A terminal communication security protection method and system based on hook technology

Abstract

This invention discloses a terminal communication security protection method and system based on Hook technology. The method includes the following steps: collecting terminal data, selecting and registering an appropriate Hook implementation method based on the terminal data, and selecting the optimal Hook point; executing the Hook after security verification; the sending end sending communication data, triggering Hook interception when the communication data reaches the optimal Hook point; performing security verification on the intercepted communication data, and transmitting the intercepted communication data if successful; generating a master key and a session key based on the terminal's unique identifier, and encrypting the session key using the master key; generating a working key based on the encrypted session key, encrypting the successfully verified communication data using the working key before sending it, and decrypting the received data using the corresponding working key to obtain the original communication data. This invention achieves full-link security protection for terminal communication, improving protection capabilities and terminal compatibility.

Description

Technical Field

[0001] This invention relates to the field of terminal security technology, and in particular to a terminal communication security protection method and system based on Hook technology. Background Technology

[0002] With the rapid development of mobile internet and IoT technologies, terminal devices have become the core nodes for data interaction, and the amount of communication data between terminals and between terminals and servers is growing exponentially. However, terminal communication processes face various security threats, such as data eavesdropping, tampering, forgery, and malicious programs intercepting communication commands. For example, hackers can intercept network communication data packets from terminals to obtain sensitive user information or tamper with communication commands to carry out malicious manipulation. Therefore, terminal communication security protection has become a crucial link in ensuring information security.

[0003] Hook technology, as a core technology capable of intercepting, monitoring, and intervening in system or application events / function calls, is widely used in the field of endpoint security protection because it can control target behavior without modifying the target program's source code.

[0004] However, the following significant shortcomings still exist in terminal communication security protection scenarios:

[0005] 1. Limited protection dimensions and lack of end-to-end protection capabilities: Existing solutions focus on single-stage protection for single types of terminals (such as only supporting Windows or Android systems) (such as only monitoring communication data or only protecting local data operations), failing to cover the entire "send-transmit-receive-process" chain of terminal communication, and making it difficult to cope with threats of data tampering and forgery during cross-system terminal communication and transmission.

[0006] 2. The selection of hook points lacks intelligence, resulting in insufficient protection efficiency and compatibility. Existing solutions mostly adopt fixed hook point configuration methods, such as blocking a few specific communication API functions. They cannot dynamically adjust hook points according to changes in terminal communication scenarios (such as HTTP / HTTPS communication, MQTT IoT communication) and data types, which can easily lead to protection omissions or over-blocking, resulting in terminal performance degradation. At the same time, the hook implementation methods of different terminal systems (Windows, Android, Linux) vary greatly (such as SetWindowsHookEx in Windows and LD_PRELOAD in Linux), making it difficult for existing solutions to adapt to multiple system terminals and resulting in poor compatibility.

[0007] 3. Lack of security protection mechanism for Hook itself; the existing solution does not effectively protect the security of the Hook module itself. The Hook module is easily tampered with, bypassed or reverse-hooked by malicious programs, causing the protection mechanism to fail. For example, hackers can analyze the implementation logic of the Hook module and use anti-Hook technology to avoid interception, or tamper with the processing logic of the Hook function to allow malicious data to pass.

[0008] 4. Poor coordination between communication data verification and encryption; In existing solutions, data encryption and Hook interception are mostly independent steps, and a real-time verification and encryption linkage mechanism based on Hook interception has not been established; For example, some solutions only monitor the intercepted data in plaintext and do not achieve real-time encryption; the encryption keys of some solutions have low binding to the terminal, making them easy to crack and unable to guarantee the end-to-end security of communication data. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a terminal communication security protection method based on Hook technology.

[0010] Another objective of this invention is to provide a terminal communication security protection system based on Hook technology.

[0011] The objective of this invention is achieved through the following technical solution:

[0012] A terminal communication security protection method based on Hook technology includes the following steps:

[0013] S1. Real-time collection of terminal data, including system type data, communication protocol data, and process and network status data;

[0014] S2. Select the appropriate Hook implementation method based on system type data, evaluate and select the optimal Hook point based on communication protocol data and process and network status data; register the Hook function through the Hook implementation method;

[0015] The Hook function is subjected to a security check. The Hook function can only be executed if the security check passes; otherwise, the execution of the Hook function is terminated.

[0016] The sending end sends communication data. When the communication data reaches the optimal hook point, the hook function is triggered to intercept it and obtain the intercepted communication data.

[0017] S3. Perform security verification on the intercepted communication data, including integrity verification, legality verification, and malicious content detection:

[0018] When the security check fails, a failure result is returned.

[0019] When the security verification is successful, the intercepted communication data will be transmitted.

[0020] S4. Combine the terminal's unique identifier to generate a master key and a session key. Encrypt the session key using the master key to obtain the encrypted session key. Generate a working key using the encrypted session key. Use the working key to encrypt the communication data that was successfully verified in S3 and send it. When receiving, use the corresponding working key to decrypt it to obtain the original communication data.

[0021] The terminal data includes system type data, communication protocol data, and process and network status data. The system type data is obtained by reading the kernel version information and system environment variables of the terminal system. The communication protocol data is obtained by parsing the port number of the terminal network connection, the transport layer protocol type, and the application layer protocol header information to identify the current communication protocol. The process and network status data is obtained by calling the system API.

[0022] The specific implementation method for selecting the appropriate Hook based on system type data is as follows:

[0023] The system type is identified as Windows, Android, or Linux. For Windows, the SetWindowsHookEx function is used for system-level hooking, selecting either a shell hook or a network message filtering hook type based on the communication scenario to intercept network communication API functions and serial communication-related functions. For Android, the Xposed / Frida framework is used for application-level hooking, combined with inline hooks for kernel-level hooking, intercepting Socket class methods and related network framework communication functions. For Linux, LD_PRELOAD technology is used for shared library hooking, intercepting functions in the libc library to intercept communication data.

[0024] The method of evaluating and selecting the optimal hook point based on communication protocol data and process and network status data is specifically implemented as follows:

[0025] Candidate Hook points are selected, and evaluation parameters are defined, including call frequency, permission score, system call value, and modulo dependency score. The call frequency is the number of times the target function is called per unit time in the current communication scenario; the permission score is the system permission level of the target function; the system call value is the degree of correlation between the target function and the core communication logic; and the modulo dependency score is the degree of dependence of the target function on the currently running application. The target function is the system function / API function corresponding to the candidate Hook point.

[0026] The raw values ​​of the evaluation parameters are converted into normalized values ​​using the following formula:

[0027] Normalized value = (Original value of evaluation parameter - Minimum value of evaluation parameter) / (Maximum value of evaluation parameter - Minimum value of evaluation parameter);

[0028] The weighted summation formula is used to calculate the evaluation value ppz for each candidate Hook point, as follows:

[0029] ppz=α×dp'+β×qf '+γ×xd'+δ×my';

[0030] Where dp' is the normalized value of call frequency, qf' is the normalized value of permission score, xd' is the normalized value of system call value, and my' is the normalized value of modulo score; α, β, γ, and δ are preset weight coefficients that are dynamically adjusted according to the communication protocol type.

[0031] Candidate Hook points with a judgment value ppz ≥ 0.7 are selected as the optimal Hook point; when there are multiple candidate Hook points with a judgment value ppz ≥ 0.7, the candidate Hook point with the highest ppz is selected as the optimal Hook point; if multiple candidate functions have the same judgment value ppz, the candidate Hook point with the highest system tuning value is selected as the optimal Hook point; or, based on the terminal performance status, all candidate Hook points with a judgment value ppz ≥ 0.7 are selected to construct a multi-level Hook interception system.

[0032] The security verification of the Hook function is specifically as follows:

[0033] A code signing mechanism is adopted to digitally sign the executable code of the Hook function. When the terminal starts, it calls the system signature verification interface to verify the signature of the Hook function. If the signature is invalid, it is determined that the Hook function has been tampered with and the execution of the Hook function is terminated immediately; if the signature is valid, the Hook function runs normally.

[0034] By detecting whether a debugger process or a mainstream anti-Hook framework exists on the terminal, a security protection mechanism is triggered if a debugger process or a mainstream anti-Hook framework is detected. This mechanism suspends Hook function interception and clears Hook function registration information. At the same time, the memory address of the Hook function is obfuscated to prevent malicious programs from locating and modifying the Hook function. If no such detection is found, the Hook function runs normally.

[0035] By setting a security-enhanced Linux access control label, only authorized system processes or applications are allowed to access Hook functions, while unauthorized processes are prohibited from interacting with Hook functions, thus preventing malicious programs from bypassing the protection mechanism by calling the Hook function interface.

[0036] The security verification of the intercepted communication data specifically includes:

[0037] The intercepted communication data undergoes integrity verification, legality verification, and malicious content detection. Integrity verification uses the SM3 hash algorithm to calculate the hash value of the intercepted communication data and compares it with the hash value pre-transmitted by the sender.

[0038] If they match, the integrity verification of the communication data is successful;

[0039] If there is a discrepancy, it is determined that the communication data has been tampered with, and the transmission of communication data is blocked.

[0040] The formula for calculating the hash value is as follows:

[0041] Hash = SM3(commData||nonce);

[0042] Here, commData is the intercepted communication data; nonce is a random number generated by the sender and sent along with the communication data to prevent replay attacks.

[0043] The legitimacy verification verifies the identity of the sender of the communication data by extracting the digital signature from the communication data. This digital signature is generated using the SM2 asymmetric encryption algorithm. The signature is then decrypted using the sender's public key to obtain the hash value of the original communication data, which is compared with the locally calculated hash value of the communication data.

[0044] If they match, the validity of the communication data has been successfully verified.

[0045] If there is a discrepancy, the communication data is deemed invalid, and the transmission of the communication data is blocked, thereby achieving identity authentication and data validity verification.

[0046] Malicious content detection is based on signature matching and behavioral analysis, with a built-in malicious data signature library. It performs lightweight signature-based fast matching on intercepted communication data using this library, enabling real-time identification of known malicious commands and attack payloads.

[0047] If no feature match is found and there are no suspicious signs of communication, then the communication data is normal communication data.

[0048] If the feature match fails but there are suspicious signs of communication, then a deep behavioral analysis is performed in conjunction with the communication data context. The analysis includes the frequency of command sending, the credibility of the target IP, the legality of the command sequence, and whether the process communication behavior deviates from the historical baseline. If it deviates from the historical baseline, it is determined to be malicious data; otherwise, it is determined to be normal communication data.

[0049] If the signature matches, or if the behavior analysis determines that there is abnormal communication behavior, then the data is progressively determined to be malicious data.

[0050] Data transmission can only proceed if the integrity verification, legality verification, and malicious content detection determine that the data is normal; if any one of these conditions is not met, the data transmission will be blocked.

[0051] The specific method for obtaining the working key is as follows:

[0052] Collect the terminal's unique identification information, including the mobile terminal, MAC address, and CPU serial number, and generate a unique terminal verification value ID_Check using the SM3 algorithm. The specific method is as follows:

[0053] ID_Check=SM3(IMEI||MAC||CPU_SN);

[0054] Wherein, IMEI is the mobile terminal, MAC is the MAC address, and CPU_SN is the CPU serial number;

[0055] Check if the terminal supports a trusted execution environment:

[0056] If supported, the master key Master_Key is generated through the key generator of the trusted execution environment;

[0057] If not supported, a master key will be generated by combining the user's PIN code with the terminal's unique verification value, as follows:

[0058] Master_Key=SM3(PIN||ID_Check);

[0059] Wherein, PIN is the user's PIN code, and ID_Check is the terminal's unique verification value;

[0060] Generate the session key (Session_Key) as follows:

[0061] The terminal kernel-level cryptographically secure random number generator CSPRNG is invoked to generate a 256-bit initial random seed Random_Seed;

[0062] The Random_Seed is concatenated with the session unique identifier, Hook context parameters, millisecond-level timestamp, random number, and terminal state factor to obtain the concatenated data. The concatenated data is then subjected to two SM3 iterative hashes. The second hash result is XORed with the master key Master_Key, and the first 128 bits are truncated as the Session_Key conforming to the SM4 algorithm specification. The validity of the session key is verified by the SM4 algorithm's "encryption-decryption verification". If invalid, it is regenerated.

[0063] If valid, the master key is used to encrypt the session key, generating the encrypted session key Enc_Session_Key, specifically:

[0064] Enc_Session_Key=SM4_Encrypt(Master_Key,Session_Key);

[0065] Among them, SM4_Encrypt is SM4 encryption;

[0066] The session key is updated every time a communication connection is established. After it is generated, it is immediately encrypted by the master key to obtain the encrypted session key. The encrypted session key is stored in the terminal's secure storage area and is only temporarily loaded into memory during encryption and decryption in the Hook function. It is destroyed immediately after execution.

[0067] Each time the Hook function is executed, the encrypted session key is read from the terminal's secure storage area and, combined with the context parameters of the current Hook function, a temporary working key is derived using the SM3 algorithm, which is used for the encryption and decryption of the intercepted data.

[0068] Another objective of this invention is achieved through the following technical solution:

[0069] A terminal communication security protection system based on Hook technology, used in the aforementioned terminal communication security protection method based on Hook technology, includes a terminal status perception module, an intelligent Hook management module, a Hook security protection module, a security verification module, and an encryption / decryption module; wherein:

[0070] Terminal status awareness module: collects terminal data in real time, including system type data, communication protocol data, and process and network status data;

[0071] The intelligent Hook management module selects the appropriate Hook implementation method based on system type data, evaluates and selects the optimal Hook point based on communication protocol data and process and network status data, and registers Hook functions according to the Hook implementation method.

[0072] Hook security protection module: Performs security checks on hook functions. The hook function can only be executed if the security check passes; otherwise, the hook function will be terminated.

[0073] The sending end sends communication data. When the communication data reaches the optimal hook point, the hook function is triggered to intercept it and obtain the intercepted communication data.

[0074] Security verification module: performs security verification on intercepted communication data, including integrity verification, legality verification, and malicious content detection;

[0075] When the security check fails, a failure result is returned.

[0076] When the security verification is successful, the intercepted communication data will be transmitted.

[0077] Encryption / decryption module: Combines the terminal's unique identifier to generate a master key and a session key. The session key is encrypted using the master key to obtain the encrypted session key. A working key is generated based on the encrypted session key. The working key is used to encrypt the communication data that has been successfully verified in S3 before sending it. When receiving, the corresponding working key is used to decrypt the data to obtain the original communication data.

[0078] Meanwhile, this invention provides:

[0079] A server includes a processor and a memory, wherein the memory stores at least one program, which is loaded and executed by the processor to implement the aforementioned terminal communication security protection method based on Hook technology.

[0080] A computer-readable storage medium storing at least one program, which is loaded and executed by a processor to implement the above-described terminal communication security protection method based on Hook technology.

[0081] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0082] 1. This invention provides full-link security protection for terminal communication, covering all stages of "data sending-transmission-reception-processing", and is compatible with multiple system terminals such as Windows, Android, and Linux, as well as various communication protocol scenarios.

[0083] 2. This invention provides an intelligent Hook point selection mechanism, which dynamically identifies the terminal system type, adapts to different Hook implementation methods, and selects intelligent Hook points by combining multi-dimensional parameter evaluation, thereby achieving accurate interception of terminal communication in all scenarios, improving protection efficiency and terminal compatibility, and reducing performance loss.

[0084] 3. This invention constructs a security protection system for the Hook module itself. Through multiple mechanisms such as code signing, anti-debugging, anti-reverse hooking, and security-enhanced Linux access control, it prevents the Hook module from being tampered with, bypassed, or reverse hooked, thus ensuring the effectiveness of the protection mechanism.

[0085] 4. This invention establishes a collaborative mechanism for Hook interception, data verification, and encryption, deeply integrating Hook interception, security verification (integrity, legality, and malicious content detection) with end-to-end encryption (based on SM2 / SM3 / SM4 national cryptographic algorithms) to achieve full-link security protection of communication data and improve the security of terminal communication data. Attached Figure Description

[0086] Figure 1This is a flowchart of the terminal communication security protection method based on Hook technology described in this invention.

[0087] Figure 2 This is a schematic diagram of the terminal communication security protection system architecture based on Hook technology described in this invention. Detailed Implementation

[0088] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0089] like Figure 1 A terminal communication security protection method based on Hook technology includes the following steps:

[0090] S1. Real-time collection of terminal data, including system type data, communication protocol data, and process and network status data;

[0091] S2. Select the appropriate Hook implementation method based on system type data, evaluate and select the optimal Hook point based on communication protocol data and process and network status data; register the Hook function through the Hook implementation method;

[0092] The Hook function is subjected to a security check. The Hook function can only be executed if the security check passes; otherwise, the execution of the Hook function is terminated.

[0093] The sending end sends communication data. When the communication data reaches the optimal hook point, the hook function is triggered to intercept it and obtain the intercepted communication data.

[0094] S3. Perform security verification on the intercepted communication data, including integrity verification, legality verification and malicious content detection;

[0095] When the security check fails, a failure result is returned.

[0096] When the security verification is successful, the intercepted communication data will be transmitted.

[0097] S4. Combine the terminal's unique identifier to generate a master key and a session key. Encrypt the session key using the master key to obtain the encrypted session key. Generate a working key using the encrypted session key. Use the working key to encrypt the communication data that was successfully verified in S3 and send it. When receiving, use the corresponding working key to decrypt it to obtain the original communication data.

[0098] A terminal communication security protection system based on Hook technology includes a terminal status awareness module, an intelligent Hook management module, a Hook security protection module, a security verification module, and an encryption / decryption module; among which:

[0099] Terminal status sensing module:

[0100] The system collects real-time data on terminal system type, communication protocol type, current running process information, network connection status, etc., providing decision-making basis for the intelligent Hook management module. Specific implementation details are as follows:

[0101] (1) System type identification: This is achieved by reading the kernel version information and system environment variables of the terminal system. For example, Windows reads the "OS" environment variable, Android reads the "ro.build.version.release" attribute, and Linux reads the " / etc / os-release" file.

[0102] (2) Communication Protocol Identification: The current communication protocol (such as HTTP, HTTPS, MQTT, TCP / UDP serial communication, etc.) is identified by parsing the port number of the terminal network connection, the transport layer protocol type (TCP / UDP), and the application layer protocol header information. For example, HTTP protocol is identified by port number 80, HTTPS protocol by port number 443, and MQTT protocol is identified by the "MQTT" identifier in the protocol header.

[0103] (3) Process and network status acquisition: This is achieved by calling system APIs. For example, in Windows, the CreateToolhelp32Snapshot function is called to traverse the process list, and the GetTcpTable function is called to obtain the TCP connection status; in Android, the ps command is used to traverse the processes, and the NetworkInfo class is called to obtain the network connection status; in Linux, the / proc virtual file system provided by the Linux kernel is used—each running process corresponds to a directory named after its PID under / proc. By traversing this directory and reading the process metadata file, a complete list of processes and detailed information can be obtained. The specific implementation steps are as follows:

[0104] Traverse the / proc directory: Open the directory by calling opendir(" / proc"), read the directory entries in a loop using readdir(), and filter out the directory entries whose names are purely numeric (i.e., process PIDs).

[0105] Read process metadata: For each PID directory, read the following key files to obtain process information:

[0106] / proc / [PID] / stat: Gets core data such as process PID, PPID (parent process ID), process status (Running / Sleeping / Zombie), and memory usage;

[0107] / proc / [PID] / cmdline: Retrieves the complete startup command line of the process (parameters separated by \0), identifying the process name and runtime parameters;

[0108] / proc / [PID] / status: Provides supplementary information such as process UID / GID, number of threads, and file descriptor limits;

[0109] Structured data storage: The parsed process information (PID, process name, PPID, status, startup command) is stored in a linked list or array for the intelligent Hook management module to call.

[0110] The intelligent Hook management module is the core module of the system. It is responsible for dynamically selecting the appropriate Hook implementation method and Hook point based on data collected by the terminal status sensing module, thereby achieving precise interception of terminal communication-related functions / messages. Specific implementation details are as follows:

[0111] (1) Multi-system Hook adaptation implementation

[0112] For different terminal systems, corresponding Hook implementation schemes are integrated, and the appropriate Hook method is automatically selected based on the system type data identification results:

[0113] Windows system: The SetWindowsHookEx function is used to implement system-level hooks. The WH_SHELL (shell hook) and WH_NETMSGFILTER (network message filtering hook) types are selected according to the communication scenario to intercept network communication API functions such as recv, send, WSASend, and WSARecv, as well as serial communication related functions such as ReadFile and WriteFile.

[0114] A hook is a technique used in software systems to intercept and alter function calls, message passing, or event handling processes; it allows developers to insert custom logic without modifying the original code, enabling the monitoring, modification, or enhancement of program behavior.

[0115] SetWindowsHookEx is a powerful API function in the Windows operating system used to install a hook. Hooks allow programs to insert custom code to monitor, intercept, or even modify specific events (such as keyboard input, mouse clicks, or window messages) when the system processes them.

[0116] Android system: The application layer hook is implemented using the Xposed / Frida framework, and the kernel layer hook is implemented by combining inline hooks to intercept the connect, read, and write methods of the Socket class, as well as the communication functions of network frameworks such as OKHttp and Retrofit.

[0117] Xposed and Frida are both dynamic code instrumentation frameworks widely used in application reverse engineering, security research, and feature enhancement. They allow for runtime hooking of functions, modification of return values, and alteration of program logic without modifying the original application binary.

[0118] In programming, a socket is the fundamental abstraction for implementing network communication. Almost all languages ​​that support network programming (such as Python, Java, C / C++, C#, etc.) provide similar socket classes or APIs.

[0119] Linux system: LD_PRELOAD technology is used to implement shared library hooking, intercepting functions such as recv, send, and connect in the libc library to intercept communication data;

[0120] LD_PRELOAD is an environment variable provided by the dynamic linker in Linux systems. It allows users to prioritize loading specified shared libraries at runtime. This mechanism can be used to intercept, replace, or wrap standard library functions, thereby changing their behavior without modifying the program's binary file.

[0121] (2) Intelligent Hook Point Selection Algorithm

[0122] Based on communication protocol data and process and network status data, the optimal hook point is selected through multi-dimensional parameter evaluation to avoid protection omissions or performance losses caused by fixed hook points; the specific implementation is as follows:

[0123] Candidate Hook points are selected based on experience;

[0124] Define evaluation parameters: Four core parameters are selected as the evaluation criteria for candidate hook points, including:

[0125] Call frequency (dp): The number of times the target function is called in the current communication scenario per unit of time;

[0126] Permission score (qf): The system permission level of the objective function (levels 1-5, with higher permissions resulting in higher scores);

[0127] System correlation value (xd): The degree of correlation between the objective function and the core communication logic (level 1-5, the higher the correlation, the higher the score);

[0128] Modal dependency score (my): The degree to which the target function is dependent on the currently running application (level 1-5, the higher the dependency, the higher the score).

[0129] The target function is the system function / API function corresponding to the candidate Hook point. For example, the target functions under the Windows system include: recv, send, WSASend, WSARecv (network communication API), ReadFile, WriteFile (serial communication); the target functions under the Android system include: Socket.connect(), Socket.read(), Socket.write(), OKHttp / Retrofit framework functions; and the target functions under the Linux system include: recv, send, connect (libc library functions).

[0130] The raw values ​​of the evaluation parameters are converted into normalized values ​​using the following formula:

[0131] Normalized value = (Original value of evaluation parameter - Minimum value of evaluation parameter) / (Maximum value of evaluation parameter - Minimum value of evaluation parameter);

[0132] The weighted summation formula is used to calculate the evaluation value ppz for each candidate Hook point, as follows:

[0133] ppz=α×dp'+β×qf '+γ×xd'+δ×my';

[0134] Where dp' is the normalized value of call frequency, qf' is the normalized value of permission score, xd' is the normalized value of system call score, and my' is the normalized value of modulo factor score; α, β, γ, and δ are preset weight coefficients that are dynamically adjusted according to the communication protocol type. For example, in the HTTP communication scenario, α=0.3, β=0.2, γ=0.3, and δ=0.2, and in the MQTT IoT communication scenario, α=0.2, β=0.3, γ=0.3, and δ=0.2.

[0135] The basis for the dynamic adjustment is:

[0136] 1. Technical characteristics of communication protocols

[0137] Different protocols differ fundamentally in their call frequency, permission dependencies, and core logic chains.

[0138] High-frequency lightweight protocols (such as HTTP and UDP): These protocols are called very frequently and have small data volumes per call. Therefore, the call frequency (dp') has a higher weight.

[0139] Low-frequency, high-security protocols (such as MQTT and Modbus industrial protocols): These protocols are called infrequently, but involve device control and sensitive data transmission. Priority should be given to ensuring access control and core logic interception. Therefore, access control (qf') and system call value (xd') have higher weights.

[0140] Strongly dependent protocols (such as UART serial communication): The function is highly dependent on the application. Excessive interception can easily lead to terminal crashes. Compatibility should be given priority. Therefore, the modulo dependency (my') has a higher weight.

[0141] 2. Security Risk Priority

[0142] The core security threats differ in different scenarios:

[0143] In consumer-grade internet scenarios (such as HTTP / HTTPS): the core threats are data eavesdropping and malicious content injection. It is necessary to prioritize blocking frequently called communication entry functions, so dp' and xd' have high weights.

[0144] In industrial IoT scenarios (such as MQTT / Modbus), the core threats are unauthorized device control and command tampering. High-privilege and core logic functions should be intercepted first, so qf' and xd' have high weights.

[0145] In embedded terminal scenarios (such as serial communication), the core threat is service interruption caused by excessive protection. It is necessary to prioritize the interception of functions with low application dependency, so my' has a high weight.

[0146] 3. Terminal performance constraints

[0147] Different terminals have different CPU and memory resources:

[0148] Resource-constrained terminals (such as low-power sensors): performance loss needs to be strictly controlled, therefore dp' has a high weight (prioritizing the interception of high-frequency functions to reduce the total number of interceptions).

[0149] High-performance terminals (such as industrial gateways): can withstand higher performance losses, therefore qf' and xd' have high weights (prioritizing protection strength).

[0150] Candidate Hook points with a judgment value ppz ≥ 0.7 are selected as the optimal Hook point; when there are multiple candidate Hook points with a judgment value ppz ≥ 0.7, the candidate Hook point with the highest ppz is selected as the optimal Hook point; if multiple candidate functions have the same judgment value ppz, the candidate Hook point with the highest system tuning value is selected as the optimal Hook point; or, based on the terminal performance status, all candidate Hook points with a judgment value ppz ≥ 0.7 are selected to construct a multi-level Hook interception system to achieve accurate interception.

[0151] (3) Hook interception and message passing process

[0152] After registering the hook function using the above-described adapted hook method, the system triggers the execution of the hook function when the target communication function is called, thereby intercepting the communication data. The core structure of the hook function is as follows (taking Windows system as an example):

[0153] LRESULT CALLBACK CommHookProc(int nCode, WPARAM wParam, LPARAMlParam) {

[0154] if (nCode >= 0) {

[0155] / / Extract communication data, lParam is a pointer to the data buffer

[0156] ;

[0157] / / Pass the intercepted data to the security verification module

[0158] bool checkResult = SecurityCheckModule::check(commData);

[0159] if (!checkResult) {

[0160] / / Verification failed, blocking data transmission

[0161] return 0;

[0162] }

[0163] / / Verification passed, call the encryption module to encrypt (sender) or decrypt (receiver) the data.

[0164] ;

[0165] / / Replace the original data

[0166] ((LPMSG)lParam)->lParam = (LPARAM)encryptedData;

[0167] }

[0168] / / After successful verification, pass the message to the next hook or target function.

[0169] return CallNextHookEx(hHook, nCode, wParam, lParam);

[0170] }

[0171] After interception, if the data verification passes, the processed data is passed to the next hook or target function; if the verification fails, the data transmission is blocked directly, thus achieving communication security protection.

[0172] The Hook security protection module is used to ensure the security of the Hook module itself, preventing the Hook module from being maliciously tampered with, bypassed, or reverse-hooked. Specifically:

[0173] (1) Hook module integrity verification: The code signing mechanism is adopted to digitally sign the executable code of the Hook function. When the terminal starts, the system signature verification interface is called to verify the signature of the Hook function. If the signature is invalid, it is determined that the Hook function has been tampered with and the Hook function is terminated immediately; if the signature is valid, the Hook function runs normally.

[0174] (2) Anti-debugging and anti-reverse hooking: By detecting whether there is a debugger process or a mainstream anti-hook framework on the terminal, if a debugger process or a mainstream anti-hook framework is detected, the security protection mechanism is triggered, the Hook function interception is suspended and the Hook function registration information is cleared; at the same time, the memory address of the Hook function is obfuscated to prevent malicious programs from locating and modifying the Hook function; if no detectable, the Hook function runs normally.

[0175] (3) Access control: By setting the SELinux (Security-Enhanced Linux) mandatory access control label, only authorized system processes or applications are allowed to access the Hook function, and unauthorized processes are prohibited from interacting with the Hook function, thus preventing malicious programs from bypassing the protection mechanism by calling the Hook function interface.

[0176] The security verification module receives intercepted data from the intelligent Hook management module and performs integrity verification, legality verification, and malicious content detection on the communication data. Specific implementation details are as follows:

[0177] (1) Integrity verification: The SM3 hash algorithm is used to calculate the hash value of the intercepted communication data and compare it with the hash value pre-transmitted by the sender.

[0178] If they match, the integrity verification of the communication data is successful;

[0179] If there is a discrepancy, it is determined that the communication data has been tampered with, and the transmission of communication data is blocked.

[0180] The formula for calculating the hash value is as follows:

[0181] Hash = SM3(commData||nonce);

[0182] Here, commData is the intercepted communication data; nonce is a random number generated by the sender and sent along with the communication data to prevent replay attacks.

[0183] (2) Legality Verification: Verify the identity of the sender of the communication data by extracting the digital signature from the communication data, wherein the digital signature in the communication data is generated using the SM2 asymmetric encryption algorithm; decrypt the signature using the sender's public key to obtain the hash value of the original communication data, and compare it with the hash value of the communication data calculated locally:

[0184] If they match, the validity of the communication data has been successfully verified.

[0185] If there is a discrepancy, the communication data is deemed invalid, and the transmission of the communication data is blocked, thereby achieving identity authentication and data validity verification.

[0186] (3) Malicious content detection: Based on signature matching and behavior analysis, with a built-in malicious data signature library; based on the built-in malicious data signature library, lightweight signature matching is performed on intercepted communication data to achieve real-time identification of known malicious commands and attack payloads:

[0187] If no feature match is found and there are no suspicious signs of communication, then the communication data is normal communication data.

[0188] If the feature match fails but there are suspicious signs of communication, then a deep behavioral analysis is performed in conjunction with the communication data context. The analysis includes the frequency of command sending, the credibility of the target IP, the legality of the command sequence, and whether the process communication behavior deviates from the historical baseline. If it deviates from the historical baseline, it is determined to be malicious data; otherwise, it is determined to be normal communication data.

[0189] If the signature matches, or if the behavior analysis determines that there is abnormal communication behavior (such as frequently sending abnormal commands or sending data to unknown IPs), then the data is progressively determined to be malicious data.

[0190] Data transmission can only proceed if the integrity verification, legality verification, and malicious content detection determine that the data is normal; if any one of these conditions is not met, the data transmission will be blocked.

[0191] The encryption / decryption module works in conjunction with the intelligent Hook management module and the security verification module to achieve end-to-end encryption of communication data, ensuring data security during transmission. Specific implementation details are as follows:

[0192] Collect the terminal's unique identification information, including IMEI (Mobile Terminal), MAC address, CPU serial number, etc., and generate a unique terminal verification value (ID_Check) using the SM3 algorithm. The specific method is as follows:

[0193] ID_Check=SM3(IMEI||MAC||CPU_SN);

[0194] Wherein, IMEI is the mobile terminal, MAC is the MAC address, and CPU_SN is the CPU serial number;

[0195] Check if the terminal supports a trusted execution environment (such as TrustZone):

[0196] If supported, the master key Master_Key is generated through the key generator of the trusted execution environment;

[0197] If not supported, a master key will be generated by combining the user's PIN code with the terminal's unique verification value, as follows:

[0198] Master_Key=SM3(PIN||ID_Check);

[0199] Wherein, PIN is the user's PIN code, and ID_Check is the terminal's unique verification value;

[0200] Generate the session key (Session_Key) as follows:

[0201] Call the terminal kernel-level cryptographically secure random number generator (CSPRNG) to generate a 256-bit initial random seed (Random_Seed).

[0202] The Random_Seed is concatenated with the session unique identifier (Session_ID), Hook context parameters (Hook point PID, communication protocol encoding, Hook function entry address hash value), millisecond-level timestamp + random number (Timestamp + Nonce), and terminal status factors (network status, risk level) to form Seed_With_Factor;

[0203] Perform two SM3 iterative hashes on Seed_With_Factor, XOR the second hash result with the master key, and truncate the first 128 bits as the Session_Key that conforms to the SM4 algorithm specification;

[0204] The validity of the key is verified using the SM4 algorithm's "encryption-decryption verification" process. If invalid, it is regenerated; if valid, the session key is encrypted using the master key, generating the encrypted session key Enc_Session_Key, specifically:

[0205] Enc_Session_Key=SM4_Encrypt(Master_Key,Session_Key);

[0206] Among them, SM4_Encrypt is SM4 encryption;

[0207] The session key is used for encryption and decryption of real-time communication data. The session key is updated every time a communication connection is established. After it is generated, it is immediately encrypted by the master key to obtain the encrypted session key. The encrypted session key is stored in the terminal's secure storage area (such as the TrustZone secure storage area or Windows' Encrypting File System EFS). It is only temporarily loaded into memory during Hook function encryption and decryption and is destroyed immediately after execution.

[0208] Each time the Hook function is executed, the encrypted session key is read from the secure storage area and combined with the entry address of the current Hook function, the caller process PID, and the timestamp parameter to derive a temporary working key using the SM3 algorithm. This temporary working key is used for encrypting and decrypting the intercepted data. The working key and the session key in memory are destroyed immediately after the Hook function is executed.

[0209] The protection process of this invention mainly includes three stages: startup initialization, real-time protection, and end cleanup. The startup initialization stage includes terminal status acquisition, Hook adaptation selection, key generation, and module verification. The real-time protection stage includes Hook function interception of communication data, security verification, encryption and decryption, and data transmission / blocking. The end cleanup stage includes Hook function deregistration and key destruction. In the end cleanup stage, when terminal communication ends or the protection system is shut down, the intelligent Hook management module calls the deregistration function (such as UnhookWindowsHookEx) to deregister all registered Hook functions. The encryption and decryption module destroys the current session key and clears the temporary key information in the secure storage area. The log of this protection process (including the amount of intercepted data, verification results, alarm information, etc.) is recorded and saved.

[0210] like Figure 2 A terminal communication security protection system based on Hook technology, used in the aforementioned terminal communication security protection method based on Hook technology, includes a terminal status perception module, an intelligent Hook management module, a Hook security protection module, a security verification module, and an encryption / decryption module; wherein:

[0211] Terminal status awareness module: collects terminal data in real time, including system type data, communication protocol data, and process and network status data;

[0212] The intelligent Hook management module selects the appropriate Hook implementation method based on system type data, evaluates and selects the optimal Hook point based on communication protocol data and process and network status data, and registers Hook functions according to the Hook implementation method.

[0213] Hook security protection module: Performs security checks on hook functions. The hook function can only be executed if the security check passes; otherwise, the hook function will be terminated.

[0214] The sending end sends communication data. When the communication data reaches the optimal hook point, the hook function is triggered to intercept it and obtain the intercepted communication data.

[0215] Security verification module: performs security verification on intercepted communication data, including integrity verification, legality verification, and malicious content detection;

[0216] When the security check fails, a failure result is returned.

[0217] When the security verification is successful, the intercepted communication data will be transmitted.

[0218] Encryption / decryption module: Combines the terminal's unique identifier to generate a master key and a session key. The session key is encrypted using the master key to obtain the encrypted session key. A working key is generated based on the encrypted session key. The working key is used to encrypt the communication data that has been successfully verified in S3 before sending it. When receiving, the corresponding working key is used to decrypt the data to obtain the original communication data.

[0219] Meanwhile, this invention provides:

[0220] A server includes a processor and a memory, wherein the memory stores at least one program, which is loaded and executed by the processor to implement the aforementioned terminal communication security protection method based on Hook technology.

[0221] A computer-readable storage medium storing at least one program, which is loaded and executed by a processor to implement the above-described terminal communication security protection method based on Hook technology.

[0222] The core improvement of this invention is not simply applying the national cryptographic algorithm, but rather deeply binding the verification and encryption logic with the execution flow and lifecycle of the Hook technology, constructing an atomic collaborative mechanism of "Hook interception-verification-encryption," achieving a protection effect that existing technologies cannot achieve. Specific detailed improvements are as follows:

[0223] (I) Three core innovative improvements to the security verification module

[0224] Common shortcomings of existing technologies include: decoupling the verification logic from Hook interception, allowing only one-time post-event verification of all data, fixed verification rules that are easily bypassed, significant performance overhead, and inability to meet the real-time requirements of Hook interception. The improvements in this invention are entirely designed around the execution characteristics of Hook technology, as detailed below:

[0225] 1. A three-stage progressive verification mechanism based on Hook execution flow

[0226] This invention fully embeds the verification logic into the execution lifecycle of the Hook function, rather than as a serial step independent of the Hook, thus achieving a progressive verification process of "before execution - during execution - after execution." Specifically:

[0227] Pre-execution identity verification: Before the Hook function is triggered and the original communication function is executed, the caller process's digital certificate is whitelisted to verify its permissions and whether the digital certificate is on the whitelist. If the signature verification fails, the Hook execution flow is directly cut off, preventing it from entering the data processing stage and blocking communication requests from illegal processes at the source. Note: This process identity verification is a different level of security mechanism from the subsequent data-level SM2 signature validity verification.

[0228] In-process segmented integrity verification: During the data interception process in the Hook function, SM3 integrity verification and SM2 validity verification are performed on the communication data; the SM3 integrity verification is a fixed-length SM3 segmented hash verification, rather than a one-time verification after receiving all data; the hash value is calculated synchronously for each received data block and compared with the segmented hash value of the sending end. Once tampering is detected, data reception and transmission are immediately terminated to avoid wasting resources after processing all data and to prevent the tampered data from being stored.

[0229] Post-execution compliance verification: After the Hook function allows data and the original communication function is executed, feature analysis is performed on the communication behavior to verify whether the communication target IP, port, message frequency, and command type comply with the security policy. If abnormal behavior is found, the Hook point is dynamically adjusted and the blacklist is updated immediately to achieve the linkage between post-event tracing and pre-emptive protection.

[0230] Creative value: No existing technology has a solution that deeply binds the verification logic to the execution flow of the Hook function. This invention achieves atomic fusion of verification logic and Hook interception, which not only improves the protection response speed, but also fundamentally avoids the risk of the verification process being maliciously bypassed, thus solving the core defect of "verification and interception being disconnected" in existing technologies.

[0231] 2. Adaptive mechanism for dynamic verification rules linked with the smart Hook module

[0232] The verification rules of this invention are not fixed, but are dynamically adjusted in real time according to the intelligent Hook management module and the terminal scenario. The verification in this invention is a combination of three verification methods in the security verification module, rather than a single type. Specifically, the implementation is as follows:

[0233] Protocol adaptation verification dimension adjustment: Based on the communication protocol identified by the Hook, the verification dimensions are automatically switched: In HTTP / HTTPS scenarios, the focus is on verifying certificate validity, message header integrity, and malicious characteristics of transmitted content; in MQTT IoT scenarios, the focus is on verifying message command validity, device identity signature, and topic access permissions; in serial communication scenarios, the focus is on verifying data frame format, command permissions, and transmission frequency. The protocol adaptation verification dimension adjustment is actually to differentiate and focus on the three verification mechanisms of integrity verification, validity verification, and malicious content detection according to the technical characteristics of different protocols.

[0234] Adjustment of verification intensity for risk grading:

[0235] Based on the level of security incidents, the verification threshold is dynamically adjusted: in low-risk scenarios, only core identity and integrity verification is performed to reduce performance loss; in high-risk scenarios, full-dimensional verification is enabled, including in-depth detection of malicious content, comparison of behavioral baselines, and two-way signature verification.

[0236] Machine learning-driven threshold self-optimization: By analyzing historical security events and verification results through machine learning algorithms, the verification feature library and thresholds are automatically optimized. For example, verification rules are automatically tightened for IPs with high frequency of abnormal access, and verification processes are automatically optimized for devices with long-term compliance, balancing security and performance.

[0237] Creative value: Existing technologies use fixed configurations for verification rules, which cannot adapt to the differentiated needs of different communication scenarios. This invention achieves dynamic adaptation of verification rules to Hook interception scenarios, resolving the contradiction in existing technologies where "fixed rules either prevent omissions or over-intercept".

[0238] 3. Verification-interception non-bypass atomic execution mechanism

[0239] This invention compiles the execution code of the verification logic into the kernel-mode / user-mode execution flow of the Hook function, rather than calling it externally via function calls. Specifically:

[0240] The verification logic and the Hook function share the same memory space, with no cross-process / cross-module calls, thus preventing the verification results from being maliciously intercepted or tampered with during the call process;

[0241] If the verification fails, the return operation is executed directly in the Hook function without calling the original communication function. The execution flow cannot be bypassed, and the verification process cannot be skipped through reverse hooking.

[0242] The verification result is bound to the execution status of the Hook function, and the memory address is obfuscated throughout the verification process to prevent the debugger from tampering with the verification result.

[0243] Creative value: Existing technologies use independent modules for verification, which are easily bypassed by reverse hooking. This invention achieves atomic execution of verification and interception, eliminating the possibility of the verification process being bypassed from the execution mechanism, and the protection strength is far higher than that of existing technologies.

[0244] (II) Three core creative improvements to the encryption and decryption module

[0245] Common shortcomings of existing technologies include: decoupling of encryption logic from Hook interception; static keys that are easily stolen; multiple memory copies during encryption and decryption, resulting in significant performance overhead and inability to meet the real-time requirements of Hook interception. The improvements in this invention are entirely designed around the characteristics of Hook technology, as detailed below:

[0246] 1. Dynamic session key rotation mechanism based on Hook call cycle

[0247] The key rotation in this invention is not based on a fixed time period, but is deeply bound to the lifecycle of the Hook function call. Specifically, the implementation is as follows:

[0248] The key rotation trigger condition is bound to the number of times the Hook function is called: every N times the communication function is hooked and processed, a session key rotation is automatically triggered. The value of N is dynamically adjusted according to the risk level (in high-risk scenarios, N=1, that is, the key is rotated every time the Hook is called; in low-risk scenarios, N can be adjusted adaptively).

[0249] The generation factor of the session key is bound to the current Hook context: Each generated session key contains four factors: the entry address of the current Hook function, the PID of the caller process, the unique terminal verification value, and the timestamp. It is derived iteratively through the SM3 algorithm. The generated key can only be used in the current Hook context and the current communication session. Even if the key is stolen, it cannot be used in other scenarios or other processes.

[0250] The key lifecycle is bound to the Hook function execution cycle: the session key only exists temporarily in the Hook's private memory space during the execution of the Hook function. The key is destroyed immediately after the Hook function is completed. It is not stored on the ground or kept in memory, preventing the key from being stolen through memory dumps or debuggers.

[0251] Creative value: Existing key rotation technologies are all time-driven static rotations, which cannot resist data theft within a single session. This invention realizes dynamic key rotation driven by Hook calls, with the key deeply bound to the Hook context, fundamentally solving the problem of batch data security caused by key leakage, and its security is far superior to existing technologies.

[0252] 2. Multi-factor binding key hierarchical derivation mechanism

[0253] This invention does not directly generate encryption keys from terminal identifiers, but instead constructs a three-layer key derivation system of "master key - session key - working key", specifically implemented as follows:

[0254] Master key generation: Collect five factors: terminal IMEI, MAC address, CPU serial number, digital signature hash value of Hook module, and user PIN code. Perform three iterations of hashing using the SM3 algorithm to generate a 256-bit master key. The master key is only used to derive lower-level keys and does not directly participate in any data encryption or decryption. It is stored in the terminal trusted execution environment (TEE) or encrypted security zone throughout the process and cannot be accessed externally.

[0255] Session key generation: Each time a communication session is established, a session key is generated using the SM4 key derivation algorithm by combining the master key, session ID, and random number. The session key is used only for the current communication session and is destroyed immediately upon the end of the session.

[0256] Working key generation: Each time the Hook function is executed, a temporary working key is generated using the session key and the Hook context parameter. This temporary working key is used for encrypting and decrypting the intercepted data and is destroyed immediately after execution.

[0257] Creative value: Existing key systems are mostly single-layer structures, with the master key directly involved in encryption, making them easy to steal. The three-layer key derivation system of this invention completely isolates the master key from the actual encryption and decryption, and the key factor is bound to the signature hash value of the Hook module itself. Once the Hook module is tampered with, the key system immediately becomes invalid, and at the same time achieves the ultimate security protection of "one key per call", which cannot be achieved by existing technologies.

[0258] 3. Zero-copy in-place encryption / decryption mechanism within the hook memory space

[0259] The encryption and decryption operations of this invention are completed entirely within the memory space of the Hook function, eliminating the need for multiple data copies. Specific implementation details are as follows:

[0260] After the Hook function intercepts the communication data, it directly performs SM4 encryption and decryption operations in the kernel / user space memory address of the original data, without having to copy the data to the memory space of the encryption module, thus achieving zero-copy processing. This improves encryption and decryption performance by more than 40% and significantly reduces the impact of Hook interception on terminal performance.

[0261] Based on the length of the data intercepted by the Hook, the SM4 encryption mode is adaptively adjusted: small data packets (≤1024 bytes) use ECB mode to improve processing speed; large data packets (>1024 bytes) use CBC mode to ensure encryption security.

[0262] The memory addresses during the encryption and decryption process are dynamically obfuscated throughout to prevent debuggers from stealing plaintext data through memory breakpoints. Plaintext residue in memory is cleared immediately after encryption and decryption are completed.

[0263] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A terminal communication security protection method based on Hook technology, characterized in that, Includes the following steps: S1. Real-time acquisition of terminal data; S2. Select the appropriate Hook implementation method based on the terminal data, evaluate and select the optimal Hook point; register the Hook function according to the Hook implementation method; Perform security checks on Hook functions: the Hook function can only be executed if the check passes; otherwise, the Hook execution is terminated. Send communication data. When the communication data reaches the optimal Hook point, trigger the Hook function to intercept it and obtain the intercepted communication data. S3. Perform security verification on the intercepted communication data: When the security check fails, a failure result is returned. When the security verification is successful, the intercepted communication data will be transmitted. S4. Combine the terminal's unique identifier to generate a master key and a session key. Encrypt the session key using the master key to obtain the encrypted session key. Generate a working key using the encrypted session key. Use the working key to encrypt the communication data that was successfully verified in S3 and send it. When receiving, use the corresponding working key to decrypt it to obtain the original communication data.

2. The terminal communication security protection method based on Hook technology according to claim 1, characterized in that, The method of evaluating and selecting the optimal hook point based on communication protocol data and process and network status data is specifically implemented as follows: Select candidate hook points and define evaluation parameters; Convert the raw values ​​of the evaluation parameters into normalized values; The evaluation value ppz of each candidate hook point is calculated by using a weighted summation formula combined with normalized values, and the optimal hook point is selected.

3. The terminal communication security protection method based on Hook technology according to claim 1, characterized in that, The security verification of the Hook is specifically performed as follows: The executable code of the Hook function is digitally signed and verified: if the signature is invalid, it is determined that the Hook function has been tampered with, and the execution of the Hook function is terminated immediately; if the signature is valid, the Hook function runs normally. When a debugger process or a mainstream anti-Hook framework is detected, the Hook function interception is paused and the Hook registration information is cleared; at the same time, the memory address of the Hook function is obfuscated; if no debugger process or mainstream anti-Hook framework is detected, the Hook function runs normally. By setting a security-enhanced Linux mandatory access control label, unauthorized processes are prohibited from interacting with Hook functions.

4. The terminal communication security protection method based on Hook technology according to claim 1, characterized in that, The security verification of the intercepted communication data specifically includes: The intercepted communication data undergoes integrity verification, legality verification, and malicious content detection. Integrity verification involves calculating the hash value of the intercepted communication data and comparing it with a hash value pre-transmitted by the sender. If they match, the verification is successful; If they do not match, the verification fails; The legitimacy verification involves extracting and decrypting the digital signature from the communication data to obtain its hash value, which is then compared with the locally calculated hash value of the communication data. If they match, the verification is successful; If they do not match, the verification fails; Malicious content detection performs fast, lightweight signature matching on intercepted communication data: If no feature match is found and there are no suspicious signs of communication, then the communication data is normal communication data. If the feature match fails but there are suspicious signs of communication, further analysis is conducted to determine if the data deviates from the historical baseline. If it deviates from the historical baseline, it is determined to be malicious data; otherwise, it is determined to be normal communication data. If the signature matches, or if the behavior analysis determines that there is abnormal communication behavior, then the data is determined to be malicious data. Communication data can only be transmitted when the integrity verification, legality verification, and malicious content detection determine that the communication data is normal; if any one of these conditions is not met, the communication data transmission will be blocked.

5. The terminal communication security protection method based on Hook technology according to claim 1, characterized in that, The specific method for obtaining the working key is as follows: Collect the unique identifier information of the terminal and generate a unique verification value for the terminal; Check if the terminal supports a trusted execution environment: If supported, the master key is generated using the key generator of the trusted execution environment; If not supported, a master key will be generated by combining the user's PIN code with the terminal's unique verification value; Generate a session key, encrypt the session key using the master key, and generate the encrypted session key; A temporary working key is generated using the encrypted session key and the context parameters of the current Hook function, which is used for encrypting and decrypting the intercepted data.

6. A terminal communication security protection system based on Hook technology, characterized in that, It includes a terminal status awareness module, an intelligent Hook management module, a Hook security protection module, a security verification module, and an encryption / decryption module; among which: Terminal status sensing module: collects terminal data in real time; The intelligent Hook management module selects the appropriate Hook implementation method based on terminal data and evaluates and selects the optimal Hook point; it also registers Hook functions according to the Hook implementation method. Hook security protection module: performs security verification on hook functions: the hook function can only be executed if the verification passes; otherwise, the hook function will be terminated. The sending end sends communication data. When the communication data reaches the optimal hook point, the hook function is triggered to intercept it and obtain the intercepted communication data. Security verification module: Performs security verification on intercepted communication data. When the security check fails, a failure result is returned. When the security verification is successful, the intercepted communication data will be transmitted. Encryption / decryption module: Combines the terminal's unique identifier to generate a master key and a session key. The session key is encrypted using the master key to obtain the encrypted session key. A working key is generated based on the encrypted session key. The working key is used to encrypt the communication data that has been successfully verified in S3 before sending it. When receiving, the corresponding working key is used to decrypt the data to obtain the original communication data.

7. A server, characterized in that, The server includes a processor and a memory, the memory storing at least one program, which is loaded and executed by the processor to implement the terminal communication security protection method based on Hook technology as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium stores at least one program, which is loaded and executed by a processor to implement the terminal communication security protection method based on Hook technology as described in any one of claims 1 to 5.

Images