Password-controlled decryption method, device, equipment and storage medium thereof

Abstract

The application discloses a password-controlled decryption method and device, equipment and a storage medium thereof, and relates to the technical field of information security. The method comprises the following steps: obtaining a focus control and website information of a current page, and performing legal verification on the website information; after the website information is verified, collecting multi-dimensional feature information of the focus control and behavior sequence data of a user; extracting time sequence features from the behavior sequence data based on a time sequence coding module in a preset prediction model, and predicting whether a password needs to be input and a password box position based on the time sequence features to obtain a prediction result; matching the multi-dimensional feature information with a pre-stored feature template to obtain a matching result; when the prediction result and the matching result both satisfy a preset condition, obtaining a pre-stored decryption password, and delivering the decryption password to the focus control for decryption. The password plaintext is prevented from being decrypted in an illegal input control, and the online banking password is realized to be decrypted and input only in a legal online banking password input box.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to cryptographic controlled decryption methods, apparatus, devices and their storage media. Background Technology

[0002] In RPA (Robotic Process Automation) online banking automation scenarios, online banking login passwords are typically stored in encrypted form. When the automated program needs to input the password onto the online banking login page, it must first decrypt it into plaintext before filling it into the password field by simulating keyboard input. During this process, the plaintext password appears in the client's memory, becoming a primary target for attackers.

[0003] Currently, existing password managers and autofill schemes typically bind decryption permissions to user or application identities. Once authentication is successful, the decrypted plaintext can be delivered to any input control with focus, and the identification of the input target usually relies on matching the window title or process name. However, the legitimacy of the target entering the password is not verified. This allows the target to potentially decrypt and output the password in a fake window program with the same title or process name, resulting in the online banking password being decrypted and entered into an invalid online banking password input box.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a controlled password decryption method, apparatus, device and storage medium, which aims to solve the technical problem of how to ensure that online banking passwords are decrypted and entered only in the valid online banking password input box.

[0006] To achieve the above objectives, this application proposes a cryptographically controlled decryption method, the method comprising: Obtain the focus control and URL information of the current page, and verify the validity of the URL information; After the URL information is verified, multidimensional feature information of the focus control and user behavior sequence data are collected. The temporal coding module in the preset prediction model extracts temporal features from the behavioral sequence data, and based on the temporal features, predicts whether a password needs to be entered and the position of the password box, thus obtaining the prediction result. The multidimensional feature information is matched with the pre-stored feature template to obtain the matching result; When both the prediction result and the matching result meet the preset conditions, the pre-stored decryption password is obtained and the decryption password is delivered to the focus control for decryption.

[0007] In one embodiment, when both the prediction result and the matching result meet preset conditions, the step of obtaining a pre-stored decryption password and submitting the decryption password to the focus control for decryption includes: When both the prediction result and the matching result meet the preset conditions, the pre-stored decryption password is obtained in the preset safe space. The safe space is pre-configured to prevent external processes from accessing the memory inside the safe space. The decryption password is delivered to the focus control for decryption within the secure space.

[0008] In one embodiment, the step of pre-configuring the safe space to prevent external processes from accessing the memory within the safe space includes: The memory pages in the safe space are marked as protected by a preset memory page protection mechanism, preventing external processes from accessing the memory inside the safe space. The memory page protection mechanism involves setting the PAGE_GUARD protection flag to trigger a structured exception for unauthorized access.

[0009] In one embodiment, before the step of delivering the decryption password to the focus control for decryption, the method further includes: The integrity of the runtime environment of the process to which the focused control belongs is verified. The integrity verification includes detecting at least one of the following: dynamic link library injection, remote threads, system hook chains, clipboard monitoring, reverse analysis tools, and parent process chain anomalies. When the integrity verification of the operating environment passes, the decryption password is delivered to the focused control for decryption.

[0010] In one embodiment, the step of performing integrity verification on the runtime environment of the process to which the focused control belongs further includes: The system detects whether the dynamic link library list loaded by the process to which the focus control belongs contains a preset blacklist module, and checks whether there is a remote thread created by a process other than the process to which the focus control belongs in the process. Check for any global message hooks installed by processes not on the default whitelist; Check whether a clipboard monitoring process exists in the runtime environment, and detect whether a preset reverse analysis tool is running in the runtime environment; Verify the parent process chain of the process to which the focused control belongs; If any check fails, the integrity check of the operating environment is deemed to have failed.

[0011] In one embodiment, the step of verifying the parent process chain of the process to which the focused control belongs includes: Starting from the process to which the focus control belongs, trace the complete parent process chain along the parent process chain direction to verify whether each parent process is valid. The parent process chain consists of the password control process, the online banking host process, the browser main process, and the user startup process. If an invalid parent process exists, the runtime environment is determined to have failed the integrity check.

[0012] In one embodiment, after the step of performing integrity verification on the runtime environment of the process to which the focused control belongs, the method further includes: If the integrity verification of the operating environment fails, decoy data is deployed in the operating environment, and a general rejection message is output to the page where the focus control is located, indicating that the decryption failed. Record the verification failure logs, and determine whether to trigger a preset response delay in the next decryption based on the cumulative number of failures recorded in the logs; When the cumulative number of failures reaches a preset number, the response delay is triggered, introducing a preset decryption delay duration for the next decryption operation; The decryption operation is terminated when the decoy data is detected to be accessed during the next decryption process.

[0013] Furthermore, to achieve the above objectives, this application also proposes a cryptographically controlled decryption device, which includes: The acquisition module is used to acquire the focus control and URL information of the current page, and to verify the validity of the URL information; The acquisition module is used to acquire multidimensional feature information of the focus control and user behavior sequence data after the URL information is verified. The prediction module is used to extract temporal features from the behavioral sequence data based on the temporal coding module in the preset prediction model, and based on the temporal features, predict whether a password needs to be entered and the position of the password box, and obtain the prediction result. The matching module is used to match the multidimensional feature information with the pre-stored feature template to obtain the matching result; The decryption module is used to obtain a pre-stored decryption password when both the prediction result and the matching result meet preset conditions, and to submit the decryption password to the focus control for decryption.

[0014] In addition, to achieve the above objectives, this application also proposes a cryptographically controlled decryption device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the cryptographically controlled decryption method as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the password-controlled decryption method described above.

[0016] One or more technical solutions proposed in this application have at least the following technical effects: By acquiring and validating the current page's focus control and URL information, fake and illegal windows are excluded. After URL verification, multi-dimensional feature information of the focus control and user behavior sequence data are collected. Based on the temporal coding module in the preset prediction model, temporal features are extracted from the behavior sequence data. Based on the temporal features, predictions are made about whether a password is required and the password box position. The temporal coding module models and analyzes the user's true input intent from a temporal perspective, making the intent recognition results at the user behavior level one of the decision bases for password delivery, avoiding the wrong delivery of passwords when the user has no input intent. The multi-dimensional feature information is then matched with pre-stored feature templates to obtain matching results, which can provide a second confirmation of the legality of the target input control from the control feature level. When both the prediction result and the matching result meet the preset conditions, the pre-stored decryption password is acquired and delivered to the focus control for decryption. In other words, password delivery is only triggered when the three conditions of URL legitimacy verification, control feature matching, and user behavior intent prediction are met simultaneously. This constructs a multi-layered security verification mechanism from three dimensions: URL source legitimacy, control feature authenticity, and user behavior intent authenticity. This prevents plaintext passwords from being decrypted and output in invalid input controls, ensuring that online banking passwords are only decrypted and entered in valid online banking password input boxes. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1This is a flowchart illustrating an embodiment of the cryptographically controlled decryption method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the cryptographically controlled decryption method of this application. Figure 3 This is a flowchart of the URL / domain detection and multi-source cross-verification process provided by the controlled decryption party for the password in this application. Figure 4 A deep neural network model structure diagram provided by the cryptographically controlled decryption party in this application; Figure 5 This is a flowchart illustrating Embodiment 3 of the cryptographically controlled decryption method of this application; Figure 6 A multi-dimensional intelligent verification flowchart provided for the password-controlled decryption party in this application; Figure 7 This is a schematic diagram of the module structure of the password-controlled decryption device according to an embodiment of this application; Figure 8 This is a schematic diagram of the device structure of the hardware operating environment involved in the password-controlled decryption method in the embodiments of this application.

[0020] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0022] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or RPA robot capable of performing the above functions. The following description uses an RPA robot as an example to illustrate this embodiment and the subsequent embodiments.

[0023] Based on this, embodiments of this application provide a password-controlled decryption method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the cryptographically controlled decryption method of this application.

[0024] In this embodiment, the password-controlled decryption method includes steps S10 to S50: Step S10: Obtain the focus control and URL information of the current page, and verify the validity of the URL information; It should be noted that a focused control is a control on the current page that has input focus, including but not limited to password input boxes, text boxes, and other UI controls that can receive input. The URL information is the Uniform Resource Locator (URL) address of the current page. Validation verifies the authenticity of the URL information, determining whether the URL is from a pre-defined list of trusted URLs.

[0025] Understandably, by acquiring and verifying the focus control and URL information, it is possible to determine whether the page the user is currently interacting with is a legitimate page, thus preventing decryption operations from being performed on fake pages and improving the security of the password decryption process.

[0026] Step S20: After the URL information is verified, collect the multidimensional feature information of the focus control and the user's behavior sequence data; It should be noted that multidimensional feature information refers to the attribute characteristics of the focused control across multiple dimensions, including but not limited to control type, control size, control position, control style, and the process name to which the control belongs. Behavioral sequence data is a record of continuous user actions during operation, including but not limited to mouse click trajectories, keyboard input rhythm, and page scrolling patterns.

[0027] Understandably, collecting multi-dimensional feature information and behavioral sequence data after the URL verification is successful can provide a multi-dimensional data foundation for password demand prediction and target verification, thereby increasing the accuracy of input target identification.

[0028] Step S30: Based on the temporal coding module in the preset prediction model, extract temporal features from the behavior sequence data, and based on the temporal features, predict whether a password needs to be entered and the position of the password box to obtain the prediction result; It should be noted that the prediction model employs a machine learning model with a dual-branch encoder-fusion-dual-decoder architecture, incorporating a temporal coding module, to analyze user behavior data. The temporal coding module is the encoding unit in the prediction model used to process time-series data, extracting time-dependent features from the behavioral sequence data. Temporal features reflect the regularity of user operations over time. The prediction result is a judgment output regarding whether a password is required and the position of the password input field.

[0029] Understandably, by extracting temporal features from behavioral sequence data and making predictions through the temporal coding module, it is possible to intelligently determine whether a password needs to be entered in the current scenario and the specific location of the password box based on the user's operational behavior patterns, thereby achieving proactive perception of password input needs.

[0030] Step S40: Match the multidimensional feature information with the pre-stored feature template to obtain the matching result; It should be noted that the pre-stored feature template is a set of multi-dimensional feature information of legal focus controls stored in advance. The matching result is a judgment of similarity or consistency between the multi-dimensional feature information and the feature template.

[0031] Understandably, by matching the collected multidimensional feature information with the pre-stored feature template, it is possible to verify whether the current focused control is a legitimate password input target, thereby preventing the password from being delivered to a forged input control.

[0032] Step S50: When both the prediction result and the matching result meet the preset conditions, obtain the pre-stored decryption password and submit the decryption password to the focus control for decryption.

[0033] It should be noted that the preset conditions are pre-defined criteria for judging the validity of the prediction and matching results. The pre-stored decryption password is the plaintext form of the encrypted password, which is pre-stored in a secure storage area.

[0034] It is understandable that by requiring both the prediction result and the matching result to meet preset conditions before executing the password acquisition and delivery, a dual verification mechanism is formed. This ensures that the decryption operation is only executed when the prediction confirms that a password is required and the focused control is verified as a legitimate target through feature matching. This avoids the risk of the password being mistakenly delivered or delivered to an illegal target.

[0035] In a practical implementation, let's take the example of a corporate finance employee logging into a bank's online banking system via an RPA automation system. After the RPA robot opens the bank's online banking login page, it calls the Agent service's automatic password input interface through the HTTP RESTful (HyperText Transfer Protocol Representational State Transfer) interface. The Agent service receives the trigger command and calls the focus positioning module to obtain the handle of the current foreground window through the GetForegroundWindow function, the thread ID and process ID through the GetWindowThreadProcessId function, and the handle of the currently focused control through the GetGUIThreadInfo function. The Agent service starts the verification layer URL detection module, which obtains the URL (Uniform Resource Locator) of the current active browser tab from three independent information sources: the UIAutomation (User Interface Automation) interface, the IAccessible interface, and the browser extension interface. The URLs obtained from the three sources are cross-validated to ensure that the URL has not been forged by a hook mechanism. After successful verification, the URL is matched against the pre-registered bank domain whitelist using a three-level matching process: exact matching, registered domain matching, and subdomain matching. Simultaneously, the URL protocol is verified as HTTPS, and the integrity of the SSL / TLS (Secure Sockets Layer / Transport Layer Security) certificate chain and domain consistency are checked. Anomaly detection is performed on the URL, including homonym detection and mixed script detection. Following successful URL verification, the feature information collection module collects seven-dimensional feature information of the focused control, including process digital signature information, window class name information, control password style flags, control path information in the user interface automation tree, focus state information, control visual feature information, and page environment feature information. The process digital signature information must be a code signing certificate issued by the bank's CA (Certificate Authority); invalid signatures or those not issued by the bank will result in immediate disqualification.The deep learning prediction module inputs real-time collected user behavior data and password input box data into a pre-trained deep neural network model. This model employs a dual-branch encoder-dual-decoder architecture and incorporates a GRU (Gated Recurrent Unit)-based temporal coding module. The model outputs a prediction of whether a password is required and the predicted password input box position. When the prediction indicates that a password is required and the confidence level exceeds a preset threshold, the seven-dimensional feature information is compared dimension-by-dimensionally with a pre-registered online banking password input box feature information template. The order of the dimension-by-dimensional comparisons is randomly selected from multiple preset security permutations. When all dimensions match, the security protection layer and security space isolation protection are activated, and runtime integrity verification is performed, including DLL (Dynamic Link Library) injection detection, remote thread detection, system hook chain scanning, clipboard monitoring detection, reverse engineering tool detection, and parent process chain verification. The parent process chain verification requires a complete and legitimate chain: the parent process of the password control process is the online banking host process, the parent process of the online banking host process is the browser main process, the parent process of the browser main process is the user-launched process, and each parent process must have a valid digital signature. After all verifications pass, the ciphertext is read from the ciphertext storage and decrypted into plaintext in protected memory. The plaintext is then delivered character by character to the focus control via simulated input. After delivery, the plaintext data in memory is immediately cleared. If any verification step fails, a uniform, fuzzy rejection message is returned, without revealing the specific failure dimension.

[0036] This embodiment provides a controlled password decryption method. It obtains and verifies the focus control and URL information of the current page to exclude forged, illegal windows. After successful URL verification, it collects multi-dimensional feature information of the focus control and user behavior sequence data. Based on the temporal coding module in a preset prediction model, it extracts temporal features from the behavior sequence data and predicts whether a password is required and the password box position based on these features. This prediction result allows the temporal coding module to model and analyze the user's true input intent from a temporal perspective, making the intent recognition result at the user behavior level one of the decision bases for password delivery, preventing passwords from being mistakenly delivered when the user has no input intent. The multi-dimensional feature information is then matched with a pre-stored feature template to obtain a matching result, which can provide a secondary confirmation of the legality of the target input control from the control feature level. When both the prediction result and the matching result meet preset conditions, the pre-stored decryption password is obtained and delivered to the focus control for decryption. In other words, password delivery is only triggered when the three conditions of URL legitimacy verification, control feature matching, and user behavior intent prediction are met simultaneously. This constructs a multi-layered security verification mechanism from three dimensions: URL source legitimacy, control feature authenticity, and user behavior intent authenticity. This prevents plaintext passwords from being decrypted and output in invalid input controls, ensuring that online banking passwords are only decrypted and entered in valid online banking password input boxes.

[0037] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Step S50 further includes steps S01~S02: Step S01: When both the prediction result and the matching result meet the preset conditions, obtain the pre-stored decryption password in the preset safe space. The safe space is pre-configured to prevent external processes from accessing the memory inside the safe space. Step S02: In the secure space, the decryption password is delivered to the focus control for decryption.

[0038] It should be noted that the safe space is a pre-created isolated execution environment with its own memory space and access control policies. External processes cannot directly access the memory data within the safe space. The configuration methods for the safe space include, but are not limited to, using process isolation mechanisms, memory protection mechanisms, or virtualization technologies provided by the RPA robot's operating system.

[0039] Understandably, by obtaining the decryption password and performing the delivery operation in a secure space, the password storage and delivery process is isolated from the external environment. Even if there is malicious monitoring behavior from external processes, they will not be able to steal the password data in the secure space, thereby further enhancing the security of the password decryption process.

[0040] Understandably, restricting the acquisition and delivery of passwords to the same secure space avoids the risk of passwords being intercepted during cross-space transmission, thus achieving closed protection of password data throughout its entire lifecycle.

[0041] In the specific implementation, refer to Figure 3 Taking RPA robot login to a bank's corporate online banking as an example, the Agent service collects information from three independent sources simultaneously when obtaining the URL of the current active browser tab. The first source is the UIAutomation interface, which retrieves the Value property of the browser's address bar control through IUIAutomation (Interface of User Interface Automation) tree traversal. The second source is the IAccessible interface, which retrieves the accValue property of the browser's address bar through the AccessibleObjectFromWindow function. The third source is the browser extension interface, which uses a pre-installed browser extension to call the tabs.query API to obtain the URL of the current active tab. The Agent service compares the URLs obtained from these three sources. If they do not match, it determines that a Hook spoofing attack has occurred and directly rejects the password decryption operation. If all three match, the URL is matched against the pre-registered bank domain whitelist using a three-level matching process. First, an exact match is performed to determine if the URL is completely identical to any entry in the whitelist. If no match is found, a registered domain match is performed, extracting the URL's registered domain and comparing it to those in the whitelist. If still no match is found, a subdomain match is performed to determine if the URL's domain is a subdomain of any domain in the whitelist. After successful three-level matching, the URL protocol is verified as HTTPS. If so, the operating system's certificate verification interface is called to check the integrity of the SSL / TLS certificate chain and the domain consistency. Finally, anomaly detection is performed on the URL, using a Unicode normalization algorithm to detect homonyms in the domain and checking for mixed scripts.

[0042] Furthermore, the step of pre-configuring the safe space to prevent external processes from accessing the memory within the safe space includes: The memory pages in the safe space are marked as protected by a preset memory page protection mechanism, preventing external processes from accessing the memory inside the safe space. The memory page protection mechanism involves setting the PAGE_GUARD protection flag to trigger a structured exception for unauthorized access.

[0043] It's important to note that the memory page protection mechanism is a page-level access control mechanism provided by the operating system. The PAGE_GUARD protection flag is a special protection flag in the operating system's memory management. When a memory page with this flag set is accessed, the operating system automatically triggers a structured exception handler. A structured exception is an abnormal event generated by the operating system when it detects illegal memory access. Applications can catch and handle this exception by registering an exception handling function.

[0044] Understandably, by setting the PAGE_GUARD protection flag to mark the memory pages in the safe space as protected, when an external process attempts to access the protected memory page, the operating system immediately triggers a structured exception, thereby preventing the external process from illegally reading the safe space memory and effectively protecting the decryption password.

[0045] Understandably, the isolation of the secure space is achieved by utilizing the underlying memory page protection mechanism of the operating system, without relying on additional hardware virtualization technology, which reduces the implementation complexity and improves the compatibility and reliability of the secure space.

[0046] In the specific implementation, refer to Figure 4The deep neural network model is deployed in the inference engine of the Agent service, employing a dual-branch encoder-decoder architecture. The first branch processes user behavior data, including the sequence of URLs accessed by the user, the sequence of control types interacted with, the sequence of event types triggered by the user, and their corresponding timestamps. The first branch first encodes the user behavior data using a single-layer linear encoding layer to obtain user behavior features, and then uses a positional encoding layer to perform positional encoding on the user behavior data to obtain positional encoded features, which are then added to the user behavior features. Building upon this, the first branch introduces a temporal encoding module. This module is based on a dual-layer GRU structure with 128 hidden units. The input is a sequence of user interaction events, with each event encoded as a triplet of control type, event type, and timestamp. The temporal encoding module captures the temporal dependencies of interaction intervals, interaction speed trends, and page dwell time, outputting a temporal feature vector. This temporal feature vector is then concatenated with the user behavior features after adding positional encoding to obtain the complete user behavior features. The second branch of the model processes password box data, which includes the handle, ID, name, type, depth, level, coordinates, parent-child class, sibling nodes, and a flag indicating whether a password box is present for all password boxes on the interface. The second branch extracts features from the password box data using a Multilayer Perceptron (MLP) to obtain password box features. Subsequently, the complete user behavior features output from the first branch and the password box features output from the second branch are fused using a self-attention mechanism to obtain joint features. These joint features are then input to two decoders: the first is a binary classification decoder, used to predict whether a password is required in the current operation stage, outputting a confidence score; the second is a regression decoder, used to predict the position coordinates of the password boxes.

[0047] Based on the first and second embodiments of this application, the same or similar content as the above embodiments in the third embodiment of this application can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 5 Before the step "submitting the decryption password to the focus control for decryption", the password-controlled decryption method further includes steps S1~S2: Step S1: Perform integrity verification on the runtime environment of the process to which the focus control belongs. The integrity verification includes: detecting at least one of the following: dynamic link library injection, remote thread, system hook chain, clipboard monitoring, reverse analysis tools, and parent process chain anomalies. Step S2: When the integrity verification of the operating environment passes, the decryption password is delivered to the focus control for decryption.

[0048] It's important to note that the runtime environment refers to the system environment of the process containing the focused control. This includes information such as the modules loaded by the process, the threads created, the registered system hooks, the clipboard access status, running debugging tools, and the process's parent process chain. Integrity verification is a comprehensive security check of the runtime environment, used to detect whether there is malicious tampering or monitoring activity within it.

[0049] Understandably, by performing an integrity check on the runtime environment of the process to which the focused control belongs before the password is delivered, it is possible to detect security threats such as dynamic link library injection, remote thread creation, system hook registration, clipboard monitoring, reverse engineering tool operation, or abnormal parent process chain in the runtime environment. Password delivery is only performed when the runtime environment is secure, thereby preventing the password from being leaked in a monitored or tampered environment.

[0050] Understandably, making runtime environment integrity verification a prerequisite for password delivery creates a triple security defense line of URL verification, feature matching, and runtime environment verification, which can improve the overall security of the password decryption process.

[0051] In the specific implementation, refer to Figure 6The anti-detection and anti-reconnaissance mechanism comprises three layers: a deep learning prediction layer, a multi-dimensional feature verification layer, and a context-aware risk rating layer. First, the deep learning prediction layer takes the focus control and user behavior sequence as input, outputting a confidence score and the coordinates of the password box position. Decryption is rejected when the confidence score does not reach the threshold or the position deviation exceeds the tolerance. Otherwise, the multi-dimensional feature verification layer performs a dimension-by-dimensional comparison of seven features: process signature, window class name, password style, control tree path, focus state, visual features, and page environment. Decryption is rejected when not all features match. Finally, a context-aware risk rating is applied to the operating environment; that is, the risk is divided into high-risk, medium-risk, and low-risk levels based on the current operating environment's risk level, and different verification strategies are executed according to the risk level. For low-risk scenarios, only basic process signature verification is performed. For medium-risk scenarios, remote thread detection and parent process chain verification are performed. For high-risk scenarios, a full-dimensional runtime integrity check is performed, including: checking whether the dynamic link library list loaded by the process to which the focused control belongs contains preset blacklist modules, and checking whether there are remote threads created by processes other than the process to which the focused control belongs; traversing the system's global hook list to check for security-sensitive system hooks; checking whether there are processes that have opened clipboard viewer chains or registered clipboard listeners; checking whether preset reverse engineering tools are running in the system; and verifying the parent process chain of the process to which the focused control belongs, tracing the complete parent process chain from the process to which the focused control belongs, verifying the legitimacy of each parent process. The legitimate parent process chain is, in order, the password control process, the online banking host process, the browser main process, and the user-launched process. If any parent process is invalid, the runtime environment integrity check is deemed to have failed. If any of the above checks fails, the runtime environment integrity check is deemed to have failed. When the integrity verification of the runtime environment passes, the Agent service determines that the final verification has passed, and the process enters the protection layer. It reads the ciphertext from the ciphertext storage and decrypts it into plaintext in the protected memory. It then delivers the decryption password character by character to the focus control through simulated input for decryption. After the delivery is completed, the plaintext data in the memory is immediately cleared.

[0052] Furthermore, the step of performing integrity verification on the runtime environment of the process to which the focused control belongs also includes: The system detects whether the dynamic link library list loaded by the process to which the focus control belongs contains a preset blacklist module, and checks whether there is a remote thread created by a process other than the process to which the focus control belongs in the process. Check for any global message hooks installed by processes not on the default whitelist; Check whether a clipboard monitoring process exists in the runtime environment, and detect whether a preset reverse analysis tool is running in the runtime environment; Verify the parent process chain of the process to which the focused control belongs; If any check fails, the integrity check of the operating environment is deemed to have failed.

[0053] It should be noted that the blacklist module is a pre-collected list of known malicious dynamic link libraries. Remote threads are threads created by other processes within the target process for injecting malicious code. The whitelist process is a pre-authorized list of trusted processes. The global message hook is an operating system-level message monitoring mechanism that can intercept messages sent to all windows. The clipboard monitoring process is a process that continuously monitors changes to the clipboard content. Reverse engineering tools include, but are not limited to, debuggers, disassemblers, memory editors, and other tools used to analyze or modify program behavior.

[0054] Understandably, by refining security checks across multiple dimensions, such as dynamic link library blacklist detection, remote thread detection, global message hook whitelist detection, clipboard monitoring detection, reverse engineering tool detection, and parent process chain verification, a comprehensive runtime environment security detection system is formed. If any dimension of the check fails, the integrity verification is deemed to have failed, thereby ensuring the security of the runtime environment.

[0055] Understandably, by breaking down integrity verification into multiple specific testing steps, each testing dimension can have a clear testing object and judgment standard, thereby improving the operability and accuracy of integrity verification.

[0056] In its implementation, when any verification step fails, the Agent service performs corresponding layer processing: outputting a uniform, fuzzy rejection message, sending the same generic rejection message to the RPA bot, such as "Verification failed, unable to decrypt password," without revealing the specific failure dimension, reason for failure, or verification threshold. The Agent service also records anomaly logs, including the trigger time, process name of the focused control, process path, window class name, window title, and environment risk score. The logs are written to a tamper-proof storage area, and do not record the specific failure dimension. The Agent service monitors the pattern characteristics of abnormal rejections, identifies automated probing behavior, and triggers a probing alarm when it detects high-frequency abnormal requests within a short period, a systematic change in the combination of abnormal request dimensions, or abnormal requests all originating from the same process or process group. When the number of abnormal rejections increases sharply within a short period, the Agent service automatically enters a circuit breaker state, suspending all password decryption services for that account and activating a time trap mechanism. Subsequent abnormal requests are no longer responded to immediately, but instead a gradually increasing delay is introduced, starting from 5 seconds and increasing exponentially, consuming the attacker's time resources and increasing probing costs.

[0057] Furthermore, the step of verifying the parent process chain of the process to which the focused control belongs includes: Starting from the process to which the focus control belongs, trace the complete parent process chain along the parent process chain direction to verify whether each parent process is valid. The parent process chain consists of the password control process, the online banking host process, the browser main process, and the user startup process. If an invalid parent process exists, the runtime environment is determined to have failed the integrity check.

[0058] It should be noted that the parent process chain is a chain of process creation relationships formed by tracing back from the current process to its parent processes. The password control process is a dedicated control process responsible for password input processing. The online banking host process is the container process that runs online banking functions. The browser main process is the core management process of the browser. The user-initiated process is the initial process manually started by the user after logging into the system.

[0059] Understandably, by tracing the complete parent process chain from the process to which the focus control belongs, and verifying whether each parent process conforms to the preset legitimate parent process chain order, attackers can take advantage of the fact that they cannot forge a complete legitimate parent process chain, thereby effectively detecting attacks that disguise legitimate processes by forging parent process chains.

[0060] Understandably, by defining the legitimate parent process chain order from the password control process to the user-initiated process, a reliable baseline for process creation relationships is established, so that any parent process chain that does not conform to the baseline will be judged as abnormal, thereby identifying malicious processes started through abnormal process creation methods.

[0061] In a practical implementation, taking the login of an RPA robot to a bank's corporate online banking system as an example, when the Agent service detects potential probing behavior, it executes anti-probing layer processing: It proactively deploys forged plaintext password data as bait data in the memory space of the process owning the focused control. This bait data is marked with easily detectable memory area characteristics. The Agent service continuously monitors the bait data area through a memory access anomaly monitoring mechanism. When unauthorized access to the bait data area is detected, it is directly determined as an attack, triggering the highest-level alarm and entering a circuit breaker state. All sensitive memory areas are immediately cleared, and the password decryption service is suspended.

[0062] Furthermore, after the step of performing integrity verification on the runtime environment of the process to which the focused control belongs, the method further includes: If the integrity verification of the operating environment fails, decoy data is deployed in the operating environment, and a general rejection message is output to the page where the focus control is located, indicating that the decryption failed. Record the verification failure logs, and determine whether to trigger a preset response delay in the next decryption based on the cumulative number of failures recorded in the logs; When the cumulative number of failures reaches a preset number, the response delay is triggered, introducing a preset decryption delay duration for the next decryption operation; The decryption operation is terminated when the decoy data is detected to be accessed during the next decryption process.

[0063] It should be noted that decoy data is pre-set fake sensitive data used to lure attackers into accessing it and exposing their probing behavior. The generic rejection message is a standardized rejection message without a specific reason for failure. The cumulative failure count is the number of consecutive integrity check failures within a certain period. The response latency is the time delay imposed on subsequent decryption operations after anomaly behavior is detected. The decryption latency duration is the specific time length of each delay.

[0064] It is understandable that by deploying decoy data and outputting a general rejection message when the integrity verification fails, the decoy data is used to lure attackers into probing behavior, while the general rejection message hides the specific reasons for failure, preventing attackers from inferring the verification logic based on the failure information.

[0065] It is understandable that by logging verification failures and triggering response delays based on the cumulative number of failures, an adaptive penalty for frequent probing behavior can be achieved. That is, as the number of failures increases, the waiting time for decryption operations gradually increases, thereby increasing the attacker's probing costs and time overhead.

[0066] Understandably, by terminating the decryption operation when the decoy data is accessed during the next decryption process, a real-time response to probing behavior can be achieved. That is, once the attacker touches the decoy data during the decryption process, the decryption operation is terminated immediately to prevent the password from being leaked in a threatened environment.

[0067] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the cryptographically controlled decryption method of this application. Any simple transformations based on this technical concept are within the protection scope of this application.

[0068] This application also provides a password-controlled decryption device; please refer to [reference needed]. Figure 7 The password-controlled decryption device includes: The acquisition module 10 is used to acquire the focus control and URL information of the current page, and to verify the validity of the URL information; The acquisition module 20 is used to acquire multidimensional feature information of the focus control and user behavior sequence data after the URL information is verified. The prediction module 30 is used to extract temporal features from the behavior sequence data based on the temporal coding module in the preset prediction model, and based on the temporal features, predict whether a password needs to be entered and the position of the password box, and obtain the prediction result. Matching module 40 is used to match the multidimensional feature information with a pre-stored feature template to obtain a matching result; The decryption module 50 is used to obtain a pre-stored decryption password when both the prediction result and the matching result meet the preset conditions, and to submit the decryption password to the focus control for decryption.

[0069] The password-controlled decryption device provided in this application, employing the password-controlled decryption method in the above embodiments, can solve the technical problem of how to ensure that online banking passwords are only decrypted and entered in valid online banking password input boxes. Compared with the prior art, the beneficial effects of the password-controlled decryption device provided in this application are the same as those of the password-controlled decryption method provided in the above embodiments, and other technical features in the password-controlled decryption device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0070] This application provides a password-controlled decryption device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the password-controlled decryption method in the first embodiment described above.

[0071] The following is for reference. Figure 8 The diagram illustrates a structural schematic suitable for implementing a cryptographically controlled decryption device according to embodiments of this application. The cryptographically controlled decryption device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, personal digital assistants, tablets, portable multimedia players, and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 8 The password-controlled decryption device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0072] like Figure 8As shown, the password-controlled decryption device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the password-controlled decryption device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. I / O (input / output) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the cryptographically controlled decryption device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show cryptographically controlled decryption devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0073] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0074] The password-controlled decryption device provided in this application, employing the password-controlled decryption method in the above embodiments, can solve the technical problem of how to ensure that online banking passwords are decrypted and entered only in valid online banking password input boxes. Compared with the prior art, the beneficial effects of the password-controlled decryption device provided in this application are the same as those of the password-controlled decryption method provided in the above embodiments, and other technical features in this password-controlled decryption device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0075] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0076] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0077] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the password-controlled decryption method in the above embodiments.

[0078] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0079] The aforementioned computer-readable storage medium may be included in a cryptographically controlled decryption device; or it may exist independently and not be assembled into a cryptographically controlled decryption device.

[0080] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the password-controlled decryption device, cause the password-controlled decryption device to perform the password-controlled decryption method in Embodiment 1.

[0081] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0082] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0083] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0084] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described password-controlled decryption method. This solves the technical problem of how to ensure that online banking passwords are only decrypted and entered in valid online banking password input fields. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the password-controlled decryption method provided in the above embodiments, and will not be repeated here.

[0085] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A controlled decryption method, characterized in that, The method includes: Obtain the focus control and URL information of the current page, and verify the validity of the URL information; After the URL information is verified, multidimensional feature information of the focus control and user behavior sequence data are collected. The temporal coding module in the preset prediction model extracts temporal features from the behavioral sequence data, and based on the temporal features, predicts whether a password needs to be entered and the position of the password box, thus obtaining the prediction result. The multidimensional feature information is matched with the pre-stored feature template to obtain the matching result; When both the prediction result and the matching result meet the preset conditions, the pre-stored decryption password is obtained and the decryption password is delivered to the focus control for decryption.

2. The controlled decryption method as described in claim 1, characterized in that, When both the prediction result and the matching result meet the preset conditions, the steps of obtaining the pre-stored decryption password and submitting the decryption password to the focus control for decryption include: When both the prediction result and the matching result meet the preset conditions, the pre-stored decryption password is obtained in the preset safe space. The safe space is pre-configured to prevent external processes from accessing the memory inside the safe space. The decryption password is delivered to the focus control for decryption within the secure space.

3. The controlled decryption method as described in claim 2, characterized in that, The steps of pre-configuring the safe space to prevent external processes from accessing the memory within the safe space include: The memory pages in the safe space are marked as protected by a preset memory page protection mechanism, preventing external processes from accessing the memory inside the safe space. The memory page protection mechanism involves setting the PAGE_GUARD protection flag to trigger a structured exception for unauthorized access.

4. The controlled decryption method as described in claim 1, characterized in that, Before the step of submitting the decryption password to the focused control for decryption, the method further includes: The integrity of the runtime environment of the process to which the focused control belongs is verified. The integrity verification includes detecting at least one of the following: dynamic link library injection, remote threads, system hook chains, clipboard monitoring, reverse analysis tools, and parent process chain anomalies. When the integrity verification of the operating environment passes, the decryption password is delivered to the focused control for decryption.

5. The method as described in claim 4, characterized in that, The step of performing integrity verification on the runtime environment of the process to which the focused control belongs further includes: Detect whether the dynamic link library list loaded by the process to which the focus control belongs contains a preset blacklist module, and check whether there is a remote thread created by a process other than the process to which the focus control belongs in the process; Check for any global message hooks installed by processes not on the default whitelist; Check whether a clipboard monitoring process exists in the runtime environment, and detect whether a preset reverse analysis tool is running in the runtime environment; Verify the parent process chain of the process to which the focused control belongs; If any check fails, the integrity check of the operating environment is deemed to have failed.

6. The controlled decryption method as described in claim 5, characterized in that, The steps for verifying the parent process chain of the process to which the focused control belongs include: Starting from the process to which the focus control belongs, trace the complete parent process chain along the parent process chain direction to verify whether each parent process is valid. The parent process chain consists of the password control process, the online banking host process, the browser main process, and the user startup process. If an invalid parent process exists, the runtime environment is determined to have failed the integrity check.

7. The controlled decryption method as described in claim 4, characterized in that, After the step of performing integrity verification on the runtime environment of the process to which the focused control belongs, the method further includes: If the integrity verification of the operating environment fails, decoy data is deployed in the operating environment, and a general rejection message is output to the page where the focus control is located, indicating that the decryption failed. Record the verification failure logs, and determine whether to trigger a preset response delay in the next decryption based on the cumulative number of failures recorded in the logs; When the cumulative number of failures reaches a preset number, the response delay is triggered, introducing a preset decryption delay duration for the next decryption operation; The decryption operation is terminated when the decoy data is detected to be accessed during the next decryption process.

8. A controlled decryption apparatus for implementing the controlled decryption method according to any one of claims 1-7, characterized in that, The device includes: The acquisition module is used to acquire the focus control and URL information of the current page, and to verify the validity of the URL information; The acquisition module is used to acquire multidimensional feature information of the focus control and user behavior sequence data after the URL information is verified. The prediction module is used to extract temporal features from the behavioral sequence data based on the temporal coding module in the preset prediction model, and based on the temporal features, predict whether a password needs to be entered and the position of the password box, and obtain the prediction result. The matching module is used to match the multidimensional feature information with the pre-stored feature template to obtain the matching result; The decryption module is used to obtain a pre-stored decryption password when both the prediction result and the matching result meet preset conditions, and to submit the decryption password to the focus control for decryption.

9. A password-controlled decryption device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the cryptographically controlled decryption method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the password-controlled decryption method as described in any one of claims 1 to 7.

Images