A protection method, electronic device and storage medium

Abstract

The embodiment of the present application relates to the field of computer security technology, and discloses a protection method, electronic device, and storage medium. The protection method includes: after starting a main process, starting at least one sub-process in the main process, wherein the main process is used to protect the system; during the operation of the main process, the main process is protected by the sub-process currently started. At least it is conducive to further improving the effect of protection.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer security technology, and in particular to a protection method, electronic device and storage medium. Background Art

[0002] With the rapid development of computer and network technology, terminal devices (such as smart phones, tablets, etc.) are increasingly used. However, the security issues of terminal devices are becoming increasingly prominent, especially in application scenarios involving fairness and data integrity, such as online games, mobile payments, e-commerce platforms, etc. Cheating behavior has brought huge troubles and risks to users and service providers. To this end, some protection solutions have been provided, such as software protection solutions based on behavior detection and protection solutions based on secure hardware.

[0003] However, the protective effects of these protection solutions are not good and there are still some safety hazards. Summary of the invention

[0004] The embodiments of the present application provide a protection method, an electronic device, and a storage medium, which are at least helpful in further improving the protection effect.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a protection method, comprising: after starting a main process, starting at least one sub-process in the main process, wherein the main process is used to protect the system; during the running of the main process, protecting the main process through the sub-process that has been currently started.

[0006] In some embodiments, protecting the main process through the currently started sub-process includes: obtaining device verification information of the main process through the currently started sub-process, wherein the device verification information includes information involved in a process of verifying device information based on reference device information and device information during verification, and the reference device information is device information obtained when the process starts and stored in a storage space corresponding to the process; verifying the device verification information of the main process through the currently started sub-process.

[0007] In some embodiments, the device verification information includes a verification result. While obtaining the device verification information of the main process through the currently started sub-process, the method also includes: obtaining the device verification information of the currently started sub-process through the main process; while verifying the device verification information of the main process through the currently started sub-process, the method also includes: verifying the device verification information of the currently started sub-process through the main process.

[0008] In some embodiments, obtaining the device verification information of the main process through the currently started sub-process includes: obtaining the device verification information and the reference device information of the main process through the currently started sub-process; verifying the device verification information of the main process through the currently started sub-process includes: verifying the device verification information of the main process according to the reference device information of the main process.

[0009] In some embodiments, the verifying the device verification information of the main process through the currently started sub-process includes: verifying the device verification information of the main process through the currently started sub-process according to the reference device information of the currently started sub-process.

[0010] In some embodiments, the protecting the main process through the currently started sub-process includes:

[0011] Obtain the exception detection information of the main process through the currently started sub-process, wherein the exception detection information includes information involved in the process of performing exception detection based on behavior and / or status information; and verify the exception detection information of the main process through the currently started sub-process.

[0012] In some embodiments, starting at least one sub-process in the main process includes: starting at least two of the sub-processes in the main process at different times; and / or periodically restarting at least two of the sub-processes in the main process according to different cycles.

[0013] In some embodiments, the method further includes at least one of the following: protecting the currently started sub-process through the main process; protecting the main process through the main process; protecting the currently started sub-process through the currently started sub-process; wherein, when an abnormal state and / or abnormal behavior is detected during the protection process, at least one of the following methods is used to handle the process in which the abnormal state and / or abnormal behavior is detected: terminating the process, restarting the process, issuing an alarm, and recording the exception in a log.

[0014] According to some embodiments of the present application, a second aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a protection method as described in any one of the first aspects.

[0015] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the protection method as described in any one of the first aspects.

[0016] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0017] After starting the main process for protecting the system process, at least one sub-process is started in the main process, so that during the running of the main process, the main process can be protected by the currently started sub-process, avoiding the security risks caused by the failure of system protection after the main process for protecting the system fails. By ensuring the security of the main process for protecting the system, the security of the system is further improved, and better protection effects are further achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0019] Figure 1 This is the process of the protection method provided in the embodiment of this application Figure 1 ;

[0020] Figure 2 This is the process of the protection method provided in the embodiment of this application Figure 2 ;

[0021] Figure 3 This is the process of the protection method provided in the embodiment of this application Figure 3 ;

[0022] Figure 4 This is the process of the protection method provided in the embodiment of this application Figure 4 ;

[0023] Figure 5 This is the process of the protection method provided in the embodiment of this application Figure 5 ;

[0024] Figure 6 This is the process of the protection method provided in the embodiment of this application Figure 6 ;

[0025] Figure 7 This is the process of the protection method provided in the embodiment of this application Figure 7 ;

[0026] Figure 8It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] As can be seen from the background technology, the current protection scheme is not very effective.

[0028] After analysis, it is found that the reasons for the above problems are at least that: the existing protection schemes generally have the following problems: 1. Insufficient robustness, the detection process is easily terminated or bypassed, resulting in the failure of the detection system; 2. Poor concealment, the detection method is easily identified and attacked by malware; 3. There are significant deficiencies in the protection of advanced attack methods, and detection can be avoided by various means, resulting in unsatisfactory protection effects. Specifically, for software protection schemes, all protection mechanisms are usually concentrated in one main process (i.e., single-process protection), for example, the behavior of the terminal is monitored in real time in the main process and cheating detection is performed. For this scheme, the attacker can control and attack the main process through Hook technology or memory injection. In particular, since the protection mechanism and the attack target are concentrated in the same process, the attacker can easily hide the attack traces and bypass the protection detection. Once the detection process is attacked or closed, the entire detection system will fail and cannot continue to monitor and prevent cheating behavior. At the same time, the detection accuracy and robustness of the single-process detection mode are poor when facing advanced cheating methods (such as root environment hiding and device model modification). As for the protection scheme based on secure hardware, such as using a trusted execution environment (TEE) or a secure chip to protect key data and operations, it is usually used in some systems that require advanced protection, because this scheme has the problems of high cost and very limited scope of application. Moreover, this scheme only improves the security of stored data, has very high limitations in use, and can also be attacked. For example, APP (Application) cannot call the hardware directly, but can only access it through the external interface. The external interface can be attacked, such as hooking, returning tampered results or writing tampered data.

[0029] Based on this, the embodiments of the present application provide a protection method, an electronic device and a storage medium. On the basis of not relying on security hardware, and targeting the single-process protection characteristics of existing software protection schemes, it is proposed that in addition to starting the main process for protecting the system, at least one sub-process is started in the main process to implement a dual-process protection scheme. The main process is protected by the sub-process, thereby avoiding the problem of protection failure of the main process for protecting the system due to attacks, thereby improving the security of the main process for protecting the system and improving the protection effect and system security.

[0030] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0031] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0032] The present application provides a protection method for any electronic device, such as a mobile phone, a computer, a server, etc., which will not be listed here one by one. Figures 1 to 7 The flowchart shown illustrates the protection method provided in the embodiment of the present application.

[0033] In some embodiments, the process of the protection method is as follows Figure 1 As shown, the following steps are included:

[0034] Step 101, after starting the main process, start at least one sub-process in the main process, wherein the main process is used to protect the system.

[0035] Step 102: During the running of the main process, the main process is protected through the currently started sub-process.

[0036] In this way, after starting the main process used to protect the system process, at least one sub-process is started in the main process, so that during the running of the main process, the main process can be protected by the currently started sub-process, thereby avoiding the security risks caused by the failure of system protection after the main process used to protect the system fails. By ensuring the security of the main process used to protect the system, the security of the system is further improved, and better protection effects are further achieved.

[0037] For ease of understanding, the following Figure 1 The steps shown are explained.

[0038] Step 101, after starting the main process, start at least one sub-process in the main process. The embodiment of the present application does not limit the protection method of the main process, and it can be protected by conventional protection strategies, such as process behavior analysis, file integrity check, cheating detection, etc. It can also be protected by some special protection strategies, such as root environment hiding, device model modification, and anti-debugging, etc., which will not be listed here one by one.

[0039] Furthermore, the embodiments of the present application do not limit the number of sub-processes started during the protection process. The number can be 1, 2, 5, 8, 15, etc., which can be determined based on the current system working state of the electronic device, resource idleness, and whether it is a period of frequent attacks, etc., which will not be described in detail here. At the same time, the embodiments of the present application do not limit the order of starting two or more sub-processes. For example, the sub-processes can be started immediately after the main process is started. For example, the sub-processes that need to be started can be started synchronously. For example, different start times can be set for the sub-processes: some sub-processes are started immediately after the main process is started, some sub-processes are started after the sub-processes have run for a certain period of time, and some sub-processes are started after the main process detects an abnormality, etc., which will not be listed here one by one.

[0040] It should be noted that in the embodiments of the present application, the main emphasis is that the main process has certain protection functions, but this does not mean that the main process can only undertake protection tasks. For example, the main process can also provide business services, interact with the APP through the business logic corresponding to the service, etc., which will not be elaborated here.

[0041] Step 102, during the operation of the main process, the main process is protected through the currently started sub-process. It can be understood that illegal attacks (or intrusions, etc.) are usually directed at one process, namely the main process. As for the sub-process, it is usually ignored by the attacker, or, because the number of sub-processes in the system is large relative to the main process, and the startup of the sub-process is random, it is difficult to identify the sub-process that provides protection from the numerous sub-processes, and it is difficult to attack it in a targeted manner, making the protection ineffective. Therefore, through the protection of the sub-process, the security of the main process can be greatly guaranteed. It is also based on this that the embodiment of the present application does not limit the protection of the sub-process, and it can be protected through conventional protection strategies, such as process behavior analysis, file integrity check, cheating detection, etc.; or, it can also be protected through some special protection strategies, such as root environment hiding, device model modification, and anti-debugging. Of course, in some cases, in order to reduce resource waste, different security protection strategies can be provided for the main process and the sub-process. For example, considering that the main process is more vulnerable to attack and more prone to protection failure than the sub-process, a conventional protection strategy is configured for the main process, while a special protection strategy is configured for the sub-process. In this way, the protection strategy of the sub-process that is not prone to failure is more advanced, and can identify and protect against more concealed, detectable and preventable attack methods, thereby saving resources while ensuring the effectiveness of protection.

[0042] It should be noted that the protection functions provided for different sub-processes that are started are not limited in the embodiments of the present application. For example, the protection functions between different sub-processes can overlap or partially overlap, so that different sub-processes can be supported to be started at different times without any protection loopholes, so that the startup of sub-processes can be more flexible, and sub-processes started at different times can be based on new and secure storage space to avoid sub-processes being attacked and protection failure. For example, the protection functions between different sub-processes can be completely different, that is, the protection functions of sub-processes can be split into different sub-functions and configured to different sub-processes. In this way, the problem of protection loopholes after some sub-processes are attacked and the protection fails can be avoided, further improving the protection effect and enhancing security.

[0043] It should also be noted that Figure 1 The execution order of the steps in is only an example. It is understandable that for multiple sub-processes to be started, the sub-processes do not necessarily have to be started at the same time. Therefore, the protection of the main process by the sub-process and the startup of the sub-process can appear in turn, etc., which will not be repeated here one by one.

[0044] It is understandable that a common way to tamper with the system is to tamper with the device information, thereby circumventing the platform's rules of sharing the same device, etc. In order to solve the problem of device information tampering, in some embodiments, the process of the protection method is as follows: Figure 2 As shown, the following steps may also be included:

[0045] Step 201, after starting the main process, start at least one sub-process in the main process, wherein the main process is used to protect the system.

[0046] Step 202, obtain the device verification information of the main process through the currently started sub-process, wherein the device verification information includes information involved in the process of verifying the device information based on the reference device information and the device information during verification, and the reference device information is the device information obtained when the process starts and stored in the storage space corresponding to the process.

[0047] Step 203: Verify the device verification information of the main process through the currently started sub-process.

[0048] In this way, Figure 1 On the basis of the illustrated embodiment, the sub-process verifies the device verification information of the main process. While realizing the detection of device information tampering, it can also realize risk detection of the main process environment (including storage space and related environmental configuration, etc.) by verifying the device information pre-stored in the process space and the current device information, so as to timely detect, eliminate or resolve the device information tampering problems and environmental risks of the main process.

[0049] For ease of understanding, the following Figure 2 The steps of the embodiment shown are explained. Among them, step 201 is substantially the same as step 101 of the above embodiment, and will not be described in detail here.

[0050] In step 202, the device verification information of the main process is obtained through the currently started sub-process. Among them, the embodiment of the present application does not limit the device information involved in the verification, which can be any device-related information that will not be changed during normal operation, but may be tampered with after being invaded. For example, the device information can be information that directly identifies the device, such as device identification code information, device fingerprint, etc. For example, the device information can also be device-related configuration information, such as positioning information, system version information, resource information. Alternatively, the device information can also be a combination of the aforementioned information, etc., which can be determined based on the level of protection requirements, the usage status of electronic equipment resources, the quality of the external environment, and the alarm conditions detected in the past, etc., which will not be listed here one by one.

[0051] Furthermore, the embodiments of the present application do not limit the device verification information. It is understandable that the verification of the device information involves the information being verified, the process information of the verification, and the results of the verification, etc. In addition, it also includes the verification method, etc. According to different needs, the device verification information of the main process that needs to be obtained when the sub-process protects the main process can be flexibly selected. For example, the device verification information only includes the results of the verification, so that the verification efficiency of subsequent sub-processes is relatively high, making the protection more timely. For example, the device verification information includes all information involved in the entire verification process, so that the verification reliability and effectiveness of subsequent sub-processes are strong, making the protection more reliable and effective. They will not be described one by one here.

[0052] It should be noted that the above-mentioned "device verification information includes information involved in the process of device information verification according to the reference device information and the device information at the time of verification" means a lot of information involved in the process of device information verification according to the reference device information and the device information at the time of verification, at least one of which will be used as device verification information, and the specific selection of which or which information as device verification information can be determined according to application requirements, scenarios, device performance, resource idleness, etc. Each process will generate device verification information as the device information verification according to the reference device information and the device information at the time of verification occurs, and the generation of device verification information of each process can be regarded as an independent process. In the current embodiment, it is mainly provided by taking the sub-process to verify the device verification information of the main process as an example. At this time, only the main process is required to perform device information verification, and the sub-process verifies the device verification information generated by the main process when performing device information verification, but this does not mean that the sub-process cannot perform device information verification, nor does it mean that the sub-process needs to perform device information verification at the same time as the main process. These can be configured according to relevant conditions, such as scenarios, device performance, etc. For example, only the main process can perform device information verification and generate device verification information, and the sub-process can re-verify the device verification information of the main process; for example, the sub-process and the main process can respectively perform device information verification and generate device verification information of the corresponding processes, and the generated device verification information will be transmitted to the other process for re-verification, etc., which will not be elaborated here.

[0053] In step 203, the device verification information of the main process is verified through the currently started sub-process. Among them, the embodiment of the present application does not specifically limit its verification method. As mentioned above, the configuration of the device verification information of multiple different main processes is supported. Therefore, the device verification information of the main process with different configurations can adopt different verification methods accordingly, or even based on the same main process The device verification information can be verified based on different considerations of efficiency, reliability, available resources, etc., different verification methods can also be used. For ease of understanding, it will be explained below, but this does not mean that only the following examples or their implementation can be used.

[0054] In some embodiments, the device verification information of the main process is verified through the currently started sub-process, which can be implemented in the following manner: the device verification information of the main process is verified through the currently started sub-process according to the reference device information of the currently started sub-process. In other words, the device information stored when the sub-process is started is used for verification, so as to avoid the situation that the main process is tampered when it is started, or the device verification information of the main process obtained is forged, etc., and accurate verification can still be achieved through the device verification information of the sub-process that has not been tampered with, so as to accurately, effectively and reliably identify these attacks.

[0055] In some embodiments, the device verification information of the main process is verified through the currently started sub-process, which can be achieved by: verifying the device verification information of the main process according to the reference device information of the main process. Correspondingly, the device verification information of the main process is obtained through the currently started sub-process, which is achieved by: obtaining the device verification information and reference device information of the main process through the currently started sub-process. The sub-process obtains the reference device information of the main process, so that the device verification process of the main process can be verified based on the sub-process, and the forgery process of the final detection result being consistent with the sub-process caused by the tampering of the verification process of the main process can be avoided, so that the verification process and the verification result can pass the verification of the sub-process, which improves the accuracy of the verification, thereby further improving the security of the main process and further improving the protection effect.

[0056] In some embodiments, further considering the security of the sub-process, the main process and the sub-process can be mutually verified. Therefore, when the device verification information includes the verification result, the protection method further includes: obtaining the device verification information of the currently started sub-process through the main process; while verifying the device verification information of the main process through the currently started sub-process, the protection method further includes: verifying the device verification information of the currently started sub-process through the main process. In this way, by mutually verifying the results between the main process and the sub-process, the reliability and effectiveness of the verification are improved, making the verification concise and efficient, and avoiding the protection errors and omissions caused by attacks on both the main process and the sub-process.

[0057] It should be noted that the mutual verification in the above example is not limited to the verification of the test results, it can also include re-verification of the verification process as shown in the previous example, that is, the main process and the child process also obtain each other's reference device information for verification, or include verification combined with their own reference device information, that is, when the main process and the child process re-verify the verification results of each other, they also verify the relevant information of the other party according to the reference device information stored in their own storage space, etc., which will not be elaborated here.

[0058] It should also be noted that the aforementioned multiple examples are only provided for ease of understanding. In some cases, the process that is currently rechecking the verification results or other information can also obtain the process for verification in real time. This is mainly because the device information obtained in real time may be forged after some of the processes have been tampered with or invaded, and is not the real device information of the electronic device. For example, in some embodiments, the protection of the main process through the currently started sub-process can be achieved in the following way: through the currently started sub-process, the abnormality detection information of the main process is obtained, wherein the abnormality detection information includes the information involved in the abnormality detection process of the process according to the behavior and / or state information; through the currently started sub-process, the abnormality detection information of the main process is verified. In other words, protection is achieved by verifying the detection of behavior and / or state information. Its further implementation can refer to the implementation method of the verification of the aforementioned device verification information, which will not be repeated here. The verification of different information will not be listed one by one here.

[0059] It can also be understood that since intrusions and attacks are all occasional, even if the main process and the sub-process are invaded at the same time, as long as there is a newly started sub-process after the invasion, the storage space of the newly started sub-process is started later, so the storage space occupied by it is not known by the intruder and usually will not be invaded. These newly started sub-processes can be protected without being affected. Based on this, in some embodiments, the process of the protection method can also be as follows Figure 3 As shown, the following steps are included:

[0060] Step 301: In a main process, at least two sub-processes are started at different times respectively; and / or, in a main process, at least two sub-processes are periodically restarted according to different cycles.

[0061] Step 302: During the running of the main process, the main process is protected through the currently started sub-process.

[0062] In this way, on the basis of the foregoing embodiment, by starting different sub-processes at different times, the start of each sub-process can be staggered, thereby avoiding protection omissions caused by sub-processes started at the same time being tampered with at the same time; by periodically restarting the sub-process, there can always be new uninvaded sub-processes to maintain security protection for the main process.

[0063] For ease of understanding, the following Figure 3 The steps of the embodiment shown are explained, wherein step 302 is substantially the same as step 102 of the aforementioned embodiment, and will not be described in detail here.

[0064] In step 301, in the main process, at least two sub-processes are started at different times respectively; and / or, in the main process, at least two sub-processes are restarted periodically according to different cycles. Among them, the embodiment of the present application does not limit the different startup times of different sub-processes, and can be set according to application scenarios, business requirements, etc. And the present application does not limit the periodicity of the restart of the sub-process, which can still be set according to application scenarios, business requirements, etc. For example, the startup time of the sub-process and / or the cycle of the sub-process restart can be pre-configured for the system. In this way, the system of the electronic device will automatically start the sub-process according to the configured policy after startup. For example, the startup time of the sub-process or the cycle of the sub-process startup can be randomly generated, so that the possibility of leakage of the sub-process startup information and malicious use is avoided, and the protection effect is further improved. In this way, through the restart of the sub-process and / or the newly started sub-process, there can always be a sub-process that uses the storage space that has not been attacked and invaded, thereby avoiding the protection failure caused by the failure of all sub-processes.

[0065] In particular, in some embodiments, it is also possible to arrange the startup processes of different sub-processes and the startup restart cycles so that there is always at least one sub-process to provide protection for the main process, and a new sub-process is started at every short interval (which can be determined according to the application scenario, resource capabilities, external environment, etc.). In this way, the security risk of the main process is of very short duration and has almost no impact on the security of the main process, and requires less resources to be consumed.

[0066] It should be noted that Figure 3 Only for Figure 1 Based on the embodiment shown in the figure, the embodiment obtained by further combining the starting of the sub-process at different times, in some embodiments, it is also possible to Figure 2 Based on the embodiment shown, the subprocess is started at different times, that is, Figure 2 The steps shown can be replaced by Figure 3 The steps 301 and the like shown in the figure will not be described in detail here.

[0067] It can also be understood that the embodiments of the present application start at least one sub-process in the main process so that it cooperates with the main process to form a dual-process protection architecture. Under the dual-process protection architecture, the cooperation between the protection of the sub-process and the main process can be set according to needs to further enhance the protection effect of the dual process. For example, in some embodiments, Figure 4 As shown, the process of the protection method may also include the following steps:

[0068] Step 401, after starting the main process, start at least one sub-process in the main process, wherein the main process is used to protect the system.

[0069] Step 402: During the running of the main process, the main process is protected through the currently started sub-process.

[0070] Step 403: Protect the currently started sub-process through the main process.

[0071] Step 404, protecting the main process through the main process.

[0072] Step 405: Protect the currently started sub-process through the currently started sub-process.

[0073] In this way, in the aforementioned embodiment, on the basis of protecting the main process through the sub-process, the dual-process architecture of the sub-process and the main process is further utilized to provide further protection for the main process and the sub-process, making the protection of the main process and the sub-process more stringent and the protection effect better.

[0074] For ease of understanding, the following Figure 4 The steps of the embodiment shown are explained. Among them, step 401-step 402 are substantially the same as step 101-step 102 in the above embodiment, and will not be described one by one here.

[0075] In step 403, the currently started sub-process is protected through the main process. It should be emphasized that the protection provided by the main process for the sub-process here is a new protection superimposed on the protection of the system by the main process, which is specifically provided for the sub-process used to protect the main process. These can be general protections or special protections as described above, and the embodiments of the present application do not limit this. It can be understood that if it is a general protection, since it is provided specifically for the sub-processes that protect the main process, the detection effectiveness and reliability of these sub-processes will be stronger, and since it does not need to be protected together with other sub-processes, the protection efficiency will be higher, especially when the sub-process is attacked or invaded, the detection of security issues or security risks will be more timely, so that the processing delay can be shortened and hidden dangers or problems can be eliminated in time. If it is a special protection, then compared with other sub-processes, the sub-processes that protect the main process will be safer and more reliable, so that the main process will also be safer and more reliable, and further better protection effects can be achieved, etc., which will not be repeated here.

[0076] In step 404, the main process is protected through the main process. It should be emphasized that the protection provided by the main process for the main process here is a new protection superimposed on the protection of the system by the main process, which is specifically provided for the main process itself. These can be general protections or special protections as described above, and the embodiments of the present application are not limited to this. It can be understood that if it is a general protection, the protection effectiveness and reliability of the main process will be stronger. If it is a special protection, it will make the main process safer and more reliable, and further achieve better protection effects, etc., which will not be repeated here.

[0077] Step 405: Protect the currently started subprocess through the currently started subprocess. In the embodiment of the present application, the protection method of subprocess against subprocess is not limited, and it should be noted that since more than one subprocess may be started, the protection of subprocess against subprocess can be the protection of a single process against itself, or the protection of different subprocesses against subprocesses.

[0078] For ease of understanding, for example, the process-to-process protection provided by steps 403-405 can be to detect the running state and / or behavior of the protected process through the process providing protection; and to process the process with abnormal running state and / or behavior detected in at least one of the following ways: terminating the process, restarting the process, issuing an alarm, and recording the abnormality in the log. In this way, by restarting the process, the process that uses the new storage space after the restart will use the storage space that has not been injected by the attacker, which will make the attacker's attack invalid, so that the protected process will be safe and reliable.

[0079] It should be noted that Figure 4 In the illustrated embodiment, the execution order of step 402-step 405 is only an example. In some embodiments, step 402-step 405 can be implemented simultaneously, etc., which will not be listed here one by one. In addition, step 403-step 405 does not have to be implemented in one protection, but can be implemented in one or more combinations according to needs, which will not be repeated here one by one.

[0080] For ease of understanding Figure 1-Figure 4 The protection method provided by the embodiment shown is combined with Figure 5-Figure 7 The example shown is used for illustration.

[0081] like Figure 5 As shown in the figure, the system provides basic dual-process protection functions based on the main process and the sub-process. Figure 5 As shown in the figure, the protection process is as follows:

[0082] Step 501: After the application is started, the main process starts and obtains device information and stores it in the storage space of the main process to form corresponding reference device information.

[0083] The storage space of a process includes the memory and / or files of the process, and the device information may include the device model, system version, hardware serial number, etc.

[0084] Step 502: After the main process is started, a sub-process is started in the main process and device information is obtained and stored in the storage space of the sub-process to form corresponding reference device information.

[0085] If the subprocess fails to be started in the main process, you can retry until the startup succeeds.

[0086] It should be noted that when storing the device information obtained by the child process in the storage space of the child process (including memory and / or files), it can be stored in the memory first. This is mainly because the memory is relatively safe, especially when the child process is attacked. The embodiment of the present application supports starting or restarting the child process and allocating new memory. Therefore, storage based on the memory of the child process can more effectively avoid memory attacks such as HOOK.

[0087] Step 503: When the sub-process is successfully started, the successfully started sub-process is attempted to be attached to the main process.

[0088] Among them, the method of attaching to the main process can be achieved by tracing the main process.

[0089] Step 504: If the child process cannot be attached to the main process, it is detected whether the main process is attached by an external debugging tool.

[0090] Among them, the method of detecting the external debugging tool can be carried out by reading the / proc / process id / status file, and it can also be determined whether there is a debugging program attached by checking related fields (such as the TracerPid field).

[0091] Step 505: If it is detected that the main process is attached by an external debugging tool, the application is terminated and exited, and the main process is forcibly killed.

[0092] Step 506, if the subprocess attaches to the main process successfully, or if the attachment fails but the external debugging tool attachment is not detected, the subprocess and the main process periodically perform device information verification based on the reference device information and generate a detection result as device verification information.

[0093] Step 507: The sub-process and the main process exchange device verification information.

[0094] Among them, the main process and the sub-process can realize inter-process communication and data exchange through the inter-process communication (IPC) mechanism (such as pipes, shared memory, message queues, etc.).

[0095] Step 508: The sub-process and the main process perform verification according to the device verification information.

[0096] Among them, when the verification fails (that is, the verification results of the main process and the sub-process are inconsistent), an alarm is issued that the environment has risks.

[0097] Step 509: The main process periodically detects the behavior and running status of the subprocess.

[0098] Among them, when the main process detects that the sub-process behaves abnormally or the running status is abnormal, it immediately records the log and takes corresponding measures (such as termination, restart or alarm).

[0099] Step 510: If the main process detects that the running state or behavior of the sub-process is abnormal, the sub-process is restarted.

[0100] Among them, abnormal behaviors include abnormal memory modification, stack exception, illegal call, etc. Among them, the child process can use the system application programming interface (Application Programming Interface, API) and read the / proc / process id / status file to obtain the memory information and call stack of the main process to detect behavior and status information.

[0101] like Figure 6 As shown, in Figure 5 Based on the example of , the system further provides dual-process guarding and self-checking based on the main process and sub-process. At this time, the protection process is as follows:

[0102] Step 601: After the application is started, the main process starts and obtains device information and stores it in the storage space of the main process to form corresponding reference device information.

[0103] The storage space of a process includes the memory and / or files of the process.

[0104] Step 602: After the main process is started, a sub-process is started in the main process and device information is obtained and stored in the storage space of the sub-process to form corresponding reference device information.

[0105] If the subprocess fails to be started in the main process, you can retry until the startup succeeds.

[0106] Step 603: When the sub-process is successfully started, the successfully started sub-process is attempted to be attached to the main process.

[0107] Among them, the method of attaching to the main process can be achieved by tracing the main process.

[0108] Step 604: If the child process cannot be attached to the main process, it is detected whether the main process is attached by an external debugging tool.

[0109] Among them, the method of detecting the external debugging tool can be carried out by reading the / proc / process id / status file, and it can also be determined whether an external debugging tool is attached by checking related fields (such as the TracerPid field).

[0110] Step 605: If it is detected that the main process is attached by an external debugging tool, the application is terminated and exited, and the main process is forcibly killed.

[0111] Step 606, if the child process attaches to the main process successfully, or if the attachment is unsuccessful but the external debugging tool attachment is not detected, the main process and the child process periodically detect their own running status and behavior, and / or the main process and the child process periodically detect each other's running status and behavior.

[0112] The detected contents may include memory status, call stack, etc.

[0113] Step 607: When an abnormality is detected in the sub-process, restart the sub-process.

[0114] Among them, the restart of the subprocess can also be configured to restart periodically or at a random time to increase the difficulty of attack and tampering. In this way, new memory will be allocated after the subprocess restart, which can effectively reduce the risk (such as the risk of memory injection and Hook). That is, the subprocess restart reduces the risk of being attacked and tampered. Therefore, more information and risk results can be detected.

[0115] like Figure 7 As shown, in Figure 5 or Figure 6 Based on the example of , the system provides further enhanced protection capabilities based on the main process and sub-process, especially the detection enhancement of device information tampering. Figure 7 As shown in the figure, the protection process is as follows:

[0116] Step 701: After the application is started, the main process starts and obtains device information and stores it in the storage space of the main process to form corresponding reference device information.

[0117] The storage space of a process includes the memory and / or files of the process, and the device information may include the device model, system version, hardware serial number, etc.

[0118] Step 702: After the main process is started, a sub-process is started in the main process and device information is obtained and stored in the storage space of the sub-process to form corresponding reference device information.

[0119] If the subprocess fails to be started in the main process, you can retry until the startup succeeds.

[0120] Step 703: When the sub-process is successfully started, the successfully started sub-process is attempted to be attached to the main process.

[0121] Among them, the method of attaching to the main process can be achieved by tracing the main process.

[0122] Step 704: If the child process cannot be attached to the main process, it is detected whether the main process is attached by an external debugging tool.

[0123] Among them, the method of detecting the external debugging tool can be carried out by reading the / proc / process id / status file, and it can also be determined whether an external debugging tool is attached by checking related fields (such as the TracerPid field).

[0124] Step 705: If it is detected that the main process is attached by an external debugging tool, the application is terminated and exited, and the main process is forcibly killed.

[0125] Step 706, if the child process is successfully attached to the main process, or if the attachment is unsuccessful but the external debugging tool is not detected, the child process and the main process periodically verify the device information based on the reference device information and generate a detection result, which is used as the device verification information together with their respective reference verification information.

[0126] Step 707: The subprocess and the main process exchange device verification information.

[0127] Among them, the main process and the sub-process can realize inter-process communication and data exchange through the inter-process communication (IPC) mechanism (such as pipes, shared memory, message queues, etc.).

[0128] Step 708: The sub-process and the main process perform verification according to the device verification information.

[0129] Among them, if the verification fails (that is, the verification results of the main process and the sub-process are inconsistent), it is determined that there is tampering behavior, and the log is immediately recorded and the APP is notified. At the same time, protective measures such as limiting functions can be taken, such as warnings of environmental risks. In this way, when there are environmental risks, especially environmental risks that cannot be detected by the main process, the sub-process can detect them (such as Root environment or Hook), determine the existence and mark new attack records (such as: Root hiding, Hook attack), immediately record the log and notify the APP, and at the same time, protective measures such as limiting functions can be taken.

[0130] In this process, the main process is the attack attractor. Usually, the environmental risks that the main process can detect are less than those that the sub-process can detect. Therefore, more information and risk results can be detected through the sub-process to reduce the risk of being attacked and tampered.

[0131] It should be noted that Figure 5-Figure 7 In the embodiment shown, the operation of attaching a subprocess to the main process is mainly to detect whether the only way for the main process to attach other processes is occupied, so as to determine whether there is an external test tool that performs debugging or attack operations by attaching to the main process. Through the above embodiment, when the attachment fails but the external debugging tool is not detected, the processing can still be continued, instead of killing the main process. It can also be seen that attaching a subprocess to the main process is not a necessary condition for subsequent processing. That is to say, when applying, the operation of attaching a subprocess to the main process can be removed according to needs, and it will not be repeated here.

[0132] It is not difficult to see from the above examples that, in this way, the main process provided in the embodiment of the present application can be responsible for the main business logic and APP to interact. The main process will automatically run when the system starts. As the main target of the attacker, it allows the execution of some protection tasks, such as process behavior analysis, file integrity check, etc. At the same time, the main process is also responsible for starting and monitoring the sub-process to ensure that it continues to run throughout the detection process. The sub-process, started by the main process, can provide protection against advanced cheating methods, such as root environment hiding, device model modification, and anti-debugging. The sub-process can be started and stopped flexibly, and the main process can start multiple sub-processes as needed. The sub-process has high independence and resource occupation advantages, and can continue to perform in-depth detection of the system at a lower resource consumption. Thus, the dual-process architecture implemented by the cooperation of the main process and the sub-process improves the detection capability (that is, the sub-process runs independently and has an independent memory space, making it difficult for attackers to hook or inject operations into the sub-process. In addition, the sub-process can regularly or randomly check the status and behavior of the main process to monitor whether there are abnormal activities, such as illegal memory modifications, abnormal calls, etc. At the same time, the sub-process can be restarted regularly or randomly to ensure the security of the sub-process operating environment (such as memory) and effectively avoid attacks such as injection and hooking. In addition, the sub-process uses a variety of detection methods, such as file integrity verification, memory scanning, behavior analysis, etc., to ensure the comprehensiveness and accuracy of detection) and enhance the protection mechanism (that is, the sub-process Actively attach the main process at startup, so that attackers cannot attach the main process for debugging operations, thereby improving the reliability of protection. And the child process is responsible for monitoring whether the main process is attached by the debugging tool. When attaching the main process fails and abnormal debugging behavior is detected, the child process will immediately take protective measures, such as terminating the main process, alarming, recording logs, etc.), and accurately identify tampering (that is, the main process and the child process respectively obtain the key information of the device (such as device model, system version, etc., and support comparing the device information obtained by the two processes. When inconsistent information is detected, it is determined that tampering behavior exists, and corresponding protective measures are taken, such as alarming, recording logs, limiting functions, etc.).

[0133] In other words, the following objectives can be achieved through the embodiments of the present application:

[0134] 1. Improve detection capabilities. In particular, existing single-process protection solutions are easily bypassed by attackers through Hook technology or injection into the main process, resulting in unsatisfactory detection results. The embodiments of the present application support starting sub-processes in the main process, and performing detection in the main process and sub-processes respectively, making it difficult for attackers to hook or inject into multiple processes, thereby improving the comprehensiveness and accuracy of detection. In particular, it can enhance concealment, and the main process and sub-process cooperate with each other. For example, the sub-process can actively monitor and intervene in the debugging behavior of the main process, ensuring that attackers cannot conduct in-depth analysis and attacks on the main process during the debugging phase, significantly improving the system's protection capabilities, making it difficult to be identified and attacked by malware at the same time, and improving the system's concealment and security.

[0135] 2. High flexibility and scalability. Subprocesses can be started at any time and any location, and the start and exit of subprocesses will not have a negative impact on the application (main process) business. The subprocess detection frequency and even the number of subprocesses can be adjusted according to actual needs. In particular, the robustness of the detection capability can also be improved. For example, the dual-process architecture makes the detection system highly robust. Even if a process is attacked or terminated by malware, the other process can continue to run and restore the terminated process to ensure the continued effectiveness of the detection function. Ultimately, the dual-process architecture makes the protection system more flexible, and the number of subprocesses and detection frequency can be adjusted according to actual needs to adapt to different security needs and application scenarios.

[0136] 3. Enhanced protection capability. Existing protection solutions are often powerless when facing debug attacks by attackers. Attackers can attach to the main process through debugging tools for analysis and attack. However, the embodiment of the present application supports attaching the main process in the subprocess, so that attackers cannot attach to the main process at the same time, which significantly improves the reliability of protection.

[0137] 4. Strong anti-attack ability. When the main process or the sub-process detects an attack, it can record the attack and then exit and restart. After the restart, it is a new memory space, and the last injection or hook attack methods will be invalid. If you want to improve security, you can also restart regularly. Therefore, through the restart of the sub-process and the protection of the sub-process itself, it is possible to further fight against advanced cheating methods, such as root environment hiding and device model modification. By taking advantage of the independence and resource occupation of the sub-process, the detection ability of these advanced cheating methods is enhanced, and accurate detection of advanced cheating methods is achieved.

[0138] 5. Effectively identify tampering behavior: It is difficult to effectively identify tampering behavior of device information with the existing technology. For example, attackers bypass detection by modifying device information (such as modifying Xiaomi device information to Huawei device information). The embodiment of the present application supports obtaining device information through dual processes and comparing them. When the device information obtained by the two processes is different, it can be determined that tampering behavior has occurred, thereby effectively identifying device information tampering. By comparing device information through the inter-process communication mechanism, device information tampering behavior can be quickly and accurately identified, which improves the ability to detect tampering and provides the ability to effectively identify tampering behavior.

[0139] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0140] Another aspect of the present application embodiment further provides an electronic device, such as Figure 8 As shown, it includes: at least one processor 801; and a memory 802 that is communicatively connected to the at least one processor 801; wherein the memory 802 stores instructions that can be executed by the at least one processor 801, and the instructions are executed by the at least one processor 801 so that the at least one processor 801 can execute the protection method described in any of the above method embodiments.

[0141] The memory 802 and the processor 801 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 801 and the memory 802 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 801 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 801.

[0142] The processor 801 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 802 can be used to store data used by the processor 801 when performing operations.

[0143] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0144] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0145] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A protection method, characterized in that: include: After starting a main process, starting at least one sub-process in the main process, wherein the main process is used to protect the system; During the running of the main process, the main process is protected by the currently started sub-process.

2. The protection method according to claim 1, characterized in that: The protecting the main process by the currently started sub-process includes: Obtaining device verification information of the main process through the currently started subprocess, wherein the device verification information includes information involved in the process of performing device information verification according to reference device information and device information during verification, and the reference device information is device information obtained when the process is started and stored in a storage space corresponding to the process; The device verification information of the main process is verified through the currently started sub-process.

3. The protection method according to claim 2, characterized in that: The device verification information includes a verification result. When the device verification information of the main process is obtained through the currently started sub-process, the method further includes: Obtaining, through the main process, the device verification information of the currently started sub-process; While verifying the device verification information of the main process through the currently started sub-process, the method also includes: The device verification information of the currently started sub-process is verified through the main process.

4. The protection method according to claim 2 or 3, characterized in that: The obtaining the device verification information of the main process through the currently started sub-process includes: Obtain the device verification information and the reference device information of the main process through the currently started sub-process; The verifying the device verification information of the main process through the currently started sub-process includes: The device verification information of the main process is verified according to the reference device information of the main process.

5. The protection method according to claim 2 or 3, characterized in that: The verifying the device verification information of the main process through the currently started sub-process includes: The device verification information of the main process is verified through the currently started sub-process and according to the reference device information of the currently started sub-process.

6. The protection method according to any one of claims 1 to 3, characterized in that: The protecting the main process by the currently started sub-process includes: Obtaining the anomaly detection information of the main process through the currently started sub-process, wherein the anomaly detection information includes information involved in the anomaly detection process of the process according to the behavior and / or state information; The abnormality detection information of the main process is verified through the currently started sub-process.

7. The protection method according to any one of claims 1 to 3, characterized in that: The starting at least one sub-process in the main process includes: In the main process, at least two of the sub-processes are started at different times; and / or, According to different cycles, at least two of the sub-processes are periodically restarted in the main process.

8. The protection method according to any one of claims 1 to 3, characterized in that: The method further comprises at least one of the following: Protecting the currently started sub-process through the main process; Protecting the main process through the main process; Protecting the currently started sub-process through the currently started sub-process; Among them, when an abnormal state and / or abnormal behavior is detected during the protection process, at least one of the following methods is used to handle the process in which the abnormal state and / or abnormal behavior is detected: terminating the process, restarting the process, issuing an alarm, and recording the abnormality in a log.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the protection method according to any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the protection method according to any one of claims 1 to 8 is implemented.

Images