Device protection method and device based on Windows system and storage medium

Abstract

The invention relates to the field of equipment protection, and discloses an equipment protection method and equipment based on a Windows system and a storage medium. The method comprises the steps that the Windows service process is created, the stopping / unloading permission of the Windows service process is set, and the stopping / unloading permission comprises that a non-designated user does not have the stopping / unloading permission; the method comprises the following steps: activating a Windows service process, calling a WTSQueraUserToken function, and obtaining a user token of a window at the topmost end of a desktop; the user token is transmitted into a Create ProcessAsUser function, a pop-up window process is created and activated, and the pop-up window process comprises the steps of verifying an input box and verifying a password; receiving an input password of the user through the verification input box, and judging whether the input password is equal to the verification password; if not, returning to the Windows service process and the pop-up window process; and if yes, closing the pop-up window process and the Windows service process to unlock the equipment. In the embodiment of the invention, a window permission mechanism is improved by utilizing the user token, and compatible protection on the equipment data in different scenes is realized without depending on a driver.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of device protection, and in particular to a device protection method based on a Windows system, a device and a storage medium. BACKGROUND

[0002] With the rapid development of society, the popularity of electronic devices greatly facilitates work and life, but also brings many problems. For example, children are addicted to computers, mobile phones and other devices, resulting in a decline in academic performance, impaired vision, and even affecting mental health. In the enterprise environment, due to the high risk of company data leakage due to employee device usage, it has brought great challenges to enterprise security management. Therefore, it is particularly necessary to propose a technology to limit user Windows device usage for different scenarios, to realize intelligent management of device protection through technical means, and to reduce the risk of data leakage.

[0003] Although the existing technology can achieve high security by limiting and intercepting target usage through driver protection, the implementation process is complex and not convenient. Since different versions of operating systems have different compatibility requirements for drivers, the development and deployment costs are significantly increased, and system instability may be caused. Therefore, the existing Windows device protection scheme lacks compatibility, and it is difficult to flexibly adjust to different scenarios, so a new technology is needed to solve the current problem. SUMMARY

[0004] The main purpose of the present application is to solve the technical problem that the Windows device protection scheme lacks compatibility and is difficult to flexibly adjust to different scenarios.

[0005] The first aspect of the present application provides a device protection method based on a Windows system, comprising the steps of: creating a Windows service process, and setting the stop / uninstall permission of the Windows service process, wherein the stop / uninstall permission includes that non-designated users do not have stop / uninstall permission; activating the Windows service process, calling the WTSQueryUserToken function, and obtaining the user token of the topmost window of the desktop; passing the user token into the CreateProcessAsUser function to create and activate a pop-up process, wherein the pop-up process includes a verification input box and a verification password; receiving the input password of the user through the verification input box, and determining whether the input password is equal to the verification password; when the input password is not equal to the verification password, returning the Windows service process and the pop-up process; When the verification password is equal to the input password, the pop-up process and the Windows service process are closed, and device unlocking is realized.

[0006] Optionally, in the first implementation manner of the first aspect, the device protection method based on the Windows system is applied to a device protection system based on the Windows system, and the device protection system based on the Windows system comprises a webpage system, a service system, a device system, the creating of the Windows service process, and the setting of the stop / uninstall permission of the Windows service process. The webpage system receives a device restriction rule input by a user, and sends the device restriction rule to the service system. The service system receives the device restriction rule, and distributes the device restriction rule to the device system. The device system receives the device restriction rule, creates a Windows service process, and sets a stop / uninstall permission of the Windows service process according to the device restriction rule.

[0007] Optionally, in the second implementation manner of the first aspect, after the closing of the pop-up process and the Windows service process and the realization of device unlocking, the method further comprises: The device system sends unlocking information to the service system. The service system receives the unlocking information, and sends the unlocking information to the webpage system, so as to inform a user of a state of the device system.

[0008] Optionally, in the third implementation manner of the first aspect, the activating of the Windows service process and the calling of the WTSQueryUserToken function to obtain a user token of a topmost window of a desktop comprise: The Windows service process is activated, and a console session ID of the topmost window of the desktop is obtained. The console session ID is transmitted into the WTSQueryUserToken function, and a user token corresponding to the console session ID is obtained.

[0009] Optionally, in the fourth implementation manner of the first aspect, the obtaining of the console session ID of the topmost window of the desktop comprises: The WTSGetActiveConsoleSessionId function is called, and the console session ID of the topmost window of the desktop is obtained.

[0010] Optionally, in a fifth implementation form of the first aspect of the present application, the activating the Windows service process, calling the WTSQueryUserToken function, and obtaining the user token of the topmost window of the desktop further include: activating the Windows service process, and obtaining the window handle of the topmost window of the desktop; obtaining the process ID corresponding to the window handle; obtaining the session ID corresponding to the topmost window of the desktop according to the process ID; passing the console session ID into the WTSQueryUserToken function to obtain the user token corresponding to the console session ID.

[0011] Optionally, in a sixth implementation form of the first aspect of the present application, the obtaining the session ID corresponding to the topmost window of the desktop according to the process ID further includes: calling the OpenProcess function to open the window process corresponding to the process ID; calling the GetProcessSessionId function to obtain the session ID corresponding to the window process.

[0012] Optionally, in the sixth implementation form of the first aspect of the present application, after the passing the user token into the CreateProcessAsUser function to create and activate the pop-up process, the method further includes: when receiving a forced closing instruction of the pop-up process by a user, the Windows service process creates and activates a new pop-up process as a daemon process.

[0013] The second aspect of the present application provides a device protection device based on a Windows system, which includes a memory and at least one processor, the memory stores instructions, and the memory and the at least one processor are interconnected through a circuit; the at least one processor calls the instructions in the memory to enable the device protection device based on the Windows system to perform the device protection method based on the Windows system.

[0014] The third aspect of the present application provides a computer readable storage medium, which stores instructions, and when the instructions are run on a computer, the computer performs the device protection method based on the Windows system.

[0015] In the embodiment of the present application, by using the system characteristics and system built-in functions of the Windows device, the window permission mechanism is improved by using the user token, the function of preventing the pop-up box from being always placed at the forefront in all Windows operating systems is set, the device protection effect is stable and reliable, the compatible protection of device data in different scenes is realized without relying on the driver, and the technical problems of lack of compatibility of the Windows device protection scheme and difficulty in flexible adjustment for different scenes are solved. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 An embodiment of the device protection method based on the Windows system in the embodiment of the present application is shown. Figure 2 An embodiment of the first specific embodiment of the step 102 of the device protection method based on the Windows system in the embodiment of the present application is shown. Figure 3 An embodiment of the second specific embodiment of the step 102 of the device protection method based on the Windows system in the embodiment of the present application is shown. Figure 4 An embodiment of the device protection device based on the Windows system in the embodiment of the present application is shown. DETAILED DESCRIPTION

[0017] The embodiment of the present application provides a device protection method based on a Windows system, a device and a storage medium.

[0018] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms, and should not be interpreted as being limited to the embodiments described herein, but rather, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present application are only for illustrative purposes, and are not intended to limit the scope of protection of the present application.

[0019] In the description of the embodiments of the present application, the term "comprising" and similar terms should be understood as open inclusion, i.e. "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. can refer to different or same objects. Other explicit and implicit definitions can also be included below.

[0020] For the sake of understanding, the specific process of the embodiment of the present application is described below, please refer to Figure 1 An embodiment of the device protection method based on the Windows system in the embodiment of the present application comprises: 101. creating a Windows service process, and setting a stop / uninstall permission of the Windows service process, wherein the stop / uninstall permission comprises that a non-designated user has no stop / uninstall permission; In the embodiment, a Windows service process is created, and the stop / uninstall permission of the Windows service process can only be set to a built-in administrator, and a normal user / administrator has no stop / uninstall permission of the Windows service process. The specific setting can be as listed below: <!-- D: indicates a permission setting (Discretionary Access Control List, freely accessible control list) --> <d> <!-- Allow system (SY) to have CCLCSWRPLORC rights on this resource --> <A;;CCLCSWRPLORC;;;SY> <!-- Allow built-in administrators (BA) to have CCLCSWRPLOCRRCWDWO rights on this resource --> <A;;CCLCSWRPLOCRRCWDWO;;;BA> <!-- Allow authenticated users (AU) to have CCLCSWRPLORC rights on this resource --> <A;;CCLCSWRPLORC;;;AU> <!-- Allow Power Users (PU) to have CCLCSWRPLORC rights on this resource --> <A;;CCLCSWRPLORC;;;PU> <!-- Allow interactive users (IU) to have CCLCSWLOCRRC rights on this resource --> <A;;CCLCSWLOCRRC;;;IU> <!-- Allow services (SU) to have CCLCSWLOCRRC rights on this resource --> <A;;CCLCSWLOCRRC;;;SU> < / d> "CCLCSWRPLORC", "CCLCSWLOCRRC", "CCLCSWRPWPDTLOCRRC" are SDDL (Security Descriptor Definition Language) strings used to represent service permissions in the Windows system, and the built-in administrator (BA) is set with the following permissions: CC: SERVICE_QUERY_CONFIG, query service configuration.

[0021] LC: SERVICE_QUERY_STATUS, query service status.

[0022] SW: SERVICE_ENUMERATE_DEPENDENTS, enumerate service dependencies.

[0023] RP: SERVICE_START, start service.

[0024] LO: SERVICE_INTERROGATE, query the current state of the service.

[0025] CR: SERVICE_USER_DEFINED_CONTROL, perform user-defined control operations.

[0026] RC: READ_CONTROL, read the security descriptor of the service.

[0027] WD: WRITE_DAC, change the permissions of the service.

[0028] WO: WRITE_OWNER, change the owner of the service.

[0029] Clearly, the built-in administrator (BA) settings offer additional permissions compared to "CCLCSWRPLORC" and "CCLCSWLOCRRC," including the ability to modify services and change the service owner. Alternatively, the built-in administrator (BA) permissions can be set to "CCDCLCSWRPWPDTLOCRSDRCWDWO," which allows you to assign stop / uninstall permissions to a specific user, while leaving other users without these permissions. The designated user is the administrator ultimately managing the Windows service process, while other users using the Windows service process are not granted stop / uninstall permissions.

[0030] Furthermore, the device protection method based on the Windows system is applied to a device protection system based on the Windows system, which includes a web system, a service system, and a device system. Step 101 includes the following specific implementation methods: 1011. The webpage system receives device restriction rules input by the user and sends the device restriction rules to the service system; 1012. The service system receives the device restriction rules and distributes the device restriction rules to the device system; 1013. The device system receives the device restriction rules, creates a Windows service process, and sets the stop / uninstall permissions for the Windows service process according to the device restriction rules.

[0031] In steps 1011-1013, the creation and configuration of Windows service processes are handled by the web interface of the web system and distributed to various device systems by the service system's server. Users can control the parameter settings of Windows service processes on multiple device systems through the web interface, achieving one-to-many device protection settings. On the web system, users can input device restriction rules, which can set the activation time range of the Windows service process, stop / uninstall permissions for ordinary users / administrators / built-in administrators, and permissions for interactive users. Device restriction rules are injected after the Windows service process is created, enabling customized settings for the Windows service process on different devices.

[0032] 102. Activate the Windows service process, call the WTSQueryUserToken function, and obtain the user token of the topmost window on the desktop; In this embodiment, the Windows service process is activated, and the WTSQueryUserToken function in the Windows application service is called to obtain the user token of the topmost window on the desktop.

[0033] For details, please refer to Figure 2 , Figure 2 This is a schematic diagram of the first specific embodiment of step 102 of the device protection method based on the Windows system in this invention. In the first specific embodiment, step 102 includes the following specific implementation methods: 1021. Activate the Windows service process and obtain the console session ID of the topmost window on the desktop; 1022. Pass the console session ID to the WTSQueryUserToken function to obtain the user token corresponding to the console session ID.

[0034] In steps 1021-1022, activate the Windows service process by directly retrieving the session ID of the topmost window on the desktop using `WTSGetActiveConsoleSessionId()`. After obtaining the session ID, pass it to the parameters of the `WTSQueryUserToken` function. For example, to set the session ID to `dwSessionId`, you can pass it in as follows: HANDLE hUserToken; BOOL bRet = WTSQueryUserToken(dwSessionId,&hUserToken); if (!bRet) { / / Error handling } After passing in the session ID, the user token hUserToke is obtained.

[0035] Specifically, step 1021, "obtaining the console session ID of the topmost window on the desktop," includes the following specific implementation methods: 10211. Call the WTSGetActiveConsoleSessionId function to get the console session ID of the topmost window on the desktop.

[0036] In step 10211, the built-in Windows service function WTSGetActiveConsoleSessionId is called to obtain the console session ID (dwSessionId) of the topmost window on the desktop. The specific implementation can be found below: DWORD dwSessionId; dwSessionId = WTSGetActiveConsoleSessionId(); if (dwSessionId == 0xFFFFFFFF) { / / Error handling } Assign the value of dwSessionId to WTSGetActiveConsoleSessionId() to obtain the console session ID.

[0037] For details, please refer to Figure 3 , Figure 3 This is a schematic diagram of the second specific embodiment of step 102 of the device protection method based on the Windows system in this invention. In the second embodiment, step 102 further includes the following specific implementation: 1023. Activate the Windows service process and obtain the window handle of the topmost window on the desktop; 1024. Obtain the process ID corresponding to the window handle; 1025. Based on the process ID, obtain the session ID corresponding to the topmost window on the desktop; 1026. Pass the console session ID to the WTSQueryUserToken function to obtain the user token corresponding to the console session ID.

[0038] In steps 1023-1026, the Windows service process is activated, and the GetForegroundWindow function is used to obtain the handle of the window currently at the top of the desktop. Then, the GetWindowThreadProcessId function is used to obtain the process ID to which the window belongs based on the window handle. Next, the session ID corresponding to the topmost window on the desktop is retrieved based on the process ID. Finally, the console session ID is passed to the WTSQueryUserToken function to obtain the user token corresponding to the console session ID.

[0039] Furthermore, step 1025 includes the following specific implementation methods: 10251. Call the OpenProcess function to open the window process corresponding to the process ID; 10252. Call the GetProcessSessionId function to obtain the session ID corresponding to the window process.

[0040] In steps 10251-10252, the OpenProcess function is first called to open the window process hProcess corresponding to the process ID. Then, the window process hProcess is passed to the GetProcessSessionId function to obtain the session ID (dwSessionId) corresponding to the window process. The specific pseudocode can be found below: HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE,dwProcessId); if (!hProcess) { / / Error handling } dwSessionId = GetProcessSessionId(hProcess); CloseHandle(hProcess); if (dwSessionId == 0xFFFFFFFF) { / / Error handling } Input the process ID dwProcessId into the OpenProcess function to obtain the window process hProcess, and then write the window process hProcess into the GetProcessSessionId function to obtain the session ID (dwSessionId).

[0041] 103. Pass the user token into the CreateProcessAsUser function to create and activate the pop-up process, wherein the pop-up process includes: a verification input box and a password verification box; In this embodiment, the user token hUserToken is passed as a parameter to the CreateProcessAsUser function, which sets specific parameters such as the executable file path, command line arguments, process security attributes, thread safety attributes, inherited handle, creation flag, environment variables, current directory, startup information, and process information of the new process. The pop-up process is created and activated. The pop-up process has a verification input box and a verification password, so that the protected device can enter the password in the verification input box and unlock the device by comparing the verification password with the entered password.

[0042] Specifically, following step 103, the following specific implementation methods are also included: 1031. When a user forces the pop-up process to close, the Windows service process, acting as a daemon process, creates and activates a new pop-up process.

[0043] In step 1031, if a user forcibly closes the pop-up process on the device, a new pop-up process is created and activated using a Windows service process as a daemon. This pop-up process prevents the user from bypassing it and requires verification. Because the Windows service process can only be stopped or uninstalled by the creator administrator, the user must enter a key for verification.

[0044] 104. Receive the user's input password through the verification input box, and determine whether the input password is equal to the verification password; In this embodiment, the user's input password is received in the pop-up process using a verification input box, and the input password is verified to be consistent with the verification password.

[0045] 105. If the value is not equal to the verification password, then return the Windows service process and the pop-up process; In this embodiment, if the entered password does not match the verification password, the process returns to the Windows service process and the pop-up window process, and waits for the user to enter the key again for unlock verification.

[0046] 106. If the value equals the verification password, then close the pop-up process and the Windows service process to unlock the device.

[0047] In this embodiment, when the entered password matches the verification password, the pop-up process and the Windows service process are closed, thereby unlocking the Windows device and completing user authentication.

[0048] Specifically, following step 106, the following specific implementation methods are also included: 107. The device system sends unlocking information to the service system; 108. The service system receives the unlocking information and sends the unlocking information to the web page system to notify the user of the status of the device system.

[0049] In steps 107-108, in a distributed web-based system that manages multiple device systems through a service system, after a device system completes unlocking, it sends unlocking information to the service system. The service system then forwards this unlocking information to the web-based system, notifying the administrator of the creation process that the device system is now unlocked. This allows the administrator to coordinate and manage the protection of multiple devices.

[0050] In this embodiment of the invention, by using the system characteristics and built-in functions of Windows devices, and improving the window permission mechanism with user tokens, a function is set to prevent pop-ups from always being placed on the front in all Windows operating systems. This ensures stable and reliable device protection, achieves compatible protection of device data in different scenarios without relying on drivers, and solves the technical problem of lack of compatibility with Windows device protection schemes and difficulty in flexibly adjusting them for different scenarios.

[0051] Figure 4 This is a schematic diagram of a device protection device based on a Windows system according to an embodiment of the present invention. The Windows-based device protection device 400 can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs) 410 (e.g., one or more processors) and a memory 420, and one or more storage media 430 (e.g., one or more mass storage devices) storing application programs 433 or data 432. The memory 420 and storage media 430 can be temporary or persistent storage. The program stored in the storage media 430 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the Windows-based device protection device 400. Furthermore, the processor 410 may be configured to communicate with the storage media 430 and execute the series of instruction operations in the storage media 430 on the Windows-based device protection device 400.

[0052] The Windows-based device protection device 400 may also include one or more power supplies 440, one or more wired or wireless network interfaces 450, one or more input / output interfaces 460, and / or one or more operating systems 431, such as Windows Server, Mac OS X, Unix, Linux, Free BSD, etc. Those skilled in the art will understand that... Figure 4 The device protection device structure shown is not intended to limit the device protection device based on the Windows system. It may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0053] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the steps of the device protection method based on the Windows system.

[0054] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0055] Furthermore, although the operations are described in a specific order, this should be understood as requiring that such operations be performed in the specific order shown or in sequential order, or requiring that all illustrated operations be performed to achieve the desired result. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented individually or in any suitable sub-combination in multiple implementations.

[0056] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A device protection method based on a Windows system, characterized in that, Including the following steps: Create a Windows service process and set the stop / uninstall permissions for the Windows service process, wherein the stop / uninstall permissions include: non-specified users do not have stop / uninstall permissions; Activate the Windows service process and call the WTSQueryUserToken function to obtain the user token of the topmost window on the desktop; The user token is passed to the CreateProcessAsUser function to create and activate the pop-up process, which includes: a verification input box and a password verification box. The system receives the user's input password through the verification input box and determines whether the input password is equal to the verification password. If the value is not equal to the verification password, then return the Windows service process and the pop-up process; If the value equals the verification password, then the pop-up process and the Windows service process are closed, thus unlocking the device.

2. The device protection method based on a Windows system according to claim 1, characterized in that, The device protection method based on the Windows system is applied to a device protection system based on the Windows system. The device protection system based on the Windows system includes: a web system, a service system, and a device system. The creation of a Windows service process and the setting of stop / uninstall permissions for the Windows service process include: The web page system receives device restriction rules input by the user and sends the device restriction rules to the service system; The service system receives the device restriction rules and distributes the device restriction rules to the device system; The device system receives the device restriction rules, creates a Windows service process, and sets the stop / uninstall permissions for the Windows service process according to the device restriction rules.

3. The device protection method based on a Windows system according to claim 2, characterized in that, After closing the pop-up process and the Windows service process to unlock the device, the process further includes: The device system sends unlocking information to the service system; The service system receives the unlocking information and sends it to the web page system to notify the user of the status of the device system.

4. The device protection method based on a Windows system according to claim 1, characterized in that, Activating the Windows service process and calling the WTSQueryUserToken function to obtain the user token for the topmost window on the desktop includes: Activate the Windows service process to obtain the console session ID of the topmost window on the desktop; Pass the console session ID to the WTSQueryUserToken function to obtain the user token corresponding to the console session ID.

5. The device protection method based on a Windows system according to claim 4, characterized in that, The process of obtaining the console session ID of the topmost window on the desktop includes: Call the WTSGetActiveConsoleSessionId function to get the console session ID of the topmost window on the desktop.

6. The device protection method based on a Windows system according to claim 1, characterized in that, Activating the Windows service process and calling the WTSQueryUserToken function to obtain the user token for the topmost window on the desktop also includes: Activate the Windows service process to obtain the window handle of the topmost window on the desktop; Obtain the process ID corresponding to the window handle; Based on the process ID, obtain the session ID corresponding to the topmost window on the desktop; Pass the console session ID to the WTSQueryUserToken function to obtain the user token corresponding to the console session ID.

7. The device protection method based on a Windows system according to claim 6, characterized in that, The step of obtaining the session ID corresponding to the topmost window on the desktop based on the process ID includes: Call the OpenProcess function to open the window process corresponding to the process ID; Call the GetProcessSessionId function to obtain the session ID corresponding to the window process.

8. The device protection method based on a Windows system according to claim 1, characterized in that, After passing the user token to the CreateProcessAsUser function to create and activate the pop-up process, the process further includes: When a user commands the pop-up process to be forcibly closed, the Windows service process, acting as a daemon process, creates and activates a new pop-up process.

9. A device protection device based on a Windows system, characterized in that, The Windows-based device protection device includes: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the Windows-based device protection device to perform the Windows-based device protection method as described in any one of claims 1-8.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the device protection method based on the Windows system as described in any one of claims 1-8.

Images