CN110765470A

CN110765470A - Method and device for realizing safety keyboard, computer equipment and storage medium

Info

Publication number: CN110765470A
Application number: CN201910889045.1A
Authority: CN
Inventors: 胡定耀
Original assignee: Ping An Technology Shenzhen Co Ltd
Current assignee: Ping An Technology Shenzhen Co Ltd
Priority date: 2019-09-19
Filing date: 2019-09-19
Publication date: 2020-02-07
Also published as: WO2021051591A1

Abstract

The embodiment of the invention discloses a method and a device for realizing a safety keyboard, computer equipment and a storage medium. The method belongs to the technical field of safety monitoring, and comprises the following steps: if an instruction of starting a safety keyboard by a user is received, detecting whether the current operating environment meets a preset condition for the first time; if the current operation environment detected for the first time meets the preset condition, generating a safety keyboard; if receiving the private information input by the user through the security keyboard, encrypting the private information to obtain encrypted private information, and storing the encrypted private information in the memory; if an instruction that the mobile application requests to call the encrypted private information is received, detecting whether the current operating environment meets the preset condition for the second time; and if the current operation environment detected for the second time meets the preset condition, decrypting the encrypted private information for the mobile application to call. According to the embodiment of the application, the private information of the user is input through the safety keyboard, and the input and output safety of the private information can be improved.

Description

Method and device for realizing safety keyboard, computer equipment and storage medium

Technical Field

The invention relates to the technical field of mobile terminal security keyboards, in particular to a security keyboard implementation method and device, computer equipment and a storage medium.

Background

With the rapid development of mobile internet technology, more and more mobile applications are emerging in our daily lives. These mobile applications increasingly require entry of user private information, such as payment passwords and identification numbers, and how to ensure user information security becomes increasingly important in the entry process.

Currently, mobile application keyboards include three approaches: the system comprises a default keyboard, a self-drawing fixed keyboard and a self-drawing random keyboard. The system defaults to the worst keyboard security, and has security vulnerabilities such as easy hijack and easy recording. And the self-drawing fixed keyboard mainly adopts a third keyboard, namely a self-drawing random keyboard, because a click record attack vulnerability exists. However, the self-drawing random keyboard only can defend against the attack of click record, and the security of inputting and outputting private information is still low.

Disclosure of Invention

The embodiment of the invention provides a method and a device for realizing a safety keyboard, computer equipment and a storage medium, aiming at improving the safety of private information input and output.

In a first aspect, an embodiment of the present invention provides a method for implementing a secure keyboard, where the method includes:

if an instruction of starting a safety keyboard by a user is received, detecting whether the current operating environment meets a preset condition for the first time;

if the current operating environment detected for the first time meets the preset condition, generating a safety keyboard;

if private information input by a user through the security keyboard is received, encrypting the private information to obtain encrypted private information, and storing the encrypted private information in an internal memory;

if an instruction that the mobile application requests to call the encrypted private information is received, whether the current operating environment meets the preset condition or not is detected for the second time;

and if the current operating environment detected for the second time meets the preset condition, decrypting the encrypted private information for the mobile application to call.

In a second aspect, an embodiment of the present invention further provides a device for implementing a secure keyboard, where the device includes:

the first detection unit is used for detecting whether the current operating environment meets the preset condition for the first time if an instruction of starting the safety keyboard by a user is received;

the keyboard generation unit is used for generating a safety keyboard if the current operation environment detected for the first time meets the preset condition;

the information encryption unit is used for encrypting the private information to obtain encrypted private information and storing the encrypted private information in the memory if the private information input by the user through the security keyboard is received;

the second detection unit is used for detecting whether the current operating environment meets the preset condition for the second time if an instruction of calling the encrypted private information by a mobile application request is received;

and the information decryption unit is used for decrypting the encrypted private information for the mobile application to call if the current operation environment detected for the second time meets the preset condition.

In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory and a processor, where the memory stores a computer program, and the processor implements the above method when executing the computer program.

In a fourth aspect, the present invention also provides a computer-readable storage medium, which stores a computer program, and the computer program can implement the above method when being executed by a processor.

The embodiment of the invention provides a method and a device for realizing a secure keyboard, computer equipment and a storage medium. Wherein the method comprises the following steps: if an instruction of starting a safety keyboard by a user is received, detecting whether the current operating environment meets a preset condition for the first time; if the current operating environment detected for the first time meets the preset condition, generating a safety keyboard; if private information input by a user through the security keyboard is received, encrypting the private information to obtain encrypted private information, and storing the encrypted private information in an internal memory; if an instruction that the mobile application requests to call the encrypted private information is received, whether the current operating environment meets the preset condition or not is detected for the second time; and if the current operating environment detected for the second time meets the preset condition, decrypting the encrypted private information for the mobile application to call. According to the technical scheme of the embodiment of the invention, the running environment detection is carried out before the safety keyboard is generated, so that the environment safety of inputting the private information can be ensured to a certain extent; the security of the private information can be further ensured by encrypting and storing the private information; and finally, by detecting the running environment again before decryption, the private information is decrypted and output under the condition that the running environment is safe for the mobile application to call, so that the safety of the output private information can be better protected. Therefore, the technical scheme of the invention can improve the security of private information input and output.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a schematic flowchart of a method for implementing a secure keyboard according to an embodiment of the present invention;

fig. 2 is a schematic sub-flow diagram of a method for implementing a secure keyboard according to an embodiment of the present invention;

fig. 3 is a schematic sub-flow diagram of a method for implementing a secure keyboard according to an embodiment of the present invention;

fig. 4 is a schematic sub-flow diagram of a method for implementing a secure keyboard according to an embodiment of the present invention;

fig. 5 is a schematic sub-flow diagram of a method for implementing a secure keyboard according to an embodiment of the present invention;

fig. 6 is a schematic sub-flow diagram of a method for implementing a secure keyboard according to an embodiment of the present invention;

fig. 7 is a schematic block diagram of a security keyboard implementation apparatus according to an embodiment of the present invention;

fig. 8 is a schematic block diagram of a first detection unit of the security keyboard implementation apparatus according to the embodiment of the present invention;

fig. 9 is a schematic block diagram of a keyboard generation unit of the security keyboard implementation apparatus provided in the embodiment of the present invention;

fig. 10 is a schematic block diagram of an information encryption unit of the security keyboard implementation apparatus provided in the embodiment of the present invention;

fig. 11 is a schematic block diagram of a memory monitoring unit of the security keyboard implementation apparatus according to the embodiment of the present invention;

fig. 12 is a schematic block diagram of an information decryption output determining unit of the security keyboard implementing apparatus according to the embodiment of the present invention; and

fig. 13 is a schematic block diagram of a computer device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

It is also to be understood that the terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the specification of the present invention and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

It should be further understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

As used in this specification and the appended claims, the term "if" may be interpreted contextually as "when", "upon" or "in response to a determination" or "in response to a detection". Similarly, the phrase "if it is determined" or "if a [ described condition or event ] is detected" may be interpreted contextually to mean "upon determining" or "in response to determining" or "upon detecting [ described condition or event ]" or "in response to detecting [ described condition or event ]".

Referring to fig. 1, fig. 1 is a schematic flow chart illustrating a method for implementing a secure keyboard according to an embodiment of the present invention. The method for realizing the safety keyboard can be applied to terminals, such as mobile communication terminals of mobile phones, tablet computers and the like, and the method for realizing the safety keyboard is realized through software installed on the terminals, so that a safe environment is provided for private information input by a user to ensure the safety of user information. The method will be described in detail below by taking the example that the security keyboard implementation method is applied to a mobile phone terminal. As shown in FIG. 1, the method includes the following steps S1-S5.

And S1, if an instruction of starting the safety keyboard by a user is received, detecting whether the current operating environment meets the preset condition for the first time.

In the embodiment of the invention, if the operation of starting the safety keyboard triggered by the user is detected, whether the current operating environment of the terminal meets the preset condition needs to be detected, and the safety keyboard is generated for the user to input information under the condition that the current operating environment of the terminal meets the preset condition. For example, when a user opens a mobile banking APP through the terminal and logs in an account, the user needs to click an input box in an account login interface, at this time, an operation of triggering and starting a security keyboard is generated, and then the terminal detects whether the current operating environment is safe, that is, if an instruction of starting the security keyboard by the user is received, it is detected for the first time whether the current operating environment meets a preset condition. In an embodiment of the present invention, the preset condition may include three safety conditions, where the three safety conditions are: the current operating environment is not in a dynamic debugging environment; the current operating environment is not in a Hook framework environment; the current operating environment has no secondary packaging attack. If the current operating environment meets the three safety conditions, the current operating environment is determined to meet the preset conditions, the terminal is indicated to be in a safety state at present, and a safety keyboard can be provided for a user to perform corresponding operation.

In some embodiments, such as the present embodiment, as shown in FIG. 2, the step S1 may include steps S11-S15.

And S11, judging whether the current operating environment is in a dynamic debugging environment. And executing the step S15 if the current operating environment is in the dynamic debugging environment, otherwise executing the step S12 to perform the next judgment.

In the embodiment of the invention, when judging whether the current operating environment meets the preset condition, firstly, judging whether the current operating environment is in a dynamic debugging environment. The dynamic debugging environment refers to that an illegal user performs dynamic reverse debugging by using a reverse means in the current environment. Specifically, whether the current operating environment is in the dynamic debugging environment can be determined in 8 ways. Wherein, the dynamic debugging environment is debugged through the dynamic debugger, and 8 ways of judging the dynamic debugging environment are respectively: (1) and detecting the port number to judge whether the fixed port is occupied, and if the fixed port number is occupied, judging that the current operating environment is in a dynamic debugging environment. (2) And checking whether a fixed dynamic debugger process name exists or not by the process name of the dynamic debugger, and judging that the current operating environment is in the dynamic debugging environment if the fixed dynamic debugger process name exists. (3) And detecting the process name, and if the parent process name of the mobile application is different from the parent process name during normal starting, and the current process name of the program is also different from the process name of the program, judging that the current operating environment is in the dynamic debugging environment. (4) And detecting the number of threads, and if the mobile application only has one thread, judging that the current operating environment is in a dynamic debugging environment. (5) And detecting the quantity of the fd files, and if the quantity of the fd files is different from the preset quantity of the fd files, judging that the current operating environment is in a dynamic debugging environment. (6) And debugging the detection function, and if the return value of the debugging detection function is true, judging that the current operating environment is in a dynamic debugging environment. (7) Ptrace detection, wherein if the Ptrace detection fails, the current operating environment is judged to be in a dynamic debugging environment; (8) and the characteristic of the dynamic debugger is that if a fake signal sent by the mobile application is intercepted, the current operating environment is judged to be in the dynamic debugging environment. If at least one of the above 8 ways of determining the dynamic debugging environment determines that the current operating environment is in the dynamic debugging environment, step S15 is executed. If the current operating environment is not in the dynamic debugging environment, the following step S13 is executed to determine the next security condition. The judgment of whether the current operating environment is in the dynamic debugging environment can ensure the safety of the current operating environment before the user inputs the personal private information, and can reduce the safety risk of inputting the private information of the user to a certain extent.

And S12, judging whether the current operation environment is in the Hook frame environment, if so, executing the step S15, otherwise, executing the step S13 to perform the next judgment.

In the embodiment of the invention, when judging whether the current operating environment meets the preset condition, if the current operating environment is not in the dynamic debugging environment, further judging whether the current operating environment is in the Hook frame environment. Wherein, the Hook frame environment refers to the environment in which an Xpos frame or Frida Hook frame exists. Specifically, whether the current operating environment is in the Hook framework environment can be determined in 3 ways. Wherein, the 3 ways of judging that the current operation environment is in the Hook frame environment respectively are as follows: (1) and searching for the Hook keywords, and if the Hook keywords exist, for example, keywords such as Xpos and the like, judging that the current operating environment is in the Hook frame environment. (2) And detecting the memory file, judging whether a fixed memory file exists, and if the fixed memory file exists, judging that the current operation environment is in a Hook frame environment. (3) And detecting the port number, judging whether the fixed port number is occupied, and if the fixed port number is occupied, judging that the current operation environment is in the Hook frame environment. In the above 3 manners of determining the Hook frame environment, if at least one manner determines that the current operating environment is in the Hook frame environment, step S15 is executed. If the current operating environment is not in the Hook framework environment, the following step S14 is executed to determine the next security condition. The judgment of whether the current operating environment is in the Hook frame environment can further ensure the safety of the current operating environment and reduce the safety risk of inputting the private information of the user on the basis of judging that the current operating environment is not in the dynamic debugging environment.

And S13, judging whether the current operating environment has a secondary packaging attack, if so, executing the step S15, otherwise, executing the step S14, and judging that the current operating environment meets the preset condition.

In the embodiment of the present invention, when determining whether the current operating environment meets the preset condition, if the current operating environment is not in the dynamic debugging environment, is not in the Hook frame environment, and does not have the secondary packaging attack, it is determined that the current environment is safe, and step S2 may be executed to generate the secure keyboard. The secondary packaging attack is a process of cracking the mobile application, tampering the mobile application or inserting malicious codes into the mobile application, and finally generating a new application. Specifically, the mobile application provides a mobile application signature when the security keyboard is integrated, the security keyboard stores the mobile application signature in an underlying So library in an encrypted manner, the mobile application signature is acquired in real time and compared with the encrypted mobile application signature stored in the So library each time the security keyboard is started, if the mobile application signature acquired in real time is inconsistent with the encrypted mobile application signature stored in the So library, it is determined that a secondary packaging attack exists in the current operating environment, and step S15 is executed. The detection of whether the secondary packaging attack exists in the current operating environment can further ensure the safety of the current operating environment and reduce the safety risk of inputting the private information of the user on the basis that the current operating environment is not in a dynamic debugging environment or a Hook frame environment.

And S15, sending risk prompt information to the user.

In the embodiment of the present invention, if it is found that the current environment is in any one of the following situations in the process of detecting the current operating environment: if the current operating environment is in a dynamic debugging environment or is in a Hook frame environment or has a secondary packaging attack in the current operating environment, it is indicated that the current operating environment has a security risk, and if a user inputs personal private information in the environment, the risk of information leakage exists, so that a security keyboard should not be started, and at this time, risk prompt information can be sent to the user. For example, the user may be reminded that the current operating environment is at risk by popping up a prompt box at the current interface.

It should be noted that in this embodiment, reverse debugging is resisted by means of reverse debugging, reverse Hook, reverse memory Dump, and the like; and (4) resisting secondary packaging attack by using a signature verification mode at the bottom layer. In other embodiments, other means may be used to resist reverse debugging and second packaging attack, which is not limited in the present invention. When the preset conditions are judged, the detection sequence of the three safety conditions, namely the dynamic debugging environment, the Hook frame environment and the secondary packaging attack, is not limited in the invention, and only the detection of the three conditions is needed.

And S2, if the current operation environment detected for the first time meets the preset condition, generating a safety keyboard.

In the embodiment of the invention, if the current operation environment of the terminal is detected to meet the preset condition, namely the current operation environment is not in a dynamic debugging environment, is not in a Hook frame environment and has no secondary packaging attack, the current operation environment is indicated to meet the safety requirement, and a safety keyboard can be generated so that a user can input personal private information.

In some embodiments, such as the present embodiment, as shown in FIG. 3, the step S2 may include steps S21-S24.

And S21, acquiring the pre-configured UI key.

In the embodiment of the present invention, a pre-configured UI key, that is, a UI (user interface) key, such as a numeric key, a symbol key, an alphabet key, and a function key, may be obtained. Specifically, the sizes, colors or patterns of the numeric keys, the symbol keys, the letter keys and the function keys can be drawn independently, and the patterns of the safety keyboard are more attractive and diversified by drawing the numeric keys, the symbol keys, the letter keys and the function keys independently.

It should be noted that the independently drawn UI key is obtained, the click effect of erasing the UI key button when the user clicks the security keyboard to input the private information is achieved, and the feedback-free click mode is adopted, so that the screen capture and screen recording attack of the trojan horse can be prevented. Specifically, when the user clicks the security keyboard to input the private information, the shadow highlight appearing after clicking the UI key is erased. In other embodiments, the click effect after clicking the UI key can be erased in other manners, and the click effect of erasing the button of the UI key can be achieved. By erasing the clicking effect of the UI button and adopting a feedback-free clicking mode, the attack of shooting and recording a screen by a Trojan horse when a user inputs private information can be prevented, so that the safety of private information input is improved.

And S22, generating a default sequence corresponding to the UI key according to the UI key.

In the embodiment of the invention, after the pre-configured UI key is obtained, namely the numeric keys, the symbol keys, the letter keys and the function keys are automatically drawn, the default sequence corresponding to the UI key is generated according to the UI key. The default sequence is a default sequence of a certain type of key, for example, for a number key, the corresponding default sequence is 0123456789, understandably, the inherent sequence of the number keys 0 to 9 is 0123456789, that is, the contents corresponding to the number keys 0 to 9 are 0123456789 in sequence.

And S23, randomly generating a keyboard key value sequence.

In the embodiment of the invention, a random algorithm is adopted to generate a keyboard key value sequence through a bottom-layer so library, for example, the generated key value sequence of the number keys 0-9 is 3204157869.

In other embodiments, other algorithms may be used to generate the keyboard key sequence in the underlying so library, which is not limited in this disclosure.

And S24, sequentially assigning the keyboard key value sequence to the default sequence to generate the safe keyboard.

In the embodiment of the invention, the keyboard key value sequence is sequentially assigned to the default sequence to generate the safe keyboard, for example, the numeric key value sequence 3204157869 is sequentially assigned to numeric keys 0-9 according to the default sequence 0123456789. After assignment, the content on the numeric key 0 is the number 3, the content on the numeric key 1 is the number 2, and so on. The keyboard key value sequence also comprises a symbol key value sequence, a letter key value sequence and a function key value sequence. Specifically, the symbol key value sequence, the letter key value sequence and the function key value sequence can be randomly generated as required, and then assigned in sequence corresponding to the symbol key default sequence, the letter key default sequence and the function key default sequence, so that the safety keyboard is generated.

In other embodiments, the keyboard key value sequence is generated by the underlying so library by using random algorithm, and the generation of the keyboard key value sequence supports both random and non-random modes, for example, the keyboard key value sequence is random, and the alphabetic keyboard key value sequence can be controlled by parameters when the alphabetic keyboard key value sequence is not random.

It should be noted that, the security keyboards generated in each of the steps S21-S24 are different, so that the Trojan horse click record attack can be effectively prevented.

S3, if receiving the private information input by the user through the security keyboard, encrypting the private information to obtain encrypted private information, and storing the encrypted private information in the memory.

In the embodiment of the invention, after the safety keyboard is generated, the user can input private information, such as important information such as a bank account number, an identity card number or a payment password, through the generated safety keyboard. When a user inputs important private information, the security keyboard encrypts the private information input by the user and stores the encrypted private information in the memory so as to ensure the security of the input of the private information of the user.

In some embodiments, such as the present embodiment, as shown in FIG. 4, the step S3 may include steps S31-S34.

S31, if the private information input by the user through the security keyboard is received, judging whether the first character information of the private information is successfully generated by the user or not, wherein the first ID is the same as the second ID. If the first character information of the private information is successfully generated when the user inputs the first ID and the second ID, step S32 is executed, otherwise, step S34 is executed.

In the embodiment of the invention, if the first character information of the private information input by the user through the security keyboard is received, whether the first ID and the second ID are successfully generated by utilizing the time stamp salting random algorithm on the bottom layer is judged. The first ID and the second ID are the same and are both unique IDs representing the private information. If the user successfully generates the first ID and the second ID by using the time stamp salting random algorithm on the bottom layer when inputting the first character information of the private information, step S32 is executed to encrypt the first ID to obtain an encrypted ID, and store the encrypted ID and the second ID in the memory. Wherein the second ID is for invocation by the mobile application. In this embodiment, when the user inputs the first character information of the private information, the unique ID of the private information is generated, which can prevent replay attack. Among them, Replay Attacks (Replay Attacks) are also called Replay Attacks and Replay Attacks, which means that an attacker sends a packet that a destination host has received to achieve the purpose of deceiving a system, and are mainly used in an identity authentication process to destroy the correctness of authentication.

In other embodiments, the first ID and the second ID may be generated by other algorithms, which is not limited in the present invention.

In some embodiments, for example, in this embodiment, after the first ID and the second ID are successfully generated when the user inputs the first character information of the private information, the memory change monitoring thread is started to monitor the memory change, so as to determine whether an interception and/or tampering operation exists in the memory during the encryption and/or decryption process of the private information, thereby further ensuring the security of the input and output of the private information of the user. As shown in FIG. 5, steps S61-S66 may be included.

And S61, monitoring memory change in real time.

S62, judging whether the memory interception and/or the memory tampering operation exist, if the memory interception and/or the memory tampering operation exist, executing a step S63, otherwise executing a step S61 to continuously monitor the memory change in real time.

S63, determining whether the memory interception and/or the memory tampering operation occurs during the process of encrypting the private information or during the process of decrypting the encrypted private information, if the memory interception and/or the memory tampering operation occurs during the process of encrypting the private information, performing step S64, and if the memory interception and/or the memory tampering operation occurs during the process of decrypting the encrypted private information, performing step S65.

And S64, stopping encrypting the private information, sending risk prompt information to a user, and closing the safety keyboard.

And S65, stopping decrypting the encrypted private information, sending risk prompt information to a user, and closing the safety keyboard.

In the embodiment of the invention, after the first ID and the second ID are successfully generated when the user inputs the first character information of the private information, the memory change monitoring thread is started to monitor the memory change in real time. The memory change is realized by monitoring the change of the memory file. For example, when there is a memory interception operation, a fault memory interruption phenomenon will occur, and a corresponding memory interruption file is generated in the underlying so library, so that whether the memory is intercepted or not can be determined. In the specific implementation, by judging whether the memory interception and/or memory tampering operation exists, if the dangerous operation such as the memory interception and/or memory tampering does not exist, the memory change is continuously monitored, and the user continuously inputs the private information. If dangerous operations such as memory interception and/or memory tampering exist, it is further determined whether the memory interception and/or memory tampering operations occur in the process of encrypting the private information or decrypting the encrypted private information, and if the operations occur in the process of encrypting the private information, the encryption of the private information is stopped, risk prompt information is sent to a user, and the security keyboard is closed. And if the risk prompt message is sent to the user in the process of decrypting the encrypted private information, stopping the decryption operation and closing the safety keyboard.

It should be noted that, after the first ID and the second ID are successfully generated when the user inputs the first character information of the private information, the memory change monitoring thread is started to monitor the memory change in real time, so that the security of the private information can be ensured in real time when the private information is input and before the private information is decrypted and output.

S32, encrypting the first ID to obtain an encrypted ID, and storing the encrypted ID and the second ID in a memory, wherein the second ID is used for being called by the mobile application.

In the embodiment of the invention, if the first ID and the second ID are successfully generated when the user inputs the first character information of the private information, the first ID is encrypted to obtain the encrypted ID, and the encrypted ID and the second ID are stored in the memory. Wherein the second ID is for invocation by the mobile application. Understandably, the encrypted ID and the second ID are stored in the memory, so that when the encrypted private information is decrypted, the mobile application acquires the second ID, requests to decrypt the encrypted private information represented by the second ID, decrypts the encrypted ID by a matching algorithm to obtain a decrypted ID, then performs ID matching on the decrypted ID and the second ID, and if the decrypted ID is matched with the ID of the second ID, decrypts the encrypted private information for the mobile application to call. If the decryption ID is not matched with the ID of the second ID, the encrypted private information is indicated to have a security risk, and risk prompt information is sent to a user.

S33, encrypting the private information to obtain the encrypted private information, and storing the encrypted private information in a memory.

In the embodiment of the invention, the encrypted private information can be obtained by performing RC4 algorithm and AES byte stuffing encryption on the private information, and the encrypted private information is stored in the memory.

In other embodiments, other algorithms may be used to encrypt the private information, and the invention is not limited thereto.

In the embodiment of the present invention, after the encrypted private information is stored in the memory, the method further includes the following steps:

and S35, generating a first hash value.

In the embodiment of the present invention, after the encrypted private information is stored in the memory, a first hash value is further generated, and when the first hash value is used to decrypt the encrypted private information, it is checked whether the first hash value is consistent with a second hash value generated when the encrypted private information is decrypted, so as to determine whether a memory tampering operation exists.

And S34, sending risk prompt information to the user, and closing the safety keyboard.

In the embodiment of the invention, if the first ID and the second ID are not successfully generated when the user inputs the first character information of the private information, the generation of the unique ID representing the private information input by the user is failed, and the private information has a safety risk, so that the input of the private information of the user is stopped, risk prompt information is sent to the user, and a safety keyboard is closed. For example, the user can be reminded that the currently input private information is at risk and should be stopped from being input by popping up a prompt box on the current interface.

And S4, if an instruction of calling the encrypted private information by a mobile application request is received, detecting whether the current operating environment meets the preset condition for the second time.

In the embodiment of the invention, after the encrypted private information is stored in the memory, if an instruction of calling the encrypted private information requested by the mobile application is received, the encrypted private information is decrypted for the mobile application to call, and in order to further ensure the data security, before the encrypted private information is decrypted, whether the current operating environment of the terminal is safe or not is detected again, that is, whether the current operating environment meets the preset condition or not is detected for the second time. Specifically, the preset condition may include three safety conditions, which are respectively: the current operating environment is not in a dynamic debugging environment; the current operating environment is not in a Hook framework environment; the current operating environment has no secondary packaging attack. If the current operating environment meets the three safety conditions, the current operating environment is determined to meet the preset conditions, the terminal is indicated to be in a safety state at present, and the encrypted private information can be decrypted to be called by the mobile application.

It should be noted that, in step S4, the same manner as the determination of the three safety conditions in step S1 can be adopted in steps S11 to S14, and for brevity and convenience of description, no further description is provided herein.

And S5, if the current operating environment detected for the second time meets the preset condition, decrypting the encrypted private information for being called by the mobile application.

In the embodiment of the invention, if the current operation environment detected for the second time is not in the dynamic debugging environment, the current operation environment is not in the Hook frame environment and the current operation environment is not attacked by secondary packaging, the encrypted private information stored in the memory is decrypted to be called by the mobile application. The current operating environment is detected before the private information is decrypted, and the encrypted private information is decrypted only when the current operating environment is not in a dynamic debugging environment, is not in a Hook frame environment and has no secondary packaging attack, so that the safety of outputting the private information can be further ensured.

In some embodiments, for example, in this embodiment, after the encrypted private information is stored in the memory, if the current operating environment detected for the second time meets the preset condition, before the step of decrypting the encrypted private information for the mobile application to call, as shown in fig. 6, the method further includes steps S71-S74.

S71, decrypting the encrypted ID to obtain a decrypted ID, judging whether the decrypted ID is matched with the second ID, if so, executing a step S72, otherwise, executing a step S73.

And S72, generating a second hash value, judging whether the second hash value is consistent with the first hash value, if so, executing a step S5 to decrypt the encrypted private information for the mobile application to call, otherwise, executing a step S73.

And S73, sending risk prompt information to the user, and closing the safety keyboard.

In the embodiment of the invention, if the current operation environment detected for the second time is not in the dynamic debugging environment, the current operation environment is not in the Hook frame environment and the current operation environment has no secondary packaging attack, the current operation environment of the terminal operation is indicated to be safe, the encrypted ID is decrypted to obtain the decrypted ID, and whether the decrypted ID is matched with the second ID is judged. If the decryption ID is matched with the second ID, a second hash value is generated, whether the second hash value is consistent with the first hash value or not is judged, and if the second hash value is consistent with the first hash value, step S5 is executed to decrypt the encrypted private information for the mobile application to call. Specifically, the mobile application acquires a second ID, requests decryption of encrypted private information represented by the second ID, decrypts the encrypted ID by using a matching algorithm to obtain a decrypted ID, then performs ID matching on the decrypted ID and the second ID, generates a second hash value if the decrypted ID is matched with the ID of the second ID, and determines whether the second hash value is consistent with the first hash value, and if the second hash value is consistent with the first hash value, executes step S5 to decrypt the encrypted private information for the mobile application to call. Before decrypting the encrypted private information, whether the encrypted private information is changed can be detected by judging whether the decryption ID is matched with the second ID. And then whether the second hash value is consistent with the first hash value or not is judged, whether memory tampering risk operation exists or not can be detected, and therefore the safety of the encrypted private information is ensured before the encrypted private information is output.

Fig. 7 is a schematic block diagram of a security keyboard implementation apparatus 70 according to an embodiment of the present invention. As shown in fig. 8, the present invention also provides a security keyboard implementation apparatus 80 corresponding to the above security keyboard implementation method. The security keyboard implementation apparatus 80 includes means for performing the security keyboard implementation method described above. Specifically, referring to fig. 8, the security keyboard implementation apparatus 80 includes a first detection unit 81, a keyboard generation unit 82, an information encryption unit 83, a second detection unit 84, and an information decryption unit 85.

The first detecting unit 81 is configured to, if an instruction for starting the security keyboard by a user is received, detect whether a current operating environment meets a preset condition for the first time; the keyboard generating unit 82 is configured to generate a secure keyboard if the current operating environment detected for the first time meets the preset condition; the information encryption unit 83 is configured to encrypt the private information to obtain encrypted private information and store the encrypted private information in the memory if the private information input by the user through the security keyboard is received; the second detecting unit 84 is configured to detect whether the current operating environment meets the preset condition for a second time; the information decryption unit 85 is configured to decrypt the encrypted private information for the mobile application to call if the current operating environment detected for the second time meets the preset condition.

In some embodiments, for example, in the present embodiment, referring to fig. 8, the first detecting unit 81 includes a first determining unit 811, a second determining unit 812, a third determining unit 813, and a determining unit 814.

The first judging unit 811 is configured to judge whether the current operating environment is in a dynamic debugging environment; the second determining unit 812 is configured to determine whether the current operating environment is in a Hook framework environment; the third judging unit 813 is configured to judge whether a secondary packaging attack exists in the current operating environment; the determining unit 814 is configured to determine that the current operating environment meets the preset condition if the current operating environment is not in the dynamic debugging environment, is not in the Hook frame environment, and does not have a secondary packaging attack.

In some embodiments, for example, in the present embodiment, referring to fig. 9, the keyboard generating unit 82 includes an obtaining unit 821, a first generating sub-unit 822, a second generating sub-unit 823, and a third generating sub-unit 824.

The obtaining unit 821 is configured to obtain a pre-configured UI key; the first generating subunit 822 is configured to generate a default sequence corresponding to the UI key according to the UI key; the second generating subunit 823 is configured to randomly generate a keyboard key value sequence; the third generating subunit 824 is configured to sequentially assign the keyboard key value sequences to the default sequence to generate the secure keyboard.

In some embodiments, for example, in this embodiment, referring to fig. 10, the information encrypting unit 83 includes a fourth determining unit 831, a first encrypting sub-unit 832, a second encrypting sub-unit 833 and a fourth generating sub-unit 834.

The fourth determining unit 831 is configured to determine, if the private information input by the user through the security keyboard is received, whether to generate a first ID and a second ID successfully when the first character information of the private information is input by the user, where the first ID is the same as the second ID; the first encrypting subunit 832 is configured to encrypt the first ID to obtain an encrypted ID, and store the encrypted ID and the second ID in a memory, where the second ID is used for the mobile application to call; the second encryption subunit 833 is configured to encrypt the private information to obtain the encrypted private information, and store the encrypted private information in an internal memory; the fourth generating subunit 834 is configured to generate the first hash value after the encrypted private information is stored in the memory.

In some embodiments, for example, in this embodiment, referring to fig. 11, the security keyboard implementation apparatus 80 further includes a memory monitoring unit 86. The memory monitoring unit 86 includes a memory monitoring subunit 861, a fifth determining unit 862, a sixth determining unit 863, a stop information encrypting unit 864, and a stop information decrypting unit 865.

Memory monitor subunit 861 is configured to monitor memory changes in real time; the fifth judging unit 862 is configured to judge whether a memory interception and/or memory tampering operation exists; a sixth determining unit 863 is configured to determine whether the memory interception and/or the memory tampering operation occur during the process of encrypting or decrypting the private information; the stop information encryption unit 864 is configured to stop encrypting the private information, send a risk prompt message to a user, and close the secure keyboard if the memory interception and/or the memory tampering operation occurs in the process of encrypting the private information; the stop information decryption unit 865 is configured to stop decrypting the encrypted private information, send risk prompt information to a user, and close the security keyboard, if the memory interception and/or the memory tampering operation occurs in a process of decrypting the encrypted private information.

In some embodiments, for example, in the present embodiment, referring to fig. 12, the secure keyboard implementation apparatus 80 further includes an information decryption output determination unit 87. The information decryption output determination unit 87 includes an information decryption subunit 871, a seventh judgment unit 872, an eighth judgment unit 873, and an information decryption output unit 874.

The information decryption subunit 871 is configured to decrypt the encrypted ID to obtain a decrypted ID; the seventh judging unit 872 is configured to judge whether the decryption ID matches the second ID; an eighth determining unit 873 is configured to generate a second hash value if the decryption ID matches the second ID, and determine whether the second hash value is consistent with the first hash value; the information decryption output unit 874 is configured to decrypt the encrypted private information for the mobile application to call if the second hash value is consistent with the first hash value.

It should be understood that the second detecting unit 82, like the first detecting unit 81, includes a first determining unit 811, a second determining unit 812, a third determining unit 813 and a determining unit 814, and the detecting order of the three units is not related to the order, and for brevity of description, the description is omitted here.

It should be noted that, as can be clearly understood by those skilled in the art, the specific implementation processes of the above-mentioned security keyboard implementation apparatus 80 and each unit may refer to the corresponding descriptions in the foregoing method embodiments, and for convenience and brevity of description, no further description is provided herein.

The above-described security keyboard implementation apparatus may be implemented in the form of a computer program that is executable on a computer device such as that shown in fig. 13.

Referring to fig. 13, fig. 13 is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device 900 is a terminal, and the terminal may be an electronic device having a communication function, such as a smart phone, a tablet computer, a personal digital assistant, and a wearable device.

Referring to fig. 13, the computer device 900 includes a processor 902, memory and interface 907 connected by a system bus 901, wherein the memory may include non-volatile storage medium 903 and internal memory 904.

The non-volatile storage medium 903 may store an operating system 9031 and a computer program 9032. The computer program 9032, when executed, may cause the processor 902 to perform a secure keyboard implementation.

The processor 902 is used to provide computing and control capabilities to support the operation of the overall computer device 900.

The internal memory 904 provides an environment for the execution of a computer program 9032 in the non-volatile storage medium 903, which computer program 9032, when executed by the processor 902, may cause the processor 902 to perform a secure keyboard implementation.

The interface 905 is used for communication with other devices. Those skilled in the art will appreciate that the architecture shown in fig. 13 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing device 900 to which the disclosed aspects apply, as a particular computing device 900 may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

Wherein the processor 902 is configured to run a computer program 9032 stored in the memory to implement the following steps:

In some embodiments, for example, in this embodiment, when the processor 902 implements the step of detecting whether the current operating environment meets the preset condition for the first time when receiving the instruction for starting the security keyboard from the user, the following steps are specifically implemented:

judging whether the current operating environment is in a dynamic debugging environment;

if the current operating environment is in a dynamic debugging environment, the current operating environment has a safety risk and a safety keyboard is not started;

if the current operating environment is not in the dynamic debugging environment, judging whether the current operating environment is in a Hook frame environment;

if the current operating environment is in the Hook frame environment, the current operating environment has a safety risk and a safety keyboard is not started;

if the current operating environment is not in the Hook frame environment, judging whether a secondary packaging attack exists in the current operating environment;

if the current operating environment has secondary packaging attack, the current operating environment has safety risk and a safety keyboard is not started;

and if the current operating environment does not have secondary packaging attack, judging that the current operating environment meets the preset condition, and generating the safety keyboard.

In some embodiments, for example, in this embodiment, when the processor 902 implements the step of generating the security keyboard if the current operating environment detected for the first time meets the preset condition, the following steps are specifically implemented:

acquiring a pre-configured UI key;

generating a default sequence corresponding to the UI key according to the UI key;

randomly generating a keyboard key value sequence;

and sequentially assigning the keyboard key value sequence to the default sequence to generate the safe keyboard.

In some embodiments, for example, in this embodiment, when the processor 902 performs the steps of encrypting the private information to obtain encrypted private information and storing the encrypted private information in the memory if the private information input by the user through the security keyboard is received, specifically implementing the following steps:

if private information input by a user through the security keyboard is received, judging whether a first ID and a second ID are successfully generated when the user inputs first character information of the private information, wherein the first ID is the same as the second ID;

if the first ID and the second ID are successfully generated when the user inputs the first character information of the private information, encrypting the first ID to obtain an encrypted ID, and storing the encrypted ID and the second ID in a memory, wherein the second ID is used for being called by the mobile application;

if the first ID and the second ID are not successfully generated when the user inputs the first character information of the private information, risk prompt information is sent to the user, and the safety keyboard is closed;

and encrypting the private information to obtain the encrypted private information, and storing the encrypted private information in an internal memory.

In some embodiments, for example, in this embodiment, after the step of storing the encrypted private information in the memory is implemented, the processor 902 further includes the following steps:

if the current operating environment detected for the second time meets the preset condition, decrypting the encrypted ID to obtain a decrypted ID, and judging whether the decrypted ID is matched with the second ID;

if the decryption ID is matched with the second ID, executing the step of decrypting the encrypted private information for being called by the mobile application;

and if the decryption ID is not matched with the second ID, sending risk prompt information to a user, and closing the safety keyboard.

In some embodiments, for example, in this embodiment, after the step of successfully generating the first ID and the second ID by the processor 902 when the user inputs the first character information of the private information, the specific implementation further includes the following steps:

monitoring memory changes in real time;

judging whether memory interception and/or memory tampering operation exists;

if the memory interception and/or memory tampering operation does not exist, continuously monitoring the memory change;

if the memory interception and/or memory tampering operation exists, judging whether the memory interception and/or memory tampering operation occurs in the process of encrypting or decrypting the private information;

if the memory interception and/or the memory tampering operation occur in the process of encrypting the private information, stopping encrypting the private information, sending risk prompt information to a user, and closing the security keyboard;

and if the memory interception and/or the memory tampering operation do not occur in the process of encrypting the private information, stopping decrypting the encrypted private information, sending risk prompt information to a user, and closing the safety keyboard.

In some embodiments, for example, in this embodiment, when the processor 902 implements the step of detecting whether the current operating environment meets the preset condition for the second time if the instruction of calling the encrypted private information by the mobile application request is received, since the step of detecting is the same as the step of detecting whether the current operating environment meets the preset condition for the first time if the instruction of starting the security keyboard by the user is received, the description is omitted here for simplicity and convenience.

generating a first hash value;

if the second ID is matched with the decryption ID, generating a second hash value, and judging whether the second hash value is consistent with the first hash value;

if the second hash value is consistent with the first hash value, executing the step of decrypting the encrypted private information for being called by the mobile application;

and if the second hash value is inconsistent with the first hash value, sending risk prompt information to a user, and closing the safety keyboard.

It should be understood that, in the embodiment of the present Application, the Processor 902 may be a Central Processing Unit (CPU), and the Processor 902 may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable gate arrays (FPGAs) or other Programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. Wherein a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

It will be understood by those skilled in the art that all or part of the flow of the method implementing the above embodiments may be implemented by a computer program instructing associated hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the flow steps of the embodiments of the method described above.

Accordingly, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program. The computer program, when executed by a processor, causes the processor to perform the steps of:

In some embodiments, for example, in this embodiment, when the processor executes the computer program to implement the step of detecting whether the current operating environment meets the preset condition for the first time if the instruction for starting the security keyboard by the user is received, the following steps are specifically implemented:

In some embodiments, for example, in this embodiment, when the processor executes the computer program to implement the step of generating the security keyboard if the current operating environment detected for the first time meets the preset condition, the following steps are specifically implemented:

acquiring a pre-configured UI key;

randomly generating a keyboard key value sequence;

In some embodiments, for example, in this embodiment, when the processor executes the computer program to implement the step of encrypting the private information to obtain encrypted private information and storing the encrypted private information in the memory if the private information input by the user through the secure keyboard is received, the following steps are specifically implemented:

In some embodiments, for example, in this embodiment, after the processor executes the computer program to implement the step of storing the encrypted private information in the memory, the processor further includes the following steps:

In some embodiments, for example, in this embodiment, after the step of successfully generating the first ID and the second ID if the user inputs the first character information of the private information is implemented by the processor by executing the computer program, the implementation further includes the following steps:

monitoring memory changes in real time;

judging whether memory interception and/or memory tampering operation exists;

In some embodiments, for example, in this embodiment, when the processor executes the computer program to implement that the step of detecting whether the current operating environment meets the preset condition for the second time if the instruction of calling the encrypted private information by the mobile application request is received, since the step of detecting is the same as the step of detecting whether the current operating environment meets the preset condition for the first time if the instruction of starting the security keyboard by the user is received, the description is not repeated here for simplicity and convenience.

In some embodiments, for example, in this embodiment, after the processor executes the computer program to realize the step of storing the encrypted private information in the memory, the processor further includes the following steps:

generating a first hash value;

The storage medium may be a usb disk, a removable hard disk, a Read-Only Memory (ROM), a magnetic disk, or an optical disk, which can store various computer readable storage media.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the examples described in connection with the embodiments disclosed herein may be embodied in electronic hardware, computer software, or combinations of both, and that the components and steps of the examples have been described in a functional general in the foregoing description for the purpose of illustrating clearly the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

In the embodiments provided in the present invention, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative. For example, the division of each unit is only one logic function division, and there may be another division manner in actual implementation. For example, various elements or components may be combined or may be integrated into another system, or some features may be omitted, or not implemented.

The steps in the method of the embodiment of the invention can be sequentially adjusted, combined and deleted according to actual needs. The units in the device of the embodiment of the invention can be merged, divided and deleted according to actual needs. In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a storage medium. Based on such understanding, the technical solution of the present invention essentially or partially contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a terminal, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention.

In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, while the invention has been described with respect to the above-described embodiments, it will be understood that the invention is not limited thereto but may be embodied with various modifications and changes.

While the invention has been described with reference to specific embodiments, the invention is not limited thereto, and various equivalent modifications and substitutions can be easily made by those skilled in the art within the technical scope of the invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A secure keyboard implementation method is characterized by comprising the following steps:

2. The method for implementing a security keyboard according to claim 1, wherein the detecting whether the current operating environment meets a preset condition comprises:

and if the current operating environment is not detected to be in a dynamic debugging environment, not in a Hook frame environment and not subjected to secondary packaging attack, judging that the current operating environment meets the preset condition.

3. The method for implementing a security keyboard according to claim 2, wherein the detecting whether the current operating environment meets a preset condition comprises:

and if the current operating environment does not have the secondary packaging attack, judging that the current operating environment meets the preset condition.

4. The method of claim 1, wherein the generating a secure keyboard comprises:

acquiring a pre-configured UI key;

randomly generating a keyboard key value sequence;

5. The method for implementing a security keyboard according to claim 1, wherein if receiving the private information input by the user through the security keyboard, encrypting the private information to obtain encrypted private information, and storing the encrypted private information in the memory, includes:

encrypting the private information to obtain the encrypted private information, and storing the encrypted private information in an internal memory;

after the step of storing the encrypted private information in the memory, the method further includes:

and if the decryption ID is matched with the second ID, executing the step of decrypting the encrypted private information for being called by the mobile application.

6. The method as claimed in claim 5, further comprising, after the step of successfully generating the first ID and the second ID if the user inputs the first character information of the private information:

monitoring memory changes in real time;

judging whether memory interception and/or memory tampering operation exists;

and if the memory interception and/or memory tampering operation occurs in the process of encrypting or decrypting the private information, stopping encrypting or decrypting the private information, and closing the safety keyboard.

7. The method for implementing a secure keyboard according to claim 5, wherein after the step of storing the encrypted private information in the memory, the method further comprises:

generating a first hash value;

and if the second hash value is consistent with the first hash value, executing the step of decrypting the encrypted private information for being called by the mobile application.

8. A security keyboard implementation apparatus, comprising:

9. A computer arrangement, characterized in that the computer arrangement comprises a memory having stored thereon a computer program and a processor implementing the method according to any of claims 1-7 when executing the computer program.

10. A computer-readable storage medium, characterized in that the storage medium stores a computer program which, when executed by a processor, implements the method according to any one of claims 1-7.