entity are identified. The owned domain name and IP network information refers to the domain name and IP address used for network transmission of the SDK. The associated information of the third-party SDK is identified as follows: the entity to which the third-party entity belongs, the domain name and IP address used by the third-party SDK to be introduced into the application, and the domain name and IP address used for network transmission of the SDK. The purpose of identifying the third-party entity is to analyze whether the SDK transmits personal information to non-third-party entities. For example, if the entity of the third-party SDK is identified as A, but it is detected that the SDK transmits personal information to a domain B (not A), then it violates the regulations on personal information.

[0072] Specifically, when identifying personal information collected by third-party SDKs in an Android application to be tested, the third-party SDKs are first identified to determine which third-party SDKs are used by the application. Preferably, the SDK installation package to be tested is decompiled to obtain its file structure, which includes the AndroidManifest.xml file. All installation package names in the application are obtained by traversing the tags, including uses-permission, action, activity, meta-data, receiver, service, and provider.

[0073] When identifying third-party SDK-collected personal information of an iOS application under test, the third-party SDKs are first identified to determine which third-party SDKs are used by the application. Preferably, the installation package of the application under test is decompiled to obtain its file structure, which includes a lib folder. The names of all software packages in the application are obtained by traversing the files with the .Framework extension within this folder.

[0074] 2. Setting personal information: Setting personal information values ​​within the application's runtime environment.

[0075] Setting personal information values ​​in the application's runtime environment specifically includes:

[0076] Modify the device unique identifier information in the operating system file of the application's runtime environment, and record the device unique identifier information as the first field content of the personal information value;

[0077] Modify the browsing history in the browser of the application's running environment, and record the browsing history as the content of the second field of personal information value;

[0078] Set and record the contents of other fields for personal information values ​​in the application's runtime environment.

[0079] Setting personal information values ​​in the application's runtime environment specifically includes: 1. Setting the personal information value in the runtime environment as: device unique identifier information. Modifying the device unique identifier information in the operating system file of the application's runtime environment, and recording the device unique identifier information as the first field content of the personal information value; 2. Setting the personal information value in the runtime environment as: browsing history in the browser. Modifying the browsing history in the browser of the application's runtime environment, and recording the browsing history as the second field content of the personal information value; 3. Setting and recording other fields of the personal information value in the application's runtime environment. Other fields of personal information include: the content of the address book, friend list, and email. This involves adding the content of the address book, friend list, and email to include basic personal information, personal identity information, personal biometric information, network identification information, personal health and physiological information, personal education information, personal property information, personal communication information, personal device information, personal location information, and sensitive permissions. Sensitive permissions include: address book, SMS, calendar, camera, location, microphone, sensor, and memory card permissions.

[0080] The personal information set is used for comparison to determine the personal information contained in the data transmission. It's configured in the system file because modifying the system's unique device identifier information within the personal information requires modifying the system file settings. This is because saving records by reading the device's hardware unique identifier information has limitations; some data may not be present by default, making file modification a better approach. Other settings only require the corresponding software configuration.

[0081] In the runtime environment, personal information values ​​are set for the Android application to be tested. These personal information values ​​include: device MAC address, software list, Android device unique identifier IMEI, Android ID, IMSI information, personal digital certificate, friend list information, contacts and SMS messages.

[0082] For the iOS applications to be tested, personal information values ​​include: device MAC address, software list, iOS device unique identifier IDFA, OpenUDID, GUID, SIM card, bank account information, personal digital certificate, friend list information, contacts and SMS messages.

[0083] Third, for all third-party software development kits (SDKs) introduced and installed by the application, monitor whether each third-party SDK reads local data packets. When a target third-party SDK is detected reading local data packets, capture the local data packets read by the target third-party SDK and extract the first string from the local data packets. That is, based on whether the data read locally by the third-party SDK contains pre-defined personal information values, and by detecting whether the third-party SDK includes pre-defined personal information values ​​in data transmission, and by parsing the application's data packets showing the transmission of personal information to the third-party SDK server over the network, identify whether the third-party SDK is collecting personal information.

[0084] (a) such as Figure 3 As shown, a behavior monitoring interface monitors whether the third-party SDK reads local data packets. This behavior monitoring interface is deployed in front of the operating system interface of the application's runtime environment. When it detects that the operating system interface reads a local data packet from the memory of the application's runtime environment to be returned to the third-party SDK, the behavior monitoring interface returns the local data packet to the third-party SDK. Simultaneously, the behavior monitoring interface captures the local data packet. In other words, to detect the third-party SDK's behavior of collecting personal information, a third-party SDK behavior monitoring interface (hereinafter referred to as the behavior monitoring interface) is deployed in the application's runtime environment to monitor the personal information collected by the third-party SDK within the application. Specifically, when the third-party SDK calls the operating system interface to obtain basic resources (including the local data read by the third-party SDK), it actually first calls the third-party SDK behavior monitoring interface, and then obtains the operating system's basic resources through this monitoring interface. Therefore, the third-party SDK behavior monitoring interface can intercept the third-party SDK's data reading calls, thereby monitoring the third-party SDK's behavior. The runtime environment includes: the application's basic resources, the operating system, the third-party SDK behavior monitoring interface, and the third-party SDK.

[0085] The system periodically scans the memory of the application's runtime environment to capture all local data packets read by the third-party SDK within that memory. In other words, by scanning the memory of the application's runtime environment (i.e., the detection environment), it monitors the behavior of the third-party SDK in reading local data, thereby obtaining the content of the data read by the third-party SDK. Specifically, for the Android application to be detected, the memory scan can be performed using FileReader and BufferedReader. For the iOS application to be detected, the memory scan can be performed using memoryInfo, NSRealMemoryAvailable, and scanf.

[0086] For the target third-party SDK, the first string is compared with a preset personal information value. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK is collecting personal information. Specifically: the string of content read by the SDK is compared with the set personal information value. If there is a matching value or the content contains personal information, it is determined that the SDK is reading personal information. For example, if the data content read by the third-party SDK contains an IMEI value (IMEI value refers to the mobile phone serial number) that matches the set IMEI value, it is determined that the third-party SDK is reading the personal information IMEI, thereby identifying the personal information read by the third-party SDK.

[0087] (ii) Figure 4 As shown, the method monitors whether the third-party SDK is transmitting data packets outwards. When the transmission of data packets by the third-party SDK is detected, the transmitted data packets are captured. Specifically, this includes: monitoring whether the third-party SDK is transmitting data packets outwards; and when the transmission of data packets by the third-party SDK is detected, capturing the transmitted data before it reaches the server through data forwarding and data read hijacking methods: changing the network transmission path of the transmitted data packets to a proxy interface, and capturing the data packets transmitted by the third-party SDK through a data packet capture tool within the proxy interface. In other words, by installing the certificate of the data packet capture tool in the application runtime environment and forwarding the network to the data packet capture tool, the data packets transmitted by the third-party SDK are captured.

[0088] The content of the transmitted data packet is parsed to obtain the second string. The second string is then compared sequentially with the personal information value. If the second string has the same field content as the personal information value, it is determined that the transmitted data packet contains personal information.

[0089] Once it is determined that the transmitted data packet contains personal information, the scope, content, and transmission frequency of the personal information transmitted by the third-party SDK within a preset time period are determined based on the transmitted personal information value, thereby determining the degree of violation of the third-party SDK in illegally collecting personal information.

[0090] Based on the data packets transmitted by the third-party SDK, extract the receiving entity of the data packets, the domain name and IP address used by the receiving entity;

[0091] Based on the third-party entity to which the third-party SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the third-party SDK, determine whether the receiving entity of the data packet is the third-party entity.

[0092] Based on the entity to which the third-party entity belongs, the domain name and IP address used by the application to import the third-party SDK, it is determined whether the receiving entity of the data packet belongs to the entity to which the third-party entity belongs;

[0093] If the recipient of the data packet is not the third-party entity, or is not an entity to which the third-party entity belongs, then the third-party SDK is deemed to have illegally collected personal information. Furthermore, it is determined whether the data was transmitted from overseas.

[0094] If the local data packet contains personal information, the relevant privacy policy will be used to determine whether the third-party SDK has illegally collected personal information. Similarly, if the transmitted data packet contains personal information, the relevant privacy policy will be used to determine whether the third-party SDK has illegally collected personal information.

[0095] The beneficial technical effects achieved by the embodiments of the present invention are as follows:

[0096] 1. After identifying information and setting personal information values ​​for the third-party SDK, the system monitors the reading and transmission of local data packets by the third-party SDK. It detects whether the local data read and the data transmitted by the third-party SDK contain the set personal information values ​​(values ​​of personal privacy information). This enables multi-dimensional detection of personal information collected by the third-party SDK, avoiding the limitations of static detection and source code instrumentation. It fills the gap in existing technologies that do not perform personal information detection on the data transmission of the third-party SDK, and improves the accuracy of detecting and identifying personal information collected by the third-party SDK.

[0097] 2. It can detect the collection of personal information by applications without obtaining the application source code, thus expanding the scope of application of third-party SDK detection.

[0098] 3. It can identify personal information in data packets transmitted by third-party SDKs, making up for the shortcomings of existing technologies that cannot collect and identify personal information in transmitted data content.

[0099] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process may be rearranged without departing from the scope of this disclosure. The appended method claims provide elements of various steps in an exemplary order and are not intended to limit the specific order or hierarchy described.

[0100] In the above detailed description, various features are combined together in a single embodiment to simplify this disclosure. This approach to disclosure should not be construed as reflecting an intention that embodiments of the claimed subject matter require more features than are explicitly stated in each claim. Rather, as reflected in the appended claims, the invention is presented with fewer features than all of the features of the single disclosed embodiment. Therefore, the appended claims are hereby explicitly incorporated into the detailed description, wherein each claim stands alone as a preferred embodiment of the invention.

[0101] The disclosed embodiments have been described above to enable any person skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments without departing from the spirit and scope of this disclosure. Therefore, this disclosure is not limited to the embodiments given herein, but is consistent with the broadest scope of the principles and novel features disclosed in this application.

[0102] The foregoing description includes examples of one or more embodiments. It is certainly impossible to describe all possible combinations of components or methods in order to describe the above embodiments, but those skilled in the art will recognize that further combinations and arrangements of the various embodiments are possible. Therefore, the embodiments described herein are intended to cover all such changes, modifications, and variations that fall within the scope of the appended claims. Furthermore, the term "comprising" as used in the specification or claims is interpreted in a manner similar to the term "including," as interpreted when used as a conjunction in the claims. Additionally, the use of any term "or" in the specification of the claims is intended to mean "non-exclusive or."

[0103] Those skilled in the art will also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention can be implemented by electronic hardware, computer software, or a combination of both. To clearly demonstrate the interchangeability of hardware and software, the functions of the various illustrative components, units, and steps described above have been generally described. Whether such functionality is implemented through hardware or software depends on the specific application and the overall system design requirements. Those skilled in the art can implement the described functions using various methods for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present invention.

[0104] The various illustrative logic blocks or units described in the embodiments of this invention can be implemented or operate the described functions using a general-purpose processor, digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof. The general-purpose processor can be a microprocessor; alternatively, it can be any conventional processor, controller, microcontroller, or state machine. The processor can also be implemented using a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0105] The steps of the methods or algorithms described in the embodiments of this invention can be directly embedded in hardware, a software module executed by a processor, or a combination of both. The software module can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from and write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and storage medium can be housed in an ASIC, which can be housed in a user terminal. Optionally, the processor and storage medium can also be housed in different components of the user terminal.

[0106] In one or more exemplary designs, the functions described in the embodiments of the present invention can be implemented in hardware, software, firmware, or any combination of these three. If implemented in software, these functions can be stored on a computer-readable medium or transmitted on a computer-readable medium in the form of one or more instructions or code. Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. Storage media can be any available media that can be accessed by a general-purpose or special-purpose computer. For example, such computer-readable media can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store program code in the form of instructions or data structures and other forms that can be read by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Furthermore, any connection can be suitably defined as a computer-readable medium, for example, if the software is transmitted from a website, server or other remote resource via a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wirelessly, such as infrared, wireless and microwave, it is also included in the defined computer-readable medium. The disks and discs mentioned include compressed disks, laser discs, optical discs, DVDs, floppy disks, and Blu-ray discs. Disks typically copy data magnetically, while disks typically copy data optically using lasers. Combinations of the above can also be contained in computer-readable media.

[0107] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying personal information collected by a third-party SDK, characterized in that, include: For all third-party software development kits (SDKs) introduced and installed by the application, monitor whether each third-party SDK reads local data packets. When a target third-party SDK is detected reading local data packets, capture the local data packets read by the target third-party SDK and extract the first string from the local data packets. For the target third-party SDK, the first string is compared with a preset personal information value. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK is collecting personal information. Monitor whether the third-party SDK is transmitting data packets outwards. When the third-party SDK is detected transmitting data packets outwards, capture the transmitted data packets and parse the content of the transmitted data packets to extract the second string. The second string is compared with the personal information value in sequence. If the second string has the same field content as the personal information value, it is determined that the transmitted data packet contains personal information. The method for identifying personal information collected by a third-party SDK further includes setting personal information values ​​in the application's runtime environment; specifically, setting personal information values ​​in the application's runtime environment includes: Modify the device unique identifier information in the operating system file of the application's runtime environment, and record the device unique identifier information as the first field content of the personal information value; Modify the browsing history in the browser of the application's running environment, and record the browsing history as the content of the second field of personal information value; Set and record the contents of other fields for personal information values ​​in the application's runtime environment.

2. The method for identifying personal information collected by a third-party SDK according to claim 1, characterized in that, The monitoring of whether the third-party SDK reads local data packets, and capturing the read local data packets when the monitoring detects that the third-party SDK is reading local data packets, specifically includes: The behavior monitoring interface monitors whether the third-party SDK reads local data packets. This interface is deployed in front of the operating system interface of the application's runtime environment. When the interface detects that the operating system interface has read a local data packet from the memory of the application's runtime environment to be returned to the third-party SDK, the behavior monitoring interface returns the local data packet to the third-party SDK. Simultaneously, the behavior monitoring interface captures the local data packet; or... The memory of the application's runtime environment is periodically scanned to capture all local data packets read by the third-party SDK within that memory.

3. The method for identifying personal information collected by a third-party SDK according to claim 1, characterized in that, The monitoring of whether the third-party SDK transmits data packets externally, and capturing the transmitted data packets when the external transmission of data packets by the third-party SDK is detected, specifically includes: Monitor whether the third-party SDK is transmitting data packets. When the third-party SDK is detected transmitting data packets, change the network transmission path of the transmitted data packets to the proxy interface, and capture the data packets transmitted by the third-party SDK through the data packet capture tool in the proxy interface.

4. The method for identifying personal information collected by a third-party SDK according to claim 1, characterized in that, Also includes: Static analysis is performed on the third-party SDK to identify its basic information and associated information. The basic information includes the third-party entity to which the SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the SDK. The associated information includes the entity to which the third-party entity belongs, and the domain name and IP address used by the third-party SDK when it is introduced into the application. The method for identifying personal information collected by the third-party SDK also includes: Based on the data packets transmitted by the third-party SDK, extract the receiving entity of the data packets, the domain name and IP address used by the receiving entity; Based on the third-party entity to which the third-party SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the third-party SDK, determine whether the receiving entity of the data packet is the third-party entity. Based on the entity to which the third-party entity belongs, the domain name and IP address used by the application to import the third-party SDK, it is determined whether the receiving entity of the data packet belongs to the entity to which the third-party entity belongs; If the recipient of the data packet is not the third-party entity or is not the entity to which the third-party entity belongs, then the third-party SDK is deemed to have illegally collected personal information.

5. The method for identifying personal information collected by a third-party SDK according to claim 1 further includes: Once it is determined that the transmitted data packet contains personal information, the scope, content, and transmission frequency of the personal information transmitted by the third-party SDK within a preset time period are determined based on the transmitted personal information value, thereby determining the degree of violation of the third-party SDK in illegally collecting personal information.

6. A recognition system for collecting personal information via a third-party SDK, characterized in that, include: The first monitoring unit is used to monitor whether each third-party software development kit (SDK) introduced and installed by the application reads local data packets. When a target third-party SDK is detected reading local data packets, the local data packets read by the target third-party SDK are captured. The first numerical extraction unit is used to extract the first string from the local data packet; The first determination unit is used to compare the first string with a preset personal information value for the target third-party SDK. If the first string has the same field content as the personal information value, it is determined that the target third-party SDK has collected personal information. The second monitoring unit is used to monitor whether the third-party SDK transmits data packets to the outside world, and captures the transmitted data packets when the third-party SDK is detected to be transmitting data packets to the outside world. The second numerical extraction unit is used to parse the content of the data packets transmitted by the third-party SDK and extract the second string; The second determination unit is used to compare the second string with the personal information value in sequence, and if the second string has the same field content as the personal information value, it determines that the transmitted data packet contains personal information. The aforementioned identification system for third-party SDK-collected personal information also includes a personal information setting unit, used to set personal information values ​​in the application's runtime environment; the personal information setting unit is specifically used for: Modify the device unique identifier information in the operating system file of the application's runtime environment, and record the device unique identifier information as the first field content of the personal information value; Modify the browsing history in the browser of the application's running environment, and record the browsing history as the content of the second field of personal information value; Set and record the contents of other fields for personal information values ​​in the application's runtime environment.

7. The identification system for collecting personal information via a third-party SDK according to claim 6, characterized in that, The first monitoring unit includes a behavior monitoring interface or a scanning subunit, wherein: The behavior monitoring interface is used to monitor whether the third-party SDK reads local data packets. When it is detected that the operating system interface reads local data packets from the memory of the application's runtime environment to return to the third-party SDK, it returns the local data packets to the third-party SDK. At the same time as returning the local data packets to the third-party SDK, it captures the local data packets. The behavior monitoring interface is deployed in front of the operating system interface of the application's runtime environment. The scanning subunit is used to periodically scan the memory of the application's runtime environment and capture all local data packets read by the third-party SDK within the memory.

8. The identification system for collecting personal information via a third-party SDK according to claim 6, characterized in that, The second monitoring unit includes: The data packet capture subunit is used to monitor whether the third-party SDK is transmitting data packets. When the third-party SDK is detected transmitting data packets, the network transmission path of the transmitted data packets is changed to the proxy interface, and the data packets transmitted by the third-party SDK are captured by the data packet capture tool in the proxy interface.

9. The identification system for collecting personal information via a third-party SDK according to claim 6, characterized in that, It also includes a third-party SDK recognition unit, in which: The third-party SDK identification unit is used to perform static analysis on the third-party SDK to identify its basic information and associated information. The basic information includes: the third-party entity to which the third-party SDK belongs, and the domain name and IP address used by the third-party entity when transmitting the third-party SDK. The associated information includes: the entity to which the third-party entity belongs, and the domain name and IP address used by the third-party SDK when it is introduced into the application. The second numerical extraction unit is further configured to extract the receiving entity, the domain name and IP address used by the receiving entity from the data packets transmitted by the third-party SDK. The second determination unit is further configured to determine whether the receiving entity of the data packet is the third-party entity based on the third-party entity to which the third-party SDK belongs, the domain name and IP used by the third-party entity when transmitting the third-party SDK; and to determine whether the receiving entity of the data packet is the entity to which the third-party entity belongs based on the entity to which the third-party entity belongs, the domain name and IP used by the third-party SDK to be introduced into the application. If the recipient of the data packet is not the third-party entity or is not the entity to which the third-party entity belongs, the third-party SDK is deemed to have illegally collected personal information.

10. The identification system for third-party SDK-collected personal information according to claim 6, wherein the second determination unit is further configured to: Once it is determined that the transmitted data packet contains personal information, the scope, content, and transmission frequency of the personal information transmitted by the third-party SDK within a preset time period are determined based on the transmitted personal information value, thereby determining the degree of violation of the third-party SDK in illegally collecting personal information.

Images