System and method for security protection

Abstract

The application provides a security protection system and method, which comprises a first terminal device, a second terminal device and a network device. The second terminal device is configured to send a first message, wherein the first message comprises a first permission set of the second terminal device. The network device is configured to receive threat information sent by the second terminal device, wherein the threat information is information of a threat detected by the second terminal device. The first terminal device is configured to receive a second message sent by the network device, wherein the second message comprises a second permission set of the second terminal device, and the second message is used to instruct the first terminal device to update the permission of the second terminal device according to the second permission set. The first permission set and the second permission set are used to indicate operations that can be performed on the first terminal device by the second terminal device. The first permission set comprises a first permission, and the second permission set does not comprise at least the first permission. Based on the system and method, the security risk in a distributed multi-terminal scenario can be reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the terminal field, and more particularly, to a security protection system and method. BACKGROUND

[0002] In a distributed multi-terminal scenario, attack means on the network and the device are increasingly diversified and complicated, and existing threat detection and repair methods and application scenarios are relatively single. When a terminal device is threatened, the threat cannot be accurately detected and timely intercepted, and the threat is easily spread to other terminal devices. SUMMARY

[0003] The present application provides a security protection system and method

[0004] In a first aspect, a security protection system is provided, comprising a first terminal device, a second terminal device and a network device; the second terminal device is configured to send a first message, the first message comprising a first permission set of the second terminal device; the network device is configured to receive threat information sent by the second terminal device, the threat information being information of a threat detected by the second terminal device; and the first terminal device is configured to receive a second message sent by the network device, the second message comprising a second permission set of the second terminal device, the second message being used to instruct the first terminal device to update the permissions of the second terminal device according to the second permission set, the first permission set and the second permission set being used to indicate operations that the second terminal device can perform on the first terminal device, the first permission set comprising a first permission, and the second permission set not comprising at least the first permission.

[0005] In the embodiments of the present application, after the second terminal device reports the threat information, the network device sends the second message to the first terminal device to instruct the first terminal device to prohibit part of the permissions of the second terminal device, so as to avoid the spread of the threat detected by the second terminal device, and to reduce the security risk in the distributed multi-terminal scenario.

[0006] In combination with the first aspect, in a possible implementation manner, the first permission is a permission of the second terminal device to access sensitive data of the first terminal device, or the first permission is a permission of the second terminal device to call a sensitive application of the first terminal device.

[0007] In the embodiments of the present application, the network device sends the second message to the first terminal device to instruct the first terminal device to prohibit the sensitive permission of the second terminal device, so as to avoid the spread of the threat detected by the second terminal device, and to reduce the security risk in the distributed multi-terminal scenario.

[0008] With reference to the first aspect, in a possible implementation manner, the network device is further configured to determine the second permission set according to the threat information and the first permission set.

[0009] With reference to the first aspect, in a possible implementation manner, the network device is specifically configured to determine a type of the threat detected by the second terminal device according to the threat information; determine a third permission set corresponding to the type of the threat detected by the second terminal device; and determine the second permission set according to the first permission set and the third permission set, the second permission set being an intersection of the first permission set and the third permission set.

[0010] With reference to the first aspect, in a possible implementation manner, the second terminal is further configured to receive a threat repair strategy sent by the network device, the threat repair strategy being used to repair the threat detected by the second terminal device.

[0011] In the embodiments of the present application, the network device sends a threat repair strategy to the second terminal device, and repairs the threat detected by the second terminal device in a timely manner, thereby avoiding the spread of the threat detected by the second terminal device, and being beneficial to reducing the security risk in a distributed multi-terminal scenario.

[0012] With reference to the first aspect, in a possible implementation manner, the network device is further configured to receive a threat removal message sent by the second terminal device, the threat removal message being used to request to restore the permission of the second terminal device; and the first terminal device is further configured to receive a third message sent by the network device, the third message being used to instruct the first terminal device to update the permission of the second terminal device according to the first permission set.

[0013] In the embodiments of the present application, when the threat detected by the second terminal device is repaired, the network device restores the normal communication and interaction of the first terminal device and the second terminal device, which is beneficial to improving the user experience.

[0014] With reference to the first aspect, in a possible implementation manner, the second terminal device is further configured to: obtain a real user id or a real user group id of an application program process at a current system call; obtain a real user id or a real user group id of the application program process at a last system call; and determine that an administrator permission threat exists in the second terminal device if the real user id or the real user group id of the application program process at the current system call is zero and the real user id or the real user group id of the application program process at the last system call is not zero.

[0015] In the embodiments of the present application, the administrator permission threat detection manner is more accurate, the probability of false positives of administrator permissions is reduced, and user experience is improved.

[0016] In a second aspect, a security protection method is provided, which is applied to a first terminal device, and includes: receiving a first message sent by a second terminal device, the first message including a first permission set of the second terminal device; receiving a second message sent by a network device, the second message including a second permission set of the second terminal device, the second message being used to instruct the first terminal device to update permissions of the second terminal device according to the second permission set, the first permission set and the second permission set being used to indicate operations that can be performed on the first terminal device by the second terminal device, and the first permission set including a first permission and the second permission set not including the first permission.

[0017] With reference to the second aspect, in a possible implementation manner, the first permission is a permission of the second terminal device to access sensitive data of the first terminal device, or the first permission is a permission of the second terminal device to call a sensitive application of the first terminal device.

[0018] With reference to the second aspect, in a possible implementation manner, the method further includes: receiving a third message sent by the network device, the third message being used to instruct the first terminal device to update permissions of the second terminal device according to the first permission set.

[0019] In a third aspect, a security protection method is provided, which is applied to a network device, and includes: receiving a first message sent by a second terminal device, the first message including a first permission set of the second terminal device; receiving threat information sent by the second terminal device, the threat information being information of a threat detected by the second terminal device; and sending, to a first terminal device, a second message including a second permission set of the second terminal device, the second message being used to instruct the first terminal device to update permissions of the second terminal device according to the second permission set, the first permission set and the second permission set being used to indicate operations that can be performed on the first terminal device by the second terminal device, the first permission set including a first permission, and the second permission set not including the first permission.

[0020] With reference to the third aspect, in a possible implementation manner, the first permission is a permission of the second terminal device to access sensitive data of the first terminal device, or the first permission is a permission of the second terminal device to call a sensitive application of the first terminal device.

[0021] With reference to the third aspect, in a possible implementation manner, the method further includes: determining the second permission set according to the threat information and the first permission set.

[0022] With reference to the third aspect, in a possible implementation manner, the method of determining the second permission set according to the threat information and the first permission set includes: determining a type of the threat detected by the second terminal device according to the threat information; determining a third permission set corresponding to the type of the threat detected by the second terminal device; and determining the second permission set according to the first permission set and the third permission set, the second permission set being an intersection of the first permission set and the third permission set.

[0023] With reference to the third aspect, in a possible implementation manner, the method further includes: determining a threat repair strategy according to the threat information, the threat repair strategy being used to repair the threat detected by the second terminal device; and sending the threat repair strategy to the second terminal device.

[0024] With reference to the third aspect, in a possible implementation manner, the method further includes: receiving a threat removal message sent by the second terminal device, the threat removal message being used to request to return the permission of the second terminal device; and sending a third message to the first terminal device, the third message being used to instruct the first terminal device to update the permission of the second terminal device according to the first permission set.

[0025] A fourth aspect provides a security protection method, the method being applied to a second terminal device, and the method includes: sending a first message to a first terminal device and a network device, the first message including a first permission set of the second terminal device; sending threat information to the second terminal device and / or the network device, the threat information being information of a threat detected by the second terminal device; and receiving a fourth message sent by the network device, the fourth message including a second permission set of the second terminal device, the fourth message being used to instruct the second terminal device to interact based on the second permission set and the first terminal device, the first permission set and the second permission set being used to indicate operations that can be performed on the first terminal device by the second terminal device, the first permission set including a first permission, and the second permission set not including at least the first permission.

[0026] With reference to the fourth aspect, in a possible implementation manner, the first permission is a permission of the second terminal device to access sensitive data of the first terminal device, or the first permission is a permission of the second terminal device to call a sensitive application of the first terminal device.

[0027] With reference to the fourth aspect, in a possible implementation manner, the method further includes: obtaining a real user id or a real user group id of the application process at a current system call; obtaining a real user id or a real user group id of the application process at a last system call; and determining that the administrator privilege threat exists in the second terminal device if the real user id or the real user group id of the application process at the current system call is zero and the real user id or the real user group id of the application process at the last system call is not zero.

[0028] With reference to the fourth aspect, in a possible implementation manner, the method further includes: receiving a threat repair strategy sent by the network device, the threat repair strategy being used for repairing the threat detected by the second terminal device.

[0029] With reference to the fourth aspect, in a possible implementation manner, the method further includes: sending, to the network device and / or the first terminal device, a threat removal message, the threat removal message being used for requesting to restore the privilege of the second terminal device.

[0030] With reference to the fourth aspect, in a possible implementation manner, the method further includes: receiving a third message sent by the network device, the third message being used for instructing the second terminal device to interact based on the first privilege set and the first terminal device.

[0031] A fifth aspect provides a computer-readable storage medium, including computer instructions, when the computer instructions are run on an electronic device, causing the electronic device to execute the method in the second aspect and any possible implementation manner of the second aspect, or execute the method in the third aspect and any possible implementation manner of the third aspect, or execute the method in the fourth aspect and any possible implementation manner of the fourth aspect.

[0032] A sixth aspect provides a computer program product, including computer program codes, when the computer program codes are run, realizing that the electronic device executes the method in the second aspect and any possible implementation manner of the second aspect, or executes the method in the third aspect and any possible implementation manner of the third aspect, or executes the method in the fourth aspect and any possible implementation manner of the fourth aspect.

[0033] In a seventh aspect, an electronic device is provided. The electronic device includes a module / unit for performing the method in the second aspect and any possible implementation of the second aspect, or performing the method in the third aspect and any possible implementation of the third aspect, or performing the method in the fourth aspect and any possible implementation of the fourth aspect. The module / unit can be implemented in hardware, or in software executed by hardware. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 is a schematic diagram of an application scenario provided by an embodiment of the present application.

[0035] Figure 2 is a schematic diagram of a security protection system provided by an embodiment of the present application.

[0036] Figure 3 is a schematic flowchart of detecting an administrator privilege threat provided by an embodiment of the present application.

[0037] Figure 4 is a schematic diagram of a system architecture provided by an embodiment of the present application.

[0038] Figure 5 is a schematic flowchart of a security protection method provided by an embodiment of the present application.

[0039] Figure 6 is a structural schematic diagram of an apparatus provided by an embodiment of the present application.

[0040] Figure 7 is a schematic block diagram of an apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0041] The terms used in the following embodiments are only for the purpose of describing particular embodiments and are not intended to be limiting of the present application. As used in the specification and the appended claims, the singular forms "a," "an" and "the" are intended to include both singular and plural forms, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. As used herein, the term "plurality" means two or more.

[0042] Reference within this specification to "one embodiment" or "an embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" within this specification do not necessarily refer to the same embodiment, although it can. The terms "including," "comprising," "having" and variations thereof herein are meant to be open-ended terms that can cover the presence of one or more of the specified features, structures, or characteristics, but do not exclude the presence of others. The terms "a" and "an" and "the" and similar referents in the context of this specification are to be construed to be inclusive, rather than exclusive. Only the transitional phrases "consisting of and "consisting essentially of are to be construed as being closed terms, unless in particular context it is clear that those terms mean something different.

[0043] The technical solutions in the application will be described below with reference to the drawings.

[0044] Figure 1 is a schematic diagram of an application scenario provided by an embodiment of the application. The method for security protection provided by the embodiment of the application can be applied to a distributed terminal scenario. In a distributed multi-terminal scenario, multiple terminal devices accessing the same distributed network or logging in the same account can have a communication connection, and each terminal device can access the services provided by other terminal devices, use the capabilities of other terminal devices, and the like, thereby providing rich and smooth full-scene experience for a user. For example, Figure 1 The first terminal device, the second terminal device, and the third terminal device in can access the same distributed network or log in the same account to form a distributed multi-terminal scenario. In the distributed multi-terminal scenario, the first terminal device can access and play a video stored in the second terminal device, and call the microphone and camera of the third terminal device, for example.

[0045] The terminal device in the embodiment of the application can be a mobile phone, a tablet, a headset, a personal computer (PC), a smart screen, a car machine, a sound box, a watch, glasses, and the like, which is not limited in the embodiment of the application.

[0046] To facilitate the management of the distributed multi-terminal scenario, the permission of each terminal device in the distributed multi-terminal scenario needs to be set. The permission of each terminal device can include any one or more of the following: calling the location information of other terminal devices, calling the camera of other terminal devices, calling the microphone of other terminal devices, accessing the media and files of other terminal devices, and the like. For example, Table 1 shows Figure 1The permissions of the first terminal device are shown in Table 1, where "1" indicates that the first terminal device has the corresponding permission, and "0" indicates that the first terminal device does not have the corresponding permission. As shown in Table 1, the first terminal device has the permission to call, access, or obtain the location information, camera, media, and files of the second terminal device; the first terminal device may also have the permission to call, access, or obtain the location information and microphone of the third terminal device.

[0047] Table 1. Permissions of the First Terminal Device

[0048] Second terminal device Third terminal device Location information 1 1 Camera 1 0 Microphone 0 1 Accessing media and files 1 0

[0049] It should be understood that the permissions of a terminal device are used to control communication or interaction between that terminal device and other terminal devices. That is, a terminal device can communicate or interact with other terminal devices within the scope of its permissions. For example, if a smartwatch's permissions include access to the phone's photos, the phone will agree to the smartwatch's request to access the phone's photos. Similarly, if a smartwatch's permissions include access to the phone's microphone, the phone will agree to the smartwatch's request to access the phone's microphone.

[0050] like Figure 1 As shown, the first terminal device, the second terminal device, and the third terminal device can also have a communication connection with the network device, which is used to manage the permissions of each distributed terminal. Specifically, the network device can store the permissions of each distributed terminal, and the network device can set or change the permissions of each distributed terminal.

[0051] It should be noted that the network device in this application embodiment can be a server located in the cloud, or a distributed terminal connected to the same distributed network or logged into the same account. This application does not limit it in this way.

[0052] In distributed, multi-terminal scenarios, attack methods on terminal devices are becoming increasingly diverse and complex. Existing threat detection and remediation methods, however, have limited application scenarios, and many detection methods are inefficient with high false positive rates. When a terminal device is attacked and threatened, the inability to accurately detect and promptly intercept threats can easily lead to their spread to other terminal devices. Furthermore, the lack of effective threat remediation strategies means that threats cannot be addressed in a timely manner when a terminal is attacked. For example, after the first terminal device is attacked, an attacker might exploit its privileges to access services on second and third terminal devices, thus compromising the security of distributed, multi-terminal scenarios.

[0053] Figure 2 This is a schematic diagram of a security protection system provided in an embodiment of this application. For ease of understanding, Figure 2 This explanation will use smartwatches, mobile phones, and in-vehicle systems as examples. It should be understood that...Figure 2 The mobile phone, the smart watch and the car machine in the system can be any terminal device, and the mobile phone, the smart watch and the car machine are only used as an example and should not constitute any limitation on the present application. Figure 2 As shown in FIG. 1, each device in the system performs the following steps:

[0054] S201a, the smart watch sends the initial permission of the smart watch to the network device.

[0055] S201b, the smart watch sends the initial permission of the smart watch to other terminal devices.

[0056] In the embodiments of the present application, when a terminal device accesses a distributed network, the initial permission of the terminal device needs to be sent to other terminal devices in the distributed network. The initial permission of the terminal device is the default or user-pre-set permission of the terminal device in the distributed multi-terminal scenario.

[0057] Optionally, the smart watch only sends the initial permission of the smart watch to the network device, and the network device forwards the initial permission of the smart watch to other terminal devices. Here, the other terminal devices refer to terminal devices other than the smart watch, such as a mobile phone and a car machine.

[0058] In some embodiments, the initial permission of the smart watch is different for different terminal devices. For example, the initial permission of the smart watch to the mobile phone is different from the initial permission of the smart watch to the car machine. The smart watch can send the initial permission of the smart watch to the mobile phone, and the smart watch can send the initial permission of the smart watch to the car machine.

[0059] In another example, the smart watch sends a first message to the network device, the car machine and the mobile phone, and the first message includes the initial permission of the smart watch to the mobile phone and the initial permission of the smart watch to the car machine.

[0060] In some embodiments, when a terminal device accesses a distributed network, other terminal devices in the distributed network need to send their own permissions to the terminal device respectively. For example, when the smart watch accesses a distributed network, the car machine sends the permission of the car machine to the smart watch to the smart watch, and the mobile phone sends the permission of the mobile phone to the smart watch to the smart watch.

[0061] It should be noted that the permission of the terminal device in the present application refers to the permission of the terminal device to other terminal devices, i.e., which applications of other terminal devices can be invoked by the terminal device, or which information of other terminal devices can be obtained by the terminal device.

[0062] In some embodiments, when a terminal device accesses a distributed network, the network device sends the permission of other terminal devices to the terminal device to the terminal device.

[0063] In some embodiments, each terminal device stores the permissions of other terminal devices. Table 2 is an example of the permissions of other terminal devices stored by the mobile phone. As shown in Table 2, the mobile phone stores the permissions of the car machine and the smart watch. The permissions of the car machine include the permissions of calling the location information, the microphone, the media and files, and the camera of the mobile phone; and the permissions of the smart watch include the permissions of calling the location information and the media and files of the mobile phone.

[0064] Table 2: Permission information of other terminal devices

[0065] Car kit Smart watch Location information 1 1 Camera 1 0 Microphone 1 0 Media and files 1 1

[0066] In the embodiments of the present application, each terminal device stores the permissions of other terminal devices, and two terminal devices can communicate or interact according to the respective permissions. For example, the first terminal device determines whether to agree to the request of the second terminal device for calling the camera according to the permissions of the second terminal device; and the second terminal device determines whether to agree to the request of the first terminal device for calling the camera according to the permissions of the first terminal device. For example, when the mobile phone receives the request of the smart watch for calling the microphone, the mobile phone determines that the smart watch does not have the permission of calling the microphone according to the permissions of the smart watch in Table 2, and then the mobile phone will refuse the request of the smart watch for calling the microphone.

[0067] In some embodiments, when the mobile phone receives the request of the smart watch for calling the microphone, the mobile phone determines that the smart watch does not have the permission of calling the microphone according to the permission information of the smart watch in Table 2, and then the mobile phone will display a prompt interface for prompting the user to determine whether to agree to the request of the smart watch for calling the microphone.

[0068] In some embodiments, when the mobile phone receives the request of the smart watch for calling the microphone, the mobile phone determines that the smart watch does not have the permission of calling the microphone according to the permission information of the smart watch in Table 2, and then the mobile phone will display a prompt interface for prompting the user to determine whether to agree to the request of the smart watch for calling the microphone. At this time, if the user selects to agree to the request of the smart watch for calling the microphone, the mobile phone updates the permissions of the smart watch stored by itself, that is, adds the permission of calling the microphone to the smart watch.

[0069] S202, the mobile phone detects a threat to itself.

[0070] The threat refers to an environment or event that can cause potential harm to a system through unauthorized access, destruction, disclosure, data modification or denial of service, and specifically refers to the potential possibility of a specific threat source exploiting a specific vulnerability (vulnerability).

[0071] In the embodiments of the present application, the threat may include a potential threat, an active threat, a root threat, a packed threat, etc. The potential threat refers to a behavior that may have a risk, such as AT authentication success, USB connection, system vulnerability, etc.

[0072] The active threat may refer to a behavior of attacking the terminal device, such as illegal user state memory copy, instruction stream exception, illegal kernel module, process hijacking, kernel integrity destruction, security OS threat, memory repeated release, fastboot image writing; the root threat refers to that the terminal device has illegally obtained the administrator (root) permission, such as process privilege escalation, fastboot unlocking, user unlock code unlocking, detection of su file, image writable, kernel code segment destruction, kcode-syscall system call table destruction, detection of root process, etc.; the packed threat refers to that an attacker implants malicious code in software or an application, and then packs it into an installation package or an application that appears to be normal, to deceive users to download and install. Once the user installs the application, the attacker can obtain sensitive information of the user or control the device of the user. For example, the packed threat may include startup verification failure, image verification off, key file tampering, startup verification abnormal state, system integrity destruction, etc.

[0073] In the embodiments of the present application, each distributed terminal needs to monitor itself in real time to detect whether there is a threat to itself. The manner of detecting the threat is not limited in the present application, for example, the terminal device may comprehensively scan itself, or monitor at a key node of system call.

[0074] S203a, the mobile phone sends the threat information to the network device.

[0075] In the embodiments of the present application, when the terminal device detects that it is threatened, the terminal device reports the threat information to the network device, and the threat information refers to the information of the threat to the mobile phone detected by the mobile phone. The threat information may include the type of threat, the source of threat, the level of threat, the credibility, the time of threat, etc. The type of threat includes a potential threat, an active threat, a root threat, and a packed threat, etc.

[0076] S203b, the mobile phone sends the threat information to other terminal devices.

[0077] In the embodiments of the present application, the mobile phone may send the threat information to other terminal devices, or only send the threat information to the network device. It should be understood that S203b is an optional step.

[0078] S204, the car machine receives the threat information sent by the mobile phone, and forwards the threat information to the network device.

[0079] It should be understood that S204 is an optional step.

[0080] Optionally, when the head unit receives the threat information sent by the mobile phone, the head unit actively requests the network device to update the permissions of the mobile phone, i.e., requests the network device to limit part or all of the permissions of the mobile phone.

[0081] S205a, the network device sends the controlled permissions of the mobile phone to the head unit, and correspondingly, the head unit receives the controlled permissions of the mobile phone sent by the network device.

[0082] Since the network device receives the threat information reported by the mobile phone, the network device can downgrade the permissions of the mobile phone according to the threat information. Specifically, the network device determines the controlled permissions of the mobile phone according to the threat information. The network device can determine the controlled permissions of the mobile phone according to the frequency of the mobile phone reporting the threat information, the threat level, the credibility of the threat, etc., and send the controlled permissions of the mobile phone to the head unit. The range of the controlled permissions of the mobile phone is smaller than the range of the initial permissions of the mobile phone. For example, the initial permissions of the mobile phone include 10 permissions, and the controlled permissions of the mobile phone include 6 permissions.

[0083] Generally, when the network device receives the threat information reported by the terminal device, the network device will remove the permissions of the mobile phone to access sensitive data and to call sensitive applications. Specifically, the network device will prohibit the terminal device from calling sensitive applications of other terminal devices, such as high-security-level applications, such as payment applications, applications containing personal privacy data, etc., and / or prohibit the terminal device from accessing sensitive data of other terminal devices, such as privacy data, encrypted data, etc.

[0084] In one example, the mobile phone detects multiple types of threats, and each type of threat corresponds to a different set of permissions. Table 3 shows the mapping relationship between multiple types of threats and multiple sets of permissions. As shown in Table 3, each type of threat corresponds to a set of permissions, and each set of permissions includes multiple permissions. For example, the root threat corresponds to a set of permissions including the permission to call the calendar and the permission to create a desktop shortcut. The network device can save the mapping relationship between multiple types of threats and multiple sets of permissions. Thus, the network device can determine the type of threat according to the threat information, and then determine the set of permissions corresponding to the type of threat, i.e., determine the controlled permissions of the mobile phone.

[0085] Table 3

[0086]

[0087] It should be understood that the mapping relationship between multiple types of threats and multiple sets of permissions shown in Table 3 can be pre-set by a technician or be default.

[0088] In some embodiments, a different set of permissions corresponds to each possible threat that can be detected.

[0089] In another example, Table 4 shows the initial permissions of the mobile phone, which is a set of permissions composed of multiple permissions. When the network device determines the permissions of the mobile phone to be controlled, the type of threat is determined according to the threat information, the set of permissions corresponding to the type of threat is determined, and then the intersection of the set of permissions corresponding to the type of threat and the initial set of permissions is taken as the permissions of the mobile phone to be controlled.

[0090] Table 4

[0091]

[0092] It can be understood that the number of initial permissions of the mobile phone is greater than the number of permissions corresponding to any type of threat.

[0093] In the embodiments of the present application, the car machine updates the initial permissions of the mobile phone to the permissions of the mobile phone to be controlled after receiving the permissions of the mobile phone to be controlled. The car machine communicates or interacts with the mobile phone according to the permissions of the mobile phone to be controlled. In this way, the threat of the terminal device that detects the threat will not spread to other terminal devices, thereby facilitating the reduction of security risks in a distributed multi-terminal scenario.

[0094] S205b, the network device repairs the threat of the mobile phone through a repair strategy.

[0095] In the embodiments of the present application, the network device can be provided with a threat repair strategy library for storing multiple threat repair strategies. The network device can select a suitable threat repair strategy from the threat repair strategy library according to the threat information, and send the threat repair strategy to the mobile phone. The mobile phone can repair the detected threat according to the threat repair strategy to remove the threat detected by the mobile phone. For example, the threat detected by the mobile phone is sending malicious code, and the threat repair strategy can be isolating or deleting the malicious code. After the mobile phone isolates or deletes the malicious code, the threat is repaired.

[0096] Optionally, the user can manually repair and remove the threat suffered by the mobile phone.

[0097] S206, the car machine communicates or interacts with the mobile phone according to the permissions of the mobile phone to be controlled.

[0098] For example, when receiving a request of the mobile phone to access photos, the car machine determines that the mobile phone does not have the permission to access photos according to the permissions of the mobile phone to be controlled, and then the car machine rejects the request of the mobile phone to access photos.

[0099] S207, the mobile phone removes the threat.

[0100] Specifically, after the threat is repaired, the mobile phone can detect the threat again, and if no threat is detected, it is confirmed that the threat has been removed.

[0101] S208, the mobile phone reports information about removal of the threat.

[0102] The mobile phone sends information about removal of the threat to the network device and other terminal devices, and the information about removal of the threat is used to indicate that the threat detected by the mobile phone has been repaired.

[0103] In some embodiments, the information about removal of the threat is used to instruct the other terminal devices and / or the network device to restore the initial permission of the mobile phone.

[0104] S209, the network device restores the permission of the mobile phone.

[0105] Specifically, the network device sends the initial permission of the mobile phone to the other terminal devices, and the other terminal devices update the permission of the mobile phone to the initial permission of the mobile phone. Subsequently, the mobile phone and the other terminal devices communicate or interact according to the initial permission of the mobile phone.

[0106] In some embodiments, after the other terminal devices receive the information about removal of the threat, the other terminal devices update the permission of the mobile phone to the initial permission of the mobile phone.

[0107] In some embodiments, after the other terminal devices receive the initial permission of the mobile phone sent by the network device and the information about removal of the threat sent by the mobile phone, the other terminal devices update the permission of the mobile phone to the initial permission of the mobile phone.

[0108] Figure 3 is a schematic flowchart of detection of a root threat provided by an embodiment of the present application. The following describes the steps of detection of a root threat by an embodiment of the present application. Figure 3 The following describes the steps of detection of a root threat by an embodiment of the present application.

[0109] In the embodiment of the present application, the terminal device can detect different types of threats in different ways. For example, the terminal device can perform a comprehensive scan on itself to detect whether there is a potential threat such as malicious code or system vulnerability; for another example, the terminal device can also monitor at a key node of a system call to detect whether there is an active threat such as hacking attack; the terminal device can also perform root threat detection on itself to detect whether the terminal device has acquired root permission and whether the root permission is acquired legally.

[0110] For the convenience of understanding, the root permission is described below. The root permission is the highest permission, also known as super permission or administrator permission. In a system, each file, directory and process belongs to a user, and no user can operate without the permission of another user, but the user with root permission is an exception. If a terminal device is rooted, it will give the attacker a very large autonomous operation right, allowing the attacker to delete system applications of the terminal device, view and modify program running information, etc., greatly increasing the security risk of the terminal device. In a distributed multi-terminal scenario, if a terminal device is rooted, the entire distributed network may be at risk.

[0111] Generally, we can detect the su file to determine whether the terminal device is rooted. For example, if the terminal device has an su file, the terminal device is rooted; if the terminal device does not have an su file, the terminal device is not rooted.

[0112] In addition, we can also determine whether the terminal device is rooted when the system is called. When the system is called, the system kernel needs to obtain the user id (user id, uid) or user group id (group id, gid) of the application process to determine the permission of the application process and determine whether to allow the operation of the application process. For example, when the application process tries to write a file, the system kernel will check the uid or gid of the application process to determine whether the application process has sufficient permission to modify the file. Generally, if the uid / gid is zero, the application process has root permission, and the terminal device is rooted; otherwise, the application process does not have root permission, and the terminal device is not rooted.

[0113] In some embodiments, the application process runs in a container, and the permissions of the application process inside and outside the container are different, for example, the application process has root permission inside the container, and does not have root permission outside the container. At this time, if the application process makes a system call, the system kernel may recognize that the uid or gid of the application process inside the container is zero, which may cause the terminal device to falsely detect a root threat.

[0114] In this embodiment, the step of detecting a root threat includes:

[0115] S310, determining whether the real uid / gid of the application process at the current system call is zero.

[0116] S320, determining whether the real uid / gid of the application process at the last system call is zero.

[0117] If the real uid / gid of the application process at the current system call is not zero, step S350 is performed; if the real uid / gid of the application process at the current system call is zero and the real uid / gid of the application process at the last system call is zero, step S330 is performed; if the real uid / gid of the application process at the current system call is zero and the real uid / gid of the application process at the last system call is not zero, step S340 is performed.

[0118] S330, determining that the terminal device is rooted, but no root threat is detected.

[0119] S340, determining that the terminal device is rooted, and a root threat is detected.

[0120] Optionally, the terminal device sends threat information to the network device and other terminal devices, where the threat information indicates information of the detected root threat.

[0121] S350, determining that the terminal device is not rooted, and no root threat is detected.

[0122] The real uid (real_uid) or real gid (real_gid) of an application process is the user id or user group id of the application process. If the application process is created by another application process, the real uid / gid of the application process is the id or user group id of the other application process. The real uid / gid of the application process can also refer to the real uid / gid of the application process mapped outside the container. For example, if 5000 uids are mapped to the container when the container is set, that is, the range (100000-104999) starting from uid 100000 outside the container is mapped to the range (0-4999) starting from uid 0 inside the container. If a process inside the container runs with uid 1, the real uid of the process mapped outside the container (on the terminal device) is 100001. Even if the uid of the process inside the container is zero, it only means that the process has root permission inside the container, but does not have root permission outside the container.

[0123] If the real uid / gid of the application process at the current system call and at the last system call are both zero, that is, the application process has root permission at the current system call and at the last system call, it is determined that the terminal device has been rooted. However, since the application process has root permission at the last system call, it is determined that the application process does not have an unauthorized behavior, and it is considered that the terminal device does not detect a root threat.

[0124] If the real uid / gid of the application process at the current system call is zero, but the real uid / gid of the application at the last system call is not zero, that is, the application process has root authority at the current system call, and the application process does not have root authority at the last system call, it is determined that the terminal device is currently rooted, and it is determined that the application process has an overreach behavior, and the terminal device is considered to detect a root threat.

[0125] If the real uid / gid of the application process at the current system call is not zero, it is determined that the application process does not have root authority at the current system call, and the terminal device is not currently rooted, that is, no root threat is detected.

[0126] In one example, at the current system call, the real uid / gid of the application process is obtained through the from_kuid_munged and from_kgid_munged functions. Specifically, the real uid of the application process at the current system call is obtained through the function from_kuid_munged (& init_user_ns, new->uid), and / or the real gid of the application process at the current system call is obtained through the function from_kgid_munged (& init_user_ns, new->gid); the real uid of the application process at the current system call is obtained through the function from_kuid_munged (& init_user_ns, old->uid), and / or the real gid of the application process at the last system call is obtained through the function from_kgid_munged (& init_user_ns, old->gid).

[0127] It should be understood that for any application process in the terminal device that performs a system call, the above determination is performed to determine whether the terminal device has a root threat.

[0128] It should be understood that if the real uid or the real gid of the application process is zero, it can be determined that the application process has root authority.

[0129] It should be noted that according to the root threat detection method, if the uid of the terminal device is set to zero twice in the su file, the terminal device will not detect a root threat.

[0130] Figure 4 is a schematic diagram of the system architecture provided by the embodiments of the present application. As shown in Figure 4As shown, in the distributed multi-terminal scenario, each terminal device includes a threat detection module for detecting whether a threat exists in the terminal device, identifying the type of threat, the source of the threat, the threat level, the credibility, the threat time, and the like. When detecting that a threat exists in the terminal device, the threat detection module can also send threat information to a network device and / or other terminal devices.

[0131] The network device includes a permission control module and a threat repair module. The permission control module is configured to determine the controlled permission of the terminal device according to the threat information. For example, the permission control module can determine the type of threat according to the threat information, determine the permission set corresponding to the type of threat, and send the permission set corresponding to the type of threat as the controlled permission of the terminal device to the terminal device and other terminal devices in the distributed network. The permission control module can also save the initial permissions of all terminal devices in the distributed network, so as to restore the initial permissions of the terminal device after the terminal device is removed from the threat.

[0132] The threat repair module stores a threat repair strategy library, which includes repair strategies for different threats. Each threat corresponds to a different threat repair strategy. When receiving the threat information, the threat repair strategy library is selected according to the threat information, and the threat repair strategy is sent to the terminal device sending the threat information, so as to automatically repair the threat of the terminal device.

[0133] Figure 5 is a schematic flowchart of a security protection method provided by an embodiment of the present application. The security protection method is applied to a distributed multi-terminal scenario, which can include a first terminal device, a second terminal device, and a network device. It should be understood that the distributed multi-terminal scenario can also include more terminal devices, and here only the first terminal device and the second terminal device are taken as examples for description.

[0134] As shown, Figure 5 The security protection method includes:

[0135] 501a, the second terminal device sends a first message to the first terminal device, and correspondingly, the second terminal device receives the first message sent by the first terminal device.

[0136] 502b, the second terminal device sends a second message to the first terminal device, and correspondingly, the network device receives the first message sent by the first terminal device.

[0137] The first message includes a first permission set of the second terminal device, and the first permission set is composed of one or more permissions of the second terminal device. The first permission set of the second terminal device is the initial permission of the second terminal device. The first permission set can be in the form shown in Table 1 or in the form shown in Table 4, and the embodiments of the present application do not limit this.

[0138] It should be understood that the first permission set indicates operations that the second terminal device can perform on the first terminal device. For example, the second terminal device can perform the following operations on the first terminal device: obtaining location information, calendar, call record and other information of the first terminal device, the second terminal device can call the camera and microphone of the first terminal device, the second terminal device can install an application on the first terminal device and create a desktop shortcut.

[0139] In some embodiments, the second terminal device sends the first message to the network device, and the first message includes the first permission set of the second terminal device.

[0140] In some embodiments, the first terminal device and / or the network device saves the first permission set of the second terminal device.

[0141] In some embodiments, the first permission set can also indicate operations of the second terminal device on a third terminal device, that is, the first permission set includes permissions of the second terminal device on the first terminal device and permissions of the second terminal device on the third terminal device. After receiving the first message, the first terminal device extracts and saves the permissions of the second terminal device on the first terminal device from the first permission set.

[0142] In some embodiments, if the second terminal device does not detect a threat, that is, the second terminal device does not report threat information, the first terminal device updates the permissions of the second terminal device according to the first permission set. The first terminal device will communicate or interact with the second terminal device according to the first permission set. That is, the first terminal device determines whether to agree to the operation request of the second terminal device on the first terminal device according to the first permission set. For example, the second terminal device sends a first request message to the first terminal device, and the first request message is used to request to call the camera of the first terminal device. The first terminal device determines that the second terminal device has the permission to call the camera of the first terminal device according to the first permission set, and then the first terminal device agrees to the request of the second terminal device to call the camera.

[0143] 502, the second terminal device detects whether there is a threat.

[0144] In the embodiments of the present application, each terminal device in the distributed multi-terminal scenario detects whether there is a threat, identifies the type, source, level, credibility and time of the threat of the threat existing in the terminal device.

[0145] The terminal device can detect different types of threats in different ways. For example, the terminal device can perform a comprehensive scan on itself to detect potential threats such as malicious code, system vulnerabilities, etc.; for another example, the terminal device can also monitor at key nodes of system calls to detect active threats such as hacking attacks; the terminal device can also perform root detection on itself to detect whether the terminal device has acquired root permission and whether the root permission is acquired legally. It should be understood that the embodiments of the present application do not limit the way of detecting whether a threat exists.

[0146] In some embodiments, the second terminal device can detect whether a root threat exists by: obtaining a real uid or a real gid of the application process at the current system call; obtaining a real uid or a real gid of the application process at the last system call; if the real uid or the real gid of the application process at the current system call is zero and the real uid or the real gid of the application process at the last system call is not zero, it is determined that the second terminal device has a root threat.

[0147] 503, the second terminal device sends threat information to the network device, and correspondingly, the network device receives the threat information sent by the second terminal device.

[0148] When the second terminal device detects a threat, the second terminal device sends information of the threat to the network device. The threat information is used to indicate information of the threat detected by the second terminal device. The threat information in S503 may, for example, be the threat information sent by the mobile phone in the embodiment shown in FIG. 5. The threat information may, for example, include a type of threat, a source of threat, a threat level, a credibility, a threat time, etc. The type of threat may, for example, include a root threat, an active threat, a potential threat, and a canned threat, etc. Figure 2

[0149] Optionally, the second terminal device sends the threat information to the first terminal device.

[0150] S504, the network device determines a second permission set of the second terminal device according to the threat information and the first permission set.

[0151] The second permission set is a set composed of one or more permissions of the second terminal device. The second permission set may, for example, be the second permission set shown in FIG. 6. Figure 2 ​The managed permissions of the mobile phone in the illustrated embodiment. Specifically, the network device maintains a mapping relationship between a plurality of threat types and a plurality of permission sets. The network device can determine the type of threat detected by the second terminal device according to the threat information, and then determine the third permission set corresponding to the type of threat detected by the second terminal device. The network device determines the second permission set according to the first permission set and the third permission set. The second permission set is the intersection of the first permission set and the third permission set.

[0152] The second permission set has at least some permissions prohibited relative to the first permission set, that is, the second permission set is a subset of the first permission set, and the first permission set has at least some permissions not in the second permission set. For example, the first permission set includes a first permission, and the second permission set does not include at least the first permission. The first permission may, for example, be the permission of the second terminal device to access sensitive data, or the permission of the second terminal device to call a sensitive application. Illustratively, the sensitive data is data related to personal privacy, encrypted data, etc.; the sensitive application is an application related to personal privacy, an application related to property security, etc.

[0153] In some embodiments, the third permission set corresponding to the type of threat detected by the second terminal device is determined as the second permission set of the second terminal device. That is, the network device can also determine the second permission set of the second terminal device only according to the threat information.

[0154] In some embodiments, the second terminal device detects a plurality of types of threats, and the second permission set can be the intersection of the permission sets corresponding to the plurality of types of threats.

[0155] S505, the network device sends a second message to the first terminal device, and correspondingly, the first terminal device receives the second message sent by the network device.

[0156] The second message includes the second permission set of the second terminal device, and the second message is used to instruct the first terminal device to update the permissions of the second terminal device according to the second permission set.

[0157] In some embodiments, when the network device receives the threat information sent by the second terminal device, the network device sends a fourth message to the second terminal device, the fourth message includes the second permission set, and the fourth message is used to instruct the second terminal device to communicate or interact with the first terminal device based on the second permission set, to prohibit part of the permissions of the second terminal device.

[0158] It should be understood that the second message and the fourth message can be the same message.

[0159] S506, the first terminal device updates the permissions of the second terminal device according to the second permission set.

[0160] After the first terminal device receives the second message, the first terminal device updates the permissions of the second terminal device according to the second permission set. The first terminal device will subsequently communicate or interact with the second terminal device according to the second permission set. That is, the first terminal device determines whether to agree to the operation request of the second terminal device to the first terminal device according to the second permission set.

[0161] It should be understood that after the first terminal device updates the permissions of the second terminal device according to the second permission set, at least part of the initial permissions of the second terminal device are prohibited.

[0162] In some embodiments, after the first terminal device receives the threat information sent by the second terminal device, the first terminal device can also actively request the network device to update the permissions of the second terminal device, that is, to request to prohibit part of the permissions of the second terminal device.

[0163] S507, the network device determines a threat repair strategy according to the threat information.

[0164] In the embodiments of the present application, the network device stores a threat repair strategy library, and the threat repair strategy library includes a plurality of threat repair strategies. When receiving the threat information sent by the second terminal device, the network device can determine a threat repair strategy matched with the threat detected by the second terminal device in the threat repair strategy library, so as to repair the threat detected by the second terminal device.

[0165] S508, the network device sends the threat repair strategy to the second terminal device, and correspondingly, the second terminal device receives the threat repair strategy sent by the network device.

[0166] S509, the second terminal device repairs the detected threat according to the threat repair strategy.

[0167] Optionally, the user can manually repair the threat detected by the second terminal device.

[0168] S510, the second terminal device sends information about removing the threat to the network device, and correspondingly, the network device receives the information about removing the threat sent by the second terminal device.

[0169] Specifically, when the second terminal device determines that the detected threat has been repaired, the second terminal device sends information about removing the threat to the network device, and the information about removing the threat can be used to request to restore the permissions of the second terminal device.

[0170] Optionally, the second terminal device sends the information about removing the threat to the first terminal device, and correspondingly, the first terminal device receives the information about removing the threat sent by the second terminal device.

[0171] S511, the network device sends a third message to the first terminal device, and the first terminal device receives the third message sent by the network device.

[0172] When the network device receives the threat removal message sent by the second terminal device, it is determined that the threat detected by the second terminal device has been repaired. The network device sends a third message to the first terminal device, which is used to instruct the first terminal device to update the permissions of the second terminal device according to the first set of permissions. That is, the third message is used to restore the permissions of the second terminal device, that is, to restore the permissions of the second terminal device to the initial permissions.

[0173] In some embodiments, when the network device receives the threat removal message sent by the second terminal device, it is determined that the threat detected by the second terminal device has been repaired. The network device sends a third message to the second terminal device, and the third message is used to instruct the second terminal device to communicate or interact with the first terminal device based on the first set of permissions to restore the permissions of the second terminal device. That is, the second terminal device communicates or interacts with the first terminal device within the range allowed by the first set of permissions.

[0174] It should be noted that when the first terminal device updates the permissions of the second terminal device according to the second set of permissions, the first terminal device can delete the first set of permissions and save the second set of permissions. Alternatively, the first terminal device can also retain the first set of permissions.

[0175] It should be noted that the third message can include the first set of permissions of the second terminal device, or can not include the first set of permissions of the second terminal device.

[0176] S512, the first terminal device updates the permissions of the second terminal device according to the first set of permissions.

[0177] When the first terminal device receives the third message, the first terminal device updates the permissions of the second terminal device according to the first set of permissions, that is, restores the permissions of the second terminal device to the initial permissions. Subsequently, the first terminal device communicates or interacts with the second terminal device based on the first set of permissions.

[0178] In some embodiments, when the first terminal device receives the threat removal information sent by the second terminal device and receives the third message sent by the network device, the first terminal device updates the permissions of the second terminal device according to the first set of permissions. In this way, it is beneficial to improve the security of the distributed multi-terminal scenario.

[0179] Figure 6 is a structural schematic diagram of an apparatus 600 provided by an embodiment of the present application. As shown in Figure 6 The apparatus 600 includes a transceiver unit 610 and a processing unit 620.

[0180] In one possible design, the apparatus 600 can implement steps or procedures performed by a first terminal device in the above-described method embodiments, where the transceiver 610 is configured to perform the transceiving-related operations of the first terminal device in the above-described method embodiments, and the processor 620 is configured to perform the processing-related operations of the first terminal device in the above-described method embodiments.

[0181] In another possible design, the apparatus 600 can implement steps or procedures performed by a second terminal device in the above-described method embodiments, where the transceiver 610 is configured to perform the transceiving-related operations of the second terminal device in the above-described method embodiments, and the processor 620 is configured to perform the processing-related operations of the second terminal device in the above-described method embodiments.

[0182] In another possible design, the apparatus 600 can implement steps or procedures performed by a network device in the above-described method embodiments, where the transceiver 610 is configured to perform the transceiving-related operations of the network device in the above-described method embodiments, and the processor 620 is configured to perform the processing-related operations of the network device in the above-described method embodiments.

[0183] It is to be understood that the apparatus 600 here is embodied in the form of a functional unit. The term "unit" here can refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (e.g., a shared processor, a dedicated processor, or a group of processors, etc.) and a memory for executing one or more software or firmware programs, a combinational logic circuit, and / or other suitable components that support the described functions. In one possible design, those skilled in the art can understand that the apparatus 600 can be embodied as a transmitter in the above-described embodiments, and can be configured to perform the procedures and / or steps corresponding to the transmitter in the above-described method embodiments. Alternatively, the apparatus 600 can be embodied as a receiver in the above-described embodiments, and can be configured to perform the procedures and / or steps corresponding to the receiver in the above-described method embodiments. To avoid repetition, details are not described here.

[0184] The apparatus 600 of each of the above-mentioned solutions has a function of implementing the corresponding steps performed by the sending end in the above-mentioned methods, or the apparatus 600 of each of the above-mentioned solutions has a function of implementing the corresponding steps performed by the receiving end in the above-mentioned methods. The function can be implemented by hardware or by corresponding software executed by hardware. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units such as the processing unit can be replaced by a processor, which respectively performs the transceiving operation and the related processing operation in each method embodiment.

[0185] In addition, the transceiver unit can also be a transceiver circuit (for example, can include a receiving circuit and a sending circuit), and the processing unit can be a processing circuit. In the embodiments of the present application, Figure 6 The apparatus in the above-mentioned solutions can be a receiving end or a sending end of the terminal device or the network device in the above-mentioned embodiments, or can be a chip or a chip system, for example, a system on chip (SoC). The transceiver unit can be an input / output circuit or a communication interface. The processing unit is a processor or a microprocessor integrated on the chip or an integrated circuit. In this regard, no limitation is made.

[0186] Figure 7 FIG. 7 is a schematic block diagram of the apparatus 700 provided by the embodiments of the present application. As shown in FIG. 7, the apparatus 700 includes a processor 710 and a transceiver 720. The processor 710 and the transceiver 720 communicate with each other through an internal connection path. The processor 710 is configured to execute instructions to control the transceiver 720 to send and / or receive signals. Figure 7

[0187] Optionally, the apparatus 700 can further include a memory 730, which communicates with the processor 710 and the transceiver 720 through an internal connection path. The memory 730 is configured to store instructions, and the processor 710 can execute the instructions stored in the memory 730.

[0188] In a possible implementation, the apparatus 700 is configured to implement the corresponding processes and steps of the first terminal device in the above-mentioned method embodiments.

[0189] In another possible implementation, the apparatus 700 is configured to implement the corresponding processes and steps of the second terminal device in the above-mentioned method embodiments.

[0190] In another possible implementation, the apparatus 700 is configured to implement the corresponding processes and steps of the network device in the above-mentioned method embodiments.

[0191] ​It should be understood that the apparatus 700 can be specifically a sending end or a receiving end in the above-described embodiments, or can be a chip or a chip system. Correspondingly, the transceiver 720 can be a transceiver circuit of the chip, which is not limited herein. Specifically, the apparatus 700 can be used to perform various steps and / or processes corresponding to the sending end or the receiving end in the above-described method embodiments.

[0192] Optionally, the memory 730 can include a read-only memory and a random access memory, and provide instructions and data for the processor. A part of the memory can also include a non-volatile random access memory. For example, the memory can also store device type information. The processor 710 can be used to execute the instructions stored in the memory, and when the processor 710 executes the instructions stored in the memory, the processor 710 is used to perform various steps and / or processes of the above-described method embodiments corresponding to the sending end or the receiving end.

[0193] In the implementation process, the steps of the above-described method can be completed by the integrated logic circuit of the hardware in the processor or the instructions in the form of software. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as hardware processor execution completion, or execution completion by combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above-described method. To avoid repetition, it will not be described in detail here.

[0194] It should be noted that the processor in the embodiments of the present application can be an integrated circuit chip with signal processing capability. In the implementation process, the steps of the above-described method embodiments can be completed by the integrated logic circuit of the hardware in the processor or the instructions in the form of software. The above-described processor can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The processor in the embodiments of the present application can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application. The general-purpose processor can be a microprocessor or the processor can be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as hardware decoding processor execution completion, or execution completion by combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above-described method.

[0195] It is to be appreciated that the memory in the embodiments of the application can be a volatile or nonvolatile memory, or can include both volatile and nonvolatile memory. In one embodiment, a non-volatile memory can be a read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically EPROM (EEPROM), or flash memory. A volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example, and not limitation, many forms of RAM are available, for example, static RAM (SRAM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DR RAM). Note that the system and method described herein are intended to include all such memory types and any other suitable type of memory.

[0196] The embodiments of the application further provide a computer readable storage medium, having stored thereon computer instructions for implementing the method executed by the terminal device (such as the first terminal device, or the second terminal device, or the network device) in each of the above method embodiments.

[0197] The embodiments of the application further provide a computer program product, containing instructions, which, when executed by a computer, implement the method executed by the terminal device (such as the first terminal device, or the second terminal device, or the network device) in each of the above method embodiments.

[0198] The embodiments of the application further provide a security protection system, which includes the first terminal device, the second terminal device, and the network device in each of the above embodiments.

[0199] The explanations and beneficial effects of the related contents in any of the above provided devices can refer to the corresponding method embodiments provided above, and will not be repeated here.

[0200] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0201] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0202] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are merely schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0203] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0204] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0205] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0206] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A security protection system, characterized in that, The security protection system includes a first terminal device, a second terminal device, and network devices; The second terminal device is used to send a first message, the first message including a first set of permissions of the second terminal device; The network device is used to receive threat information sent by the second terminal device, wherein the threat information is information about threats detected by the second terminal device; The first terminal device is configured to receive a second message sent by the network device. The second message includes a second set of permissions for the second terminal device. The second message is configured to instruct the first terminal device to update the permissions of the second terminal device according to the second set of permissions. The first set of permissions and the second set of permissions are configured to indicate the operations that the second terminal device can perform on the first terminal device. The first set of permissions includes a first permission, and the second set of permissions does not include at least the first permission.

2. The security protection system according to claim 1, characterized in that, The first permission is the permission for the second terminal device to access the sensitive data of the first terminal device, or the first permission is the permission for the second terminal device to call the sensitive applications of the first terminal device.

3. The security protection system according to claim 1 or 2, characterized in that, The network device is also used for: The second set of permissions is determined based on the threat information and the first set of permissions.

4. The security protection system according to claim 3, characterized in that, The network device is specifically used for: Based on the threat information, determine the type of threat detected by the second terminal device; Determine the third set of permissions corresponding to the type of threat detected by the second terminal device; Based on the first set of permissions and the third set of permissions, a second set of permissions is determined, wherein the second set of permissions is the intersection of the first set of permissions and the third set of permissions.

5. The security protection system according to claim 1 or 2, characterized in that, The second terminal is also used to receive a threat remediation policy sent by the network device, the threat remediation policy being used to remediate threats detected by the second terminal device.

6. The security protection system according to claim 1 or 2, characterized in that, The network device is also configured to receive a threat-relief message sent by the second terminal device, the threat-relief message being used to request the restoration of the permissions of the second terminal device; The first terminal device is further configured to receive a third message sent by the network device, the third message being configured to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

7. The security protection system according to claim 1 or 2, characterized in that, The second terminal device is also used for: Retrieves the real user ID or real user group ID of the application process at the time of the current system call; Obtain the real user ID or real user group ID of the application process during the last system call; If the real user ID or real user group ID of the application process during the current system call is zero, and the real user ID or real user group ID of the application process during the previous system call is not zero, then it is determined that an administrator privilege threat has been detected in the second terminal device.

8. A method for security protection, characterized in that, The method is applied to a first terminal device, and the method includes: Receive a first message sent by a second terminal device, the first message including a first set of permissions of the second terminal device; The first terminal device receives a second message sent by a network device. The second message includes a second set of permissions for the second terminal device. The second message is used to instruct the first terminal device to update the permissions of the second terminal device according to the second set of permissions. The first set of permissions and the second set of permissions are used to indicate the operations that the second terminal device can perform on the first terminal device. The first set of permissions includes a first permission, and the second set of permissions does not include at least the first permission.

9. The security protection method according to claim 8, characterized in that, The first permission is the permission for the second terminal device to access the sensitive data of the first terminal device, or the first permission is the permission for the second terminal device to call the sensitive applications of the first terminal device.

10. The security protection method according to claim 8 or 9, characterized in that, The method further includes: The first terminal device receives a third message sent by the network device, the third message being used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

11. A method for security protection, characterized in that, The method is applied to a network device, and the method includes: Receive a first message sent by a second terminal device, the first message including a first set of permissions of the second terminal device; Receive threat information sent by the second terminal device, wherein the threat information is information about threats detected by the second terminal device; A second message is sent to a first terminal device. The second message includes a second set of permissions for the second terminal device. The second message is used to instruct the first terminal device to update the permissions of the second terminal device according to the second set of permissions. The first set of permissions and the second set of permissions are used to indicate the operations that the second terminal device can perform on the first terminal device. The first set of permissions includes a first permission, and the second set of permissions does not include at least the first permission.

12. The security protection method according to claim 11, characterized in that, The first permission is the permission for the second terminal device to access the sensitive data of the first terminal device, or the first permission is the permission for the second terminal device to call the sensitive applications of the first terminal device.

13. The security protection method according to claim 11 or 12, characterized in that, The method further includes: The second set of permissions is determined based on the threat information and the first set of permissions.

14. The security protection method according to claim 13, characterized in that, The method determines the second permission set based on the threat information and the first permission set, including: Based on the threat information, determine the type of threat detected by the second terminal device; Determine the third set of permissions corresponding to the type of threat detected by the second terminal device; Based on the first set of permissions and the third set of permissions, a second set of permissions is determined, wherein the second set of permissions is the intersection of the first set of permissions and the third set of permissions.

15. The security protection method according to claim 11 or 12, characterized in that, The method further includes: Based on the threat information, a threat remediation strategy is determined, which is used to remediate the threats detected by the second terminal device; The threat remediation strategy is sent to the second terminal device.

16. The security protection method according to claim 11 or 12, characterized in that, The method further includes: Receive a threat-removal message sent by the second terminal device, the threat-removal message being used to request permission to return to the second terminal device; A third message is sent to the first terminal device, the third message being used to instruct the first terminal device to update the permissions of the second terminal device according to the first permission set.

17. A method for security protection, characterized in that, The method is applied to a second terminal device, and the method includes: Send a first message to the first terminal device and the network device, wherein the first message includes a first set of permissions for the second terminal device; Send threat information to a first terminal device and / or network device, wherein the threat information is information about a threat detected by the second terminal device; The second terminal device receives a fourth message sent by a network device. The fourth message includes a second set of permissions for the second terminal device. The fourth message is used to instruct the second terminal device to interact with the first terminal device based on the second set of permissions. The first set of permissions and the second set of permissions are used to instruct the second terminal device on the operations that the second terminal device can perform on the first terminal device. The first set of permissions includes a first permission, and the second set of permissions does not include at least the first permission.

18. The security protection method according to claim 17, characterized in that, The first permission is the permission for the second terminal device to access the sensitive data of the first terminal device, or the first permission is the permission for the second terminal device to call the sensitive applications of the first terminal device.

19. The security protection method according to claim 17 or 18, characterized in that, The method further includes: Retrieves the real user ID or real user group ID of the application process at the time of the current system call; Obtain the real user ID or real user group ID of the application process during the last system call; If the real user ID or real user group ID of the application process during the current system call is zero, and the real user ID or real user group ID of the application process during the previous system call is not zero, then it is determined that an administrator privilege threat has been detected in the second terminal device.

20. The security protection method according to claim 17 or 18, characterized in that, The method further includes: The device receives a threat remediation policy sent by the network device, the threat remediation policy being used to remediate threats detected by the second terminal device.

21. The security protection method according to claim 17 or 18, characterized in that, The method further includes: A threat deactivation message is sent to the network device and / or the first terminal device, the threat deactivation message being used to request the restoration of permissions of the second terminal device.

22. The security protection method according to claim 17 or 18, characterized in that, The method further includes: The third message sent by the network device is received, which is used to instruct the second terminal device to interact with the first terminal device based on the first set of permissions.

Images