System and method for security protection

Abstract

The invention provides a security protection system and method. The security protection system comprises a first terminal device, a second terminal device and a network device. The second terminal equipment is used for sending a first message, and the first message comprises a first permission set of the second terminal equipment; the network equipment is used for receiving threat information sent by the second terminal equipment, and the threat information is threat information detected by the second terminal equipment; the first terminal equipment is used for receiving a second message sent by the network equipment, the second message comprises a second permission set of the second terminal equipment, and the second message is used for instructing the first terminal equipment to update the permission of the second terminal equipment according to the second permission set; the first permission set and the second permission set are used for indicating the second terminal equipment to operate the first terminal equipment, the first permission set comprises the first permission, and the second permission set at least does not comprise the first permission. Based on the system and the method, the safety risk in a distributed multi-terminal scene can be reduced.

Description

Technical Field

[0001] The present application relates to the field of terminals, and more specifically, to a security protection system and method. Background Art

[0002] In a distributed multi-terminal scenario, the means of attacking networks and devices are becoming increasingly diverse and complex, while the existing threat detection and repair methods and application scenarios are relatively simple. When a terminal device is threatened, the threat cannot be accurately detected and intercepted in a timely manner, and the threat is easily spread to other terminal devices. Summary of the invention

[0003] The present application provides a system and method for security protection

[0004] In a first aspect, a security protection system is provided, including a first terminal device, a second terminal device and a network device; the second terminal device is used to send a first message, the first message including a first permission set of the second terminal device; the network device is used to receive threat information sent by the second terminal device, the threat information is information about threats detected by the second terminal device; the first terminal device is used to receive a second message sent by the network device, the second message including a second permission set of the second terminal device, the second message being used to instruct the first terminal device to update permissions of the second terminal device according to the second permission set, the first permission set and the second permission set being used to indicate operations that the second terminal device can perform on the first terminal device, the first permission set including a first permission, and the second permission set at least including the first permission.

[0005] In an embodiment of the present application, after the second terminal device reports the threat information, the network device sends a second message to the first terminal device to instruct the first terminal device to prohibit some permissions of the second terminal device, thereby avoiding the spread of the threat detected by the second terminal device, which is beneficial to reducing security risks in distributed multi-terminal scenarios.

[0006] In combination with the first aspect, in a possible implementation manner, the first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

[0007] In an embodiment of the present application, the network device sends a second message to the first terminal device to instruct the first terminal device to prohibit sensitive permissions of the second terminal device, thereby avoiding the spread of threats detected by the second terminal device, which is beneficial to reducing security risks in distributed multi-terminal scenarios.

[0008] In combination with the first aspect, in a possible implementation manner, the network device is further used to: determine the second permission set according to the threat information and the first permission set.

[0009] In combination with the first aspect, in a possible implementation method, the network device is specifically used to: determine, based on the threat information, a type of threat detected by the second terminal device; determine a third permission set corresponding to the type of threat detected by the second terminal device; determine the second permission set based on the first permission set and the third permission set, the second permission set being the intersection of the first permission set and the third permission set.

[0010] In combination with the first aspect, in a possible implementation, the second terminal is further used to receive a threat repair strategy sent by the network device, where the threat repair strategy is used to repair the threat detected by the second terminal device.

[0011] In an embodiment of the present application, the network device sends a threat repair strategy to the second terminal device to promptly repair the threat detected by the second terminal device, thereby avoiding the spread of the threat detected by the second terminal device, which is beneficial to reducing security risks in distributed multi-terminal scenarios.

[0012] In combination with the first aspect, in a possible implementation, the network device is also used to receive a threat removal message sent by the second terminal device, and the threat removal message is used to request restoration of permissions of the second terminal device; the first terminal device is also used to receive a third message sent by the network device, and the third message is used to instruct the first terminal device to update permissions of the second terminal device according to the first permission set.

[0013] In an embodiment of the present application, when the threat detected by the second terminal device is repaired, the network device restores normal communication and interaction between the first terminal device and the second terminal device, which is beneficial to improving the user experience.

[0014] In combination with the first aspect, in a possible implementation method, the second terminal device is also used to: obtain the real user ID or real user group ID of the application process in the current system call; obtain the real user ID or real user group ID of the application process in the last system call; if the real user ID or real user group ID of the application process in the current system call is zero, and the real user ID or real user group ID of the application process in the last system call is not zero, it is determined that an administrator privilege threat is detected in the second terminal device.

[0015] In the embodiment of the present application, the method of detecting administrator authority threats is relatively accurate, which reduces the probability of false positives of administrator authority and is beneficial to improving the user experience.

[0016] In a second aspect, a security protection method is provided, which is applied to a first terminal device, and the method includes: receiving a first message sent by a second terminal device, the first message including a first permission set of the second terminal device; receiving a second message sent by a network device, the second message including a second permission set of the second terminal device, the second message being used to instruct the first terminal device to update the permissions of the second terminal device according to the second permission set, the first permission set and the second permission set being used to indicate the operations that the second terminal device can perform on the first terminal device, the first permission set including a first permission, and the second permission set at least including the first permission.

[0017] In combination with the second aspect, in a possible implementation, the first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

[0018] In combination with the second aspect, in a possible implementation manner, the method further includes: receiving a third message sent by the network device, where the third message is used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

[0019] In a third aspect, a security protection method is provided, which is applied to a network device, and the method includes: receiving a first message sent by a second terminal device, the first message including a first permission set of the second terminal device; receiving threat information sent by the second terminal device, the threat information being information about threats detected by the second terminal device; sending a second message to the first terminal device, the second message including a second permission set of the second terminal device, the second message being used to instruct the first terminal device to update permissions of the second terminal device according to the second permission set, the first permission set and the second permission set being used to indicate operations that the second terminal device can perform on the first terminal device, the first permission set including a first permission, and the second permission set at least including the first permission.

[0020] In combination with the third aspect, in a possible implementation, the first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

[0021] In combination with the third aspect, in a possible implementation manner, the method further includes: determining the second permission set according to the threat information and the first permission set.

[0022] In combination with the third aspect, in a possible implementation manner, the method determines the second permission set based on the threat information and the first permission set, including: determining the type of threat detected by the second terminal device based on the threat information; determining a third permission set corresponding to the type of threat detected by the second terminal device; determining the second permission set based on the first permission set and the third permission set, the second permission set being the intersection of the first permission set and the third permission set.

[0023] In combination with the third aspect, in a possible implementation, the method further includes: determining a threat repair strategy based on the threat information, wherein the threat repair strategy is used to repair the threat detected by the second terminal device; and sending the threat repair strategy to the second terminal device.

[0024] In combination with the third aspect, in a possible implementation, the method also includes: receiving a threat removal message sent by the second terminal device, the threat removal message is used to request the return of the permission of the second terminal device; sending a third message to the first terminal device, the third message is used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

[0025] In a fourth aspect, a security protection method is provided, which is applied to a second terminal device, and the method includes: sending a first message to a first terminal device and a network device, the first message including a first permission set of the second terminal device; sending threat information to the second terminal device and / or the network device, the threat information being information about the threat detected by the second terminal device; receiving a fourth message sent by the network device, the fourth message including a second permission set of the second terminal device, the fourth message being used to indicate that the second terminal device interacts with the first terminal device based on the second permission set, the first permission set and the second permission set being used to indicate operations that the second terminal device can perform on the first terminal device, the first permission set including a first permission, and the second permission set at least not including the first permission.

[0026] In combination with the fourth aspect, in a possible implementation, the first permission is the permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is the permission for the second terminal device to call a sensitive application of the first terminal device.

[0027] In combination with the fourth aspect, in a possible implementation, the method also includes: obtaining the real user ID or real user group ID of the application process in the current system call; obtaining the real user ID or real user group ID of the application process in the last system call; if the real user ID or real user group ID of the application process in the current system call is zero, and the real user ID or real user group ID of the application process in the last system call is not zero, it is determined that an administrator privilege threat is detected in the second terminal device.

[0028] In combination with the fourth aspect, in a possible implementation manner, the method further includes: receiving a threat repair strategy sent by the network device, where the threat repair strategy is used to repair the threat detected by the second terminal device.

[0029] In combination with the fourth aspect, in a possible implementation, the method further includes: sending a threat removal message to the network device and / or the first terminal device, wherein the threat removal message is used to request restoration of permissions for the second terminal device.

[0030] In combination with the fourth aspect, in a possible implementation manner, the method further includes: receiving a third message sent by a network device, where the third message is used to instruct the second terminal device to interact with the first terminal device based on the first permission set.

[0031] In a fifth aspect, a computer-readable storage medium is provided, comprising computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the method described in the second aspect and any possible implementation of the second aspect, or executes the method described in the third aspect and any possible implementation of the third aspect, or executes the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0032] In the sixth aspect, a computer program product is provided, comprising: a computer program code, which, when executed, enables the electronic device to execute the method described in the second aspect and any possible implementation of the second aspect, or execute the method described in the third aspect and any possible implementation of the third aspect, or execute the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0033] The seventh aspect is an electronic device of an embodiment of the present application, which includes a module / unit for executing the method described in the second aspect and any possible implementation of the second aspect, or executing the method described in the third aspect and any possible implementation of the third aspect, or executing the method described in the fourth aspect and any possible implementation of the fourth aspect; these modules / units can be implemented by hardware, or the corresponding software implementation can be executed by hardware. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of an application scenario provided by an embodiment of the present application.

[0035] Figure 2 It is a schematic diagram of a security protection system provided in an embodiment of the present application.

[0036] Figure 3 It is a schematic flowchart of detecting administrator authority threats provided by an embodiment of the present application.

[0037] Figure 4 It is a schematic diagram of the system architecture provided in the embodiment of the present application.

[0038] Figure 5 It is a schematic flow chart of a security protection method provided in an embodiment of the present application.

[0039] Figure 6 It is a structural schematic diagram of a device provided in an embodiment of the present application.

[0040] Figure 7 It is a schematic block diagram of the device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The terms used in the following embodiments are only for the purpose of describing specific embodiments, and are not intended to be used as limitations on the present application. As used in the specification and the appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include expressions such as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the following embodiments of the present application, "at least one", "one or more" refer to one, two or more. The term "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist; for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0042] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear at different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0043] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0044] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present application. The security protection method provided by an embodiment of the present application can be applied to the scenario of distributed terminals. In a distributed multi-terminal scenario, there can be a communication connection between multiple terminal devices that access the same distributed network or log in to the same account. Each terminal device can access the services provided by other terminal devices, use the capabilities of other terminal devices, etc., thereby providing users with a rich and smooth full-scenario experience. For example, Figure 1 The first terminal device, the second terminal device, and the third terminal device can access the same distributed network or log in to the same account to form a distributed multi-terminal scenario. In the distributed multi-terminal scenario, the first terminal device can, for example, access and play the video stored in the second terminal device, and call the microphone and camera of the third terminal device.

[0045] The terminal device in the embodiments of the present application may be, for example, a mobile phone, a tablet, headphones, a personal computer (PC), a smart screen, a car computer, a stereo, a watch, glasses, etc., which is not limited in the embodiments of the present application.

[0046] To facilitate the management of distributed multi-terminal scenarios, it is necessary to set the permissions of each terminal device in the distributed multi-terminal scenario. The permissions of each terminal device may include any one or more of the following: calling the location information of other terminal devices, calling the camera of other terminal devices, calling the microphone of other terminal devices, accessing the media and files of other terminal devices, etc. For example, Table 1 shows Figure 1The permissions of the first terminal device shown in Table 1, where "1" in Table 1 indicates that the first terminal device has the corresponding permission, and "0" indicates that the first terminal device does not have the corresponding permission. As shown in Table 1, the first terminal device has the permission to call, access or obtain the location information, camera, media and files of the second terminal device; the first terminal device may also have the permission to call, access or obtain the location information and microphone of the third terminal device.

[0047] Table 1: Permissions of the first terminal device

[0048] Second terminal device Third terminal equipment Location Information 1 1 camera 1 0 microphone 0 1 Access media and files 1 0

[0049] It should be understood that the permissions of a terminal device are used to control the communication or interaction between the terminal device and other terminal devices. That is, the terminal device can communicate or interact with other terminal devices within the scope of the permissions of the terminal device. For example, if the permissions of a smart watch include the permission to access the photos of a mobile phone, the mobile phone will agree to the smart watch's request to access the photos of the mobile phone. For example, if a smart watch includes the permission to call the microphone of the mobile phone, the mobile phone will agree to the smart watch's request to call the microphone of the mobile phone.

[0050] like Figure 1 As shown, the first terminal device, the second terminal device and the third terminal device may also have a communication connection with the network device, wherein the network device is used to manage the authority of each distributed terminal. Specifically, the network device may store the authority of each distributed terminal, and the network device may set or change the authority of each distributed terminal.

[0051] It should be noted that the network device in the embodiment of the present application can be a server located in the cloud, or it can be a distributed terminal connected to the same distributed network or logged in to the same account, and the present application is not limited to this.

[0052] In a distributed multi-terminal scenario, the means of attacking terminal devices are becoming increasingly diverse and complex, while the existing threat detection and repair methods and application scenarios are relatively simple, and many threat detection methods are inefficient and have a high false alarm rate. When a terminal device is attacked and there is a threat, it is impossible to accurately detect the threat and intercept the threat in time, which can easily spread the threat to other terminal devices; at the same time, there is a lack of effective threat repair strategies, and when the terminal is attacked and threatened, it is impossible to repair the threat in time. For example, when the first terminal device is attacked, the attacker may use the permissions of the first terminal device to call the services of the second terminal device and the third terminal device, making it impossible to ensure the security of the distributed multi-terminal scenario.

[0053] Figure 2 Schematic diagram of a security protection system provided by an embodiment of the present application. Figure 2 Take smart watches, mobile phones and car computers as examples. It should be understood that Figure 2 The mobile phone, smart watch and car machine in the description may be any terminal device, and the mobile phone, smart watch and car machine are only used as an example and shall not constitute any limitation to the present application. Figure 2 As shown, each device in the system performs the following steps:

[0054] S201a, the smart watch sends initial permissions of the smart watch to the network device.

[0055] S201b, the smart watch sends initial permissions of the smart watch to other terminal devices.

[0056] In the embodiment of the present application, when a terminal device accesses a distributed network, it is necessary to send the initial permissions of the terminal device to other terminal devices in the distributed network. The initial permissions of the terminal device are the default permissions or user-preset permissions of the terminal device in a distributed multi-terminal scenario.

[0057] Optionally, the smart watch only sends the initial permission of the smart watch to the network device, and the network device forwards the initial permission of the smart watch to other terminal devices. The other terminal devices here refer to other terminal devices except the smart watch, such as mobile phones and car computers.

[0058] In some embodiments, the initial permissions of the smartwatch are different for different terminal devices. For example, the initial permissions of the smartwatch to the mobile phone are different from the initial permissions of the smartwatch to the car computer. The smartwatch can send the initial permissions of the smartwatch to the mobile phone to the mobile phone; the smartwatch can send the initial permissions of the smartwatch to the car computer to the car computer.

[0059] In another example, the smart watch sends a first message to the network device, the vehicle computer and the mobile phone, where the first message includes the initial permission of the smart watch to the mobile phone and the initial permission of the smart watch to the vehicle computer.

[0060] In some embodiments, when a terminal device accesses a distributed network, other terminal devices in the distributed network need to send their own permissions to the terminal device. For example, when a smart watch accesses a distributed network, the vehicle computer sends the vehicle computer's permissions to the smart watch, and the mobile phone sends the mobile phone's permissions to the smart watch.

[0061] It should be noted that the permissions of the terminal device described in this application refer to the permissions of the terminal device over other terminal devices, that is, which applications of other terminal devices can be called by the terminal device, or which information of other terminal devices can be obtained by the terminal device.

[0062] In some embodiments, when a terminal device accesses a distributed network, the network device sends permissions of other terminal devices to the terminal device.

[0063] In some embodiments, each terminal device stores permissions of other terminal devices. Table 2 is an example of permissions of other terminal devices stored by a mobile phone. As shown in Table 2, the mobile phone stores permissions of the vehicle computer and the smart watch. The permissions of the vehicle computer include permissions to call the location information, microphone, media and files, and camera of the mobile phone; while the permissions of the smart watch include permissions to call the location information, media and files of the mobile phone.

[0064] Table 2 Permission information of other terminal devices

[0065] Car Machine Smartwatch Location Information 1 1 camera 1 0 microphone 1 0 Media and Files 1 1

[0066] In the embodiment of the present application, each terminal device stores the permissions of other terminal devices, and two terminal devices can communicate or interact according to their respective permissions. For example, the first terminal device determines whether to agree to the request of the second terminal device to call the camera based on the permissions of the second terminal device; the second terminal device determines whether to agree to the request of the first terminal device to call the camera based on the permissions of the first terminal device. For example, when a mobile phone receives a request from a smart watch to call the microphone, the mobile phone determines that the smart watch does not have the permission to call the microphone based on the permissions of the smart watch in Table 2, and the mobile phone will reject the request of the smart watch to call the microphone.

[0067] In some embodiments, when the mobile phone receives a request from the smart watch to call the microphone, the mobile phone determines that the smart watch does not have permission to call the microphone based on the permission information of the smart watch in Table 2, and then the mobile phone will display a prompt interface, which is used to prompt the user to determine whether to agree to the smart watch's request to call the microphone.

[0068] In some embodiments, when the mobile phone receives a request from the smart watch to call the microphone, the mobile phone determines that the smart watch does not have the permission to call the microphone according to the permission information of the smart watch in Table 2, and then the mobile phone will display a prompt interface, which is used to prompt the user to determine whether to agree to the request of the smart watch to call the microphone. At this time, if the user chooses to agree to the request of the smart watch to call the microphone, the mobile phone updates the permissions of the smart watch saved by itself, that is, adds the permission to call the microphone to the smart watch.

[0069] S202, the mobile phone detects threats to itself.

[0070] A threat refers to an environment or event that can potentially harm a system through unauthorized access, destruction, leakage, data modification, or denial of service. Specifically, a threat refers to the potential for a specific threat source to exploit a specific vulnerability.

[0071] In the embodiment of the present application, threats may include, for example, potential threats, active threats, root threats, canned threats, etc. Potential threats refer to behaviors that may pose risks, such as successful AT authentication, USB connection, system vulnerabilities, etc.;

[0072] Active threats can refer to attacks on terminal devices, such as illegal user-mode memory copying, instruction flow anomalies, illegal kernel modules, process hijacking, kernel integrity damage, secure OS threats, memory duplication, and fastboot image writing; root threats refer to terminal devices illegally obtaining administrator (root) privileges, such as process privilege escalation, fastboot unlocking, user unlock code unlocking, su file detection, image writability, kernel code segment damage, kcode-syscall system call table damage, root process detection, etc.; canned threats refer to attackers implanting malicious code in software or applications, and then packaging it into a seemingly normal installation package or application to deceive users into downloading and installing it. Once the user installs the application, the attacker can obtain the user's sensitive information or control the user's device. For example, canned threats can include: startup verification failure, image verification shutdown, key file tampering, abnormal startup verification status, system integrity damage, etc.

[0073] In the embodiment of the present application, each distributed terminal needs to monitor itself in real time to detect whether it has threats. The present application does not limit the method of detecting threats. For example, the terminal device can perform a comprehensive scan on itself or monitor key nodes of the system call.

[0074] S203a, the mobile phone sends threat information to the network device.

[0075] In the embodiment of the present application, when the terminal device detects that it is threatened, the terminal device reports threat information to the network device, and the threat information refers to the information of the threat detected by the mobile phone against the mobile phone. The threat information may include the type of threat, the source of the threat, the threat level, the credibility, the threat time, etc. The types of threats include potential threats, active threats, root threats, canned threats, etc.

[0076] S203b, the mobile phone sends threat information to other terminal devices.

[0077] In the embodiment of the present application, the mobile phone may send the threat information to other terminal devices, or may send the threat information only to the network device. It should be understood that S203b is an optional step.

[0078] S204, the vehicle computer receives the threat information sent by the mobile phone, and forwards the threat information to the network device.

[0079] It should be understood that S204 is an optional step.

[0080] Optionally, when the vehicle computer receives the threat information sent by the mobile phone, the vehicle computer actively requests the network device to update the permissions of the mobile phone, that is, requests the network device to restrict some or all permissions of the mobile phone.

[0081] S205a, the network device sends the controlled permissions of the mobile phone to the vehicle computer, and correspondingly, the vehicle computer receives the controlled permissions of the mobile phone sent by the network device.

[0082] Since the network device receives the threat information reported by the mobile phone, the network device can downgrade the permissions of the mobile phone according to the threat information. Specifically, the network device determines the controlled permissions of the mobile phone according to the threat information. The network device can determine the controlled permissions of the mobile phone according to the frequency of threat information reported by the mobile phone, the threat level, the credibility of the threat, etc., and send the controlled permissions of the mobile phone to the vehicle computer. The range of the controlled permissions of the mobile phone is smaller than the range of the initial permissions of the mobile phone. Exemplarily, the initial permissions of the mobile phone include 10 permissions, and the controlled permissions of the mobile phone include 6 permissions.

[0083] Generally, when a network device receives threat information reported by a terminal device, the network device will remove the mobile phone's permission to access sensitive data and call sensitive applications. Specifically, the network device will prohibit the terminal device from calling sensitive applications of other terminal devices, such as high-security applications, such as payment applications, and related applications containing personal privacy data, and / or prohibit the terminal device from accessing sensitive data of other terminal devices, such as privacy data, encrypted data, etc.

[0084] In one example, there are multiple types of threats detected by the mobile phone, and each type of threat will correspond to a different permission set. Table 3 shows the mapping relationship between multiple types of threats and multiple permission sets. As shown in Table 3, each type of threat corresponds to a permission set, and each permission set includes multiple permissions. For example, the permission set corresponding to the root threat includes the permission to call the calendar and the permission to create desktop shortcuts. The network device can save the mapping relationship between multiple types of threats and multiple permission sets. Therefore, the network device can determine the type of threat based on the threat information, and then determine the permission set corresponding to the type of threat, that is, determine the controlled permissions of the mobile phone.

[0085] Table 3

[0086]

[0087] It should be understood that the mapping relationship between the various types of threats and the plurality of permission sets shown in Table 3 may be preset by a technician or may be a default.

[0088] In some embodiments, a different permission set is set corresponding to each threat that may be detected.

[0089] In another example, Table 4 shows the initial permissions of a mobile phone, which is a permission set composed of multiple permissions. When the network device determines the controlled permissions of the mobile phone, it first determines the type of threat based on the threat information, then determines the permission set corresponding to the threat of this type, and then takes the intersection of the permission set corresponding to the threat of this type and the initial permission set as the controlled permissions of the mobile phone.

[0090] Table 4

[0091]

[0092] It is understandable that the number of initial permissions of the mobile phone is greater than the number of permissions corresponding to any type of threat.

[0093] In the embodiment of the present application, after receiving the controlled permissions of the mobile phone, the vehicle computer updates the initial permissions of the mobile phone to the controlled permissions of the mobile phone. The vehicle computer communicates or interacts with the mobile phone according to the controlled permissions of the mobile phone. In this way, the threat of the terminal device that detects the threat will not spread to other terminal devices, which is conducive to reducing the security risks of distributed multi-terminal scenarios.

[0094] S205b, the network device repairs the threat to the mobile phone through a repair strategy.

[0095] In an embodiment of the present application, the network device may be provided with a threat repair policy library for storing a plurality of threat repair policies. The network device may select a suitable threat repair policy from the threat repair policy library according to the threat information, and send the threat repair policy to the mobile phone. The mobile phone may repair the detected threat according to the threat repair policy to eliminate the threat detected by the mobile phone. For example, if the threat detected by the mobile phone is the sending of malicious code, the threat repair policy may be to isolate or delete the malicious code. After the mobile phone isolates or deletes the malicious code, the threat is repaired.

[0096] Optionally, users can manually repair and remove threats from their phones.

[0097] S206, the vehicle computer communicates or interacts with the mobile phone according to the controlled permissions of the mobile phone.

[0098] Exemplarily, after receiving a request from a mobile phone to access photos, the vehicle computer determines, based on the controlled permissions of the mobile phone, that the mobile phone does not have permission to access photos, and then the vehicle computer rejects the request from the mobile phone to access photos.

[0099] S207, mobile phone eliminates threat.

[0100] Specifically, when the threat repair is completed, the mobile phone can detect the threat again. If no threat is detected, it is confirmed that the threat has been eliminated.

[0101] S208, the mobile phone reports information on removing the threat.

[0102] The mobile phone sends threat elimination information to the network device and other terminal devices, and the threat elimination information is used to indicate that the threat detected by the mobile phone has been repaired.

[0103] In some embodiments, the threat removal information is used to instruct other terminal devices and / or network devices to restore the initial permissions of the mobile phone.

[0104] S209, the network device restores the authority of the mobile phone.

[0105] Specifically, the network device sends the initial permissions of the mobile phone to other terminal devices, and the other terminal devices update the permissions of the mobile phone to the initial permissions of the mobile phone. Subsequently, the mobile phone and other terminal devices communicate or interact according to the initial permissions of the mobile phone.

[0106] In some embodiments, after other terminal devices receive the information about removing the threat, the other terminal devices update the permissions of the mobile phone to the initial permissions of the mobile phone.

[0107] In some embodiments, after other terminal devices receive the initial permissions of the mobile phone sent by the network device and the threat removal information sent by the mobile phone, the other terminal devices update the permissions of the mobile phone to the initial permissions of the mobile phone.

[0108] Figure 3 This is a schematic flow chart of detecting root threats provided by an embodiment of the present application. Figure 3 The steps of detecting root threats according to an embodiment of the present application are introduced.

[0109] In the embodiments of the present application, the terminal device can detect different types of threats in different ways. For example, the terminal device can perform a comprehensive scan on itself to detect whether there are potential threats such as malicious code and system vulnerabilities; for another example, the terminal device can also monitor key nodes of system calls to detect whether there are active threats such as hacker attacks; the terminal device can also perform root threat detection on itself to detect whether the terminal device has obtained root permissions and whether the root permissions are legally obtained.

[0110] For ease of understanding, the root permission is explained below. The root permission is the highest permission, also known as super permission or administrator permission. In the system, each file, directory, and process belongs to a certain user. Other ordinary users cannot operate without the user's permission, except for users with root permissions. If a terminal device is rooted, it will give the attacker a great deal of independent operation rights, allowing the attacker to delete the system applications of the terminal device, view and modify the running information of the program, etc., greatly increasing the security risk of the terminal device. In a distributed multi-terminal scenario, if a terminal device is rooted, the entire distributed network may be at risk.

[0111] Generally, we can check the su file to determine whether the terminal device is rooted. For example, if the terminal device has the su file, the terminal device is rooted; if the terminal device does not have the su file, the terminal device is not rooted.

[0112] In addition, we can also determine whether the terminal device is rooted during a system call. During a system call, the system kernel needs to obtain the user id (uid) or group id (gid) of the application process to determine the permissions of the application process and whether the operation of the application process is allowed. For example, when an application process tries to write a file, the system kernel checks the uid or gid of the application process to determine whether the application process has sufficient permissions to modify the file. Generally, if the uid / gid is zero, the application process has root permissions and the terminal device is rooted; otherwise, the application process does not have root permissions and the terminal device is not rooted.

[0113] In some embodiments, the application process runs in a container, and the permissions of the application process inside and outside the container are different. For example, the application process has root permissions inside the container, but not outside the container. At this time, if the application process makes a system call, the system kernel may recognize that the uid or gid of the application process in the container is zero, which may cause the terminal device to falsely detect a root threat.

[0114] In this embodiment, the step of detecting root threats includes:

[0115] S310, determining whether the real uid / gid of the application process during the current system call is zero.

[0116] S320, determining whether the real uid / gid of the application process during the last system call is zero.

[0117] If the real uid / gid of the application process in the current system call is not zero, execute step S350; if the real uid / gid of the application process in the current system call is zero, and the real uid / gid of the application process in the previous system call was zero, execute step S330; if the real uid / gid of the application process in the current system call is zero, and the real uid / gid of the application process in the previous system call is not zero, execute step S340.

[0118] S330: It is determined that the terminal device is rooted, but no root threat is detected.

[0119] S340: Determine that the terminal device is rooted and detect a root threat.

[0120] Optionally, the terminal device sends threat information to the network device and other terminal devices to indicate the detected root threat information.

[0121] S350: Determine that the terminal device is not rooted and no root threat is detected.

[0122] The real uid (real_uid) or real gid (real_gid) of an application process is the user id or user group id that created the application process. If the application process is created by another application process, the real uid / gid of the application process is the id or user group id of the other application process. The real uid / gid of the application process can also refer to the real uid / gid mapped by the application process outside the container. For example, if 5000 uids are mapped to the container when setting up the container, the range (100000-104999) starting from uid100000 outside the container is mapped to the range (0-4999) starting from uid 0 inside the container. If the process inside the container runs with uid 1, the real uid of the process mapped outside the container (on the terminal device) is 100001. Even if the uid of the process inside the container is zero, it only means that the process has root privileges inside the container, but not outside the container.

[0123] If the real uid / gid of the application process is zero during the current system call and the last system call, that is, the application process has root privileges during the current system call and the last system call, then the terminal device is determined to be rooted. However, since the application process already had root privileges during the last system call, it means that the application process originally had root privileges, so it is determined that the application process does not have any unauthorized behavior, and the terminal device is deemed to have not detected a root threat.

[0124] If the real uid / gid of the application process is zero during the current system call, but the real uid / gid of the application process was not zero during the previous system call, that is, the application process has root privileges during the current system call, but did not have root privileges during the previous system call, then it is determined that the terminal device is currently rooted, and it is determined that the application process has exceeded its privileges, and the terminal device is deemed to have detected a root threat.

[0125] If the real uid / gid of the application process is not zero during the current system call, it is determined that the application process does not have root authority during the current system call, and the terminal device is not currently rooted, that is, no root threat is detected.

[0126] In one example, during the current system call, the real uid / gid of the application process is obtained through the two functions from_kuid_munged and from_kgid_munged. Specifically, the real uid of the application process during the current system call is obtained through the function from_kuid_munged(&init_user_ns,new->uid), and / or the real gid of the application process during the current system call is obtained through from_kgid_munged(&init_user_ns,new->gid); the real uid of the application process during the current system call is obtained through the function from_kuid_munged(&init_user_ns,old->uid), and / or the real gid of the application process during the previous system call is obtained through from_kgid_munged(&init_user_ns,old->gid).

[0127] It should be understood that the above judgment is performed for any application process that makes a system call in the terminal device, so as to detect whether there is a root threat in the terminal device.

[0128] It should be understood that if the real uid or real gid of an application process is zero, it can be determined that the application process has root privileges.

[0129] It should be noted that, according to the method of detecting root threats, if the uid of the terminal device is set to zero twice in succession by using the su file, the terminal device will not detect the root threat.

[0130] Figure 4 Schematic diagram of the system architecture provided by the embodiment of the present application. Figure 4As shown, in a distributed multi-terminal scenario, each terminal device includes a threat detection module for detecting whether it has a threat, identifying the type, source, level, credibility, and time of the threat, etc. When a threat is detected in a terminal device, the threat detection module can also send threat information to the network device and / or other terminal devices.

[0131] The network device includes a permission control module and a threat repair module. Among them, the permission control module is used to determine the controlled permissions of the terminal device based on the threat information. For example, the permission control module can determine the type of threat based on the threat information, and then determine the permission set corresponding to the threat of this type, and send the permission set corresponding to the threat of this type as the controlled permissions of the terminal device to the terminal device and other terminal devices in the distributed network. The permission control module can also save the initial permissions of all terminal devices in the distributed network, so that the initial permissions of the terminal device can be restored after the terminal device removes the threat.

[0132] The threat repair module stores a threat repair strategy library, including repair strategies for different threats, and each threat corresponds to a different threat repair strategy. When threat information is received, a matching threat repair strategy is selected from the threat repair strategy library according to the threat information, and the threat repair strategy is sent to the terminal device that sent the threat information, so that the terminal device can automatically repair the threat.

[0133] Figure 5 1 is a schematic flow chart of a security protection method provided in an embodiment of the present application. The security protection method is applied to a distributed multi-terminal scenario, which may include a first terminal device, a second terminal device, and a network device. It should be understood that the distributed multi-terminal scenario may also include more terminal devices, and only the first terminal device and the second terminal device are used as examples for illustration.

[0134] like Figure 5 As shown, the security protection method includes:

[0135] 501a, the second terminal device sends a first message to the first terminal device, and correspondingly, the second terminal device receives the first message sent by the first terminal device.

[0136] 502b, the second terminal device sends a second message to the first terminal device, and correspondingly, the network device receives the first message sent by the first terminal device.

[0137] The first message includes a first permission set of the second terminal device, and the first permission set consists of one or more permissions of the second terminal device. The first permission set of the second terminal device is the initial permission of the second terminal device. The first permission set can be in the form shown in Table 1, or in the form shown in Table 4, which is not limited in the embodiment of the present application.

[0138] It should be understood that the first permission set indicates the operations that the second terminal device can perform on the first terminal device. For example, the second terminal device can perform the following operations on the first terminal device: obtain the location information, calendar, call records and other information of the first terminal device, the second terminal device can call the camera and microphone of the first terminal device, and the second terminal device can install applications and create desktop shortcuts on the first terminal device.

[0139] In some embodiments, the second terminal device sends a first message to the network device, where the first message includes a first permission set of the second terminal device.

[0140] In some embodiments, the first terminal device and / or the network device stores the first permission set of the second terminal device.

[0141] In some embodiments, the first permission set can also indicate the operation performed by the second terminal device on the third terminal device, that is, the first permission set includes the permission of the second terminal device on the first terminal device and the permission of the second terminal device on the third terminal device. After the first terminal device receives the first message, the first terminal device extracts and saves the permission of the second terminal device on the first terminal device from the first permission set.

[0142] In some embodiments, if the second terminal device does not detect a threat, that is, the second terminal device does not report threat information, the first terminal device updates the permissions of the second terminal device according to the first permission set. The first terminal device will communicate or interact with the second terminal device according to the first permission set. In other words, the first terminal device determines whether to agree to the operation request of the second terminal device to the first terminal device based on the first permission set. For example, the second terminal device sends a first request message to the first terminal device, and the first request message is used to request to call the camera of the first terminal device. The first terminal device determines that the second terminal device has the permission to call the camera of the first terminal device based on the first permission set, and the first terminal device agrees to the request of the second terminal device to call the camera.

[0143] 502. The second terminal device detects whether there is a threat.

[0144] In an embodiment of the present application, each terminal device in a distributed multi-terminal scenario will detect whether there is a threat to itself, and identify the type, source, level, credibility, time, etc. of the threat to itself.

[0145] Terminal devices can detect different types of threats in different ways. For example, a terminal device can perform a comprehensive scan on itself to detect whether there are potential threats such as malicious code and system vulnerabilities; for another example, a terminal device can also monitor key nodes of system calls to detect whether there are active threats such as hacker attacks; a terminal device can also perform root detection on itself to detect whether the terminal device has obtained root permissions and whether the root permissions are legally obtained. It should be understood that the embodiments of the present application do not limit the method of detecting whether there are threats.

[0146] In some embodiments, the second terminal device can detect whether there is a root threat in the following way: obtain the real uid or real gid of the application process in the current system call; obtain the real uid or real gid of the application process in the last system call; if the real uid or real gid of the application process in the current system call is zero, and the real uid or real gid of the application process in the last system call is not zero, then it is determined that there is a root threat in the second terminal device.

[0147] 503, the second terminal device sends threat information to the network device, and correspondingly, the network device receives the threat information sent by the second terminal device.

[0148] When the second terminal device detects a threat, the threat information is sent to the network device. The threat information is used to indicate the threat information detected by the second terminal device to the second terminal device. The threat information in S503 can be, for example, Figure 2 Threat information sent by the mobile phone in the illustrated embodiment. The threat information may include the type of threat, threat source, threat level, credibility, threat time, etc. The type of threat may include, for example, root threat, active threat, potential threat, and canned threat, etc.

[0149] Optionally, the second terminal device sends the threat information to the first terminal device.

[0150] S504: The network device determines a second permission set for the second terminal device according to the threat information and the first permission set.

[0151] The second permission set is a set of one or more permissions of the second terminal device. The second permission set can be, for example, Figure 2The controlled permissions of the mobile phone in the illustrated embodiment. Specifically, the network device maintains a mapping relationship between multiple threat types and multiple permission sets. The network device can determine the type of threat detected by the second terminal device based on the threat information, and then determine the third permission set corresponding to the type of threat detected by the second terminal device. The network device then determines the second permission set based on the first permission set and the third permission set. The second permission set is the intersection of the first permission set and the third permission set.

[0152] Compared with the first permission set, at least some permissions of the second permission set are prohibited, that is, the second permission set is a subset of the first permission set, and at least some permissions of the first permission set are not in the second permission set. For example, the first permission set includes the first permission, and the second permission set at least does not include the first permission. The first permission can be, for example, the permission for the second terminal device to access sensitive data, or the permission for the second terminal device to call sensitive applications. Exemplarily, sensitive data refers to data involving personal privacy, encrypted data, etc.; sensitive applications refer to applications involving personal privacy, applications involving property safety, etc.

[0153] In some embodiments, the third permission set corresponding to the type of threat detected by the second terminal device is determined as the second permission set of the second terminal device. That is, the network device may also determine the second permission set of the second terminal device only based on the threat information.

[0154] In some embodiments, the second terminal device detects multiple types of threats, and the second permission set may be an intersection of permission sets corresponding to the multiple types of threats.

[0155] S505, the network device sends a second message to the first terminal device, and correspondingly, the first terminal device receives the second message sent by the network device.

[0156] The second message includes a second permission set of the second terminal device, and the second message is used to instruct the first terminal device to update the permission of the second terminal device according to the second permission set.

[0157] In some embodiments, after the network device receives threat information sent by the second terminal device, the network device sends a fourth message to the second terminal device, the fourth message including the second permission set, and the fourth message is used to instruct the second terminal device to communicate or interact with the first terminal device based on the second permission set to prohibit some permissions of the second terminal device.

[0158] It should be understood that the second message and the fourth message may be the same message.

[0159] S506: The first terminal device updates the permissions of the second terminal device according to the second permission set.

[0160] After receiving the second message, the first terminal device updates the permissions of the second terminal device according to the second permission set. The first terminal device will subsequently communicate or interact with the second terminal device according to the second permission set. In other words, the first terminal device determines whether to agree to the operation request of the second terminal device to the first terminal device according to the second permission set.

[0161] It should be understood that after the first terminal device updates the permissions of the second terminal device according to the second permission set, at least part of the initial permissions of the second terminal device are prohibited.

[0162] In some embodiments, after the first terminal device receives the threat information sent by the second terminal device, the first terminal device may also actively request the network device to update the permissions of the second terminal device, that is, request to disable some permissions of the second terminal device.

[0163] S507: The network device determines a threat repair strategy based on the threat information.

[0164] In an embodiment of the present application, the network device stores a threat repair policy library, which includes multiple threat repair policies. After receiving the threat information sent by the second terminal device, the network device can determine the threat repair policy matching the threat detected by the second terminal device in the threat repair policy library, so that the second terminal device can repair the threat detected by it.

[0165] S508, the network device sends a threat repair strategy to the second terminal device, and correspondingly, the second terminal device receives the threat repair strategy sent by the network device.

[0166] S509: The second terminal device repairs the detected threat according to the threat repair strategy.

[0167] Optionally, the user can manually repair the threat detected by the second terminal device.

[0168] S510, the second terminal device sends threat elimination information to the network device, and correspondingly, the network device receives the threat elimination information sent by the second terminal device.

[0169] Specifically, when the second terminal device determines that the detected threat has been repaired, the second terminal device sends information about removing the threat to the network device, and the information about removing the threat can be used to request restoration of the authority of the second terminal device.

[0170] Optionally, the second terminal device sends information for eliminating the threat to the first terminal device, and correspondingly, the first terminal device receives the information for eliminating the threat sent by the second terminal device.

[0171] S511, the network device sends a third message to the first terminal device, and correspondingly, the first terminal device receives the third message sent by the network device.

[0172] When the network device receives the threat removal message sent by the second terminal device, it determines that the threat detected by the second terminal device has been repaired. The network device sends a third message to the first terminal device to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set. That is, the third message is used to restore the permissions of the second terminal device, that is, to restore the permissions of the second terminal device to the initial permissions.

[0173] In some embodiments, after the network device receives the threat removal message sent by the second terminal device, it determines that the threat detected by the second terminal device has been repaired. The network device sends a third message to the second terminal device, and the third message is used to instruct the second terminal device to communicate or interact with the first terminal device based on the first permission set to restore the permissions of the second terminal device. That is, the second terminal device communicates or interacts with the first terminal device within the scope allowed by the first permission set.

[0174] It should be noted that when the first terminal device updates the permissions of the second terminal device according to the second permission set, the first terminal device may delete the first permission set and save the second permission set. Alternatively, the first terminal device may also retain the first permission set.

[0175] It should be noted that the third message may include the first permission set of the second terminal device, or may not include the first permission set of the second terminal device.

[0176] S512: The first terminal device updates the permissions of the second terminal device according to the first permission set.

[0177] When the first terminal device receives the third message, the first terminal device updates the permissions of the second terminal device according to the first permission set, that is, restores the permissions of the second terminal device to the initial permissions. Subsequently, the first terminal device communicates or interacts with the second terminal device based on the first permission set.

[0178] In some embodiments, when the first terminal device receives the threat removal information sent by the second terminal device and receives the third message sent by the network device, the first terminal device updates the permissions of the second terminal device according to the first permission set. This is conducive to improving the security of the distributed multi-terminal scenario.

[0179] Figure 6 600 is a schematic diagram of the structure of a device provided in an embodiment of the present application. Figure 6 As shown, the device 600 includes a transceiver unit 610 and a processing unit 620 .

[0180] In one possible design, the device 600 can implement steps or processes corresponding to those executed by the first terminal device in the above method embodiment, wherein the transceiver unit 610 is used to execute transceiver-related operations of the first terminal device in the above method embodiment, and the processing unit 620 is used to execute processing-related operations of the first terminal device in the above method embodiment.

[0181] In another possible design, the device 600 can implement steps or processes corresponding to those executed by the second terminal device in the above method embodiment, wherein the transceiver unit 610 is used to execute transceiver-related operations of the second terminal device in the above method embodiment, and the processing unit 620 is used to execute processing-related operations of the second terminal device in the above method embodiment.

[0182] In another possible design, the device 600 can implement steps or processes corresponding to those executed by the network device in the above method embodiment, wherein the transceiver unit 610 is used to execute the transceiver-related operations of the network device in the above method embodiment, and the processing unit 620 is used to execute the processing-related operations of the network device in the above method embodiment.

[0183] It should be understood that the device 600 here is embodied in the form of a functional unit. The term "unit" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 600 can be specifically the transmitting end in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the transmitting end in the above-mentioned method embodiment, or the device 600 can be specifically the receiving end in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the receiving end in the above-mentioned method embodiment. To avoid repetition, it will not be repeated here.

[0184] The device 600 of each of the above schemes has the function of implementing the corresponding steps performed by the sending end in the above method, or the device 600 of each of the above schemes has the function of implementing the corresponding steps performed by the receiving end in the above method. The functions can be implemented by hardware, or by hardware executing corresponding software implementations. The hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0185] In addition, the transceiver unit may also be a transceiver circuit (for example, it may include a receiving circuit and a sending circuit), and the processing unit may be a processing circuit. Figure 6 The device in the embodiment may be a receiving end or a transmitting end of a terminal device or a network device in the foregoing embodiment, or may be a chip or a chip system, for example, a system on chip (SoC). The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor or a microprocessor or an integrated circuit integrated on the chip. This is not limited here.

[0186] Figure 7 is a schematic block diagram of the device 700 provided in the embodiment of the present application. Figure 7 As shown, the device 700 includes a processor 710 and a transceiver 720. The processor 710 and the transceiver 720 communicate with each other through an internal connection path, and the processor 710 is used to execute instructions to control the transceiver 720 to send and / or receive signals.

[0187] Optionally, the device 700 may further include a memory 730, which communicates with the processor 710 and the transceiver 720 via an internal connection path. The memory 730 is used to store instructions, and the processor 710 may execute the instructions stored in the memory 730.

[0188] In a possible implementation, the apparatus 700 is used to implement various processes and steps corresponding to the first terminal device in the above method embodiment.

[0189] In another possible implementation, the apparatus 700 is used to implement various processes and steps corresponding to the second terminal device in the above method embodiment.

[0190] In another possible implementation, the apparatus 700 is used to implement various processes and steps corresponding to the network device in the above method embodiment.

[0191] It should be understood that the device 700 can be specifically the transmitting end or receiving end in the above embodiment, or a chip or a chip system. Correspondingly, the transceiver 720 can be a transceiver circuit of the chip, which is not limited here. Specifically, the device 700 can be used to execute the various steps and / or processes corresponding to the transmitting end or the receiving end in the above method embodiment.

[0192] Optionally, the memory 730 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type. The processor 710 may be used to execute instructions stored in the memory, and when the processor 710 executes instructions stored in the memory, the processor 710 is used to execute the various steps and / or processes of the above-mentioned method embodiment corresponding to the transmitting end or the receiving end.

[0193] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0194] It should be noted that the processor in the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The processor in the embodiment of the present application can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor can be combined to perform. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0195] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0196] An embodiment of the present application also provides a computer-readable storage medium on which are stored computer instructions for implementing the methods executed by a terminal device (such as a first terminal device, or a second terminal device, or a network device) in the above-mentioned method embodiments.

[0197] An embodiment of the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by a terminal device (such as a first terminal device, or a second terminal device, or a network device) in the above-mentioned method embodiments.

[0198] An embodiment of the present application also provides a security protection system, which includes the first terminal device, the second terminal device and the network device in the above embodiments.

[0199] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0200] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0201] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0202] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0203] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0204] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0205] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0206] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A safety protection system, characterized in that: The security protection system includes a first terminal device, a second terminal device and a network device; The second terminal device is used to send a first message, where the first message includes a first permission set of the second terminal device; The network device is used to receive threat information sent by the second terminal device, where the threat information is information about the threat detected by the second terminal device; The first terminal device is used to receive a second message sent by the network device, the second message includes a second permission set for the second terminal device, the second message is used to instruct the first terminal device to update the permissions of the second terminal device according to the second permission set, the first permission set and the second permission set are used to indicate operations that the second terminal device can perform on the first terminal device, the first permission set includes a first permission, and the second permission set at least does not include the first permission.

2. The safety protection system according to claim 1, characterized in that: The first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

3. The safety protection system according to claim 1 or 2, characterized in that: The network device is also used for: The second permission set is determined according to the threat information and the first permission set.

4. The safety protection system according to claim 3, characterized in that: The network device is specifically used for: Determining, according to the threat information, a type of threat detected by the second terminal device; Determine a third permission set corresponding to the type of threat detected by the second terminal device; The second permission set is determined according to the first permission set and the third permission set, where the second permission set is an intersection of the first permission set and the third permission set.

5. The safety protection system according to any one of claims 1 to 4, characterized in that: The second terminal is also used to receive a threat repair strategy sent by the network device, where the threat repair strategy is used to repair the threat detected by the second terminal device.

6. The safety protection system according to any one of claims 1 to 5, characterized in that: The network device is further used to receive a threat-removal message sent by the second terminal device, where the threat-removal message is used to request restoration of the authority of the second terminal device; The first terminal device is further used to receive a third message sent by the network device, where the third message is used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

7. The safety protection system according to any one of claims 1 to 6, characterized in that: The second terminal device is also used for: Get the real user ID or real user group ID of the application process during the current system call; Obtain the real user ID or real user group ID of the application process at the time of the last system call; If the real user id or real user group id of the application process in the current system call is zero, and the real user id or real user group id of the application process in the previous system call is not zero, it is determined that an administrator privilege threat is detected in the second terminal device.

8. A safety protection method, characterized in that: The method is applied to a first terminal device, and the method includes: Receiving a first message sent by a second terminal device, where the first message includes a first permission set of the second terminal device; Receive a second message sent by a network device, where the second message includes a second permission set of the second terminal device, where the second message is used to instruct the first terminal device to update permissions of the second terminal device according to the second permission set, where the first permission set and the second permission set are used to indicate operations that the second terminal device can perform on the first terminal device, where the first permission set includes a first permission, and where the second permission set does not include at least the first permission.

9. The safety protection method according to claim 8, characterized in that: The first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

10. The safety protection method according to claim 8 or 9, characterized in that: The method further comprises: A third message sent by the network device is received, where the third message is used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

11. A safety protection method, characterized in that: The method is applied to a network device, and the method comprises: Receiving a first message sent by a second terminal device, where the first message includes a first permission set of the second terminal device; Receiving threat information sent by the second terminal device, where the threat information is information about the threat detected by the second terminal device; A second message is sent to a first terminal device, where the second message includes a second permission set of the second terminal device, where the second message is used to instruct the first terminal device to update permissions of the second terminal device according to the second permission set, where the first permission set and the second permission set are used to indicate operations that the second terminal device can perform on the first terminal device, where the first permission set includes a first permission, and where the second permission set does not include at least the first permission.

12. The safety protection system according to claim 11, characterized in that: The first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

13. The safety protection method according to claim 11 or 12, characterized in that: The method further comprises: The second permission set is determined according to the threat information and the first permission set.

14. The safety protection method according to claim 13, characterized in that: The method determines the second permission set according to the threat information and the first permission set, including: Determining, according to the threat information, a type of threat detected by the second terminal device; Determine a third permission set corresponding to the type of threat detected by the second terminal device; The second permission set is determined according to the first permission set and the third permission set, where the second permission set is an intersection of the first permission set and the third permission set.

15. The safety protection method according to any one of claims 11 to 14, characterized in that: The method further comprises: Determine a threat repair strategy according to the threat information, where the threat repair strategy is used to repair the threat detected by the second terminal device; Send the threat remediation strategy to the second terminal device.

16. The safety protection method according to any one of claims 11 to 15, characterized in that: The method further comprises: receiving a threat-removal message sent by the second terminal device, where the threat-removal message is used to request permission to return to the second terminal device; A third message is sent to the first terminal device, where the third message is used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

17. A safety protection method, characterized in that: The method is applied to a second terminal device, and the method includes: Sending a first message to a first terminal device and a network device, wherein the first message includes a first permission set of the second terminal device; Sending threat information to a second terminal device and / or a network device, where the threat information is information about the threat detected by the second terminal device; Receive a fourth message sent by a network device, the fourth message including a second permission set of the second terminal device, the fourth message being used to indicate that the second terminal device interacts with the first terminal device based on the second permission set, the first permission set and the second permission set being used to indicate operations that the second terminal device can perform on the first terminal device, the first permission set including a first permission, and the second permission set at least not including the first permission.

18. The safety protection method according to claim 17, characterized in that: The first permission is permission for the second terminal device to access sensitive data of the first terminal device, or the first permission is permission for the second terminal device to call a sensitive application of the first terminal device.

19. The safety protection method according to claim 17 or 18, characterized in that: The method further comprises: Get the real user ID or real user group ID of the application process during the current system call; Obtain the real user ID or real user group ID of the application process at the time of the last system call; If the real user id or real user group id of the application process in the current system call is zero, and the real user id or real user group id of the application process in the previous system call is not zero, it is determined that an administrator privilege threat is detected in the second terminal device.

20. The safety protection method according to any one of claims 17 to 19, characterized in that: The method further comprises: Receive a threat repair strategy sent by the network device, where the threat repair strategy is used to repair the threat detected by the second terminal device.

21. The safety protection method according to any one of claims 17 to 20, characterized in that: The method further comprises: A threat removal message is sent to the network device and / or the first terminal device, where the threat removal message is used to request restoration of authority for the second terminal device.

22. The safety protection method according to any one of claims 17 to 21, characterized in that: The method further comprises: A third message sent by a network device is received, where the third message is used to instruct the second terminal device to interact with the first terminal device based on the first permission set.

Images