Method and device for processing sensitive information

Abstract

The embodiment of the invention provides a sensitive information processing method and device, and the method comprises the steps: obtaining sensitive information, inputting the sensitive information into N functions, and obtaining N function values, where N is an integer greater than or equal to 1; n target bits corresponding to the N function values are determined on a first character string, values of characters on the N target bits are determined, N character values are obtained, the first character string comprises M characters, and M is an integer larger than N; and processing the sensitive information through the N character values. The problem of high occupation of sensitive information monitoring resources in related technologies is solved, and the effect of saving resources is achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of network security and application program security, and in particular, to a method and device for processing sensitive information. Background Art

[0002] With the rapid development of mobile Internet, more and more mobile applications are widely used, providing rich functions and services. Along with this comes the issue of protecting users' sensitive information. When users' information is improperly handled or leaked, it may lead to serious privacy violations and financial losses.

[0003] In many applications, developers use encryption algorithms to protect sensitive data to prevent unauthorized access. These encryption algorithms often call general encryption functions at the bottom of the operating system. However, the input and output of these underlying functions may be stolen by attackers through dynamic analysis when the application is running. In the prior art, although there are monitoring methods for data transmission and storage, most solutions are difficult to track the encryption process in real time, especially in complex applications. Due to the diversity of calling levels, it is difficult to fully capture the flow of sensitive data during the encryption process. In addition, many traditional monitoring methods generally have high resource usage and false positive rates, lack the necessary flexibility and pertinence, and cannot meet the high requirements for real-time and accuracy.

[0004] There is currently no effective solution to the above problems. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for processing sensitive information, so as to at least solve the problem of high resource occupancy of monitoring sensitive information in related technologies.

[0006] According to one embodiment of the present invention, there is provided a method for processing sensitive information, comprising: obtaining sensitive information, and inputting the sensitive information into N functions respectively to obtain N function values, wherein N is an integer greater than or equal to 1; determining N target bits corresponding to the N function values ​​in a first character string, and determining the values ​​of characters at the N target bits to obtain N character values, wherein the first character string includes M characters, and M is an integer greater than N; and processing the sensitive information through the N character values.

[0007] In an exemplary embodiment, determining N target positions corresponding to the N function values ​​in a first string includes: when the function value is S, determining the Sth position in the first string as the target position, wherein S is an integer.

[0008] In an exemplary embodiment, the sensitive information is processed using the N character values, including: when the N character values ​​have a first value, recording the sensitive information in a log; and when the N character values ​​are all second values, filtering the sensitive information.

[0009] In an exemplary embodiment, after recording the sensitive information in the log, the method further includes: when the first value is located at a first target position in the first character string, replacing the first value at the first target position with the second value.

[0010] In an exemplary embodiment, obtaining sensitive information includes: when the sensitive information is encrypted by an encryption function, obtaining the sensitive information from input parameters of the encryption function, wherein the input parameters of the encryption function include the sensitive information.

[0011] In an exemplary embodiment, the sensitive information is input into N functions respectively to obtain N function values, including: converting the sensitive information into a second string; inputting the second string into N hash functions to obtain N hash values, wherein the N functions include the hash function, and the function values ​​include the hash value.

[0012] According to another embodiment of the present invention, there is provided an apparatus for processing sensitive information, comprising: an acquisition module, used to acquire sensitive information, and input the sensitive information into N functions respectively to obtain N function values, wherein N is an integer greater than or equal to 1; a determination module, used to determine N target bits corresponding to the N function values ​​in a first character string, and determine the values ​​of characters at the N target bits to obtain N character values, wherein the first character string includes M characters, and M is an integer greater than N; and a processing module, used to process the sensitive information through the N character values.

[0013] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein the computer program implements the steps of any of the above methods when executed by a processor.

[0014] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0015] According to yet another embodiment of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0016] Through the present invention, sensitive information is obtained and input into N functions respectively to obtain N function values, where N is an integer greater than or equal to 1; N target bits corresponding to the N function values ​​are determined in the first character string, and the values ​​of the characters on the N target bits are determined to obtain N character values, where the first character string includes M characters, and M is an integer greater than N; the sensitive information is processed through the N character values. Therefore, the problem of high resource occupation of monitoring sensitive information in the related art can be solved, and the effect of saving resources can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a hardware structure block diagram of a mobile terminal of a method for processing sensitive information according to an embodiment of the present invention;

[0018] Figure 2 is a flowchart of a method for processing sensitive information according to an embodiment of the present invention;

[0019] Figure 3 is a sensitive information audit flow chart according to an embodiment of the present invention;

[0020] Figure 4 is a structural block diagram of an apparatus for processing sensitive information according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0023] The method for processing sensitive information provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a method for processing sensitive information according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0024] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for processing sensitive information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0025] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0026] In this embodiment, a method running on the above mobile terminal or network architecture is provided. Figure 2 is a flow chart of a method for processing sensitive information according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0027] Step S202, obtaining sensitive information, and inputting the sensitive information into N functions respectively to obtain N function values, where N is an integer greater than or equal to 1;

[0028] The above sensitive information is information that may leak personal privacy, and may be user passwords, encryption keys, ID numbers, mobile phone numbers, credit card numbers, etc. The above function is a hash function, which is used to perform a hash operation on sensitive information to obtain a function value after the hash operation. In order to reduce the misjudgment rate of capturing sensitive information, the embodiment of the present invention uses N (N is greater than or equal to 1) hash functions to process sensitive information.

[0029] Specifically, when the sensitive information is encrypted by an encryption function, the sensitive information is obtained from an input parameter of the encryption function, wherein the input parameter of the encryption function includes the sensitive information.

[0030] The above sensitive information is obtained from the input parameters of the underlying system encryption function, and the input parameters of the above encryption function include the above sensitive information. The embodiment of the present invention writes the Frida framework, and uses Hook to hook the common underlying system encryption functions. In the Frida framework, the update and digest functions of the Hook Java class "java.security.MessageDigest" are used to obtain the encryption process parameters of the secure hash algorithm (such as SHA-1, SHA-256, MD5, etc.). The init, update and dofinal functions of the Hook Java class "javax.crypto.Mac" are used to obtain the encryption process functions of the hash message authentication algorithm (such as HMAC-SHA256, HMAC-MD5). The init and dofinal functions of the Hook Java class "javax.crypto.Cipher" are used to obtain the encryption process parameters of common encryption algorithms (such as AES, DES, RSA). The update and sign functions of the Hook Java class "java.security.Signature" are used to obtain the encryption process parameters of the signature algorithm (such as RSA, DSA, ECDSA, etc.).

[0031] Specifically, the sensitive information is converted into a second character string; the second character string is input into N hash functions to obtain N hash values, wherein the N functions include the hash function, and the function values ​​include the hash values.

[0032] The above function is a hash function. The above sensitive information is input into multiple hash functions for hash operation to obtain multiple hash values. The above hash value is a 0 / 1 binary string containing multiple bits, that is, the second string.

[0033] Step S204, determining N target positions corresponding to the N function values ​​in the first character string, and determining the values ​​of the characters at the N target positions to obtain N character values, wherein the first character string includes M characters, and M is an integer greater than N;

[0034] The first string is a 0 / 1 binary string containing M bits, the original state of the first string is that all bits of binary numbers are 0, the function value is a hash value obtained by inputting sensitive information into a hash function and performing a hash operation, and the binary characters at the corresponding positions of the first string are modified according to the size of the hash value. In order to ensure that all function values ​​have corresponding target positions in the first string, M is an integer greater than N.

[0035] Specifically, when the function value is S, the Sth bit in the first character string is determined as the target bit, where S is an integer.

[0036] The position of the function value in the first string is determined according to its size. If a function value is 1011, the target position of the function value in the first string is the 11th position. If the binary character of the 11th position of the first string is 0, it is modified to 1; if the binary character of the first string is 1, it remains unchanged.

[0037] Step S206: Process the sensitive information using the N character values.

[0038] To determine whether a function value has been recorded by the first string, the hash function is also used to find the corresponding position, and check whether the corresponding positions of the first string are all equal to 1. If they are all equal to 1, the element may exist, but it may not be accurate; if the counter value of any position is 0, the element has definitely not been recorded by the first string.

[0039] Specifically, when the N character values ​​have a first value, the sensitive information is recorded in a log; and when the N character values ​​are all a second value, the sensitive information is filtered.

[0040] The first value is 0, and the second value is 1. If the function value of a hash function that performs a hash operation on the sensitive information is 0 in the corresponding position of the first string, it means that the sensitive information has not been recorded by the first string and has not been recorded in the log file, and the sensitive information is recorded in the log. If the function value of the hash function that performs a hash operation on the sensitive information is 1 in the corresponding position of the first string, it means that the sensitive information has been recorded by the first string, and it is filtered without being recorded repeatedly in the log file.

[0041] Specifically, after the sensitive information is recorded in the log, in a case where the first value is located at a first target position in the first character string, the first value at the first target position is replaced with the second value.

[0042] After recording the sensitive information in the log, in order to avoid repeated recording of the sensitive information, if the function value after hashing the sensitive information is 0 at the corresponding position of the first string, the position is modified to 1, indicating that the sensitive information has been recorded.

[0043] The system architecture of the embodiment of the present invention includes the following modules:

[0044] Frida monitoring module: Use Frida injection code to monitor the calls of the application runtime and the underlying system encryption functions through log output, including input parameters, return values, and related context information. The input parameters may include sensitive information such as user privacy information and encryption algorithm keys.

[0045] String processing module: Establish a first string for storing and verifying the known format or characteristics of sensitive information. When hooking the Hook encryption function to obtain sensitive data, first determine whether it has been obtained repeatedly. If not, first store the hooked encrypted data in the first string, and then achieve efficient filtering log output.

[0046] Sensitive information matching module: First, you need to define the standards for sensitive information, such as user passwords, encryption keys, ID numbers, mobile phone numbers, financial information, etc., which are classified as sensitive information. Then, in the filter logs output by the Frdia detection module, the frequently used sensitive information formats are matched through regular expressions. Finally, the security auditors conduct a focused review of the matched sensitive information. If sensitive information is found, subsequent rectification is required. Non-essential information is not encrypted or the underlying encryption algorithm is not used, and the information is encrypted using a custom algorithm.

[0047] Figure 3 is a sensitive information audit flow chart according to an embodiment of the present invention, such as Figure 3 As shown, the process includes the following steps:

[0048] S301, define the standard of sensitive information, for example, classify user passwords, encryption keys, ID numbers, mobile phone numbers, credit card numbers, etc. as sensitive information. And record the format of these sensitive information, which will be used as a regular expression pattern matching algorithm for subsequent audit logs.

[0049] S302, write the Frida detection framework, Hook is to hook the common underlying system encryption functions. In the Frida framework, Hook the update and digest functions of the Java class "java.security.MessageDigest" to obtain the encryption process parameters of the secure hash algorithm (such as SHA-1, SHA-256, MD5, etc.). Hook the init, update and dofinal functions of the Java class "javax.crypto.Mac" to obtain the encryption process functions of the hash message authentication algorithm (such as HMAC-SHA256, HMAC-MD5). Hook the init and dofinal functions of the Java class "javax.crypto.Cipher" to obtain the encryption process parameters of common encryption algorithms (such as AES, DES, RSA). Hook the update and sign functions of the Java class "java.security.Signature" to obtain the encryption process parameters of the signature algorithm (such as RSA, DSA, ECDSA, etc.). After writing the Frida framework, you need to deploy the string processing module in the framework.

[0050] S303, deploy a suitable string processing module according to the size of the APP, for example, set the number of bits of the first string η = 10000, the number of hash functions γ = 5, and the first string parameters can be adjusted in real time according to the monitoring situation in the actual application. In the Frida framework, when the encryption function is hooked, the parameters are first converted into strings for hash calculation. The hash algorithm here can choose the MurmurHash algorithm suitable for high-performance scenarios. Then use the first string to judge the encryption parameter. If the first string contains the encryption parameter, it will return directly without processing. If it does not contain the encryption parameter, the encryption parameter is added to the first string to retain the feature, and finally the encryption parameter is output in the form of a log.

[0051] S304: For the encryption parameter logs monitored by Frida, regular expression matching is performed based on the predefined sensitive information format. For the sensitive information finally found, security personnel need to audit. If sensitive information is found in the encryption parameters carried by the underlying encryption algorithm, it means that this information can also be obtained by malicious attackers, and subsequent rectification is required. For non-essential information, it is necessary to evaluate whether it can be deleted, and for necessary information, it is necessary to evaluate whether to use a custom algorithm instead of the underlying general encryption algorithm.

[0052] In an embodiment of the present invention, based on the dynamic instrumentation feature of Frida, the underlying encrypted information can be captured and processed when the mobile application is running, without static analysis or modification of the application. This method does not consume a large amount of system resources and is suitable for real-time detection on mobile devices. Combining the flexibility of Frida with the efficiency of strings, customized monitoring can be performed for a variety of different types of underlying encrypted information, and different application scenarios can also be easily adapted. Developers can quickly adjust and expand monitoring logic to adapt to changing security needs. By combining Frida's fine-grained dynamic analysis with the fast filtering characteristics of strings, false positives and false negatives can be effectively reduced. Strings can quickly determine whether certain data may be known sensitive information, thereby reducing the time and resources for further analysis. By timely monitoring and processing of underlying encrypted information, it helps to ensure that users' sensitive data (such as identity information, payment information, etc.) are legally and securely stored and processed, thereby further improving user trust.

[0053] Optionally, the executor of the above steps may be a background processor, or other devices with similar processing capabilities, or a machine that integrates at least an image acquisition device and a data processing device, wherein the image acquisition device may include a graphics acquisition module such as a camera, and the data processing device may include a computer, a mobile phone or other terminal, but is not limited thereto.

[0054] Through the above steps, the problem of high resource usage in monitoring sensitive information in related technologies is solved, thereby saving resources and improving the efficiency of efficient monitoring of sensitive information.

[0055] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0056] In this embodiment, a device for processing sensitive information is also provided, which is used to implement the above embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0057] Figure 4 is a structural block diagram of an apparatus for processing sensitive information according to an embodiment of the present invention, such as Figure 4 As shown, the device includes an acquisition module 402, which is used to acquire sensitive information, and input the sensitive information into N functions respectively to obtain N function values, wherein N is an integer greater than or equal to 1; a determination module 404, which is used to determine N target bits corresponding to the N function values ​​in a first character string, and determine the values ​​of the characters on the N target bits to obtain N character values, wherein the first character string includes M characters, and M is an integer greater than N; a processing module 406, which is used to process the sensitive information through the N character values.

[0058] In an exemplary embodiment, the apparatus is further configured to, when the function value is S, determine the Sth bit in the first character string as the target bit, wherein S is an integer.

[0059] In an exemplary embodiment, the above-mentioned device is also used to record the sensitive information in a log when the N character values ​​have a first value; and filter the sensitive information when the N character values ​​are all second values.

[0060] In an exemplary embodiment, the apparatus is further configured to, when the first value is located at a first target position in the first character string, replace the first value at the first target position with the second value.

[0061] In an exemplary embodiment, the above-mentioned device is also used to obtain the sensitive information from the input parameters of the encryption function when the sensitive information is encrypted by the encryption function, wherein the input parameters of the encryption function include the sensitive information.

[0062] In an exemplary embodiment, the above-mentioned device is also used to convert the sensitive information into a second string; input the second string into N hash functions to obtain N hash values, wherein the N functions include the hash function, and the function value includes the hash value.

[0063] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0064] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0065] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0066] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0067] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0068] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0069] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the steps of the method described in each embodiment of the present application when executed by a processor.

[0070] Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the present invention is not limited to any specific combination of hardware and software. The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention can have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing sensitive information, characterized in that: include: Acquire sensitive information, and input the sensitive information into N functions respectively to obtain N function values, where N is an integer greater than or equal to 1; Determine N target positions corresponding to the N function values ​​in a first character string, and determine the values ​​of characters at the N target positions to obtain N character values, wherein the first character string includes M characters, and M is an integer greater than N; The sensitive information is processed through the N character values.

2. The method according to claim 1, characterized in that Determining N target positions corresponding to the N function values ​​in the first character string includes: When the function value is S, the Sth bit in the first character string is determined as the target bit, where S is an integer.

3. The method according to claim 1 or 2, characterized in that: Processing the sensitive information through the N character values ​​includes: If the N character values ​​have a first value, recording the sensitive information in a log; When the N character values ​​are all the second value, the sensitive information is filtered.

4. The method according to claim 3, characterized in that After recording the sensitive information in the log, the method further includes: When the first value is located at a first target position in the first character string, the first value at the first target position is replaced by the second value.

5. The method according to claim 1, characterized in that Access to sensitive information, including: In the case where the sensitive information is encrypted by an encryption function, the sensitive information is obtained from input parameters of the encryption function, wherein the input parameters of the encryption function include the sensitive information.

6. The method according to claim 1, characterized in that The sensitive information is input into N functions respectively to obtain N function values, including: Converting the sensitive information into a second string; The second character string is input into N hash functions to obtain N hash values, wherein the N functions include the hash function, and the function values ​​include the hash value.

7. A device for processing sensitive information, characterized in that: include: An acquisition module, used to acquire sensitive information, and input the sensitive information into N functions respectively to obtain N function values, wherein N is an integer greater than or equal to 1; A determination module, configured to determine N target bits corresponding to the N function values ​​in a first character string, and determine the values ​​of characters at the N target bits to obtain N character values, wherein the first character string includes M characters, and M is an integer greater than N; A processing module is used to process the sensitive information through the N character values.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 6 when executed by a processor.

9. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

Images