Method and device for verifying target device

Abstract

The invention provides a method and equipment for verifying target equipment, and relates to the technical field of computers. According to the specific implementation scheme, target information sent by target equipment is received; and under the condition that the target information comprises equipment related identification information and information of a to-be-verified object, and the equipment related identification information has corresponding information of a target object, determining a verification result of the target equipment based on the information of the target object and the information of the to-be-verified object, the equipment related identification information is extracted from a starting path of the target equipment, the information of the to-be-verified object is extracted from system attributes of the target equipment, and the verification result of the target equipment is whether a system of the target equipment is tampered or not.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method and a device for verifying a target device. Background Art

[0002] With the popularity of mobile terminals, mobile terminal applications are closely related to daily life. However, some people install mobile terminal applications on tampered mobile terminals to bypass the detection mechanism of mobile terminal applications to achieve the purpose of brushing orders or volume. This behavior seriously infringes the rights and interests of other users and the normal operation order of mobile terminal applications. Therefore, how to efficiently and accurately determine whether the mobile terminal system has been tampered with has become a technical problem that needs to be solved. Summary of the invention

[0003] The present disclosure provides a method and a device for authenticating a target device.

[0004] According to one aspect of the present disclosure, there is provided a method for verifying a target device, comprising:

[0005] Receive target information sent by the target device;

[0006] In the case where the target information includes device-related identification information and information of an object to be verified, and the device-related identification information contains corresponding target object information, a verification result of the target device is determined based on the target object information and the object to be verified information, wherein the device-related identification information is extracted from a startup path of the target device, the information of the object to be verified is extracted from system properties of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

[0007] According to one aspect of the present disclosure, there is provided a method for verifying a target device, comprising:

[0008] When the device-related identification information is extracted from the startup path of the target device, the information of the object to be verified is extracted from the system properties;

[0009] Generate target information including the device-related identification information and information about the object to be verified, wherein the device-related identification information and the information about the object to be verified are used by the server to determine a verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with;

[0010] The target information is sent to the server.

[0011] According to one aspect of the present disclosure, there is provided a server, comprising:

[0012] A first communication module, used for receiving target information sent by a target device;

[0013] A verification module is used to determine the verification result of the target device based on the target object information and the object to be verified information, when the target information includes device-related identification information and information of an object to be verified, and the device-related identification information contains corresponding target object information, wherein the device-related identification information is extracted from a startup path of the target device, the object to be verified information is extracted from system properties of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

[0014] According to one aspect of the present disclosure, a target device is provided, including:

[0015] An extraction module, used to extract information of the object to be verified from system properties when device-related identification information is extracted from the startup path of the target device;

[0016] a target information generation module, used to generate target information including the device-related identification information and information about the object to be verified, wherein the device-related identification information and information about the object to be verified are used by the server to determine a verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with;

[0017] The second communication module is used to send the target information to the server.

[0018] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0022] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0023] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0024] By adopting the above implementation, when the received target information includes device-related identification information and information about the object to be verified, it is determined whether the system of the target device has been tampered with based on the device-related identification information and the information about the object to be verified, wherein the device-related identification information is extracted from the startup path of the target device, and the information about the object to be verified is extracted from the system properties of the target device. In this way, the device-related identification information contained in the startup path that is difficult to tamper with and the information about the object to be verified of the target device extracted from the system properties can be compared, and then through the comparison result of the device-related identification information and the information about the object to be verified of the target device, it can be determined whether the system of the target device has been tampered with, and then it can be determined whether the mobile terminal application is installed on the tampered mobile terminal.

[0025] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0027] Figure 1 is a flowchart of a method for verifying a target device according to an embodiment of the present disclosure;

[0028] Figure 2 is a flowchart of a method for verifying a target device according to another embodiment of the present disclosure;

[0029] Figure 3 is a flowchart of a method for verifying a target device according to another embodiment of the present disclosure;

[0030] Figure 4 is a flowchart of a method for verifying a target device according to yet another embodiment of the present disclosure;

[0031] Figure 5 is a schematic block diagram of a server according to an embodiment of the present disclosure;

[0032] Figure 6 is a schematic block diagram of a server according to another embodiment of the present disclosure;

[0033] Figure 7 is a schematic block diagram of a target device according to another embodiment of the present disclosure;

[0034] Figure 8 is a block diagram of an electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0036] Figure 1 is a schematic flow chart of a method for verifying a target device proposed in an embodiment of the present disclosure, comprising:

[0037] S110, receiving target information sent by a target device;

[0038] S120, in a case where the target information includes device-related identification information and information of an object to be verified, and the device-related identification information contains corresponding target object information, determining a verification result of the target device based on the target object information and the object to be verified information, wherein the device-related identification information is extracted from a startup path of the target device, the information of the object to be verified is extracted from system properties of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

[0039] The method for verifying a target device according to an embodiment of the present disclosure may be executed by a server. Exemplarily, the server may be a single server, or may be at least one server in a server cluster, or may be a server in a distributed system.

[0040] The target device may be a mobile terminal such as a mobile phone or a tablet computer.

[0041] The startup path of the target device may be extracted by the target device from its own executable file. The executable file may be an optimized executable file or an executable file. The executable file refers to a file that can be loaded or executed by the target device. The startup path may be a path for loading a class library.

[0042] By adopting the above implementation, when the target information includes device-related identification information and information of the object to be verified, and the device-related identification information contains information of the corresponding target object, it is determined whether the system of the target device has been tampered with based on the information of the target object and the information of the object to be verified, wherein the device-related identification information is extracted from the startup path of the target device, and the information of the object to be verified is extracted from the system properties of the target device. In this way, it is possible to determine whether the system of the target device has been tampered with only by comparing the information of the target object corresponding to the device-related identification information contained in the startup path that is difficult to tamper with with the information of the object to be verified of the target device extracted from the system properties, thereby improving the efficiency and accuracy of determining whether the system of the target device has been tampered with.

[0043] In one embodiment, it also includes: when there is a first keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, information of a first candidate object corresponding to the first keyword among one or more candidate objects included in the keyword library is used as information of the target object corresponding to the device-related identification information.

[0044] The keyword library may include: information of one or more candidate objects, and one or more candidate keywords corresponding to or associated with each of the one or more candidate objects. Among the one or more candidate objects, different candidate objects correspond to different candidate keywords, and the number of candidate keywords corresponding to different candidate objects may be the same or different.

[0045] Among them, any one of the one or more candidate objects may include: any candidate manufacturer and / or any candidate brand. The information of the candidate object may be complete descriptive information used to fully express or fully represent the candidate object, that is, the information of the candidate object is content with actual meaning or accurate meaning. For example, the information of any candidate object may include: complete descriptive information used to fully represent or fully express the candidate manufacturer, and / or, complete descriptive information used to fully represent or fully express the candidate brand. For example, the description information of a candidate manufacturer may be the full name or official name of the candidate manufacturer, etc.

[0046] Any candidate keyword may be any one of a candidate number, a candidate identifier, a candidate serial number, a candidate name abbreviation, a candidate name abbreviation, etc., which may be composed of one or more characters, wherein the one or more characters may include one or more numbers and / or one or more letters, etc. In other words, a candidate keyword may be composed of one or more characters that have no actual meaning or no accurate meaning. A candidate keyword needs to determine the information of the candidate object with actual meaning or accurate meaning associated with the candidate keyword based on the candidate object associated or corresponding to the candidate keyword in the keyword library.

[0047] For example, the keyword library may include the following multiple candidate keywords: candidate identifier-1, candidate identifier-2, candidate name abbreviation-1, candidate name abbreviation-2, candidate number-3. The keyword library may also include information on the following multiple candidate objects: the full name of candidate manufacturer A, the full name of candidate manufacturer B, the full name of candidate brand C; in the keyword library, candidate identifier-1 and candidate name abbreviation-1 are both associated with or correspond to candidate object A; candidate identifier-2 and candidate name abbreviation-2 are both associated with or correspond to candidate object B; candidate number-3 is associated with or corresponds to candidate brand C, and so on. All possible situations are not limited or enumerated here.

[0048] The device-related identification information may be any one of a number, an identification, a serial number, a name abbreviation, a name abbreviation, etc. consisting of one or more characters.

[0049] The process of determining whether there is a first keyword matching the device-related identification information among one or more candidate keywords included in the keyword library may include: comparing the device-related identification information with each candidate keyword among the one or more candidate keywords included in the keyword library; if the device-related identification information matches the first candidate keyword among the one or more candidate keywords included in the keyword library, using the first candidate keyword as the first keyword matching the device-related identification information; and if the device-related identification information does not match each candidate keyword among the one or more candidate keywords, determining that there is no keyword matching the device-related identification information among the one or more candidate keywords included in the keyword library.

[0050] In one example, comparing the device-related identification information with each candidate keyword in one or more candidate keywords contained in the keyword library may include: comparing each character and the order of each character contained in the device-related identification information with each character and the order of each character contained in the first candidate keyword.

[0051] Correspondingly, the method for determining whether the device-related identification information matches the first candidate keyword among the one or more candidate keywords contained in the keyword library may be: when each character and the order of each character contained in the device-related identification information are the same as each character and the order of each character contained in the first candidate keyword, determining that the device-related identification information matches the first candidate keyword among the one or more candidate keywords; or, when each character and the order of each character contained in the device-related identification information are different from each character and the order of each character contained in each candidate keyword in the keyword library, determining that there is no keyword among the one or more candidate keywords contained in the keyword library that matches the device-related identification information.

[0052] In one example, comparing the device-related identification information with each candidate keyword in the one or more candidate keywords included in the keyword library may include: calculating the similarity between the device-related identification information and each candidate keyword in the one or more candidate keywords included in the keyword library.

[0053] Correspondingly, the method for determining whether the device-related identification information matches the first candidate keyword in one or more candidate keywords contained in the keyword library may be: when the similarity between the device-related identification information and one or more second candidate keywords in the keyword library is greater than or equal to the first specified threshold, the second candidate keyword with the greatest similarity to the device-related identification information among the one or more second candidate keywords is used as the first candidate keyword; or, when the similarity between the device-related identification information and each of the one or more candidate keywords contained in the keyword library is less than the first specified threshold, it is determined that there is no keyword in the one or more candidate keywords contained in the keyword library that matches the device-related identification information. The first specified threshold may be configured according to actual conditions, which is not limited in this application.

[0054] By adopting the above implementation, when there is a first keyword matching the device-related identification information in one or more candidate keywords included in the keyword library, the information of the first candidate object corresponding to the first keyword in the keyword library is used as the information of the target object corresponding to the device-related identification information. In this way, the real manufacturer name and / or real brand name (i.e., the target object information) corresponding to the device-related identification information in the startup path of the target device can be accurately determined through the candidate keywords and candidate objects in the keyword library.

[0055] In one embodiment, determining the verification result of the target device based on the information of the target object and the information of the object to be verified includes one of the following: when the information of the object to be verified is the same as the information of the target object, determining that the verification result of the target device is that the system of the target device has not been tampered with; when the information of the object to be verified is different from the information of the target object, determining that the verification result of the target device is that the system of the target device has been tampered with.

[0056] The information of the object to be verified may be extracted by the target device from its own system properties. The embodiment does not limit the specific method of extracting the information of the object to be verified by the target device. The information of the object to be verified may include: information of the manufacturer to be verified and / or information of the brand to be verified.

[0057] In one example, the process of determining whether the information of the object to be verified is the same as the information of the target object may include: determining that the information of the object to be verified is the same as the information of the target object when each character and the order of each character contained in the information of the object to be verified are the same as each character and the order of each character contained in the information of the target object; or determining that the information of the object to be verified is not the same as the information of the target object when each character and the order of each character contained in the information of the object to be verified are different from each character and the order of each character contained in the information of the target object.

[0058] In one example, the process of determining whether the information of the object to be verified is the same as the information of the target object may include: determining whether the information of the object to be verified is the same as the information of the target object based on the similarity between the information of the object to be verified and the information of the target object.

[0059] The determination of whether the information of the object to be verified is the same as the information of the target object based on the similarity between the information of the object to be verified and the information of the target object may include: determining that the information of the object to be verified is the same as the information of the target object when the similarity between the information of the object to be verified and the information of the target object is greater than or equal to a second specified threshold; or determining that the information of the object to be verified is not the same as the information of the target object when the similarity between the information of the object to be verified and the information of the target object is less than a second specified threshold. The second specified threshold may be set according to actual conditions and is not limited in this application.

[0060] By adopting the above implementation, it is determined whether the information of the object to be verified is the same as the information of the target object, and whether the system of the target device has been tampered with. Since the information of the object to be verified is extracted from the system attributes, and the system attributes are often easy to be tampered with, the solution provided by this embodiment can accurately determine whether the system of the target device has been tampered with by judging whether the information of the object to be verified in the target device that is easy to be tampered with is the same as the information of the target object corresponding to the device-related identification information extracted from the startup path of the target device that is difficult to tamper with.

[0061] In one embodiment, the method further includes: when there is no candidate keyword matching the device-related identification information among one or more candidate keywords contained in the keyword library, sending a request to obtain a startup path to the target device; receiving the startup path of the target device sent by the target device; and updating the keyword library based on the startup path of the target device to obtain an updated keyword library.

[0062] It is understandable that, when one or more candidate keywords included in the keyword library do not contain a candidate keyword that matches the device-related identification information, it is impossible to obtain information about the candidate object that the device-related identification information can match. This result may be caused by the following two situations: the first situation is that the candidate object included in the keyword library may be missing, and the candidate keyword that the missing candidate object should be associated with is not included in the keyword library; the second situation is that the keyword library may contain a candidate object, but the candidate keyword associated with the candidate object is not comprehensive enough.

[0063] In the case that there is no candidate keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, sending a request to obtain a startup path to the target device may include one of the following: in the case that there is no candidate keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, immediately sending a request to obtain a startup path to the target device; after determining that there is no candidate keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, sending a request to obtain a startup path to the target device at a specified time interval. The specified time interval may be set according to actual conditions and is not limited in this application.

[0064] By adopting the above-mentioned implementation mode, when the target device cannot be verified, the startup path of the target device can be obtained from the target device, and then the keyword library can be updated based on the startup path of the target device. In this way, the comprehensiveness and accuracy of the keyword library can be improved, and it can be ensured that when the target information including device-related identification information and information of the object to be verified sent by the target device is obtained next time, the information of the target object corresponding to the device-related identification information can be obtained, thereby more accurately verifying the target device.

[0065] In one implementation, the method further includes: when the target information only includes the startup path of the target device, updating the keyword library based on the startup path of the target device to obtain an updated keyword library.

[0066] The target information only includes the startup path of the target device because the target device has not extracted device-related identification information in the startup path of the target device. Therefore, the target device needs to send the startup path of the target device to the server; correspondingly, when the target information only includes the startup path of the target device, the server can determine that the target device cannot extract device-related identification information. Therefore, the server side only needs to update the keyword library based on the startup path of the target device.

[0067] In an example, after the keyword library is updated based on the startup path of the target device to obtain the updated keyword library, the method further includes: sending the updated keyword library to the target device.

[0068] By adopting the above-mentioned implementation mode, when the target information only includes the startup path of the target device, the keyword library is updated based on the startup path of the target device. In this way, the comprehensiveness and accuracy of the keyword library can be improved, and it can be ensured that when the target information including device-related identification information and information of the object to be verified sent by the target device is obtained next time, the information of the target object corresponding to the device-related identification information can be obtained, thereby performing more accurate verification of the target device.

[0069] The updating of the keyword library based on the startup path of the target device to obtain an updated keyword library includes: determining a second keyword based on the startup path of the target device; determining information of a second candidate object corresponding to the second keyword based on the second keyword; and updating the keyword library based on the second keyword and the information of the second candidate object to obtain an updated keyword library.

[0070] Determining the second keyword based on the startup path of the target device may include: performing cluster analysis on the startup paths of one or more devices to obtain one or more second keywords, wherein the one or more devices include the target device.

[0071] The startup path of the one or more devices may be received by the server within a specified time period, wherein the specified time period may be set according to actual conditions and is not limited in this application.

[0072] Performing cluster analysis on the startup paths of one or more devices to obtain one or more second keywords includes: determining one or more directory names of the startup path of each device in the startup path of the one or more devices; clustering the same directory names in the one or more directory names of the startup path of each device to obtain one or more first directory names; and using the character strings corresponding to the manufacturer and / or brand in the one or more first directory names as the one or more second keywords.

[0073] Taking one or more directory names in the startup path of any device as an example, determining one or more directory names in the startup path of each device in the startup path of the one or more devices may include: determining one or more directory names in the startup path of the arbitrary device based on a separator in the startup path of the arbitrary device.

[0074] Taking any directory name in the startup path of any device as an example, determining one or more directory names in the startup path of any device based on the separators in the startup path of any device may include one of the following: taking the character string before the first separator in the startup path of any device as any directory name in the startup path of any device; taking the character string after the last separator in the startup path of any device as any directory name in the startup path of any device; taking the character string between any two adjacent separators in the startup path of any device as any directory name in the startup path of any device.

[0075] Determining the information of the second candidate object corresponding to the second keyword based on the second keyword may include: using the complete description information of the manufacturer and / or the complete description information of the brand corresponding to the one or more second keywords as the information of the second candidate object corresponding to the one or more second keywords.

[0076] The updating of the keyword library based on the information of the second keyword and the second candidate object to obtain an updated keyword library may include one of the following: when the keyword library does not include the second candidate object, associating the one or more second keywords and the information of the second candidate objects corresponding to the one or more second keywords to the keyword library to obtain an updated keyword library; when the keyword library includes the second candidate object, adding the one or more second keywords to the keyword library and associating the one or more second keywords with the second candidate objects in the keyword library to obtain an updated keyword library.

[0077] By adopting the above implementation, the keyword library is updated based on the second keyword determined by the startup path of the target device and the information of the second candidate object determined by the second keyword to obtain an updated keyword library. In this way, the content of the keyword library can be enriched and the comprehensiveness of the keyword library can be improved.

[0078] Combination Figure 2 The above implementation is described by way of example. Figure 2 Said:

[0079] S201, receiving target information sent by the target device; when the target information includes device-related identification information and information of the object to be verified, and the device-related identification information contains corresponding target object information, execute S202; when the target information only includes the startup path of the target device, execute S206.

[0080] S202, determine whether there is a keyword matching the device-related identification information among one or more candidate keywords included in the keyword library; if there is a first keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, execute S203; if there is no keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, execute S205.

[0081] S203: Using information of a first candidate object corresponding to the first keyword among one or more candidate objects included in the keyword library as information of the target object corresponding to the device-related identification information.

[0082] S204 determines the verification result of the target device based on the information of the target object and the information of the object to be verified, and ends the process.

[0083] Wherein, determining the verification result of the target device based on the information of the target object and the information of the object to be verified includes one of the following: when the information of the object to be verified is the same as the information of the target object, determining that the verification result of the target device is that the system of the target device has not been tampered with; when the information of the object to be verified is different from the information of the target object, determining that the verification result of the target device is that the system of the target device has been tampered with.

[0084] S205: Send a request for obtaining a startup path to the target device, and receive a startup path of the target device sent by the target device.

[0085] S206, updating the keyword library based on the startup path of the target device to obtain an updated keyword library, and ending the process.

[0086] Optionally, after executing S206, the method may further include: sending the updated keyword library to the target device.

[0087] Figure 3 is a schematic flow chart of a method for verifying a target device proposed in an embodiment of the present disclosure, comprising:

[0088] S310, extracting information of the object to be verified from system properties when device-related identification information is extracted from the startup path of the target device;

[0089] S320, generating target information including the device-related identification information and the information of the object to be verified, wherein the device-related identification information and the information of the object to be verified are used by the server to determine the verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with;

[0090] S330: Send the target information to the server.

[0091] The method for verifying a target device according to the embodiment of the present disclosure may be executed by an application in the target device, and the target device may be a mobile terminal such as a mobile phone or a tablet computer.

[0092] By adopting the above implementation, the target device can send the device-related identification information extracted from the startup path and the information of the object to be verified extracted from the system properties of the target device to the server, so that the server can verify the target device to determine whether the system of the target device has been tampered with.

[0093] The extracting the information of the object to be verified from the system properties may include: executing a specified command to obtain the system properties of the target device; obtaining the information of the object to be verified based on one or more subsystem properties in the system properties of the target device. The specified instructions may be the same or different in different system environments, and the specific command content may be set according to the system environment, which is not limited by this application. For example, when the system environment of the target device is an Android environment, the specified command may be "getprop".

[0094] Among them, one or more subsystem attributes in the system attributes may include: complete description information for completely representing or fully expressing the candidate manufacturer, complete description information for completely representing or fully expressing the candidate brand, system version, device ID, storage space size information, chip model, etc., which are not listed one by one here.

[0095] The obtaining of the information of the object to be verified based on one or more subsystem attributes in the system attributes of the target device includes: using the complete descriptive information used to completely represent or fully express the candidate manufacturer, and / or the complete descriptive information used to completely represent or fully express the candidate brand in the one or more subsystem attributes as the information of the object to be verified.

[0096] The startup path of the target device may include one or more directory names, and the one or more directory names may be divided into levels in order from front to back, that is, each directory name in the one or more directory names corresponds to a level, and the level of each directory name is the order of each directory name from front to back in the specified startup path. The method for determining the directory name is the same as the above implementation, and will not be repeated here.

[0097] In one example, extracting device-related identification information from the startup path of the target device may include: extracting the directory name corresponding to the specified level in the startup path of the target device as the device-related identification information. The specified level may be set according to actual conditions and is not limited in this application.

[0098] In one example, extracting device-related identification information from the startup path of the target device may include: when there is a third directory name in the startup path of the target device that matches one or more candidate keywords included in the keyword library, extracting the third directory name as the device-related identification information.

[0099] In addition, the method may further include: determining that the device-related identification information is not extracted when there is no directory name matching one or more candidate keywords included in the keyword library in the startup path of the target device.

[0100] The keyword library may be obtained by receiving the keyword library sent by the server.

[0101] A processing method for determining whether there is a third directory name matching one or more candidate keywords included in a keyword library in a startup path of a target device includes: determining whether there are one or more first candidate directory names that are not matched in the one or more candidate directory names in the startup path of the target device; in the case where there are one or more first candidate directory names that are not matched, using any one of the one or more first candidate directory names as a second candidate directory name; determining whether the second candidate directory name matches each candidate keyword in the keyword library; in the case where the second candidate directory name matches any candidate keyword in the keyword library, using the second candidate directory name as a third directory name; in the case where the second candidate directory name does not match each candidate keyword in the keyword library and there are no one or more first candidate directory names that are not matched in the one or more candidate directory names in the startup path of the target device, determining that there is no directory name matching one or more candidate keywords included in the keyword library in the one or more candidate directory names included in the startup path of an executable file.

[0102] Optionally, the method for determining whether the second candidate directory name matches any candidate keyword in the keyword library includes: determining that the second candidate directory name matches any candidate keyword when each character and the order of each character in the second candidate directory name are the same as each character and the order of each character in any candidate keyword.

[0103] Optionally, the method of determining that the second candidate directory name matches any candidate keyword in the keyword library includes: determining that the second candidate directory name matches any candidate keyword when the similarity between the second candidate directory name and any candidate keyword is greater than or equal to a third specified threshold. The third specified threshold can be configured according to actual conditions and is not limited in this application.

[0104] In an example, the method further includes: generating target information containing only the startup path of the target device when the device-related identification information is not extracted from the startup path of the target device.

[0105] The generating target information including only the startup path of the target device may include: generating target information including the startup path in the executable file.

[0106] By adopting the above implementation, target information including the startup path of the target device is generated when the device-related identification information is not extracted. In this way, it can be ensured that the target device can obtain the target information, and then the server can determine the verification result of the target device, that is, for the situation where some target devices may lack specific identification or attributes (i.e., device-related identification information), comprehensive information collection and reporting are carried out to further analyze and mine keywords or features related to the manufacturer of the target device (i.e., device-related identification information) in the future.

[0107] Combination Figure 4 The above-mentioned implementation modes are exemplarily described, including:

[0108] S401, determine whether device-related identification information is extracted from the startup path in the executable file; if device-related identification information is extracted from the startup path in the executable file, execute S402; if device-related identification information is not extracted from the startup path in the executable file, execute S404.

[0109] S402: extract information of the object to be verified from system properties.

[0110] S403, generate target information including the device-related identification information and the information of the object to be verified, and execute S405, wherein the device-related identification information and the information of the object to be verified are used by the server to determine the verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

[0111] S404, generating target information including only the boot path of the target device, and executing S405.

[0112] S405: Send the target information to the server.

[0113] Optionally, after S405, the method further includes: receiving an updated keyword library sent by the server, and then returning to execute step S401, that is, extracting device-related identification information from the startup path in the executable file based on the updated keyword library.

[0114] In one implementation, the method further includes: upon receiving a request for obtaining a startup path sent by the server, sending the startup path of the target device to the server.

[0115] The method of obtaining the startup path of the target device may include: obtaining a storage address corresponding to the executable file name based on a system mapping file; obtaining the executable file of the target device based on the storage address; and parsing the executable file to obtain the startup path of the target device. The system mapping file includes a corresponding relationship between the executable file name and the storage address.

[0116] The startup path of the target device can also be called the startup path feature of the target device. The key class files involved in the startup path feature of the target device cover the core components necessary for the system startup and operation of the target device. Each type of core component contains a class library that is crucial for the system startup and operation of the target device. These class libraries are loaded by the corresponding virtual machine when the system of the target device is started, ensuring the normal operation of the system of the target device and providing the necessary basic functions for the development and operation of applications on the target device. When the target device manufacturer customizes the system of its own target device, the manufacturer's private tool chain will be added to the device startup path feature. Among them, the manufacturer's feature information (i.e., device-related identification information) is included in the private tool chain path of the target device manufacturer. Normal target device manufacturers generally only contain brand-related features of this manufacturer, and the startup path features of the target device whose system attributes are tampered with will not contain the brand features in the tampered system attributes or contain other brand features. Based on the above principle, it is possible to obtain evidence for most of the devices that modify the system attributes to disguise as other manufacturers, thereby achieving the purpose of verifying whether the target device has been tampered with in this application.

[0117] The executable files of the target device may be: specific intermediate files involved in the process of optimizing the system files of the target device. When these intermediate files are created, they may record specific attributes or features of the underlying system environment of the target device (i.e., specific attributes or features of the boot path of the target device), and embed these specific attributes or features into the metadata or specific data structure of the intermediate file. Although this information is usually not directly displayed to the end user, it can be accessed or extracted through professional tools or specific technical means.

[0118] By adopting the above implementation, when receiving a request for obtaining a startup path sent by the server, the startup path of the target device is sent to the server, and the server can update the keyword library according to the startup path to improve the comprehensiveness of the server keyword library.

[0119] Through the implementation methods of this application, by collecting and analyzing the device startup path characteristics of the target device system, it is possible to effectively identify and obtain evidence of devices that tamper with system properties, which will greatly enhance business risk control capabilities and effectively reduce losses caused by the disruption of normal business by black and gray industry practitioners; and it can quickly identify risky target devices that are forged to appear to be from other manufacturers, providing strong support for combating illegal activities such as brushing volume and brushing orders. Furthermore, compared to the system properties of the target device, the features extracted by this application (i.e., device-related identification information) are difficult to tamper with, which means that the evidence collection scheme is more robust and difficult to be bypassed by black industry users; the features extracted by this application are short (or the extracted features are small), that is, the bandwidth consumption is small, which will make this application more efficient in practical applications and can save a lot of network resources.

[0120] Figure 5 FIG. 1 shows a schematic block diagram of a server provided by an embodiment of the present disclosure. Figure 5 As shown, including:

[0121] The first communication module 501 is used to receive target information sent by a target device;

[0122] The verification module 502 is used to determine the verification result of the target device based on the target object information and the object to be verified information, when the target information includes device-related identification information and information of the object to be verified, and the device-related identification information contains corresponding target object information, wherein the device-related identification information is extracted from the startup path of the target device, the information of the object to be verified is extracted from the system properties of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

[0123] The verification module is used to use the information of the first candidate object corresponding to the first keyword in one or more candidate objects included in the keyword library as the information of the target object corresponding to the device-related identification information when there is a first keyword matching the device-related identification information in one or more candidate keywords included in the keyword library.

[0124] The verification module is used to perform one of the following: when the information of the object to be verified is the same as the information of the target object, determine that the verification result of the target device is that the system of the target device has not been tampered with; when the information of the object to be verified is different from the information of the target object, determine that the verification result of the target device is that the system of the target device has been tampered with.

[0125] like Figure 6 As shown, it also includes:

[0126] A keyword library updating module 601 is used to update the keyword library based on the startup path of the target device to obtain an updated keyword library;

[0127] The first communication module is used to send a request for obtaining a startup path to the target device when there is no candidate keyword matching the device-related identification information among one or more candidate keywords included in the keyword library; and receive the startup path of the target device sent by the target device.

[0128] The keyword library updating module updates the keyword library based on the startup path of the target device to obtain an updated keyword library when the target information only includes the startup path of the target device.

[0129] The keyword library updating module is used to determine a second keyword based on the startup path of the target device; determine information of a second candidate object corresponding to the second keyword based on the second keyword; and update the keyword library based on the second keyword and the information of the second candidate object to obtain an updated keyword library.

[0130] Figure 7 FIG. 1 shows a schematic block diagram of a target device provided by an embodiment of the present disclosure. Figure 7 As shown, including:

[0131] Extraction module 701, used to extract information of the object to be verified from system properties when device-related identification information is extracted from the startup path of the target device;

[0132] A target information generating module 702 is used to generate target information including the device-related identification information and the information of the object to be verified, wherein the device-related identification information and the information of the object to be verified are used by the server to determine the verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with;

[0133] The second communication module 703 is used to send the target information to the server.

[0134] The target information generating module is used to generate target information containing only the startup path of the target device when the device-related identification information is not extracted from the startup path of the target device.

[0135] The second communication module is configured to send the startup path of the target device to the server upon receiving the startup path acquisition request sent by the server.

[0136] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0137] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0138] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0139] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0140] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0141] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0142] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above. For example, in some embodiments, the above method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, at least one step of the method described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform the above method in any other appropriate manner (e.g., by means of firmware).

[0143] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0144] The program code for implementing the method of the present disclosure may be written in any combination of at least one programming language. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0145] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on at least one line, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0146] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0147] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0148] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0149] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0150] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for authenticating a target device, comprising: Receive target information sent by the target device; In the case where the target information includes device-related identification information and information of an object to be verified, and the device-related identification information contains corresponding target object information, a verification result of the target device is determined based on the target object information and the object to be verified information, wherein the device-related identification information is extracted from a startup path of the target device, the information of the object to be verified is extracted from system properties of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

2. The method according to claim 1, further comprising: When there is a first keyword matching the device-related identification information among one or more candidate keywords included in the keyword library, information of the first candidate object corresponding to the first keyword among one or more candidate objects included in the keyword library is used as information of the target object corresponding to the device-related identification information.

3. The method according to claim 2, wherein: The determining, based on the information of the target object and the information of the object to be verified, a verification result of the target device includes one of the following: In a case where the information of the object to be verified is the same as the information of the target object, determining that the verification result of the target device is that the system of the target device has not been tampered with; In a case where the information of the object to be verified is different from the information of the target object, it is determined that the verification result of the target device is that the system of the target device is tampered with.

4. The method according to claim 1, further comprising: When there is no candidate keyword matching the device-related identification information among the one or more candidate keywords included in the keyword library, sending a request to obtain a startup path to the target device; Receiving a startup path of the target device sent by the target device; The keyword library is updated based on the startup path of the target device to obtain an updated keyword library.

5. The method according to claim 1, further comprising: In the case that the target information only includes the startup path of the target device, the keyword library is updated based on the startup path of the target device to obtain an updated keyword library.

6. The method according to claim 4 or 5, wherein updating the keyword library based on the startup path of the target device to obtain the updated keyword library comprises: Determining a second keyword based on the startup path of the target device; Based on the second keyword, determining information of a second candidate object corresponding to the second keyword; The keyword library is updated based on the information of the second keyword and the second candidate object to obtain an updated keyword library.

7. A method for authenticating a target device, comprising: When the device-related identification information is extracted from the startup path of the target device, the information of the object to be verified is extracted from the system properties; Generate target information including the device-related identification information and information about the object to be verified, wherein the device-related identification information and the information about the object to be verified are used by the server to determine a verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with; The target information is sent to the server.

8. The method according to claim 7, further comprising: If the device-related identification information is not extracted from the boot path of the target device, target information including only the boot path of the target device is generated.

9. The method according to claim 7, further comprising: In case of receiving the request for obtaining the startup path sent by the server, sending the startup path of the target device to the server.

10. A server, comprising: A first communication module, used for receiving target information sent by a target device; A verification module is used to determine the verification result of the target device based on the target object information and the object to be verified information, when the target information includes device-related identification information and information of an object to be verified, and the device-related identification information contains corresponding target object information, wherein the device-related identification information is extracted from a startup path of the target device, the information of the object to be verified is extracted from system properties of the target device, and the verification result of the target device is whether the system of the target device has been tampered with.

11. The server according to claim 10, wherein: The verification module is used to use the information of the first candidate object corresponding to the first keyword in one or more candidate objects included in the keyword library as the information of the target object corresponding to the device-related identification information when there is a first keyword matching the device-related identification information in one or more candidate keywords included in the keyword library.

12. The server according to claim 11, wherein: The verification module is used to perform one of the following: when the information of the object to be verified is the same as the information of the target object, determine that the verification result of the target device is that the system of the target device has not been tampered with; In a case where the information of the object to be verified is different from the information of the target object, it is determined that the verification result of the target device is that the system of the target device is tampered with.

13. The server according to claim 10, further comprising: A keyword library updating module, used to update the keyword library based on the startup path of the target device to obtain an updated keyword library; The first communication module is used to send a request to obtain a startup path to the target device when there is no candidate keyword matching the device-related identification information among one or more candidate keywords included in the keyword library; and receive the startup path of the target device sent by the target device.

14. The server according to claim 10, further comprising: The keyword library updating module updates the keyword library based on the startup path of the target device to obtain an updated keyword library when the target information only includes the startup path of the target device.

15. The server according to claim 13 or 14, wherein: The keyword library updating module is used to determine a second keyword based on the startup path of the target device; and determine information of a second candidate object corresponding to the second keyword based on the second keyword; The keyword library is updated based on the information of the second keyword and the second candidate object to obtain an updated keyword library.

16. A target device, comprising: An extraction module, used to extract information of the object to be verified from system properties when device-related identification information is extracted from the startup path of the target device; a target information generation module, used to generate target information including the device-related identification information and information about the object to be verified, wherein the device-related identification information and information about the object to be verified are used by the server to determine a verification result of the target device, and the verification result of the target device is whether the system of the target device has been tampered with; The second communication module is used to send the target information to the server. 17 . The target device according to claim 16 , wherein the target information generating module is configured to generate target information containing only the startup path of the target device when the device-related identification information is not extracted from the startup path of the target device.

18. The target device according to claim 16, wherein the second communication module is configured to send the startup path of the target device to the server upon receiving the request for obtaining the startup path sent by the server.

19. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6 or claims 7-9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-6 or claims 7-9.

21. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 6 or claims 7 to 9.

Images