WO2016165674A1 - 一种终端可信环境运行方法及装置 - Google Patents

一种终端可信环境运行方法及装置 Download PDF

Info

Publication number
WO2016165674A1
WO2016165674A1 PCT/CN2016/080392 CN2016080392W WO2016165674A1 WO 2016165674 A1 WO2016165674 A1 WO 2016165674A1 CN 2016080392 W CN2016080392 W CN 2016080392W WO 2016165674 A1 WO2016165674 A1 WO 2016165674A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
running
preset
environment
application
Prior art date
Application number
PCT/CN2016/080392
Other languages
English (en)
French (fr)
Inventor
刘小锐
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016165674A1 publication Critical patent/WO2016165674A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Definitions

  • the present application relates to, but is not limited to, the field of communications, and in particular, to a terminal trusted environment operating method and apparatus.
  • Terminals that are currently able to access the network through wireless communication technologies such as mobile phones, are becoming personal information centers, carrying more and more functions.
  • mobile Internet applications based on data services have been involved. Every aspect of life.
  • the mobile Internet is developing rapidly, the information security of the mobile Internet is also threatened.
  • the entrance and node of the mobile Internet the security of the operating environment has become the focus of the industry.
  • the present application proposes a method and a device for operating a terminal trusted environment, and performs real-time intervention when a user accesses the network through the WLAN to ensure that key information of the user is not captured by the WLAN provider, thereby improving the security of the terminal.
  • a method for operating a terminal trusted environment including:
  • the terminal When the application running by the terminal system conforms to the preset scenario, the terminal currently operates the environment to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.
  • the preset scenario is preset by the system and/or preset by the user, and includes at least one of the following:
  • the preset scenario includes: a specific application type preset by the user in the whitelist and a specific running scenario.
  • the step of determining whether the application running by the terminal system meets a preset scenario comprises: determining whether a package name of an application running by the terminal system is in a white list, and if it is in a white list, determining that the The application running on the terminal system conforms to the preset scenario.
  • the step of intervening the current running environment of the terminal includes: when the application running by the terminal system meets the preset scenario, Open a WLAN connection, initiate a data connection to the mobile communication network, and forcefully terminate all running non-system applications.
  • the method for operating the terminal trusted environment further includes determining the current terminal system. Whether the running application conforms to the preset scenario, if the preset scenario is not met, the mobile network data network connection is disconnected, and the disconnected WLAN connection is connected.
  • the application further provides a computer readable storage medium storing computer executable instructions that are implemented when the computer executable instructions are executed.
  • a terminal trusted environment running apparatus including:
  • the application monitoring module is configured to perform real-time monitoring on the application running on the terminal system
  • the scenario determining module is configured to determine whether the application running by the terminal system conforms to the preset scenario
  • the environment intervention module is configured to intervene in the current running environment of the terminal when the application running by the terminal system meets the preset scenario, so as to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.
  • the preset scenario is preset by the system and/or preset by the user, and includes at least one of the following:
  • the apparatus further includes a whitelist setting module configured to preset a specific application type and a specific running scenario in the whitelist.
  • the scenario determining module is configured to: determine whether the package name of the application running by the terminal system is in the whitelist, and if it is in the whitelist, consider that the application running by the terminal system conforms to the preset scenario.
  • the environment intervention module is configured to: when the application running by the terminal system conforms to the preset scenario, disconnect the WLAN connection, initiate a data connection of the mobile communication network, and forcefully terminate all running non-operations. system applications.
  • the device further includes an environment recovery module, where the environment recovery module is configured to determine whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, disconnect the mobile network data network. And connecting the disconnected WLAN connection.
  • the environment recovery module is configured to determine whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, disconnect the mobile network data network. And connecting the disconnected WLAN connection.
  • the method for operating the trusted environment of the terminal is used to perform real-time intervention when the user accesses the network through the WLAN, so as to ensure that the key information of the user is not captured by the WLAN provider, and the security of the terminal is improved.
  • FIG. 1 is a flowchart of a method for operating a trusted environment of a terminal according to an embodiment of the present invention
  • FIG. 2 is a flowchart of an optional embodiment of a method for operating a trusted environment of a terminal according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a method for using a whitelist in a method for operating a trusted environment of a terminal according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a method for forcibly ending a non-system application of all running terminal systems in a terminal trusted environment operation method according to an embodiment of the present invention
  • FIG. 5 is a structural diagram of a terminal trusted environment running device according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for operating a trusted environment of a terminal according to an embodiment of the present invention. As shown in FIG. 1, the method includes: Step S102 to Step S106, where
  • S102 Perform real-time monitoring on an application running on the terminal system
  • the step is preset by the terminal system manufacturer, and has system-level authority to perform real-time monitoring on the application running on the terminal system.
  • S104 Determine whether the application running by the terminal system meets a preset scenario.
  • the preset scenario is preset by the system and/or preset by the user, and includes at least one of the following items:
  • the specific running scenario includes an interface when the account password is input, and the like, where a specific application type in the preset scenario is applied when a specific running scenario in the preset scenario is applied.
  • the preset scenario is preset by the user, including: a specific application type and a specific running scenario preset by the user in the whitelist, and the application type and the specific running scenario in the whitelist may be added, deleted, or modified.
  • the terminal can determine whether the application name of the application running in the terminal system is in the white list. If the application is in the white list, the application that the terminal system runs is consistent with the preset scenario.
  • FIG. 3 is a flowchart of a method for using a whitelist in a method for operating a trusted environment of a terminal according to an embodiment of the present invention, as shown in FIG. 3:
  • Step S303 The terminal system reads a whitelist built in the terminal system
  • Step S304 After the built-in whitelist is read, a whitelist queue is generated, and each time the terminal system starts the application, the package name of the application started this time and the package name of the application in the whitelist queue are compared. .
  • the user can add, delete, and modify the application type and running scenario in the whitelist in the whitelist configuration window provided by the system, and update the modified whitelist of the user, and the modified result is reflected in the whitelist queue.
  • the step of intervening the current running environment of the terminal includes: when the application running by the terminal system meets the preset scenario, Open a WLAN connection, initiate a data connection to the mobile communication network, and forcefully terminate all running non-system applications.
  • 4 is a flowchart of a method for forcibly ending a non-system application of all running terminal systems in a method for operating a terminal trusted environment according to an embodiment of the present invention. As shown in FIG. 4, the method includes the following steps:
  • step S402 determining, according to the package name of the application that is started this time, whether the terminal system needs to enter the trusted environment: if it is required to enter the trusted environment, step S403 is performed;
  • step S404 detecting whether the result of the cleaning meets the requirement: if the requirement is met, determining that all running non-system applications have been forcibly terminated; if the requirement is not met, executing step S406;
  • the terminal trusted environment running method further includes: determining whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, Disconnect the mobile network data network connection and connect the disconnected WLAN connection.
  • FIG. 2 is a flowchart of an optional embodiment of a method for operating a trusted environment of a terminal according to an embodiment of the present invention; as shown in FIG. 2, the embodiment includes the following steps:
  • step S203 determining whether the terminal system needs to enter the trusted environment, if it is determined that the trusted environment needs to be entered, step S204 is performed;
  • S204 Switch the data channel of the terminal from the WLAN to the mobile communication network.
  • step S205 Terminate all terminal system non-system applications, and determine whether to complete the data transmission; if it is determined that the data transmission has been completed, step S207 is performed;
  • step S207 determining whether to exit the trusted environment; if it is necessary to exit the trusted environment, proceed to step S208;
  • the terminal indicates the direction in which the mobile terminal should move according to the location of the base station where the cell with the best signal strength is located, and the direction is the position coordinate from the location coordinate of the mobile terminal to the optimal base station of the signal strength.
  • Embodiments of the present invention further provide a computer readable storage medium storing computer executable instructions that are implemented when the computer executable instructions are executed.
  • FIG. 5 is a structural diagram of a terminal trusted environment running device according to an embodiment of the present invention. As shown in Figure 5, the device includes:
  • the application monitoring module 50 is configured to perform real-time monitoring on an application running on the terminal system
  • the scenario determining module 51 is configured to determine whether the application running by the terminal system meets a preset scenario
  • the scenario determining module 51 determines whether the application running by the terminal system conforms to the preset scenario, where The preset scene is preset by the system and/or preset by the user, and includes at least one of the following:
  • the specific running scenario includes an interface when the account password is input, and the like, where a specific application type in the preset scenario is applied when a specific running scenario in the preset scenario is applied.
  • the device further includes a whitelist setting module, configured to preset the specific application type and the specific running scenario in the whitelist, and add, delete, or modify the whitelist.
  • a whitelist setting module configured to preset the specific application type and the specific running scenario in the whitelist, and add, delete, or modify the whitelist.
  • the scenario judging module 51 determines whether the type of the application running in the terminal system is in the whitelist. If the application running in the terminal system is in the whitelist, the application running on the terminal system is considered to be in the preset scenario.
  • the environment intervention module 52 is configured to intervene in the current operating environment of the terminal to ensure that the terminal is in a trusted operating environment when receiving key information input by the user.
  • the environment intervention module 52 is further configured to: when the application running by the terminal system conforms to the preset scenario, automatically disconnect the WLAN connection, initiate a data connection of the mobile communication network, and forcefully terminate all running non-operations. system applications.
  • the device further includes an environment recovery module, configured to determine whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, automatically disconnect the mobile network data network connection, and automatically connect the disconnected Wi-Fi connection.
  • an environment recovery module configured to determine whether the application currently running by the terminal system meets a preset scenario, and if the preset scenario is not met, automatically disconnect the mobile network data network connection, and automatically connect the disconnected Wi-Fi connection.
  • each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function.
  • Embodiments of the invention are not limited to any specific form of combination of hardware and software.
  • modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device, or distributed. Alternatively, on a network of computing devices, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, The steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of the modules or steps may be implemented as a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.
  • the terminal operates in a trusted environment to perform real-time intervention when the user accesses the network through the WLAN, ensuring that the key information of the user is not captured by the WLAN provider, thereby improving the security of the terminal.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

提出一种终端可信环境运行方法及装置，本申请提供的终端可信环境运行方法包括对终端***运行的应用进行实时监控；判断所述终端***运行的应用是否符合预设场景；当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预，以保证接收用户输入的关键信息时，终端处于可信的运行环境中。

Description

一种终端可信环境运行方法及装置 技术领域
本申请涉及但不限于通信领域，尤其是一种终端可信环境运行方法及装置。
背景技术
目前能够通过无线通信技术访问网络的终端，例如手机，正在成为个人的信息中心，承载着越来越多的功能，除了传统的基于电路域的语音业务外，基于数据业务的移动互联网应用已经涉及了生活的各个方面。在移动支付、媒体传输、信息浏览、资源分享等领域，已经改变了人们的传统生活方式。在移动互联网迅猛发展的同时，移动互联网的信息安全也受到威胁。而终端作为移动互联网的入口和节点，其运行环境的安全已经成为业界的焦点。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本申请提出一种终端可信环境运行方法及装置，在用户通过WLAN访问网络时进行实时干预，确保用户的关键信息不被WLAN的提供方捕获，提高了终端使用的安全性。
根据本申请的一个方面，提供了一种终端可信环境运行方法，包括：
对终端***运行的应用进行实时监控；
判断所述终端***运行的应用是否符合预设场景；
当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预，以保证接收用户输入的关键信息时，终端处于可信的运行环境中。
可选地，所述预设场景为***默认设置和/或用户预先设置的，包括以下各项至少之一：
特定的应用类型，包括银行相关应用、支付相关应用的包名。
特定的运行场景，包括在输入账户密码时的界面。
可选地，若所述预设场景为用户预先设置的，则所述预设场景包括：用户在白名单内预先设置的特定的应用类型和特定的运行场景。
可选地，所述判断所述终端***运行的应用是否符合预设场景的步骤包括：判断所述终端***运行的应用的包名是否在白名单内，若在白名单内，则认为所述终端***运行的应用符合所述预设场景。
可选地，所述当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预的步骤包括：当所述终端***运行的应用符合所述预设场景时，断开WLAN连接，启动移动通信网络的数据连接，并且强制结束所有正在运行的非***应用。
可选地，在所述当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预的步骤之后，所述终端可信环境运行方法还包括判断当前所述终端***运行的应用是否符合预设场景，如果不符合预设场景，则断开移动网络数据网络连接，并且连接所述断开的WLAN连接。
本申请另外提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述方法。
根据本申请的另一方面，还提供了一种终端可信环境运行装置，包括：
应用监控模块，设置成对终端***运行的应用进行实时监控；
场景判断模块，设置成判断所述终端***运行的应用是否符合预设场景；
环境干预模块，设置成当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预，以保证接收用户输入的关键信息时，终端处于可信的运行环境中。
可选地，其中，所述预设场景为***默认设置和/或用户预先设置的，包括以下各项至少之一：
特定的应用类型，包括银行相关应用、支付相关应用的包名。
特定的运行场景，包括在输入账户密码时的界面。
可选地，该装置还包括白名单设置模块，设置成在白名单内预先设置特定的应用类型和特定的运行场景。
可选地，场景判断模块是设置成包括判断所述终端***运行的应用的包名是否在白名单内，若在白名单内，则认为所述终端***运行的应用符合所述预设场景。
可选地，所述环境干预模块是设置成：当所述终端***运行的应用符合所述预设场景时，断开WLAN连接，启动移动通信网络的数据连接，并且强制结束所有正在运行的非***应用。
可选地，该装置还包括环境恢复模块，所述环境恢复模块设置成判断当前所述终端***运行的应用是否符合预设场景，如果不符合预设场景，则断开移动网络数据网络连接，并且连接所述断开的WLAN连接。
通过本发明实施例，采用终端可信环境运行的方法，在用户通过WLAN访问网络时进行实时干预，确保用户的关键信息不被WLAN的提供方捕获，提高了终端使用的安全性。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为根据本发明实施例的终端可信环境运行方法的流程图；
图2为根据本发明实施例的终端可信环境运行方法的可选实施例的流程图；
图3为根据本发明实施例的终端可信环境运行方法中使用白名单的方法的流程图；
图4为根据本发明实施例的终端可信环境运行方法中强制结束所有正在运行的终端***的非***应用的方法的流程图；
图5为根据本发明实施例的终端可信环境运行装置结构图。
本发明的较佳实施方式
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本申请。
现在，用户在使用终端进行移动支付时，如果通过WLAN访问网络，其支付信息能够被WLAN的提供方捕获，导致其帐户、密码泄露，带来重大的安全风险。针对用户在通过使用WLAN访问网络而购物的过程中进行实时干预，从而确保用户的关键信息不被WLAN的提供方捕获，目前尚未提出有效的解决方案。
图1为根据本发明实施例的终端可信环境运行方法的流程图。如图1所示，该方法包括：步骤S102至步骤S106，其中，
S102：对终端***运行的应用进行实时监控；
在本发明实施例中，该步骤由终端***厂商进行预置，具有***级权限，对终端***运行的应用进行实时监控。
S104：判断所述终端***运行的应用是否符合预设场景；
在本发明实施例中，所述预设场景为***默认设置和/或用户预先设置的，包括以下各项至少之一：
特定的应用类型，包括银行相关应用、支付相关应用的包名等；
特定的运行场景，包括在输入账户密码时的界面等；其中，在应用预设场景中的特定的运行场景时，会应用预设场景中的特定的应用类型。
预设场景为用户预先设置的，包括：用户在白名单内预先设置的特定的应用类型和特定的运行场景，并且白名单中的应用类型和特定的运行场景可以被增加、删除或修改。终端可以判断所述终端***运行的应用的包名是否在白名单内，若在白名单内，则认为所述终端***运行的应用符合所述预设场景。
图3为本发明实施例的终端可信环境运行方法中使用白名单的方法的流程图，如图3所示：
步骤S303：终端***读取终端***内置的白名单；
步骤S304：在读取所述内置的白名单后，生成一个白名单队列，每次终端***启动应用时，都将本次启动的应用的包名和白名单队列中的应用的包名进行比对。
需要说明的是，用户可以在***提供的白名单配置窗口对白名单中的应用类型和运行场景进行增加、删除、修改，更新用户修改后的白名单，将修改结果体现在白名单队列中。
S106：当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预，以保证接收用户输入的关键信息时，终端处于可信的运行环境中。
可选地，所述当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预的步骤包括：当所述终端***运行的应用符合所述预设场景时，断开WLAN连接，启动移动通信网络的数据连接，并且强制结束所有正在运行的非***应用。图4为本发明实施例的终端可信环境运行方法中强制结束所有正在运行的终端***的非***应用的方法的流程图，如图4所示，该方法包括以下步骤：
S402：根据本次启动的应用的包名，判定终端***是否需要进入可信环境：如果需要进入可信环境，则执行步骤S403；
S403：结束终端***所有非***应用；
S404：检测清理的结果是否达到要求：如果达到要求，则确定已强制结束所有正在运行的非***应用；如果没有达到要求，则执行步骤S406；
S406：在提升终端***应用结束的策略等级后，结束终端***的非***应用，并返回步骤S404。
可选地，在步骤S106之后，所述终端可信环境运行方法还包括：判断当前所述终端***运行的应用是否符合预设场景，如果不符合预设场景，则 断开移动网络数据网络连接，并且连接所述断开的WLAN连接。
图2为根据本发明实施例的终端可信环境运行方法的可选实施例的流程图；如图2所示，该实施例包括如下步骤：
S203：判定所述终端***是否需要进入可信环境，若判定需要进入可信环境，则执行步骤S204；
S204：将终端的数据通道从WLAN切换到移动通信网络；
S205：终结所有的终端***非***应用，并判定是否完成数据传输；若判定已完成数据传输，则执行步骤S207；
S207：判定是否要退出可信环境；若需要退出可信环境，则执行步骤S208；
S208：在终端退出可信环境之后，使终端重新通过WLAN访问网络。
此外，终端根据所述信号强度最佳的小区所在的基站位置，指示出移动终端应该移动的方向，该方向就是从移动终端的位置坐标指向信号强度最佳基站的位置坐标。
本发明实施例另外提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述方法。
在本实施例中还提供了终端可信环境运行装置结构图，用于实现上述实施例及可选实施方式，已经进行过说明的不再赘述，下面对该***中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。图5为根据本发明实施例的终端可信环境运行装置结构图。如图5所示，该装置包括：
应用监控模块50，设置成对终端***运行的应用进行实时监控；
场景判断模块51，设置成判断所述终端***运行的应用是否符合预设场景；
所述场景判断模块51判断终端***运行的应用是否符合预设场景，其中 所述预设场景为***默认设置和/或用户预先设置的，包括以下至少之一：
特定的应用类型，包括银行相关应用、支付相关应用的包名等。
特定的运行场景，包括在输入账户密码时的界面等；其中，在应用预设场景中的特定的运行场景时，会应用预设场景中的特定的应用类型。
该装置还包括白名单设置模块，设置成用户在白名单内预先设置所述特定的应用类型和特定的运行场景，并且可以对白名单进行增加、删除或修改。
场景判断模块51判断所述终端***运行的应用的类型是否在白名单内，若所述终端***运行的应用在白名单内，则认为所述终端***运行的应用符合所述预设场景。
环境干预模块52，设置成对终端当前运行环境进行干预，以保证在接收用户输入的关键信息时，终端处于可信的运行环境中。
可选地，环境干预模块52还设置成：当所述终端***运行的应用符合所述预设场景时，自动断开WLAN连接，启动移动通信网络的数据连接，并且强制结束所有正在运行的非***应用。
该装置还包括环境恢复模块，设置成判断当前所述终端***运行的应用是否符合预设场景，如果不符合预设场景，则自动断开移动网络数据网络连接，并且自动连接所述断开的WLAN连接。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储于存储器中的程序/指令来实现其相应功能。本发明实施例不限制于任何特定形式的硬件和软件的结合。
显然，本领域的技术人员应该明白，上述的本申请的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布 在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本申请不限制于任何特定的硬件和软件结合。
以上仅为本申请的可选实施例而已，并不用于限制本申请，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。
工业实用性
采用终端可信环境运行的方法，在用户通过WLAN访问网络时进行实时干预，确保用户的关键信息不被WLAN的提供方捕获，提高了终端使用的安全性。

Claims (12)

  1. 一种终端可信环境运行方法，包括：
    对终端***运行的应用进行实时监控；
    判断所述终端***运行的应用是否符合预设场景；
    当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预，以保证接收用户输入的关键信息时，终端处于可信的运行环境中。
  2. 根据权利要求1所述的终端可信环境运行方法，其中，所述预设场景为***默认设置和/或用户预先设置的，包括以下各项至少之一：
    特定的应用类型，包括银行相关应用、支付相关应用的包名；
    特定的运行场景，包括在输入账号密码时的界面。
  3. 根据权利要求2所述的终端可信环境运行方法，其中，若所述预设场景为用户预先设置的，则所述预设场景包括：用户在白名单内预先设置的特定的应用类型和特定的运行场景。
  4. 根据权利要求3所述的终端可信环境运行方法，其中，所述判断所述终端***运行的应用是否符合预设场景的步骤包括：判断所述终端***运行的应用的包名是否在白名单内，若在白名单内，则认为所述终端***运行的应用符合所述预设场景。
  5. 根据权利要求1所述的终端可信环境运行方法，其中，所述当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预的步骤包括：当所述终端***运行的应用符合所述预设场景时，断开WLAN连接，启动移动通信网络的数据连接，并且强制结束所有正在运行的非***应用。
  6. 根据权利要求5所述的终端可信环境运行方法，在所述当所述终端系 统运行的应用符合所述预设场景时，对终端当前运行环境进行干预的步骤之后，所述终端可信环境运行方法还包括：判断当前所述终端***运行的应用是否符合预设场景，如果不符合预设场景，则断开移动网络数据网络连接，并且连接所述断开的WLAN连接。
  7. 一种终端可信环境运行装置，包括：
    应用监控模块，设置成对终端***运行的应用进行实时监控；
    场景判断模块，设置成判断所述终端***运行的应用是否符合预设场景；
    环境干预模块，设置成当所述终端***运行的应用符合所述预设场景时，对终端当前运行环境进行干预，以保证接收用户输入的关键信息时，终端处于可信的运行环境中。
  8. 根据权利要求7所述的终端可信环境运行装置，其中，所述预设场景为***默认设置和/或用户预先设置的，包括以下各项至少之一：
    特定的应用类型，包括银行相关应用、支付相关应用的包名；
    特定的运行场景，包括在输入账号密码时的界面。
  9. 根据权利要求8所述的终端可信环境运行装置，还包括白名单设置模块，设置成在白名单内预先设置特定的应用类型和特定的运行场景。
  10. 根据权利要求9所述的终端可信环境运行装置，其中，场景判断模块是设置成包括判断所述终端***运行的应用的包名是否在白名单内，若在白名单内，则认为所述终端***运行的应用符合所述预设场景。
  11. 根据权利要求7所述的终端可信环境运行装置，其中，所述环境干预模块是设置成：当所述终端***运行的应用符合所述预设场景时，断开WLAN连接，启动移动通信网络的数据连接，并且强制结束所有正在运行的 非***应用。
  12. 根据权利要求11所述的终端可信环境运行装置，还包括环境恢复模块，所述环境恢复模块设置成判断当前所述终端***运行的应用是否符合预设场景，如果不符合预设场景，则断开移动网络数据网络连接，并且连接所述断开的WLAN连接。
PCT/CN2016/080392 2015-10-21 2016-04-27 一种终端可信环境运行方法及装置 WO2016165674A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510690352.9 2015-10-21
CN201510690352.9A CN106612504A (zh) 2015-10-21 2015-10-21 一种终端可信环境运行方法及装置

Publications (1)

Publication Number Publication Date
WO2016165674A1 true WO2016165674A1 (zh) 2016-10-20

Family

ID=57127156

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/080392 WO2016165674A1 (zh) 2015-10-21 2016-04-27 一种终端可信环境运行方法及装置

Country Status (2)

Country Link
CN (1) CN106612504A (zh)
WO (1) WO2016165674A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115361470A (zh) * 2022-08-26 2022-11-18 中国银行股份有限公司 限制移动端app运行网络环境的方法和装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107621977B (zh) * 2017-09-28 2021-06-18 努比亚技术有限公司 一种应用的控制方法、终端及计算机可读存储介质
CN112416380B (zh) * 2019-08-21 2024-03-29 成都鼎桥通信技术有限公司 一种应用防杀死防冻结的方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100185953A1 (en) * 2009-01-19 2010-07-22 Compagnie Industrielle Et Financiere D'ingenierie Ingenico Method for securing an interface between a user and an application, corresponding system, terminal and computer program product
CN103595731A (zh) * 2013-11-29 2014-02-19 北京网秦天下科技有限公司 用于保护账户安全的***和方法
CN104021339A (zh) * 2014-06-10 2014-09-03 北京奇虎科技有限公司 移动终端的安全支付方法及装置
CN104267994A (zh) * 2014-09-30 2015-01-07 北京奇虎科技有限公司 一种运行应用程序的装置和终端设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104463569A (zh) * 2014-11-11 2015-03-25 北京奇虎科技有限公司 安全连接支付方法及其装置
CN109548024B (zh) * 2015-05-20 2021-12-21 玉环看知信息科技有限公司 一种网络安全管理设备、方法和移动终端
CN104821992B (zh) * 2015-05-25 2018-01-19 广东欧珀移动通信有限公司 一种手机自动切换网络连接类型的方法及装置
CN104869565A (zh) * 2015-05-28 2015-08-26 魅族科技（中国）有限公司 一种通信信息访问方法及终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100185953A1 (en) * 2009-01-19 2010-07-22 Compagnie Industrielle Et Financiere D'ingenierie Ingenico Method for securing an interface between a user and an application, corresponding system, terminal and computer program product
CN103595731A (zh) * 2013-11-29 2014-02-19 北京网秦天下科技有限公司 用于保护账户安全的***和方法
CN104021339A (zh) * 2014-06-10 2014-09-03 北京奇虎科技有限公司 移动终端的安全支付方法及装置
CN104267994A (zh) * 2014-09-30 2015-01-07 北京奇虎科技有限公司 一种运行应用程序的装置和终端设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115361470A (zh) * 2022-08-26 2022-11-18 中国银行股份有限公司 限制移动端app运行网络环境的方法和装置
CN115361470B (zh) * 2022-08-26 2024-02-27 中国银行股份有限公司 限制移动端app运行网络环境的方法和装置

Also Published As

Publication number Publication date
CN106612504A (zh) 2017-05-03

Similar Documents

Publication Publication Date Title
US20220312166A1 (en) Network Access Method, Device, and System
TWI587674B (zh) 用以支援嵌入式通用積體電路卡上全球平台使用之方法與裝置
RU2622876C2 (ru) Способ, устройство и электронное устройство для управления соединениями
RU2651800C1 (ru) Способ и устройство для проверки состояния соединения
CN107784221B (zh) 权限控制方法、服务提供方法、装置、***及电子设备
EP3644636B1 (en) Secure access method, device and system
WO2020007158A1 (zh) 一种网络接入方法及装置
EP2974512A1 (en) Tethering of mobile wireless devices
CN105635084A (zh) 终端认证装置及方法
EP3163834B1 (en) Method and device for equipment control
JP2010068015A (ja) 通信方法、通信装置、携帯電話端末装置および通信システム
TW201906433A (zh) 無線網路類型的檢測方法、裝置及電子設備
WO2016150191A1 (zh) 一种数据共享方法及装置
WO2019047708A1 (zh) 资源配置方法及相关产品
WO2016165674A1 (zh) 一种终端可信环境运行方法及装置
CN104410969A (zh) 无线保真wifi热点隐藏方法及终端设备
CN108541000B (zh) 一种检测网络连接的方法、介质以及设备
WO2017088294A1 (zh) 用于建立无线连接的方法与设备
CN114025412A (zh) 业务访问方法、***、装置及存储介质
JP6301446B2 (ja) Ｕｉｃｃによる非同期コマンド処理をサポートするアクセス端末の中にｕｉｃｃとプロセッサとの間のインターフェースを設けるための方法および装置
KR20130123149A (ko) 데이터 망 접속 인증 방법 및 그 전자 장치
CN108156598B (zh) 移动终端及wifi切换时应用控制方法、及存储介质
WO2022037619A1 (zh) 鉴权失败的处理方法、装置、终端及网络侧设备
US11218491B2 (en) Security de-escalation for data access
EP3545703B1 (en) Method, apparatus, and system for controlling access to a local network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16779649

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16779649

Country of ref document: EP

Kind code of ref document: A1