A data access marking and shielding device for a sandbox area of ​​a mobile device

Abstract

This invention discloses a data access marking and shielding device for a mobile device sandbox area, belonging to the field of data access control technology. The technical solution disclosed in this invention adds a novel call tracing link, including key nodes such as call initiation, user-mode call, kernel-mode execution, and data processing during the IPC call execution process; it records and marks the data owner and data destination for all external data accesses in the sandbox area, thereby effectively identifying the aforementioned data outflow behavior; finally, these records are summarized and given to the user, who can use a device switch to disable such access operations when data outflow occurs.

Description

Technical Field

[0001] This invention belongs to the field of data access control technology, and in particular relates to a data access marking and shielding device for a mobile device sandbox area. Background Technology

[0002] On mobile devices, user data is stored in a sandbox area (i.e., the software's private data area). On the surface, this area is prohibited from being accessed by other software, but application developers are allowed to share their application's sandbox data with other software. This results in the insecurity and misuse of user privacy data, and this happens without the user's knowledge or when the user is aware but unable to prevent it.

[0003] A typical scenario of sandbox data leakage is an IPC call, or inter-process communication call. For example, software A shares content with software B. Software A's sandbox contains its own private data, such as username, phone number, avatar, device ID, and serial number. When the user uses the sharing function, software A combines this private data from its sandbox into shared data and hands it over to software B. This results in software A's sandbox data leaking to software B. The user may have authorized software A to use its sandbox data normally, but software A directly provides this data to software B without the user's knowledge or ability to prevent it.

[0004] The sharing function mentioned above is just a typical scenario. Other scenarios, such as third-party login, document editing, launching a new page, etc., may all become common scenarios for sandbox data leakage when using IPC calls. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention proposes a data access marking and shielding scheme for mobile device sandbox areas.

[0006] A first aspect of the present invention provides a data access marking and shielding device for a mobile device sandbox area, the device comprising a processing unit configured to perform:

[0007] On the application software A side of the smart device:

[0008] Invoke application software B via IPC call;

[0009] During the IPC call, the package name visitorName of application software A and the process ID visitorId of the data caller are passed in. The package name visitorName of application software A refers to the unique identifier of application software A, and the process ID visitorId of the data caller refers to the process space of application software A.

[0010] On the application software side (B side) of smart devices:

[0011] The data sharing process is initiated, and based on the package name visitorName of application software A, all process IDs created by application software A are queried.

[0012] Here, all process IDs created by application software A are represented as {progressA1, progressA2, ..., progressAn}, where progressAn represents the nth process ID created by application software A;

[0013] The process ID visitorId of the data caller is matched with all process IDs {progressA1, progressA2, ..., progressAn} created by application software A. If a match is found, the process continues; otherwise, the process is terminated.

[0014] Obtain the process ID progressB of application software B, and continue to initiate kernel-mode system calls, passing in the call parameters;

[0015] The calling parameters are {process ID of the data owner: progressB, process ID of the data caller: visitorId}, where the process ID of the application software B itself represents the process ID of the data owner;

[0016] Query the dataTab table, read the switch data corresponding to the passed call parameters, and determine whether to enter the kernel mode system call process based on the switch data;

[0017] Specifically: when the read switch data is "on", the kernel-mode system call process is entered, and an external access record for the relevant data is added and stored in the dataTab data table; when the read switch data is "off", the current process is terminated.

[0018] In this context, application software A is the data caller, and application software B is the data owner.

[0019] According to the apparatus of the first aspect of the present invention, during a kernel-mode system call, the sandbox data sandboxB of application software B is copied via a data pipeline to the process space of application software A corresponding to the process ID visitorId of the data caller.

[0020] According to the apparatus of the first aspect of the present invention, during a kernel-mode system call, the process space of application software A changes from kernel mode to user mode, thereby allowing application software A to obtain sandbox data (sandboxB) of application software B.

[0021] According to the apparatus of the first aspect of the invention, the processing unit is further configured to perform: providing a dataTab data table to system settings software on a smart device to visualize the data flow, the data flow including: application software B providing several bytes of data to application software A and the recorded data provision time.

[0022] According to the apparatus of the first aspect of the invention, the processing unit is further configured to perform: configuring the open or closed state of switch data and updating the configuration record to the dataTab data table.

[0023] A second aspect of this invention provides a method for marking and blocking data access in a mobile device sandbox area, the method comprising:

[0024] On the application software A side of the smart device:

[0025] Invoke application software B via IPC call;

[0026] During the IPC call, the package name visitorName of application software A and the process ID visitorId of the data caller are passed in. The package name visitorName of application software A refers to the unique identifier of application software A, and the process ID visitorId of the data caller refers to the process space of application software A.

[0027] On the application software side (B side) of smart devices:

[0028] The data sharing process is initiated, and based on the package name visitorName of application software A, all process IDs created by application software A are queried.

[0029] Here, all process IDs created by application software A are represented as {progressA1, progressA2, ..., progressAn}, where progressAn represents the nth process ID created by application software A;

[0030] The process ID visitorId of the data caller is matched with all process IDs {progressA1, progressA2, ..., progressAn} created by application software A. If a match is found, the process continues; otherwise, the process is terminated.

[0031] Obtain the process ID progressB of application software B, and continue to initiate kernel-mode system calls, passing in the call parameters;

[0032] The calling parameters are {process ID of the data owner: progressB, process ID of the data caller: visitorId}, where the process ID of the application software B itself represents the process ID of the data owner;

[0033] Query the dataTab table, read the switch data corresponding to the passed call parameters, and determine whether to enter the kernel mode system call process based on the switch data;

[0034] Specifically: when the read switch data is "on", the kernel-mode system call process is entered, and an external access record for the relevant data is added and stored in the dataTab data table; when the read switch data is "off", the current process is terminated.

[0035] In this context, application software A is the data caller, and application software B is the data owner.

[0036] According to the method of the second aspect of the present invention, during a kernel-mode system call, the sandbox data sandboxB of application software B is copied via a data pipeline to the process space of application software A corresponding to the process ID visitorId of the data caller.

[0037] According to the method of the second aspect of the present invention, during a kernel-mode system call, the process space of application software A changes from kernel mode to user mode, thereby allowing application software A to obtain sandbox data (sandboxB) from application software B.

[0038] According to the method of the second aspect of the present invention, a dataTab data table is provided to system settings software on a smart device to visualize the data flow, the data flow including: application software B providing several bytes of data to application software A and the recorded data provision time.

[0039] According to the method of the second aspect of the present invention, the on or off state of switch data is configured, and the configuration record is updated to the dataTab data table.

[0040] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements a method for marking and shielding data access in a mobile device sandbox area, as disclosed in the second aspect of this invention.

[0041] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements a method for marking and masking data access in a mobile device sandbox area according to a second aspect of this disclosure.

[0042] In summary, the technical solution disclosed in this invention adds a novel call tracing link, including key nodes such as call initiation, user-mode call, kernel-mode execution, and data processing during the IPC call execution process; all external data accesses in the sandbox area are recorded and marked with the data owner and data destination, thereby effectively identifying the aforementioned data outflow behavior; finally, these records are summarized and given to the user, and the user is allowed to use a device switch to disable such access operations when data outflow occurs. Attached Figure Description

[0043] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of the data access marking and blocking process in the mobile device sandbox area according to an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] The first aspect of this invention provides a data access marking and shielding device for a mobile device sandbox area, the device comprising a processing unit configured to perform (e.g.) Figure 1 (as shown)

[0047] On the application software A side of the smart device:

[0048] Invoke application software B via IPC call;

[0049] During the IPC call, the package name visitorName of application software A and the process ID visitorId of the data caller are passed in. The package name visitorName of application software A refers to the unique identifier of application software A, and the process ID visitorId of the data caller refers to the process space of application software A.

[0050] On the application software side (B side) of smart devices:

[0051] The data sharing process is initiated, and based on the package name visitorName of application software A, all process IDs created by application software A are queried.

[0052] Here, all process IDs created by application software A are represented as {progressA1, progressA2, ..., progressAn}, where progressAn represents the nth process ID created by application software A;

[0053] The process ID visitorId of the data caller is matched with all process IDs {progressA1, progressA2, ..., progressAn} created by application software A. If a match is found, the process continues; otherwise, the process is terminated.

[0054] Obtain the process ID progressB of application software B, and continue to initiate kernel-mode system calls, passing in the call parameters;

[0055] The calling parameters are {process ID of the data owner: progressB, process ID of the data caller: visitorId}, where the process ID of the application software B itself represents the process ID of the data owner;

[0056] Query the dataTab table, read the switch data corresponding to the passed call parameters, and determine whether to enter the kernel mode system call process based on the switch data;

[0057] Specifically: when the read switch data is "on", the kernel-mode system call process is entered, and an external access record for the relevant data is added and stored in the dataTab data table; when the read switch data is "off", the current process is terminated.

[0058] In this context, application software A is the data caller, and application software B is the data owner.

[0059] According to the apparatus of the first aspect of the present invention, during a kernel-mode system call, the sandbox data sandboxB of application software B is copied via a data pipeline to the process space of application software A corresponding to the process ID visitorId of the data caller.

[0060] According to the apparatus of the first aspect of the present invention, during a kernel-mode system call, the process space of application software A changes from kernel mode to user mode, thereby allowing application software A to obtain sandbox data (sandboxB) of application software B.

[0061] According to the apparatus of the first aspect of the invention, the processing unit is further configured to perform: providing a dataTab data table to system settings software on a smart device to visualize the data flow, the data flow including: application software B providing several bytes of data to application software A and the recorded data provision time.

[0062] According to the apparatus of the first aspect of the invention, the processing unit is further configured to perform: configuring the open or closed state of switch data and updating the configuration record to the dataTab data table.

[0063] A second aspect of this invention provides a method for marking and blocking data access in a mobile device sandbox area, the method comprising (e.g.) Figure 1 (as shown)

[0064] On the application software A side of the smart device:

[0065] Invoke application software B via IPC call;

[0066] During the IPC call, the package name visitorName of application software A and the process ID visitorId of the data caller are passed in. The package name visitorName of application software A refers to the unique identifier of application software A, and the process ID visitorId of the data caller refers to the process space of application software A.

[0067] On the application software side (B side) of smart devices:

[0068] The data sharing process is initiated, and based on the package name visitorName of application software A, all process IDs created by application software A are queried.

[0069] Here, all process IDs created by application software A are represented as {progressA1, progressA2, ..., progressAn}, where progressAn represents the nth process ID created by application software A;

[0070] The process ID visitorId of the data caller is matched with all process IDs {progressA1, progressA2, ..., progressAn} created by application software A. If a match is found, the process continues; otherwise, the process is terminated.

[0071] Obtain the process ID progressB of application software B, and continue to initiate kernel-mode system calls, passing in the call parameters;

[0072] The calling parameters are {process ID of the data owner: progressB, process ID of the data caller: visitorId}, where the process ID of the application software B itself represents the process ID of the data owner;

[0073] Query the dataTab table, read the switch data corresponding to the passed call parameters, and determine whether to enter the kernel mode system call process based on the switch data;

[0074] Specifically: when the read switch data is "on", the kernel-mode system call process is entered, and an external access record for the relevant data is added and stored in the dataTab data table; when the read switch data is "off", the current process is terminated.

[0075] In this context, application software A is the data caller, and application software B is the data owner.

[0076] According to the method of the second aspect of the present invention, during a kernel-mode system call, the sandbox data sandboxB of application software B is copied via a data pipeline to the process space of application software A corresponding to the process ID visitorId of the data caller.

[0077] According to the method of the second aspect of the present invention, during a kernel-mode system call, the process space of application software A changes from kernel mode to user mode, thereby allowing application software A to obtain sandbox data (sandboxB) from application software B.

[0078] According to the method of the second aspect of the present invention, a dataTab data table is provided to system settings software on a smart device to visualize the data flow, the data flow including: application software B providing several bytes of data to application software A and the recorded data provision time.

[0079] According to the method of the second aspect of the present invention, the on or off state of switch data is configured, and the configuration record is updated to the dataTab data table.

[0080] First embodiment (e.g.) Figure 1 (As shown)

[0081] Smart device application software A uses an IPC call to wake up application software B. This IPC call needs to pass the package name of application software A (the unique identifier of the application software) and the process ID of the current caller A, and mark them as visitorName and visitorId.

[0082] Application software B initiates a data sharing process and queries all process IDs created by software A based on the current visitorName. For example, software A currently has three processes: progressA1, progressA2, and progressA3.

[0083] The visitorId is compared with progressA1 / progressA2 / progressA3. If it matches any of the three, the process continues; otherwise, the current process is terminated.

[0084] Application software B obtains its current process ID progressB and continues to initiate a kernel-mode system call, passing in the call parameters {process ID of the data owner: progressB, process ID of the data caller: visitorId}.

[0085] Application software B queries the dataTab data table, reads the current record switch, and if it is on, enters the kernel mode procedure call and adds a data external access record to the dataTab data table; otherwise, it terminates the current process.

[0086] The system kernel-mode procedure call copies the data sandboxB from the application software B's sandbox area to the visitorId process space via a data pipe.

[0087] The visitorId process space moves from kernel mode to user mode, and application software A obtains sandbox data sandboxB.

[0088] The smart device provides the dataTab data table content to the system settings software, displaying the data flow visualization page. For example, the local record shows that application software B provides XX bytes of data to application software A, with the recording time being xxxx-xx-xx.

[0089] Users can click to turn this record switch on or off; the default is on, and the record is written to the dataTab table. For example, to prevent application B from providing data to application A, change the switch of this record to off. If the above operation process is initiated again, no new data flow record will be generated.

[0090] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements a method for marking and shielding data access in a mobile device sandbox area, as disclosed in the second aspect of this invention.

[0091] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements a method for marking and masking data access in a mobile device sandbox area according to a second aspect of this disclosure.

[0092] In summary, the technical solution disclosed in this invention adds a novel call tracing link, including key nodes such as call initiation, user-mode call, kernel-mode execution, and data processing during the IPC call execution process. External access to data in the sandbox area is recorded and marked with the data owner and data destination, thereby effectively identifying the aforementioned data outflow behavior. Finally, these records are aggregated and provided to the user, who can use a device switch to disable such access operations when data outflow occurs. This device can intuitively display the outflow of data in the sandbox area to the user and provide switch control, allowing the user to disable this function, ensuring data security while protecting the user's right to know and control.

[0093] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A data access marking and shielding device for a mobile device sandbox area, characterized in that, The apparatus includes a processing unit configured to perform: On the application software A side of the smart device: Invoke application software B via IPC call; During the IPC call, the package name visitorName of application software A and the process ID visitorId of the data caller are passed in. The package name visitorName of application software A refers to the unique identifier of application software A, and the process ID visitorId of the data caller refers to the process space of application software A. On the application software side (B side) of smart devices: The data sharing process is initiated, and based on the package name visitorName of application software A, all process IDs created by application software A are queried. Here, all process IDs created by application software A are represented as {progressA1, progressA2, ..., progressAn}, where progressAn represents the nth process ID created by application software A; The process ID visitorId of the data caller is matched with all process IDs {progressA1, progressA2, ..., progressAn} created by application software A. If a match is found, the process continues; otherwise, the process is terminated. Obtain the process ID progressB of application software B, and continue to initiate kernel-mode system calls, passing in the call parameters; The calling parameters are {process ID of the data owner: progressB, process ID of the data caller: visitorId}, where the process ID of the application software B itself represents the process ID of the data owner; Query the dataTab table, read the switch data corresponding to the passed call parameters, and determine whether to enter the kernel mode system call process based on the switch data; Specifically: when the read switch data is "on", the kernel-mode system call process is entered, and an external access record for the relevant data is added and stored in the dataTab data table; when the read switch data is "off", the current process is terminated. In this context, application software A is the data caller, and application software B is the data owner.

2. The mobile device sandbox area data access marking and shielding device according to claim 1, characterized in that, During a kernel-mode system call, the sandbox data (sandboxB) of application software B is copied via a data pipeline to the process space of application software A, which corresponds to the process ID (visitorId) of the data caller.

3. The mobile device sandbox area data access marking and shielding device according to claim 2, characterized in that, During a kernel-mode system call, the process space of application software A changes from kernel mode to user mode, allowing application software A to access the sandbox data (sandboxB) of application software B.

4. A data access marking and shielding device for a mobile device sandbox area according to claim 3, characterized in that, The processing unit is also configured to perform the following: provide the dataTab data table to the system settings software on the smart device to visualize the data flow, which includes: application software B providing several bytes of data to application software A and the recorded data provision time.

5. A data access marking and shielding device for a mobile device sandbox area according to claim 4, characterized in that, The processing unit is also configured to perform: configure the on or off state of the switch data, and update the configuration record to the dataTab data table.

6. A method for marking and blocking data access in a mobile device sandbox area, characterized in that, The method includes: On the application software A side of the smart device: Invoke application software B via IPC call; During the IPC call, the package name visitorName of application software A and the process ID visitorId of the data caller are passed in. The package name visitorName of application software A refers to the unique identifier of application software A, and the process ID visitorId of the data caller refers to the process space of application software A. On the application software side (B side) of smart devices: The data sharing process is initiated, and based on the package name visitorName of application software A, all process IDs created by application software A are queried. Here, all process IDs created by application software A are represented as {progressA1, progressA2, ..., progressAn}, where progressAn represents the nth process ID created by application software A; The process ID visitorId of the data caller is matched with all process IDs {progressA1, progressA2, ..., progressAn} created by application software A. If a match is found, the process continues; otherwise, the process is terminated. Obtain the process ID progressB of application software B, and continue to initiate kernel-mode system calls, passing in the call parameters; The calling parameters are {process ID of the data owner: progressB, process ID of the data caller: visitorId}, where the process ID of the application software B itself represents the process ID of the data owner; Query the dataTab table, read the switch data corresponding to the passed call parameters, and determine whether to enter the kernel mode system call process based on the switch data; Specifically: when the read switch data is "on", the kernel-mode system call process is entered, and an external access record for the relevant data is added and stored in the dataTab data table; when the read switch data is "off", the current process is terminated. In this context, application software A is the data caller, and application software B is the data owner.

7. A method for marking and shielding data access in a mobile device sandbox area according to claim 6, characterized in that, During a kernel-mode system call, the sandbox data (sandboxB) of application software B is copied via a data pipeline to the process space of application software A, which corresponds to the process ID (visitorId) of the data caller.

8. A method for marking and blocking data access in a mobile device sandbox area according to claim 7, characterized in that, During a kernel-mode system call, the process space of application software A changes from kernel mode to user mode, allowing application software A to access the sandbox data (sandboxB) of application software B.

9. A method for marking and shielding data access in a mobile device sandbox area according to claim 8, characterized in that, In the method described above: the dataTab data table is provided to the system settings software on the smart device to visualize the data flow, which includes: application software B providing several bytes of data to application software A and the recorded data provision time.

10. A method for marking and blocking data access in a mobile device sandbox area according to claim 9, characterized in that, In the method: configure the on or off state of the switch data, and update the configuration record to the dataTab data table.

Images