WO2013182005A1

WO2013182005A1 - Method and device for use in intercepting call for service by application

Info

Publication number: WO2013182005A1
Application number: PCT/CN2013/076450
Authority: WO
Inventors: 丁祎; 李元
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2012-06-07
Filing date: 2013-05-30
Publication date: 2013-12-12
Also published as: CN102693394B; CN102693394A

Abstract

Disclosed are a method and device for use in intercepting a call for a service by an application in an operating system. The method comprises: loading an interception dynamic-link library to a process where the service is at; replacing the address of an input/output control function in the process with a first address of the interception dynamic-link library; when the application is calling the service, executing the interception dynamic-link library on the basis of the first address to acquire the name and information of the application and information of the call, and replacing the address of the service-to-be-called and comprised in the information of the call with a second address of the interception dynamic-link library; displaying the information of the application and the information of the call on the basis of the second address, and executing the process on the basis of a selection with respect to the call on an electronic device via the operating system. The present invention increases the security of the operating system of the electronic device.

Description

Method and apparatus for intercepting an application's call to a service

The present invention relates to system security of an electronic device operating system, and more particularly to a method and apparatus for intercepting an application's call to an application in an operating system of an electronic device. Background technique

In recent years, electronic devices equipped with operating systems, particularly portable electronic devices (for example, mobile phones, tablets, etc.) have become more and more popular. Correspondingly, the number of applications running on the operating systems of these electronic devices has also exploded exponentially. Take iOS and Android as examples. Currently, there are more than 600,000 and 400,000 applications on these two systems.

Although a large number of applications give users more choices, the security issues that follow are also worthy of attention. Taking the Android system as an example, some important functions of the system are provided through a service interface. For example, reading contact information is through a data source service (ie, a process of the system, the process loads the data source service object, and provides an interface). In the process, any program that needs to read the contact information needs to apply for reading the contact information through the interface.

The interface of this service is based on the Binder communication mechanism. The process of calling the interface is as follows: The application issues an interface request for a service, sends the service name and interface serial number -> the service's total route query service, and registers the caller, letting it wait -> The service's total route allocates the client's request to the specific service -> the specific service performs the call to its own interface -> the specific service returns the result of the interface call -> the service's total route gets the result and returns it to the registered application -> The client program gets the result of the interface request.

Currently, the Android system itself does not have an interception mechanism. It only tells the system user that the program may access certain services before the malicious program is installed, but does not judge whether the application is a malicious program. Currently, there are some options for intercepting malicious programs. For example, interception is achieved by registering a fake service with the system, but this way leaves a noticeable fake service name in the intercepted system, which is easily detected by malicious programs, which in turn invalidates the interception. Summary of the invention

In view of the above problems, the present invention has been made in order to provide an application pair in an operating system for intercepting an electronic device that overcomes the above problems or at least partially solves or alleviates the above problems. Method and device for calling a service.

According to an aspect of the present invention, a method for intercepting an application's call to a service in an operating system of an electronic device includes: loading an intercepted dynamic library into a process in which the service is located; and inputting and outputting the process The address of the control function is replaced with the first address of the intercepting dynamic library; when the application invokes the service, executing the intercepting dynamic library based on the first address to obtain information and a location of the application Decoding the information, and replacing the address of the service to be called included in the invoked information with the second address of the intercepting dynamic library; and displaying the information of the application based on the second address and The invoked information, and the processing is performed in accordance with the selection of the call by the operating system on the electronic device.

According to another aspect of the present invention, an apparatus for intercepting an application's call to a service in an operating system of an electronic device is provided, including a load module, configured to load the intercept dynamic library to a process in which the service is located; a module, configured to replace an address of the input/output control function in the process with a first address of the intercepting dynamic library; a second replacement module, configured to: when the application invokes the service, based on the Executing the intercepting dynamic library with an address, obtaining information of the application and the called information, and replacing an address of the service to be called included in the called information with the number of the intercepting dynamic library And a processing module, configured to display information of the application and the invoked information based on the second address, and perform processing according to selection of the call by an operating system on an electronic device.

According to still another aspect of the present invention, a computer program comprising computer readable code causing the server to perform any of claims 1-7 when run on a server The method for intercepting an application's call to a service in an operating system of an electronic device.

According to still another aspect of the present invention, a computer readable medium storing the computer program according to claim 15 is provided.

The beneficial effects of the invention are:

The present invention is capable of intercepting calls and displaying information about applications and calls when the application makes a call to the service, so that it can be selected based on this information to allow the application to invoke the service. In the case of, for example, a malicious application calling a service, the call can be rejected, and the false service result of the successful call can be returned to the malicious application, so that the malicious application cannot be found, thereby improving the security of the system.

The above description is merely an overview of the technical solutions of the present invention, and can be implemented in accordance with the contents of the specification in order to more clearly understand the technical means of the present invention, and The other objects, features and advantages of the invention will become more apparent and obvious. DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flow chart schematically showing a method for intercepting an application's call to a service in an operating system of an electronic device, in accordance with an embodiment of the present invention;

2 schematically illustrates an example view of a selection of an invocation by an operating system on an electronic device in accordance with an embodiment of the present invention;

3 is a block diagram schematically showing an apparatus for intercepting an application's call to a service in an operating system of an electronic device, in accordance with an embodiment of the present invention;

Figure 4 is a schematic block diagram showing a server for performing the method according to the present invention; and

Fig. 5 schematically shows a memory unit for holding or carrying a program code implementing a method according to the invention. Specific embodiment

The invention is further described below in conjunction with the drawings and specific embodiments.

1 is a flow diagram of a method for intercepting an application's call to a service in an operating system of an electronic device, in accordance with an embodiment of the present invention. According to the present invention, the electronic device includes, but is not limited to, the following electronic devices with an operating system installed: mobile phone, tablet, notebook computer, navigator, audio and/or video player, radio, mobile TV, multi-function remote control Such as portable computing devices; desktop computers, mainframe computers, printers, fax machines, copiers, all-in-ones, set-top boxes, public information inquiry devices, multimedia computing devices, and other fixed computing devices; and other electronic devices with operating systems installed.

In the following, the principle of the present invention is exemplarily described by taking a mobile phone equipped with an Andro id system as an example, but the description is merely exemplary, and the scope of the present invention is not limited thereto, and the principle of the present invention can also be applied to Any electronic device installed with other operating systems (eg, Lenovo, i OS, Wi ndow Phone, Symbi an, etc.), such as those previously mentioned. In the method 100 for intercepting an application's call to a service in an operating system for intercepting an electronic device, the following is described by taking an application call to the service through the Binder mechanism of the Andro id system, but the description is merely exemplary. The invention is also applicable to other communication mechanisms.

According to the present invention, the process in which each service is located is found in the Andro id system in advance, and in step S101, the interception dynamic library is loaded to the process in which the service is located. According to an embodiment of the present invention, the pull dynamic library can be loaded into the The process in which the service is located. According to an embodiment of the present invention, the process may be suspended before execution of step S101, for example, by the application programming interface pt race provided by the Linux system.

After the above step S101, step S102 is performed, in which the address of the input/output control function in the process is replaced with the first address of the intercepting dynamic library. According to an embodiment of the invention, the input and output control function is an I0CTL function in the Binder mechanism. The first address of the intercepting dynamic library is used to execute the intercepting dynamic library. After the execution of step S102, the process can be resumed.

Next, in step S103, when the application invokes the service, executing the intercepting dynamic library based on the first address, obtaining information of the application and the invoked information, and The address of the service to be called included in the called information is replaced with the second address of the intercepting dynamic library. According to an embodiment of the present invention, when the application calls the service through the Binder mechanism, the I0CTL function will be reached, since the address of the IOCTTL function has been replaced with the first of the intercepting dynamic library. The address, so the intercepting dynamic library will be executed based on the first address. At this time, the intercepting dynamic library may obtain the information of the application and the called message according to the Andro id system by using the IOCT function according to an embodiment of the present invention, where the information of the application includes the The name and description of the application, the information of the call includes the interface number of the call and the address of the service to be called. Replacing the address of the service to be called with the second address of the intercepting dynamic library, the information of the application and the called information may be displayed based on the second address, and according to the call Select to perform processing on the call.

Since the address of the service to be called has been replaced with the second address of the intercepting dynamic library, in step S104, the information and the application of the application will be displayed based on the second address. Said information, and according to the operating system on the electronic device Processing is performed on the selection of the call.

2 is an exemplary view of a selection of an invocation by an operating system on an electronic device in accordance with an embodiment of the present invention. Referring to Fig. 2, the information of the application and the called information are displayed on the display screen of the mobile phone, and the user is asked whether to allow the application to make a call to the service. In the case where the user selects to allow the application to make a call to the service, the call is performed according to the address of the service, and the actual service result is returned to the application; or when the user selects not to allow the In the case of an application's call to the service, a predefined service result is returned to the application. The predefined service result may, for example, be a service result indicating that the call has been successful, in order for the application to consider that its call to the service has succeeded, and to intercept the interception according to an embodiment of the present invention. Nothing to know.

According to the principle of the present invention, the user can judge whether the application is a malicious application according to the displayed information of the application and the called information, and select to allow the application if it is determined to be a non-malicious normal application. For the invocation of the service to ensure the normal execution of the application; and in the case of determining that the malicious application (for example, by the information of the displayed application or the information of the called to know that it is a malicious application), the selection does not allow the The application invokes the service to ensure system security, while returning to the malicious application a false service result indicating that the call has succeeded, thereby rendering the malicious application unaware of the interception performed in accordance with the present invention.

The following describes the principle of the present invention with the malicious application A initiating a request to dial the debit phone number 888, but the description is merely exemplary, and the present invention is applicable to intercepting any malicious application.

According to an embodiment of the present invention, the process in which each service is located in the Android system (including the process in which the call service is located, assuming that the name is the process S) is pre-loaded, and the interception dynamic library is loaded into the process (including the process S) where each service is located. . The malicious application A needs to make a call to the call service in order to dial the charge number 888, which first initiates access to the call interface.

According to an embodiment of the invention, the address of the IOCT function in the Binder mechanism is replaced with the first address of the intercepting dynamic library. Since the malicious application A will implement the call service through the Binder mechanism, it will execute the I0CTL function in the Binder mechanism. The IOCCTL has been replaced with the first address, and thus the interception dynamic library will be executed based on the first address. At this time, the intercepting dynamic library can be prior to the Android system through the IOCTTL function. The information of the application (the malicious program A and its description) and the called information (calling the call service, dialing the telephone number 888) are obtained. Then, the address of the call service is replaced with the second address of the interception dynamic library.

Next, since the address of the call service has been replaced with the second address, the information of the malicious application A and the call service for calling the call service are displayed on the display screen of the mobile phone based on the second address. Number 888 information. Based on the above information, the user chooses not to allow malicious application A to call the call service. At this point, instead of making a call, the pre-defined service result is returned directly to the malicious application A, that is, the service result indicating that the call has been successful, so that the malicious application A thinks that its call to the call service has succeeded, and Nothing is known about the interception performed in accordance with an embodiment of the present invention.

The present invention provides a method for intercepting an application's call to a service in an operating system of an electronic device. The present invention is capable of intercepting calls and displaying information about applications and calls when the application makes a call to the service, so that it can be selected based on this information to allow the application to invoke the service. In the case of, for example, a malicious application calling a service, the call can be rejected and the virtual service result of the successful call can be returned to the malicious application, so that the malicious application cannot be found, thereby improving the security of the system.

According to the present invention, the malicious application can intercept the privacy information of the electronic device user (including contact information, call history, short message, multimedia message, various accounts and passwords, etc.), and prevent the malicious application from dialing the charge call and sending the buckle. Pay SMS, visit websites that consume network traffic, prevent malicious applications from installing Trojans and virus programs, prevent malicious applications from recording users' GPS or network location, block malicious applications from popping up harassment ads, etc., for any malicious application. The call of the service is intercepted, thereby improving the security of the system.

Corresponding to the method 100 described above, the present invention also provides an apparatus 200 for intercepting an application's call to a service in an operating system of an electronic device. Referring to Figure 3, the apparatus 200 includes:

The loading module 210 is configured to load the intercepting dynamic library into the process where the service is located, and the loading module 210 can be used to perform step S101 in the foregoing method 100;

a first replacement module 220, configured to replace an address of the input/output control function in the process with a first address of the intercepting dynamic library, where the first replacement module 220 is configured to perform step S10 ² in the foregoing method 100. ;

a second replacement module 230, configured to execute the intercepting dynamic library based on the first address when the application invokes the service, to obtain information about the application and the calling Information, and the address of the service to be called included in the called information is replaced with the second address of the intercepting dynamic library, the second replacement module 230 can be used to perform step S103 in the above method 100; as well as

The processing module 240 is configured to display information about the application and the invoked information based on the second address, and perform processing according to selection of the call by an operating system on an electronic device, the processing module 240 It can be used to perform step S104 in the above method 100.

In a preferred embodiment of the present invention, in the case where the application's call to the service is selected as allowed, the processing module 240 performs the call according to the address of the service, and to the application Returning the actual service result; or in the event that the application's call to the service is selected to be disallowed, the processing module 240 returns a predefined service result to the application.

In a preferred embodiment of the present invention, the apparatus 200 further includes a suspending module 250 for suspending the process before the loading module 210 loads the intercepting dynamic library to a process in which the service is located, and for the A replacement module 220 replaces the address of the input-output control function in the process with the recovery module 260 that resumes the process after intercepting the first address of the dynamic library.

In a preferred embodiment of the invention, the information of the application includes the name and description of the application, and the information of the call includes the interface number of the call and the address of the service to be called.

In a preferred embodiment of the present invention, the operating system is an Andro id system, and the application invokes the service through a Binder mechanism of the Andro id system.

In a preferred embodiment of the invention, the input and output control function is an I0CTL function in the Binder mechanism.

In a preferred embodiment of the present invention, when the application invokes the service, the second replacement module 230 executes the intercepting dynamic library based on the first address to pass the

The I0CTL function obtains the information of the application and the letter of the call before the Andro id system.

Since the above-described respective device embodiments correspond to the foregoing respective method embodiments, the respective device embodiments will not be described in detail.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) can be used in practice. Some or all of the functionality of some or all of the means for intercepting an application's call to a service in an operating system of an electronic device in accordance with an embodiment of the present invention is implemented. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 4 illustrates a server, such as an application server, that can implement a method for intercepting an application's call to a service in an operating system of an electronic device in accordance with the present invention. The server conventionally includes a processor 410 and a computer program product or computer readable medium in the form of a memory 420. Memory 420 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk or ROM. Memory 420 has a memory space 430 for program code 431 for performing any of the method steps described above. For example, storage space 430 for program code may include various program code 431 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to Figure 5. The storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 420 in the server of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 431, i.e., code that can be read by a processor, such as 410, which, when executed by a server, causes the server to perform various steps in the methods described above.

"an embodiment," or "an embodiment," or "one or more embodiments" as used herein means that the particular features, structures, or characteristics described in connection with the embodiments are included in at least one embodiment of the invention. In addition, it should be noted that the phrase "in one embodiment" herein does not necessarily refer to the same embodiment.

Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well known methods, structures, and techniques have not been shown in detail so as not to obscure the description.

It should be noted that the above embodiments illustrate the invention and are not intended to limit the invention. Alternative embodiments can be devised by those skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected primarily for the purpose of readability and teaching, and is not intended to be interpreted or limited. Therefore, many modifications and variations will be apparent to those of ordinary skill in the art. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

Rights request

A method (100) for intercepting an application's call to a service in an operating system of an electronic device, comprising:

Loading the intercepting dynamic library into the process where the service is located (S101);

Replacing an address of the input/output control function in the process with a first address of the intercepting dynamic library (S102);

When the application makes a call to the service, executing the intercepting dynamic library based on the first address, obtaining information about the application and the called information, and including the information included in the called information The address of the called service is replaced with the second address of the intercepting dynamic library (S103);

Based on the second address, information of the application and the invoked information are displayed, and processing is performed according to selection of the call by an operating system on the electronic device (S104).

2. The method of claim 1, wherein the step of performing processing according to selection of the call by an operating system on an electronic device comprises: in the case where a call to the application is permitted to be selected by the application Executing the call according to the address of the service, and returning an actual service result to the application; or returning to the application in advance if the application is not allowed to invoke the service Defined service results.

3. The method according to claim 1 or 2, further comprising suspending the process before loading the intercepting dynamic library to the process in which the service is located (S101), and outputting the control function in the process of inputting the process The process is resumed after the step of replacing the address with the first address of the intercepting dynamic library (S102).

4. The method according to claim 1 or 2, wherein the information of the application includes a name and a description of the application, and the information of the call includes an interface number of the call and an address of a service to be called. .

The method according to claim 1 or 2, wherein the operating system is an Andro id system, and the application calls the service through a Binder mechanism of the Andro id system.

6. The method of claim 5, wherein the input and output control function is an IOCTTL function in a Binder mechanism.

7. The method of claim 5, wherein when the application makes a call to the service, executing the intercepting dynamic library based on the first address to obtain the prior to the Andro id system by the IOCT function The information of the application and the information of the call.

8. A device (200) for intercepting an application's call to a service in an operating system of an electronic device, comprising:

a loading module (210), configured to load the intercepting dynamic library into a process where the service is located; a first replacement module (220), configured to replace an address of the input/output control function in the process with the intercepting dynamic library An address

a second replacement module (230), configured to execute the intercepting dynamic library based on the first address when the application invokes the service, to obtain information about the application and the invoked information, and Replacing the address of the service to be called included in the invoked information with the second address of the intercepting dynamic library;

The processing module (240) is configured to display information of the application and the invoked information based on the second address, and perform processing according to selection of the call by an operating system on an electronic device.

9. The apparatus of claim 8, wherein in the case where the application's call to the service is selected to be allowed, the processing module (240) performs the call according to an address of the service, and Returning the actual service result to the application; or in the event that the application's call to the service is selected to be disallowed, the processing module (240) returns a predefined service result to the application.

10. Apparatus according to claim 8 or claim 9, further comprising a pause module for suspending the process before the load module (210) loads the intercept dynamic library to the process in which the service is located

(250), and a recovery module for restoring the process after the first replacement module (220) replaces an address of the input/output control function in the process with the first address of the intercepting dynamic library (260) ).

The apparatus according to claim 8 or 9, wherein the information of the application includes a name and a description of the application, and the information of the call includes an interface serial number of the call and an address of a service to be called. .

12. The apparatus according to claim 8 or 9, wherein the operating system is an Andro id system, and the application tunes the service through a Binder mechanism of an Andro id system use.

13. The apparatus of claim 12, wherein the input and output control function is an IOCCTL function in a Binder mechanism.

14. The apparatus of claim 12, wherein when the application invokes the service, the second replacement module (230) executes the intercept dynamic library based on the first address to pass the IOCTL The function obtains the information of the application and the called information before the Android system.

15. A computer program comprising computer readable code, when the computer readable code is run on a server, causing the server to perform the interception of an electronic device according to any one of claims 1-7 The method of the application's call to the service in the operating system.

A computer readable medium storing the computer program of claim 15.