Device security analysis method and electronic device
By introducing a sandbox analysis module into electronic devices and employing a method of isolation before analysis, the security issues associated with connecting external devices are resolved, thereby improving security without affecting work efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-05
- Publication Date
- 2026-03-10
AI Technical Summary
When electronic devices are connected to external devices, they may be infected by malicious programs and become botnets controlled by hackers or targets for data theft. Existing technologies are insufficient to effectively improve security.
The electronic device is equipped with a sandbox analysis module. It first keeps the external device in an isolated state, performs a security analysis through the sandbox analysis module, determines whether the conditions for de-isolation are met, and decides whether to switch to a connected state based on the results.
Without affecting the performance of electronic devices, it improves the security of accessing external devices and prevents malicious programs from infecting the core system.
Smart Images
Figure CN121637481A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to an information security protection technology, and more particularly to a device security analysis method and an electronic device. Background Technology
[0002] With the advancement of technology, information security threats are also increasing. In daily life, users' electronic devices (such as smartphones, personal computers, or servers) often connect to external devices to read data from, store data on, or perform extended functions through these external devices. However, if an external device carries malicious programs with the ability to actively spread or infect, the electronic device may be infected with these programs when connected, thus becoming a botnet controlled by hackers or a target for hackers to steal secrets. Summary of the Invention
[0003] The present invention provides a device security analysis method and an electronic device that can improve the above-mentioned problems and enhance the security of the electronic device accessing external devices.
[0004] Embodiments of the present invention provide a device security analysis method for an electronic device, the electronic device running a sandbox analysis module, and the device security analysis method comprising: in response to an external device being connected to the electronic device, maintaining the external device in an isolated state and determining whether the external device meets the de-isolation conditions; if the external device does not meet the de-isolation conditions, performing security analysis on the external device through the sandbox analysis module during the period when the external device is in the isolated state; and determining whether to switch the external device to a connected state based on the execution result of the security analysis.
[0005] An embodiment of the present invention also provides an electronic device, which includes a connection interface circuit, a storage circuit, and a processor. The connection interface circuit is used to connect to an external device. The storage circuit is used to store a sandbox analysis module. The processor is connected to the connection interface circuit and the storage circuit. The processor is used to: in response to the external device connecting to the electronic device through the connection interface circuit, maintain the external device in an isolated state and determine whether the external device meets the de-isolation conditions; if the external device does not meet the de-isolation conditions, perform a security analysis on the external device through the sandbox analysis module during the period when the external device is in the isolated state; and determine whether to switch the external device to a connected state based on the execution result of the security analysis.
[0006] Based on the above, after the electronic device is connected to an external device, the external device is initially kept in an isolated state. Simultaneously, the electronic device can determine whether the external device meets the de-isolation conditions. If the external device does not meet the de-isolation conditions, during the period the external device is in isolation, the electronic device can perform a security analysis on the external device through a sandbox analysis module, and decide whether to switch the external device to a connected state based on the results of the security analysis. Therefore, the security of the electronic device's access to the external device can be effectively improved without significantly affecting the electronic device's operating performance. Attached Figure Description
[0007] Figure 1 This is a schematic diagram of a device safety analysis system according to an embodiment of the present invention;
[0008] Figure 2 This is a schematic diagram illustrating access to an external device in a connected state, according to an embodiment of the present invention;
[0009] Figure 3 This is a schematic diagram illustrating the security analysis of an external device performed by a sandbox analysis module in an isolated state, according to an embodiment of the present invention.
[0010] Figure 4 This is a flowchart illustrating a device safety analysis method according to an embodiment of the present invention. Detailed Implementation
[0011] Reference will now be made in detail to exemplary embodiments of the invention, examples of which are illustrated in the accompanying drawings. Wherever possible, the same element references are used in the drawings and description to denote the same or similar parts.
[0012] Figure 1 This is a schematic diagram of a device safety analysis system according to an embodiment of the present invention. Please refer to... Figure 1 The device security analysis system may include electronic device 10 and external device 100. Electronic device 10 may be a smartphone, tablet computer, desktop computer, industrial computer, game console, server, wearable device (such as head-mounted display, watch, wristband, etc.) or computer device installed in a specific carrier (such as vehicle, aircraft or ship), and the type of electronic device 10 is not limited to these.
[0013] External device 100 can also be a smartphone, tablet computer, desktop computer, industrial computer, game console, server, wearable device (e.g., head-mounted display, watch, bracelet, etc.) or computer device or information storage device (e.g., USB flash drive or external hard drive) installed in a specific carrier (e.g., vehicle, aircraft, or ship), and the type of external device 100 is not limited thereto. Furthermore, the number of external devices 100 can be one or more, and this invention is not limited thereto.
[0014] Electronic device 10 may include a connection interface circuit 11, a processor 12, and a storage circuit 13. The connection interface circuit 11 is used to connect to an external device 100. For example, the connection interface circuit 11 can connect electronic device 10 to external device 100 via wired or wireless means. For example, the connection interface circuit 11 may support wireless communication standards such as WiFi, Bluetooth, Near-Field Communication (NFC), 3G, 4G, or 5G, or wired communication standards such as Universal Serial Bus (USB) to communicate with external device 100 (e.g., to transmit signals between electronic device 10 and external device 100). Alternatively, the connection interface circuit 11 may also support other communication standards; this invention is not limited thereto. Furthermore, this invention does not limit the number or type of connection interface circuits 11.
[0015] Processor 12 is connected to connection interface circuitry 11 and storage circuitry 13. Processor 12 may include a central processing unit (CPU), graphics processing unit (GPU), or other programmable general-purpose or special-purpose microprocessor, digital signal processor (DSP), programmable controller, application-specific integrated circuit (ASIC), programmable logic device (PLD), or other similar device or combination of these devices.
[0016] In one embodiment, the processor 12 may further include processors dedicated to assisting in performing logical operations (e.g., neural network operations and / or image processing), such as a vision processing unit (VPU), a neural network processing unit (NPU), and / or a tensor processing unit (TPU). However, the present invention does not limit the number or type of processor 12.
[0017] Storage circuit 13 is used to store data. For example, storage circuit 13 may include volatile storage circuitry and non-volatile storage circuitry. Volatile storage circuitry is used to volatilely store data. For example, volatile storage circuitry may include random access memory (RAM) or similar volatile storage media. Non-volatile storage circuitry is used to non-volatilely store data. For example, non-volatile storage circuitry may include read-only memory (ROM), solid-state disk (SSD), hard disk drive (HDD), or similar non-volatile storage media. However, the present invention does not limit the number and type of storage circuitry 13.
[0018] In one embodiment, the storage circuit 13 stores the kernel system 101 and the sandbox analysis module 102. The kernel system 101 controls the overall operation of the electronic device 10. For example, the kernel system 101 may include the operating system (OS) of the electronic device 10. In one embodiment, the processor 12 may run the kernel system 101 to control the overall operation of the electronic device 10.
[0019] In one embodiment, the sandbox analysis module 102 can operate independently of the core system 101. Specifically, the sandbox analysis module 102 can be used to perform security analysis on the external device 100 when the core system 101 cannot access the external device 100. In other words, in one embodiment, when the core system 101 cannot access the external device 100, the processor 12 can run the sandbox analysis module 102 to perform security analysis on the external device 100 without affecting the operation of the core system 101.
[0020] In one embodiment, the electronic device 10 may further include various input / output devices such as a power management circuit, a mouse, a keyboard, a display, a speaker, and / or a microphone, and the type of input / output interface is not limited thereto.
[0021] In one embodiment, the processor 12 can detect whether the external device 100 is connected to the electronic device 10 via the connection interface circuit 11. In one embodiment, if the external device 100 is connected to the connection interface circuit 11 via a wired connection, the processor 12 can determine whether the external device 100 is connected to the electronic device 10 by detecting the potential state of at least one electrical pin of the connection interface circuit 11. For example, when the potential state of at least one electrical pin of the connection interface circuit 11 is a certain potential state (also referred to as the first potential state), the processor 12 can determine that the external device 100 is connected to the electronic device 10. However, when the potential state of at least one electrical pin of the connection interface circuit 11 is another potential state (also referred to as the second potential state), the processor 12 can determine that the external device 100 is not connected to the electronic device 10. The first potential state may be different from the second potential state. For example, the first potential state may be logic high, while the second potential state may be logic low. However, the first potential state and the second potential state can be adjusted according to practical needs, and the present invention is not limited thereto.
[0022] In one embodiment, if the external device 100 is connected to the connection interface circuit 11 via a wireless connection, the processor 12 can determine whether the external device 100 is connected to the electronic device 10 by using a flag reflecting the connection status between the external device 100 and the electronic device 10. For example, when the flag reflecting the connection status between the external device 100 and the electronic device 10 is in a certain bit state (also called the first bit state), the processor 12 can determine that the external device 100 is connected to the electronic device 10. However, when the flag reflecting the connection status between the external device 100 and the electronic device 10 is in another bit state (also called the second bit state), the processor 12 can determine that the external device 100 is not connected to the electronic device 10. The first bit state may be different from the second bit state. For example, the first bit state may be bit "1", while the second bit state may be bit "0". However, the first bit state and the second bit state can be adjusted according to practical needs, and the present invention is not limited thereto.
[0023] In one embodiment, in response to external device 100 being connected to electronic device 10 (e.g., ... Figure 1 As shown, processor 12 can automatically maintain external device 100 in an isolated state. In one embodiment, the isolated state is also referred to as an unbinded state. It should be noted that in the isolated state, core system 101 cannot access external device 100. In one embodiment, while external device 100 is in the isolated state, processor 12 can prevent core system 101 from accessing external device 100.
[0024] In one embodiment, in response to external device 100 being connected to electronic device 10 (e.g., ... Figure 1As shown, the processor 12 can further determine whether the external device 100 meets the de-isolation condition. In one embodiment, the de-isolation condition is also called the bind condition.
[0025] In one embodiment, if the processor 12 determines that the external device 100 meets the de-isolation condition, the processor 12 can switch the external device 100 from an isolated state to a connected state. In one embodiment, the connected state is also called a bound state. It should be noted that in the connected state, the core system 101 can access the external device 100. In one embodiment, if the external device 100 is in the connected state, the processor 12 can allow the core system 101 to access the external device 100. For example, if the external device 100 is in the connected state, the core system 101 can read data from the external device 100, store data in the external device 100, and / or perform specific operations through the external device 100.
[0026] In one embodiment, after the external device 100 is connected to the electronic device 10, the processor 12 can obtain device identification information of the external device 100. For example, this device identification information can be used to uniquely identify the external device 100. For example, this device identification information may include the device name, device type and / or other information that can be used to uniquely identify the external device 100.
[0027] In one embodiment, after obtaining the device identification information of the external device 100, the processor 12 can compare the device identification information with a device list. For example, this device list can be used to record the device identification information of one or more external devices. The processor 12 can determine whether the external device 100 meets the de-isolation conditions based on the comparison result.
[0028] In one embodiment, the processor 12 may employ a whitelist filtering mechanism to determine whether the external device 100 meets the de-isolation conditions. For example, in the whitelist filtering mechanism, if the aforementioned comparison result reflects that the device identification information of the external device 100 is recorded in the device list, the processor 12 may determine that the external device 100 meets the de-isolation conditions. However, if the aforementioned comparison result reflects that the device identification information of the external device 100 is not recorded in the device list, the processor 12 may determine that the external device 100 does not meet the de-isolation conditions.
[0029] In one embodiment, the processor 12 may also employ a blacklist filtering mechanism to determine whether the external device 100 meets the de-isolation conditions. For example, in the blacklist filtering mechanism, if the aforementioned comparison result reflects that the device identification information of the external device 100 is recorded in the device list, the processor 12 may determine that the external device 100 does not meet the de-isolation conditions. However, if the aforementioned comparison result reflects that the device identification information of the external device 100 is not recorded in the device list, the processor 12 may determine that the external device 100 meets the de-isolation conditions. In one embodiment, the processor 12 may employ a whitelist filtering mechanism and / or a blacklist filtering mechanism as needed to determine whether the external device 100 meets the de-isolation conditions; this invention does not impose any limitations on this.
[0030] In one embodiment, if the processor 12 determines that the external device 100 does not meet the de-isolation conditions, the processor 12 can maintain the external device 100 in an isolated state (i.e., not switch the external device 100 from an isolated state to a connected state). Simultaneously, while the external device 100 is in an isolated state, the processor 12 can perform security analysis on the external device 100 through the sandbox analysis module 102. For example, the processor 12 can monitor the behavior of the external device 100 through the sandbox analysis module 102 to determine whether the external device 100 poses a security risk. Then, the processor 12 can decide whether to switch the external device 100 from an isolated state to a connected state based on the execution result of the security analysis. In one embodiment, the sandbox analysis module 102 can monitor the behavior of the external device 100 and determine whether the external device 100 poses a security risk using various common security analysis techniques (e.g., malware detection techniques). Related operational details can be set according to practical needs, and this invention does not impose limitations.
[0031] In one embodiment, while the external device 100 is in an isolated state, if the processor 12 determines, based on the execution result of the security analysis, that the external device 100 poses a security risk (e.g., the execution result of the security analysis reflects that the external device 100 has a high probability of carrying malicious programs), the processor 12 can maintain the external device 100 in an isolated state (i.e., not switch the external device 100 from an isolated state to a connected state). This effectively prevents the electronic device 10 (or the core system 101) from being infected by malicious programs carried by the external device 100.
[0032] In one embodiment, while the external device 100 is in an isolated state, if the processor 12 determines, based on the execution result of the security analysis, that the external device 100 does not pose a (significant) security risk (e.g., the execution result of the security analysis reflects a high probability that the external device 100 does not carry malicious programs), then the processor 12 can switch the external device 100 from the isolated state to the connected state. Subsequently, in the connected state, the core system 101 can access the external device 100. Thus, the security of the electronic device 10 accessing the external device 100 can be effectively improved without significantly affecting the operating performance of the electronic device 10 (or the core system 101).
[0033] In one embodiment, while the external device 100 is in an isolated state, the processor 12 can associate the external device 100 with a specific container (also referred to as a first container). Then, while the external device 100 is in an isolated state, the sandbox analysis module 102 can monitor the behavior of the external device 100 through the first container.
[0034] In one embodiment, the first container is a sandbox container. Therefore, the operation of the external device 100 within the first container (i.e., the sandbox container) will not affect the core system 101. Thus, even if the external device 100 carries malicious programs, by running the external device 100 within the first container (i.e., the sandbox container), the malicious programs carried by the external device 100 can be prevented from infecting the core system 101.
[0035] In one embodiment, if the external device 100 is in a connected state, the processor 12 can associate the external device 100 with another container (also referred to as a second container). It should be noted that the second container is a general container type, unlike the first container. Thus, while the external device 100 is in a connected state, the core system 101 can access the external device 100 through the second container.
[0036] Figure 2 This is a schematic diagram illustrating access to an external device in a connected state, according to an embodiment of the present invention. Please refer to... Figure 1 and Figure 2 In one embodiment, it is assumed that external device 100 is already connected to electronic device 10. After switching external device 100 to a connected state (i.e., a bound state), processor 12 can associate external device 100 with container 21. For example, container 21 is a general container. Subsequently, core system 101 can access external device 100 through container 21. For example, processor 12 can run core system 101 and use container 21 to read data from external device 100, store data in external device 100, and / or perform specific operations through external device 100.
[0037] Figure 3This is a schematic diagram illustrating the security analysis of an external device performed in an isolated state using a sandbox analysis module, according to an embodiment of the present invention. Please refer to... Figure 1 and Figure 3 In one embodiment, it is assumed that external device 100 is connected to electronic device 10. While external device 100 is in an isolated state (i.e., unbound state), processor 12 can associate external device 100 with container 31. For example, container 31 is a sandbox container. Subsequently, processor 12 can run sandbox analysis module 102 to perform security analysis on external device 100 through container 31. Based on the results of the security analysis, processor 12 can decide whether to maintain external device 100 in an isolated state or switch external device 100 from an isolated state to a connected state. It should be noted that while external device 100 is in an isolated state (i.e., unbound state), processor 12 can prevent core system 101 from accessing external device 100 to avoid core system 101 being infected by malware that external device 100 may carry.
[0038] Figure 4 This is a flowchart illustrating a device safety analysis method according to an embodiment of the present invention. Please refer to... Figure 4 In step S401, in response to the external device being connected to the electronic device, the external device is maintained in an isolated state. In step S402, it is determined whether the external device meets the de-isolation condition. If the external device meets the de-isolation condition, in step S403, the external device is switched from the isolated state to the connected state.
[0039] However, if the external device does not meet the de-isolation conditions, in step S404, a security analysis is performed on the external device through the sandbox analysis module while it is in the isolated state. In step S405, based on the results of the security analysis, it is determined whether the external device poses a security risk. If the external device poses a security risk (e.g., the external device has a relatively high probability of carrying malicious programs), then in step S406, the external device is kept in the isolated state. Alternatively, if the external device does not pose a security risk (e.g., the external device has a relatively low probability of carrying malicious programs), then step S403 can be initiated to switch the external device from the isolated state to the connected state.
[0040] However, Figure 4 Each step has been explained in detail above and will not be repeated here. It is worth noting that... Figure 4 Each step can be implemented as multiple program codes or circuits, and this invention is not limited thereto. Furthermore, Figure 4 The method can be used in conjunction with the above examples and embodiments, or it can be used alone. This invention does not impose any limitations.
[0041] In summary, the device security analysis method and electronic device proposed in the embodiments of the present invention can temporarily keep the external device in an isolated state (i.e., an unbound state) when initially connected to an external device of unknown security, to prevent malicious programs that may be carried by the external device from infecting the core system of the electronic device. After determining that the external device is trustworthy, the external device can be switched to a connected state (i.e., a bound state) to facilitate the core system of the electronic device to access the external device. Thus, the security of the electronic device accessing the external device can be effectively improved without affecting the working performance of the electronic device as much as possible.
[0042] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A device security analysis method characterized by comprising: An electronic device running a sandbox analysis module, and a device security analysis method comprising: in response to an external device being connected to the electronic device, maintaining the external device in an isolated state, and determining whether the external device meets a de-isolation condition; if the external device does not meet the de-isolation condition, performing a security analysis on the external device by the sandbox analysis module while the external device is in the isolated state; and deciding whether to switch the external device to a connected state according to a result of the security analysis.
2. The device security analysis method of claim 1, wherein in the isolated state, a core system of the electronic device cannot access the external device.
3. The device security analysis method of claim 1, wherein in the connected state, the core system of the electronic device can access the external device.
4. The device security analysis method of claim 1, wherein the step of determining whether the external device meets the de-isolation condition comprises: obtaining device identification information of the external device; comparing the device identification information with a device list; and determining whether the external device meets the de-isolation condition according to a comparison result.
5. The device security analysis method of claim 1, wherein the step of performing the security analysis on the external device by the sandbox analysis module while the external device is in the isolated state comprises: associating the external device to a first container while the external device is in the isolated state; and monitoring, by the sandbox analysis module, a behavior of the external device through the first container, wherein the behavior of the external device in the first container does not affect a core system of the electronic device.
6. The device security analysis method of claim 1, further comprising: if the external device meets the de-isolation condition, switching the external device to the connected state.
7. The device security analysis method of claim 1, further comprising: if the external device is in the connected state, associating the external device to a second container; and accessing, by a core system of the electronic device, the external device through the second container. comprising: a connection interface circuit to connect to an external device; a storage circuit to store a sandbox analysis module; and 8. An electronic device, comprising: a processor connected to the connection interface circuit and the storage circuit, wherein the processor is to: in response to the external device being connected to the electronic device through the connection interface circuit, maintain the external device in an isolated state, and determine whether the external device meets a de-isolation condition; if the external device does not meet the de-isolation condition, perform a security analysis on the external device by the sandbox analysis module while the external device is in the isolated state; and decide whether to switch the external device to a connected state according to a result of the security analysis. 9.The electronic device of claim 8, wherein, in the isolated state, a core system of the electronic device is unable to access the external device. 10.The electronic device of claim 8, wherein, in the connected state, the core system of the electronic device is able to access the external device. 11.The electronic device of claim 8, wherein the operation of determining, by the processor, whether the external device meets the un-isolation condition comprises: obtaining device identification information of the external device; comparing the device identification information with a device list; and determining, based on the comparison, whether the external device meets the un-isolation condition. 12.The electronic device of claim 8, wherein, during the period when the external device is in the isolated state, the operation of performing, by the processor, the security analysis on the external device via the sandbox analysis module comprises: associating the external device to a first container during the period when the external device is in the isolated state; and monitoring, by the sandbox analysis module, behaviors of the external device via the first container, wherein the behaviors of the external device within the first container do not affect the core system of the electronic device. 13.The electronic device of claim 8, wherein the processor is further configured to: switch the external device to the connected state if the external device meets the un-isolation condition. 14.The electronic device of claim 8, wherein the processor is further configured to: associate the external device to a second container if the external device is in the connected state; and access, by the core system of the electronic device, the external device via the second container.