Android device intelligent locking method and system based on multi-dimensional security monitoring

Abstract

The invention provides an Android device intelligent locking method and system based on multi-dimensional security monitoring, and relates to the technical field of communication. The method comprises the following steps: monitoring and collecting application installation and operation information through a monitoring module in the Android equipment; whether the software is illegal or not is analyzed by combining a software blacklist or a behavior feature recognition algorithm, and if yes, a locking mechanism is triggered. And meanwhile, acquiring equipment position information and a network IP address, and if the equipment position information and the network IP address do not accord with the preset safety standard, executing locking operation, including sending a locking instruction to enable the equipment to be started to display an illegal prompt and automatically shut down. And finally, after receiving an unlocking instruction of the sending end of the manufacturer, controlling the equipment to unlock the locking state. By implementing the method, potential safety hazards caused by illegal software to the equipment can be effectively prevented, the equipment can be locked under the condition that the equipment is unsafe, and user data security and normal operation of the equipment are effectively protected.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and system for intelligently locking an Android device based on multi-dimensional security monitoring. Background Art

[0002] With the popularity of smartphones, Android devices have become one of the most widely used mobile operating systems in the world. These devices are not only used for daily communication and entertainment, but are also increasingly used to perform sensitive personal and business tasks. Due to its openness, the Android platform faces many security threats.

[0003] In the prior art, the user sets a password to unlock the device when the device is locked or in certain circumstances. The user can also unlock the device by drawing a specific pattern, or by using the fingerprint recognition function of the device. The device can only be unlocked after the registered fingerprint is recognized. The device is locked after multiple unsuccessful unlocks.

[0004] However, the current risk judgment mode of locking the device is single, which is vulnerable to security threats such as malware attacks, data theft, and illegal rooting, resulting in user privacy leakage and developer data theft, and it is difficult to monitor the security risks of Android devices and intelligently lock the device. Therefore, there is an urgent need for an efficient, intelligent and multi-dimensional Android device security monitoring system that can automatically lock the device when illegal operations are detected to ensure device security. Summary of the invention

[0005] The present application provides an Android device intelligent locking method based on multi-dimensional security monitoring, which is used to solve the problems in the prior art that the Android device security monitoring means are single and it is difficult to effectively deal with the problems of illegal software installation and unsafe usage environment, and to achieve comprehensive and accurate identification of illegal software and potential security threats. Under multi-dimensional security monitoring, it is ensured that the device is locked in time when illegal software is installed or in an unsafe environment, so as to effectively protect user data security and the normal operation of the device.

[0006] In the first aspect, the present application provides an Android device smart locking method based on multi-dimensional security monitoring, which is applied to the server of the smart locking system, and the method includes: determining the device operation data corresponding to the Android device through a monitoring module in the Android device, and the monitoring module is used to monitor and collect the application installation information and operation information of the Android device; combining with a preset software blacklist or behavior feature recognition algorithm, analyzing whether the software installed in the device operation data is illegal software; if it is illegal software, triggering the locking mechanism; obtaining the location information and network IP address of the Android device; if the location information or the network IP address does not meet the preset security standard, performing the locking operation, and the security standard refers to the preset standard for judging whether the location information or the network IP address is within the normal usage range, and the locking operation includes sending a locking instruction to the Android device, and the locking instruction is used to make the Android device directly display an illegal operation prompt message and automatically shut down after starting up; after receiving the unlocking instruction sent by the manufacturer's sending end, controlling the Android device to unlock the state.

[0007] By adopting the above technical solution, it is possible to monitor and collect the application installation information and operation information of the device in real time, and accurately determine whether the installed software is illegal software, trigger the locking mechanism in time, and prevent illegal software from causing safety hazards to the device. Obtain the device location information and network IP address, perform the locking operation according to safety standards, ensure that the device cannot be used normally in unsafe conditions, and effectively protect user data security and the normal operation of the device.

[0008] In combination with some embodiments of the first aspect, in some embodiments, after the step of determining the device operation data corresponding to the Android device through a monitoring module in the Android device, it also includes: analyzing the device operation data sent from the Android device to determine whether there is abnormal access behavior in the device operation data, and the abnormal access behavior refers to access behavior that does not conform to normal usage habits or preset rules; if the abnormal access pattern exists, it is determined that the Android device has a potential security threat; and sending a lock command to the Android device to cause the Android device to execute a lock operation.

[0009] By adopting the above technical solution, the device operation data can be analyzed to detect abnormal access behavior. When there is an abnormal access pattern, it is determined that the device has a potential security threat and sends a lock command, which can detect security issues at an early stage and prevent potential threats from further expanding.

[0010] In combination with some embodiments of the first aspect, in some embodiments, after the step of sending a lock instruction to the Android device to cause the Android device to execute a lock operation, it also includes: performing machine learning based on multiple previous device operation data and location data of the Android device, and adjusting the security standard and the abnormal access behavior, the location data including the location information and the network IP address.

[0011] By adopting the above technical solutions, machine learning can continuously optimize the judgment criteria according to the actual use of the device, making security protection more accurate. By learning from a large amount of data, the system can better adapt to the usage habits and environmental changes of different users, improve the effectiveness and adaptability of security protection, and protect the security of devices and user data to the greatest extent.

[0012] In combination with some embodiments of the first aspect, in some embodiments, after receiving the unlocking instruction sent from the manufacturer's sending end, before the step of controlling the Android device to unlock the state, it also includes: if the unlocking operation is not performed within the set time, it is determined that the Android device is lost; after receiving the loss confirmation information sent by the Android device, the loss confirmation information is sent to the user account corresponding to the Android device; after receiving the lost feedback information sent from the client corresponding to the user account, confirm the data to be saved that the user needs to save; control the Android device to upload the data to be saved to the cloud and then destroy it.

[0013] By adopting the above technical solution, user data security can be protected to the greatest extent after the device is lost, and important information leakage can be avoided. Timely confirmation and saving of important data, and then destruction of the device can prevent others from obtaining user sensitive information.

[0014] In combination with some embodiments of the first aspect, in some embodiments, after the step of controlling the Android device to upload the data to be saved to the cloud and then destroying it, it also includes: receiving an Android device location viewing instruction sent by the client; sending the location information of the Android device to the client, so that the user can view the location of the lost Android device on the client.

[0015] By adopting the above technical solution, it is convenient for users to track the whereabouts of lost devices and increase the possibility of recovering the devices. Even if the devices cannot be recovered, it can provide users with certain clues to facilitate further measures, such as reporting to the police, to protect the property safety of users.

[0016] In combination with some embodiments of the first aspect, in some embodiments, if the location information or the network IP address does not meet the preset security standards, then after executing the step of locking the device, it also includes: capturing the user image information corresponding to the Android device through the image recognition module on the Android device; comparing and verifying the user image information through a preset user image library; if the comparison and verification pass, confirming that the user is the target user of the Android device, and sending an unlocking instruction to the Android device; if the comparison and verification fails, sending a strengthened locking instruction to the Android device.

[0017] By adopting the above technical solution, if the comparison verification passes, the unlocking command is sent after confirming that the user is the target user, which can facilitate the legal user to quickly resume the use of the device under the premise of ensuring the safety of the device, avoiding the user being unable to use the device normally due to misjudgment. If the comparison verification fails, a strengthened locking command is sent, which further enhances the security of the device, prevents illegal users from obtaining device permissions, and effectively protects the security of user data and the normal use of the device.

[0018] In combination with some embodiments of the first aspect, in some embodiments, after receiving the unlocking instruction sent from the manufacturer's sending end, after the step of controlling the Android device to unlock the state, it also includes: counting the number of times the Android device is locked within a set time; if the number of locks exceeds a preset threshold within the set time, determining that the Android device is subject to a continuous security threat; controlling the Android device to disable some of the set software functions, and sending an early warning message to the Android device to remind the user that the Android device has a security risk and has restricted some functions.

[0019] By adopting the above technical solution, the security status of the device can be timely understood by counting the number of times the device is locked. On the one hand, the security risks faced by the device can be reduced by disabling some software functions that may pose risks and reducing potential threats. On the other hand, sending early warning information to users can remind users of the security status of their devices and prompt them to take corresponding measures, such as checking device security settings, checking and killing viruses, etc., thereby improving the security and stability of the device and protecting user data and the normal operation of the device.

[0020] In a second aspect, the present application provides a smart lock system, which includes a server, and the server includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, and the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the server to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, the present application provides a computer-readable storage medium comprising instructions, which, when executed on a server, causes the server to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, the present application provides a computer program product, which, when executed on a server, enables the server to execute the method described in the first aspect and any possible implementation manner of the first aspect.

[0023] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. The invention adopts a technical method of setting up a monitoring module in the Android device to monitor and collect application installation and operation information in real time, and combining the software blacklist or behavior feature recognition algorithm to judge illegal software, and obtaining the device location information and network IP address to perform the locking operation according to the safety standards. Therefore, the technical problem that it is difficult to comprehensively and accurately identify illegal software and ensure the safety of the device in an unsafe environment in the existing technology is effectively solved, thereby achieving the technical effect of preventing illegal software from causing security risks to the device and effectively protecting user data security and normal operation of the device in an unsafe environment.

[0024] 2. Since the technical means of receiving loss confirmation information and sending it to the user account after determining that the device is lost is adopted, uploading the data to be saved to the cloud and destroying the device after confirmation is adopted, the technical problem of easy leakage of user data after the device is lost in the prior art is effectively solved, and the technical effect of protecting user data security to the greatest extent after the device is lost and avoiding the leakage of important information is achieved.

[0025] 3. Since the number of times the device is locked within a set time is counted after receiving the unlocking command from the manufacturer, if it exceeds the preset threshold, it is determined that there is a continuous security threat to the device, and the device is controlled to disable some software functions and send early warning information. Therefore, the technical problem that the prior art cannot promptly remind users of device security risks and take measures after the device is locked multiple times is effectively solved, thereby achieving the technical effect of reminding users of the device security status, prompting users to take corresponding measures, improving device security and stability, and protecting user data and normal operation of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flowchart of a method for intelligently locking an Android device based on multi-dimensional security monitoring in an embodiment of the present application; Figure 2 It is another flowchart of the method for intelligently locking an Android device based on multi-dimensional security monitoring in an embodiment of the present application; Figure 3It is a schematic diagram of a physical device structure of a server in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to and includes any or all possible combinations of one or more listed items.

[0028] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0029] By adopting the Android device smart locking method based on multi-dimensional security monitoring in the embodiment of the present application, while achieving comprehensive and accurate identification of illegal software and potential security threats and ensuring that the device is locked in time when illegal software is installed or in an unsafe environment, it can also effectively solve the problems of the existing technology of single security monitoring means for Android devices and difficulty in effectively responding to illegal software installation and unsafe usage environment, thereby achieving the purpose of effectively protecting user data security and normal operation of the device and improving the security of Android devices.

[0030] For ease of understanding, the method provided by this embodiment is described in detail below.

[0031] The server can be a connection port that communicates with multiple Android devices to achieve centralized cloud management. The server has powerful computing and storage capabilities and can process data uploaded from a large number of Android devices at the same time. The server can also be set up as an independent remote server cluster or deployed in a local LAN. By implanting a monitoring module in an Android device, the server can obtain the kernel space information of the device, such as process running status, file operation logs, network connection information, etc. These internal detailed data are inaccessible to third-party applications and ordinary users.

[0032] The server can also instruct the Android device to actively report internal data, such as the current application list, CPU and memory usage of the Android device. The reporting strategy can be periodic or triggered by application or system events. The Android device can have an internal monitoring module to collect data on the internal operating status of the device and the user's operating behavior. The Android device can also have a built-in positioning module to collect the device's geographic location information.

[0033] The following is a description of the process of the method provided by this implementation in combination with the above. Figure 1 , which is a flow chart of the method for intelligent locking of an Android device based on multi-dimensional security monitoring in an embodiment of the present application.

[0034] S101, determining device operation data corresponding to the Android device through a monitoring module in the Android device, where the monitoring module is used to monitor and collect application installation information and operation information of the Android device; Among them, the device operation data may include the data generated by the user's application installation behavior or application operation on the Android device. The application installation information may refer to the software information installed by the user on the Android device, including the software name, version number, installation time and other data. The operation information may be the runtime behavior data of the Android device including CPU and memory usage, network traffic statistics, file access and modification records, system calls and other runtime behavior data. For application installation information, the monitoring module will perform real-time monitoring during the system installation of applications. When a new application is downloaded and begins to be installed, the monitoring module will record the application name, version number, source (for example, whether it is downloaded from the application store or obtained from other third-party channels), installation time and other detailed information. It obtains these key data through the preset installation program related interface and organizes them into a specific data format for subsequent transmission to the server. In terms of collecting application operation information, the monitoring module will continue to track the running application. It can obtain information such as the application's process ID, memory usage, CPU occupancy, network access (including the accessed IP address, port number, and the amount and type of data transmitted).

[0035] In some embodiments, after this step, when the server detects that the abnormal access behavior in the device operation data conforms to the abnormal access mode, it will determine that the Android device has a potential security threat. The abnormal access mode can set a reasonable usage time range and frequency threshold according to the application type and user habits. For example, if the office application is frequently used outside the working hours on weekdays, it is considered abnormal, and the frequency of use of social applications is too high (exceeding a certain proportion of the average number of normal users). It is also considered abnormal. The abnormality is determined by analyzing the application startup time and usage time data. For example, a social application is frequently started from 2 to 4 in the morning. The server analyzes the usage data of this time period and determines it as an abnormal usage frequency in combination with the normal usage time range of the application. Once it is determined that the device has a potential security threat, the server sends a corresponding lock command to the Android device to lock the device. Among them, the security standards and abnormal access behaviors can be dynamically adjusted, which can be implemented as follows: collect various types of operation data allowed by the user in advance, including APP usage, collect the location data of the Android device, including GPS positioning, extract important features that affect the security assessment from the collected data, such as application usage time, number of new applications, access to uncommon locations, etc., manually add labels to some data, and mark normal behavior and abnormal behavior. Use labeled data sets for machine learning to output abnormal behavior labels. Continue to collect operating data of Android devices while users are using the devices normally. If there are misclassifications, re-label the new data and add it to the training set. Use the new data to retrain the model regularly. The next time you determine the safety standard, it will be the new adjusted safety standard.

[0036] S102, analyzing whether the software installed in the device operation data is illegal software in combination with a pre-set software blacklist or behavior feature recognition algorithm; The server maintains a comprehensive software blacklist database, which contains information on known pirated software, software containing malicious code, illegal software, etc. The server can identify illegal software in the following two ways: 1) Software signature comparison: The server extracts the software name, version number, digital signature and other data from the application installation information uploaded by the Android device, and compares it with the blacklist database. If the installed software is found in the blacklist library, it is judged as illegal software. 2) Behavioral feature analysis: The server collects software running information, such as frequent modifications of key system files, suspicious network connections, and requests to access private data. The server compares these behavioral features with the known malware behavior library through machine learning algorithms. If the match exceeds the threshold, the software is judged to have potential risks.

[0037] To improve the accuracy of the judgment, the server can use the above two technical means in combination. If the software signature is in the blacklist, it will be directly determined as illegal. If suspicious signs are detected only through behavioral analysis, the server can issue more detailed monitoring instructions to track other potentially dangerous behaviors of the software to confirm whether it is illegal.

[0038] If it is illegal software, execute step S103; If it is not illegal software, the locking mechanism will not be triggered.

[0039] S103, triggering the locking mechanism; When the server determines that there is illegal software on the Android device, it will start the lock program to restrict the device. Specific technical means may include: 1) Send a lock command. After the device's lock module receives the command, a lock prompt interface pops up, requiring the user to enter the unlock password within a limited time. If the timeout period expires, the device automatically restarts and enters the lock screen state. 2) Instruct the Android device to directly cut off the connection with the illegal software and force it to stop running. At the same time, a lock prompt interface pops up to prompt the details of the illegal software and require the user to uninstall it. 3) Send an enhanced lock command. At this time, the device will cut off the network connection, lock the screen touch function, and only allow basic communication applications to be executed, waiting for the user to unlock or remote control commands. 4) Send a complete lock command. The device enters a deep lock screen state. The core hardware such as the graphics processor and wireless module suspend work, turn off the screen display, and only respond to the smallest external commands or physical operations. For different levels of illegal software risks, the server can send lock commands of different strengths and take gradual restriction measures to stop illegal behavior and avoid excessive impact on normal user use. At the same time, the lock prompt interface will also show the user the name of the illegal software, the risk level and other information, and guide the user to actively monitor and uninstall it.

[0040] S104, obtaining the location information and network IP address of the Android device; If no illegal software is detected, the location information and network IP address of the Android device can be obtained through the following technical means: 1) Command the Android device to actively report its current GPS positioning data or network positioning information, such as base station positioning, WiFi positioning, etc. The device will start the built-in positioning module, obtain its own latitude and longitude coordinates or detailed location description, and transmit it to the server in real time. 2) Obtain the base station information of the device, including the unique identification code of the mobile cellular base station to which the device is currently connected, to determine the approximate location range of the device. This method can be used as a supplementary means of network positioning. 3) Extract the source IP address of the communication between the device and the server as the current network positioning information of the device. The server can analyze the subnet range and network operator of the IP address to determine the network environment of the device.

[0041] The acquired location data and IP address will serve as an important reference for multi-dimensional judgment on whether the device is in a normal use environment. The server can also continuously track this data, analyze the device's usage trajectory, and discover potential abnormal behaviors.

[0042] S105, if the location information or the network IP address does not meet the preset safety standard, a locking operation is performed, wherein the safety standard refers to a preset standard for determining whether the location information or the network IP address is within a normal usage range, and the locking operation includes sending a locking instruction to the Android device, wherein the locking instruction is used to cause the Android device to directly display an illegal operation prompt message and automatically shut down after being turned on; Specifically, the server will first analyze the location information, which may include various forms, such as longitude and latitude coordinates and more detailed address descriptions (such as cities, street names, etc.). The server will compare the current location information obtained with the historical location information of the device. If the device usually moves in a specific area, such as a certain area of ​​a city or within a city, and the current location information shows that the device appears in an abnormal location, such as a place far away from the regular activity area, this may indicate that the device has been stolen or is in an unsafe environment. The server will also consider the user's preset location-related information. For example, the user may set a daily activity range, which can be a circular area or a polygonal area centered on the place where he or she often moves. The server will use an algorithm to determine whether the current location is within this preset range. If not, it may not meet the safety standards. The setting of this preset range can be operated by the user through a specific application interface, or the server can automatically generate a reasonable range based on the historical location data of the device.

[0043] In addition to comparing with historical locations and preset ranges, the server will also make a comprehensive judgment based on other factors. For example, if the device changes locations frequently in a short period of time and there is no reasonable movement track between these locations (such as jumping from one city to another in an instant), this may also be regarded as an abnormal situation and does not meet security standards. For network IP addresses, the server will determine whether it belongs to a legal network environment. If the device is used in a specific network environment, such as an enterprise intranet, the server will know the IP address range corresponding to the network. If the obtained device IP address is not within this range, there may be a security risk. For example, the device may be taken out of the enterprise environment, or the IP address may be changed through a proxy server or other means after being attacked by a hacker.

[0044] The server also analyzes the stability of the IP address. If the device's IP address changes frequently, this may mean that the device is in an unstable network environment, or that there is malware that is constantly trying to change the IP address to evade detection. In addition, the server checks the network operator information corresponding to the IP address. If the device suddenly connects to an unfamiliar network operator, this may also be an abnormal signal that does not meet security standards. When the server determines that the location information or network IP address does not meet security standards, it will send a lock command to the Android device. This lock command is designed based on a protocol format that can be recognized by Android devices. Before sending the command, the server will encrypt the command to ensure that the command is not tampered with or forged during transmission.

[0045] After receiving the lock command, the Android device will start the internal lock program. First, the current running status of the Android device will be obtained, including the list of running applications, system resource usage, etc. Then, the control module of the Android device will forcefully close all running applications to prevent possible malware from continuing to run and causing further harm. At the same time, the system settings of the Android device will be modified so that the device will directly enter the locked state the next time it is turned on. In the locked state, the Android device will display a specific illegal operation prompt message to inform the user that the device has been locked due to location or network abnormalities. In addition, the lock program will also set a timer. When the device enters the locked state, if no legal unlock command is received within a certain period of time, the device will automatically shut down to further protect the security of the device.

[0046] In some embodiments, if the user's Android device is locked, the user can use facial recognition to unlock it. The server can instruct the Android device to start its built-in image recognition module, which can call the front camera to capture the facial image of the current user. The server persistently stores the facial image data of the official user corresponding to the Android device, forming a preset user image library. The server can use a variety of biometric algorithms to process and compare the acquired facial images to improve the accuracy of verification. Once the server determines that the facial recognition result is consistent with the user facial information stored in the preset image library, that is, the current user is identified as the target user of the Android device, the server will generate an unlock instruction and send it to the Android device, and the instruction contains an encrypted and authenticated unlock code. If the facial comparison result does not match the preset library, the server determines that the current illegal user is trying to unlock, so it sends a strengthened lock instruction to the Android device, which will cause the Android device to enter the reinforced lock screen logic, start the maximum hardware and software protection measures, turn off multiple input and output functions, and encrypt or delete important data in the device to prevent leakage.

[0047] S106: After receiving the unlock instruction sent by the manufacturer, control the Android device to unlock the device.

[0048] The server receives the unlock command sent by the manufacturer through a pre-established communication channel. When an Android device is locked, the user can submit an unlock application on the manufacturer's official website or application. It is necessary to provide device information, lock reason, etc. to apply for unlocking. After the manufacturer receives the application, a specialist will manually review it to confirm whether the lock is a false alarm and whether it can be unlocked. If necessary, the user can also provide more proof materials. If the manufacturer confirms that it can be unlocked, it will send an unlock command to the server through the established secure channel. The command contains the device's unique identification code, unlock operation code, certificate signature and other information. After receiving the command, the server first performs a format check and then verifies the manufacturer's digital certificate. If they are consistent, it confirms that the source of the command is authentic and valid. The server decodes the command, searches for the locked device according to the device identification code, and performs a series of unlocking operations such as restarting, loading a normal system, and deleting illegal software. Finally, the server feeds back the unlock result of the device to the manufacturer. If successful, the user's device will return to normal. The server can record the unlocking process, including recording relevant information about the unlocking command (such as the source of the command, sending time, receiving time, etc.), and relevant information about the device unlocking (such as the device identifier, lock reason, unlocking time, unlocking result, etc.). These records can be used for subsequent security audits and troubleshooting.

[0049] In the embodiment of the present application, a monitoring module is set in the Android device to monitor application installation information, illegal software is judged in combination with the software blacklist, the device location and network information are obtained to determine security, and a lock command is sent under abnormal circumstances. This technical problem of the inability to comprehensively monitor the security status of the device and respond to security incidents in the prior art is effectively solved, so that the device can make a timely response and intelligent lock when facing illegal software and an unsafe state.

[0050] In some embodiments, the server will count the number of times each Android device is locked within a certain period of time (such as 1 month), which can reflect the frequency of security incidents encountered by the device. The server will pre-set a threshold for the number of locks, which can be obtained based on the data analysis of past device lock situations. If the number of locks of a device exceeds the threshold, it indicates that the device has a persistent security threat. For devices with persistent security threats, the server can issue instructions to disable some software functions on the device, especially some functions related to sensitive permissions. For example, disabling the function of installing applications from unknown sources, disabling the function of accessing specific files or hardware interfaces, etc., reduces the risk of the device being exploited. While issuing the prohibition of using some software functions, the server will also construct an early warning notification message and send it to the client where the corresponding user account is located. The early warning message will inform that the device is assessed to have a security risk and list the disabled function items. The message can be displayed through a pop-up window on the client, and various notification modes can also be integrated, such as emails, text messages, etc. In this way, the correlation analysis of the device lock situation is realized, and a progressive management and control method is adopted, which can deal with the situation of multiple device locks in a smarter and safer way.

[0051] In some scenarios, if the Android device is indeed illegally hacked or stolen, a series of preset security measures can be triggered to protect the data in the device and prevent the device from being further abused. The following is a more detailed description of the process of the method provided by this implementation. Figure 2 , which is another flow chart of the method for intelligent locking of an Android device based on multi-dimensional security monitoring in an embodiment of the present application.

[0052] S201, if the unlocking operation is not performed within the set time, it is determined that the Android device is lost; The server sets a specific unlock operation time threshold for each Android device. This threshold is determined based on the analysis of a large number of device usage habits and security requirements. For example, for ordinary consumer-grade Android devices, it may be set to 24 hours; for enterprise-level devices, it may be set to a shorter time, such as 8 hours, based on the company's security policy. The server will continue to track the lock time of each device and compare it with the set time threshold. When the device enters the locked state, the server will start a timer to record the time when the lock starts. During the timer operation, if the device does not perform any unlocking operation within the set time, the server will preliminarily determine that the device may have been lost or stolen.

[0053] In addition to time monitoring, the server also analyzes the device's status and behavior during the locked state. For example, the server will continue to obtain the device's location information (if the device can still provide location information when it is locked). If the device's location changes abnormally during the locked state, such as moving from a familiar location (such as the user's home address or workplace) to an unknown or abnormal location, this will also increase the possibility of the device being lost.

[0054] The server also checks the device's network connection. If the device attempts to connect to some unfamiliar network during the lock period, or the network connection is disconnected and reconnected abnormally frequently, this may indicate that the device is in an abnormal state and may have been lost and operated by someone else.

[0055] The server can also perform correlation analysis with other devices under the same user account. If a user has multiple Android devices, when one of the devices enters a locked state and has not been unlocked for a long time, the server can check the usage of other devices. If other devices show signs of normal user use (such as normal application usage records, location information consistent with the user's daily activities, etc.), and the locked device has no corresponding unlock operation, this will also increase the possibility of judging that the device is lost.

[0056] In some embodiments, when the device is not unlocked at a set time and shows some signs of possible loss, including abnormal location or network, the system will send an early warning message to the user's pre-registered emergency contact (such as a mobile phone number or email address). The early warning message can include basic information about the device (such as the device model) and a description of the current abnormal situation, reminding relevant personnel to pay attention to the status of the device so that timely measures can be taken, such as trying to contact the user to confirm the location of the device or reporting it to relevant agencies.

[0057] S202, after receiving the loss confirmation information sent by the Android device, sending the loss confirmation information to the user account corresponding to the Android device; If an Android device has not been unlocked for a long time, it will actively send a loss confirmation message to the server. The loss confirmation message may contain key information such as the device identifier, the device's current location information, and the timestamp of the message being sent. The server will search for the corresponding user account based on the device identifier, because in some cases, if the Android device is lost, the user may use another Android device to log in to his or her account. The server maintains a database of device and user account associations. By searching this database, the server can accurately find the user account to which the device belongs. Once the user account is found, the server will send the received loss confirmation message to the user account.

[0058] S203, after receiving the lost feedback information sent by the client corresponding to the user account, confirm the data to be saved that the user needs to save; After the user logs in to the account on the client of another Android device and sees the loss confirmation information, he can use the client to feedback to the server whether the data has been lost. At the same time, the user can also send the selection result about the data to be saved on the original Android device and whether to delete the remaining other data to the server through the client. The server sends instructions to the Android device based on the data information to be saved confirmed by the user, requiring it to identify and extract the corresponding data. The Android device will search for the data to be saved in the local storage according to the instructions. For example, if the data to be saved is contact information, the Android device will extract the relevant data from the contact database; if it is a photo, it will get the corresponding file from the album storage location.

[0059] S204, controlling the Android device to upload the data to be saved to the cloud and then destroying it; The Android device uploads the encrypted and compressed data to be saved to the cloud through the established secure connection. The server receives and stores the data through the cloud. The user can log in to the user account on other Android devices to download the saved data from the cloud. After the upload is completed, the server will send a command to the Android device, asking it to delete the data in the Android device.

[0060] S205, receiving an Android device location viewing instruction sent by the client; When the user confirms that the Android device is lost on the client, the user can send a device location check command to the server on the client to request the current location information of the Android device. The command can include user account information, device identification information, etc., which is used by the server to identify which user has made the location check request for which device. After receiving the location check command, the Android device sends its location information to the server.

[0061] S206. Send the location information of the Android device to the client, so that the user can view the location of the lost Android device on the client.

[0062] After obtaining the device location information, the server will send it to the user's client. The location information will be displayed on the client's user interface in the form of a visual map, so that the user can intuitively view the specific location of the lost device.

[0063] In the embodiment of the present application, since a technical solution is adopted to confirm that the device is lost and obtain its location information when the device has not been unlocked for a long time, send loss confirmation information to the user account, and then perform cloud backup and device destruction after the user determines that the data needs to be saved, it effectively solves the technical problem that the prior art cannot promptly and actively respond to the loss of the device, reduces the risk of user data leakage and illegal use of the device, and further achieves the technical effect of protecting user data security and deleting sensitive information to the greatest extent after the device is lost.

[0064] The following describes the server in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , is a schematic diagram of a physical device structure of a server in an embodiment of the present application.

[0065] It should be noted that Figure 3 The structure of the server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0066] like Figure 3 As shown, the server includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method described in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0067] The following components are connected to the I / O interface 305: an input section 306 including an audio input device, a button switch, etc.; an output section 307 including a liquid crystal display (LCD) and an audio output device, an indicator light, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0068] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0069] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0070] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings.

[0071] Specifically, the server of this embodiment includes a processor and a memory. A computer program is stored in the memory. When the computer program is executed by the processor, the smart locking method for Android devices based on multi-dimensional security monitoring provided in the above embodiment is implemented.

[0072] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the server described in the above embodiment; or may exist independently without being assembled into the server. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of the server, the server implements the Android device smart lock method based on multi-dimensional security monitoring provided in the above embodiment.

[0073] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0074] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0075] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A smart locking method for Android devices based on multi-dimensional security monitoring, applied to a server of a smart locking system, characterized in that: The method comprises: Determine the device operation data corresponding to the Android device through a monitoring module in the Android device, wherein the monitoring module is used to monitor and collect application installation information and operation information of the Android device; Analyze whether the software installed in the device operation data is illegal software by combining a pre-set software blacklist or behavior feature recognition algorithm; If it is illegal software, the locking mechanism is triggered; Obtaining the location information and network IP address of the Android device; If the location information or the network IP address does not meet the preset safety standard, a locking operation is performed, wherein the safety standard refers to a preset standard for judging whether the location information or the network IP address is within the normal use range, and the locking operation includes sending a locking instruction to the Android device, wherein the locking instruction is used to make the Android device directly display an illegal operation prompt message and automatically shut down after being turned on; After receiving the unlocking instruction sent by the manufacturer's sending end, the Android device is controlled to unlock the device.

2. The method according to claim 1, characterized in that After the step of determining the device operation data corresponding to the Android device through the monitoring module in the Android device, the method further includes: Analyze the device operation data sent from the Android device to determine whether there is abnormal access behavior in the device operation data, where the abnormal access behavior refers to access behavior that does not conform to normal usage habits or preset rules; If the abnormal access mode exists, it is determined that there is a potential security threat to the Android device; Send a lock instruction to the Android device so that the Android device performs a lock operation.

3. The method according to claim 2, characterized in that After sending a lock instruction to the Android device so that the Android device performs a lock operation, the method further includes: The security standard and the abnormal access behavior are adjusted by performing machine learning based on a plurality of previous device operation data and location data of the Android device, wherein the location data includes the location information and the network IP address.

4. The method according to claim 1, characterized in that: After receiving the unlocking instruction sent by the manufacturer's sending end, before the step of controlling the Android device to unlock the state, the method further includes: If the unlocking operation is not performed within the set time, it is determined that the Android device is lost; After receiving the loss confirmation information sent by the Android device, sending the loss confirmation information to the user account corresponding to the Android device; After receiving the lost feedback information sent by the client corresponding to the user account, confirm the data to be saved that the user needs to save; The Android device is controlled to upload the data to be saved to the cloud and then destroy it.

5. The method according to claim 4, characterized in that After the step of controlling the Android device to upload the data to be saved to the cloud and then destroying it, the method further includes: Receiving an Android device location viewing instruction sent by the client; The location information of the Android device is sent to the client, so that the user can view the location of the lost Android device on the client.

6. The method according to claim 1, characterized in that If the location information or the network IP address does not meet the preset security standard, after executing the step of locking the device, the method further includes: Capturing user image information corresponding to the Android device through an image recognition module on the Android device; Comparing and verifying the user image information through a preset user image library; If the comparison and verification pass, the user is confirmed to be the target user of the Android device, and an unlock instruction is sent to the Android device; If the comparison verification fails, a strengthened locking instruction is sent to the Android device.

7. The method according to claim 1, characterized in that After receiving the unlocking instruction sent by the manufacturer's sending end, after the step of controlling the Android device to unlock the state, the method further includes: Count the number of times the Android device is locked within a set period of time; If the number of lock times exceeds a preset threshold within the set time, it is determined that there is a continuous security threat to the Android device; The Android device is controlled to disable some of the set software functions, and an early warning message is sent to the Android device to remind the user that the Android device has security risks and some functions are restricted.

8. A smart lock system, comprising a server, characterized in that: The server includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the server to execute the method described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a server, the server is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a server, the server is caused to execute the method according to any one of claims 1 to 7.

Images