Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://patents.google.com/patent/CN108804911A/en below:

CN108804911A - A kind of acquisition methods and device of implicit identification's symbol

Publication number

CN108804911A

CN108804911A CN201710297568.8A CN201710297568A CN108804911A CN 108804911 A CN108804911 A CN 108804911A CN 201710297568 A CN201710297568 A CN 201710297568A CN 108804911 A CN108804911 A CN 108804911A

Authority

CN

China

Prior art keywords

access

threshold

identifier

equal

malicious access

Prior art date

2017-04-28

Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)

Granted

• Espacenet
• Global Dossier
• Discuss

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04M—TELEPHONIC COMMUNICATION
  • H04M1/00—Substation equipment, e.g. for use by subscribers
  • H04M1/72—Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
  • H04M1/724—User interfaces specially adapted for cordless or mobile telephones
  • H04M1/72403—User interfaces specially adapted for cordless or mobile telephones with means for local support of applications that increase the functionality
  • H04M1/72406—User interfaces specially adapted for cordless or mobile telephones with means for local support of applications that increase the functionality by software upgrading or downloading
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04M—TELEPHONIC COMMUNICATION
  • H04M1/00—Substation equipment, e.g. for use by subscribers
  • H04M1/72—Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
  • H04M1/724—User interfaces specially adapted for cordless or mobile telephones
  • H04M1/72448—User interfaces specially adapted for cordless or mobile telephones with means for adapting the functionality of the device according to specific conditions
  • H04M1/72454—User interfaces specially adapted for cordless or mobile telephones with means for adapting the functionality of the device according to specific conditions according to context-related or environment-related conditions

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Software Systems (AREA)
• Theoretical Computer Science (AREA)
• General Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Human Computer Interaction (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Environmental & Geological Engineering (AREA)
• Telephone Function (AREA)
• Mobile Radio Communication Systems (AREA)

技术领域technical field

本发明实施例涉及通信技术领域，尤其涉及一种隐性标识符的获取方法及装置。The embodiments of the present invention relate to the field of communication technologies, and in particular, to a method and device for acquiring a hidden identifier.

背景技术Background technique

随着终端和互联网的普及，线上推广成为一种趋势。广告公司为了掌握大部分用户的兴趣取向，可以通过特定应用程序(Application，app)跟踪用户在不同网页(website)、应用程序上执行的操作，以了解用户访问了哪些广告，从而更有针对性地为用户推送相应的广告内容。With the popularity of terminals and the Internet, online promotion has become a trend. In order to grasp the interest orientation of most users, advertising companies can use specific applications (Application, app) to track the actions performed by users on different web pages (websites) and applications, so as to understand which advertisements users have visited, so as to be more targeted Push the corresponding advertising content to users in a timely manner.

目前，在特定应用程序跟踪用户行为的过程中，可以使用终端的显性标识符区分不同用户，其中，显性标识符可以包括国际移动设备身份码(International MobileEquipment Identity，IMEI)、国际移动用户识别码(International Mobile SubscriberIdentification Number，IMSI)等能够唯一标识终端的信息。为了避免恶意应用程序获取终端的显性标识符，操作系统(Operating System，OS)可以预先设置各个应用程序的访问权限，并在某一应用程序试图访问某一终端的显性标识符时，对该应用程序是否具有访问权限进行判断，若该应用程序具有访问权限，则终端允许该应用程序访问所需的显性标识符，否则，该应用程序无法获取到显性标识符。At present, in the process of tracking user behavior by a specific application program, the explicit identifier of the terminal can be used to distinguish different users, where the explicit identifier can include the International Mobile Equipment Identity (International MobileEquipment Identity, IMEI), International Mobile Subscriber Identity Information that can uniquely identify a terminal such as an International Mobile Subscriber Identification Number (IMSI). In order to prevent malicious applications from obtaining the explicit identifier of the terminal, the operating system (Operating System, OS) can pre-set the access rights of each application, and when an application tries to access the explicit identifier of a certain terminal, the Whether the application program has the access right is judged, and if the application program has the access right, the terminal allows the application program to access the required explicit identifier; otherwise, the application program cannot obtain the explicit identifier.

但是，在终端中除了包括显性标识符外，还包括隐性标识符。隐性标识符不同于显性标识符，由于隐性标识符一般不会被设置访问权限，即便隐性标识符具有访问权限，应用程序在身份认证时也无需告知正在使用终端的用户，即可完成整个身份认证过程，因此，任何应用程序都能够成功访问隐性标识符。虽然，通过一个隐性标识符很难确定唯一的一个终端，但通过多个隐性标识符的组合，就能够很容易地区分不同用户。因此，应用程序除了可以通过显性标识符区分不同用户，还可以根据多个隐性标识符的组合区分不同用户。也就意味着，无论是特定应用程序还是恶意应用程序，都能够成功获取终端的隐性标识符，之后通过多个隐性标识符的组合，区分不同用户。这样一来，恶意应用程序依然能够了解各个终端的信息，并跟踪用户行为，从而在未经用户同意的情况下，过度收集用户行为数据，增加用户在终端使用过程中的安全隐患。However, implicit identifiers are included in terminals in addition to explicit identifiers. Implicit identifiers are different from explicit identifiers. Since implicit identifiers generally do not have access permissions, even if implicit identifiers have access permissions, the application does not need to inform the user who is using the terminal during identity authentication. Complete the entire authentication process, so any application can successfully access the covert identifier. Although it is difficult to determine a unique terminal through a hidden identifier, different users can be easily distinguished through a combination of multiple hidden identifiers. Therefore, in addition to distinguishing different users through explicit identifiers, the application program can also distinguish different users based on the combination of multiple implicit identifiers. That is to say, whether it is a specific application or a malicious application, it can successfully obtain the hidden identifier of the terminal, and then distinguish different users through the combination of multiple hidden identifiers. In this way, malicious applications can still understand the information of each terminal and track user behavior, thereby excessively collecting user behavior data without the user's consent, increasing the security risks of the user in the process of using the terminal.

发明内容Contents of the invention

本发明实施例提供一种隐性标识符的获取方法及装置，能够解决因任何应用程序都能够成功访问隐性标识符，而导致在终端使用过程中存在安全隐患的问题。Embodiments of the present invention provide a method and device for obtaining a hidden identifier, which can solve the problem of security risks in the process of using a terminal because any application program can successfully access the hidden identifier.

为达到上述目的，本发明实施例采用如下技术方案：In order to achieve the above object, the embodiment of the present invention adopts the following technical solutions:

第一方面，本发明实施例提供一种隐性标识符的获取方法。该方法包括：截获应用程序访问隐性标识符的操作指令，之后根据操作指令，确定在应用程序启动后，应用程序的访问情况，并根据访问情况确定应用程序是否具有恶意访问隐性标识符的趋势；在根据访问情况确定应用程序具有恶意访问隐性标识符的趋势后，向应用程序反馈伪造信息或空白信息，或提示用户决定是否允许应用程序访问隐性标识符。相比较于现有技术中任何应用程序都能够成功访问隐性标识符，本发明实施例可以在应用程序试图访问隐性标识符时，截获该应用程序访问隐性标识符的操作指令，之后根据所截获的操作指令，确定在应用程序启动后该应用程序的访问情况，并在结合访问情况确定应用程序具有恶意访问隐性标识符的趋势后，向应用程序反馈伪造信息，或空白信息，或提示用户决定是否允许应用程序访问隐性标识符。由此可见，本发明实施例利用隐性标识符在使用过程中的特点，即获取隐性标识符的一方需要通过多个隐性标识符的组合才能唯一确定某一终端的身份，将那些频繁获取隐性标识符、或是获取大量隐性标识符的应用程序，确定为具有恶意访问隐性标识符趋势的应用程序，之后为了保证终端使用过程中的安全性，避免大量隐性标识符的泄露，向该应用程序反馈错误的隐性标识符或是空白信息，也可以通过提醒用户的方式，让用户自行判断应用程序获取隐性标识符的过程是否存在安全隐患。这样一来，对于频繁或是大量获取隐性标识符的应用程序而言，并不一定能够成功访问终端真实的隐性标识符，从而解决因任何应用程序都能够成功访问隐性标识符，而导致在终端使用过程中存在安全隐患的问题。In a first aspect, an embodiment of the present invention provides a method for acquiring a hidden identifier. The method includes: intercepting the operation instruction for the application program to access the hidden identifier, and then according to the operation instruction, determining the access situation of the application program after the application program starts, and determining whether the application program has malicious access to the hidden identifier according to the access situation Trend: After determining that the application has a tendency to maliciously access the hidden identifier according to the access situation, feed back fake information or blank information to the application, or prompt the user to decide whether to allow the application to access the hidden identifier. Compared with any application program in the prior art that can successfully access the hidden identifier, the embodiment of the present invention can intercept the operation instruction of the application program to access the hidden identifier when the application program tries to access the hidden identifier, and then according to The intercepted operating instructions determine the access status of the application program after the application program is started, and after combining the access status to determine the tendency of the application program to have a malicious access hidden identifier, feed back forged information or blank information to the application program, or Prompts the user to decide whether to allow the application to access the implicit identifier. It can be seen that the embodiment of the present invention utilizes the characteristics of hidden identifiers in the process of use, that is, the party who obtains the hidden identifier needs to combine multiple hidden identifiers to uniquely determine the identity of a certain terminal, and those who frequently Applications that obtain hidden identifiers, or obtain a large number of hidden identifiers, are determined to be applications that have a tendency to maliciously access hidden identifiers. In order to ensure the security of the terminal during use, avoid the use of a large number of hidden identifiers. Leakage, feeding back wrong hidden identifiers or blank information to the application, or by reminding the user, allowing the user to judge whether there is a security risk in the process of the application obtaining the hidden identifier. In this way, for applications that obtain hidden identifiers frequently or in large quantities, they may not be able to successfully access the real hidden identifiers of the terminal, so as to solve the problem that any application can successfully access hidden identifiers and It leads to the problem of potential safety hazards in the process of using the terminal.

在一种可能的设计中，访问情况至少包括第一数量以及第二数量中的至少一个。其中，第一数量为应用程序访问隐性标识符的数量，第二数量为应用程序访问隐性标识符种类的数量。也就意味着，在本发明实施例中，能够根据应用程序访问隐性标识符的数量和/或应用程序访问隐性标识符种类的数量，确定应用程序是否具有恶意访问隐性标识符的趋势。In a possible design, the access situation at least includes at least one of the first quantity and the second quantity. Wherein, the first quantity is the quantity of implicit identifiers accessed by applications, and the second quantity is the quantity of types of implicit identifiers accessed by applications. That is to say, in the embodiment of the present invention, it can be determined whether an application program has a tendency to maliciously access a covert identifier according to the number of covert identifiers accessed by the application program and/or the number of types of covert identifiers accessed by the application program .

在一种可能的设计中，属于同一种类的两个隐性标识符之间的相关性大于两个隐性标识符中每个隐性标识符与其他种类中任意一个隐性标识符之间的相关性。并且，用于划分隐性标识符种类的划分依据包括隐性标识符的来源、生成时间、使用方式中的至少一个；隐性标识符种类包括用户界面UI设置以及用户习惯中的至少一个。由此可见，隐性标识符种类的划分可以依据用户或是工作人员对于各个参数在生成和使用过程中功能上的判别，当然也可以基于各个参数对于终端安全性的影响进行判别。这样一来，在经过种类划分后，可以更直观反映应用程序是否属于恶意访问。In one possible design, the correlation between two implicit identifiers belonging to the same category is greater than the correlation between each implicit identifier of the two implicit identifiers and any one of the other categories. Correlation. Moreover, the basis for classifying the types of implicit identifiers includes at least one of the source, generation time, and usage of the implicit identifiers; the types of implicit identifiers include at least one of user interface UI settings and user habits. It can be seen that the classification of implicit identifier types can be based on the user or staff's functional discrimination of each parameter in the process of generation and use, and of course can also be based on the impact of each parameter on terminal security. In this way, after classification, it can be more intuitive to reflect whether the application belongs to malicious access.

在一种可能的设计中，访问情况包括第一数量，则根据访问情况确定应用程序是否具有恶意访问隐性标识符的趋势，可以实现为：当满足一个或多个恶意访问判断条件时，确定应用程序具有恶意访问隐性标识符的趋势，不满足恶意访问判断条件时，确定应用程序不具有恶意访问隐性标识符的趋势。其中，满足一个或多个恶意访问判断条件包括：第一数量大于第一阈值；不满足恶意访问判断条件包括：第一数量小于或等于第一阈值；或者，满足一个或多个恶意访问判断条件包括：第一数量与第一总数量的比值大于第二阈值，其中，第一总数量为隐性标识符的总数量；不满足恶意访问判断条件包括：第一数量与第一总数量的比值小于或等于第二阈值；或者，满足一个或多个恶意访问判断条件包括：第一数量大于第三阈值，以及第一数量与第一总数量的比值大于第四阈值；不满足恶意访问判断条件包括：第一数量小于或等于第三阈值，以及第一数量与第一总数量的比值小于或等于第四阈值。由于访问情况能够有效反映某一应用程序企图获取隐性标识符的数量，且恶意应用程序获取隐性标识符的目的在于，通过多个隐性标识符的组合来唯一确定某一终端的身份，因此，在本发明实施例中，可以根据上述各种数量参数与各自对应的阈值之间的大小管理，确定应用程序是否具有恶意访问隐性标识符的趋势，也就是根据上述访问情况来确定是否具有恶意访问隐性标识符的趋势。In a possible design, the access situation includes the first quantity, then according to the access situation, it is determined whether the application program has a trend of malicious access to the hidden identifier, which can be implemented as follows: when one or more malicious access judgment conditions are met, determine The application has a tendency to maliciously access the hidden identifier, and when the malicious access judgment condition is not met, it is determined that the application does not have the tendency to maliciously access the hidden identifier. Wherein, meeting one or more malicious access judgment conditions includes: the first number is greater than the first threshold; not meeting the malicious access judgment condition includes: the first number is less than or equal to the first threshold; or, meeting one or more malicious access judgment conditions Including: the ratio of the first number to the first total number is greater than the second threshold, wherein the first total number is the total number of hidden identifiers; the condition for judging malicious access is not met includes: the ratio of the first number to the first total number less than or equal to the second threshold; or, satisfying one or more malicious access judgment conditions includes: the first number is greater than the third threshold, and the ratio of the first number to the first total number is greater than the fourth threshold; the malicious access judgment condition is not satisfied It includes: the first quantity is less than or equal to the third threshold, and the ratio of the first quantity to the first total quantity is less than or equal to the fourth threshold. Since the access situation can effectively reflect the number of hidden identifiers that an application attempts to obtain, and the purpose of obtaining hidden identifiers by malicious applications is to uniquely determine the identity of a certain terminal through the combination of multiple hidden identifiers, Therefore, in the embodiment of the present invention, it can be determined whether the application program has a tendency to maliciously access the hidden identifier according to the size management between the above-mentioned various quantity parameters and their respective corresponding thresholds, that is, it can be determined according to the above-mentioned access situation whether Tendency to have malicious access to implicit identifiers.

在一种可能的设计中，访问情况包括每个隐性标识符的权重。那么，上述满足一个或多个恶意访问判断条件，以及不满足恶意访问判断条件还可以包括更多选项。比如，满足一个或多个恶意访问判断条件包括：第一参数大于第五阈值，其中，x_i用于表示隐性标识符i的权重，n用于表示第一数量，i、n都为大于或等于1的整数；不满足恶意访问判断条件包括：第一参数小于或等于第五阈值；或者，满足一个或多个恶意访问判断条件包括：第一比值大于第六阈值，其中，m用于表示第一总数量，m为大于或等于1的整数，且n小于或等于m；不满足恶意访问判断条件包括：第一比值小于或等于第六阈值；或者，满足一个或多个恶意访问判断条件包括：第一参数大于第七阈值，以及第一比值大于第八阈值；不满足恶意访问判断条件包括：第一参数小于或等于第七阈值，以及第一比值小于或等于第八阈值。In one possible design, the access profile includes a weight for each implicit identifier. Then, satisfying one or more malicious access judging conditions and not satisfying the malicious access judging conditions may further include more options. For example, satisfying one or more malicious access judgment conditions includes: the first parameter greater than the fifth threshold, where x _i is used to represent the weight of the implicit identifier i, n is used to represent the first number, i and n are both integers greater than or equal to 1; conditions for judging malicious access that do not meet include: the first parameter less than or equal to the fifth threshold; or, meeting one or more malicious access judgment conditions includes: the first ratio Greater than the sixth threshold, where m is used to represent the first total quantity, m is an integer greater than or equal to 1, and n is less than or equal to m; the conditions for judging malicious access include: the first ratio Less than or equal to the sixth threshold; or, meeting one or more malicious access judgment conditions includes: the first parameter greater than the seventh threshold, and the first ratio greater than the eighth threshold; the conditions for judging malicious access are not satisfied include: the first parameter less than or equal to the seventh threshold, and the first ratio less than or equal to the eighth threshold.

在一种可能的设计中，访问情况包括第二数量，则根据访问情况确定应用程序是否具有恶意访问隐性标识符的趋势，可以实现为：当满足一个或多个恶意访问判断条件时，确定应用程序具有恶意访问隐性标识符的趋势，不满足恶意访问判断条件时，确定应用程序不具有恶意访问隐性标识符的趋势。其中，满足一个或多个恶意访问判断条件包括：第二数量大于第九阈值；不满足恶意访问判断条件包括：第二数量小于或等于第九阈值；或者，满足一个或多个恶意访问判断条件包括：第二数量与第二总数量的比值大于第十阈值；不满足恶意访问判断条件包括：第二数量与第二总数量的比值小于或等于第十阈值；或者，满足一个或多个恶意访问判断条件包括：第二数量大于第十一阈值，以及第二数量与第二总数量的比值大于第十二阈值；不满足恶意访问判断条件包括：第二数量小于或等于第十一阈值，以及第二数量与第二总数量的比值小于或等于第十二阈值。由于访问情况能够有效反映企图获取的隐性标识符所属类型的数量，且恶意应用程序获取隐性标识符的目的在于，通过多个隐性标识符的组合来唯一确定某一终端的身份，因此，在本发明实施例中，可以根据上述各种数量参数与各自对应的阈值之间的大小管理，确定应用程序是否具有恶意访问隐性标识符的趋势，也就是根据上述访问情况来确定是否具有恶意访问隐性标识符的趋势。In a possible design, the access situation includes the second quantity, then according to the access situation, it is determined whether the application program has a trend of malicious access to the hidden identifier, which can be implemented as: when one or more malicious access judgment conditions are met, determine The application has a tendency to maliciously access the hidden identifier, and when the malicious access judgment condition is not met, it is determined that the application does not have the tendency to maliciously access the hidden identifier. Wherein, meeting one or more malicious access judgment conditions includes: the second number is greater than the ninth threshold; not meeting the malicious access judgment condition includes: the second number is less than or equal to the ninth threshold; or, meeting one or more malicious access judgment conditions Including: the ratio of the second number to the second total number is greater than the tenth threshold; not meeting the malicious access judgment condition includes: the ratio of the second number to the second total number is less than or equal to the tenth threshold; or, satisfying one or more malicious accesses The access judgment condition includes: the second number is greater than the eleventh threshold, and the ratio of the second number to the second total number is greater than the twelfth threshold; the malicious access judgment condition does not meet: the second number is less than or equal to the eleventh threshold, And the ratio of the second quantity to the second total quantity is less than or equal to the twelfth threshold. Since the access situation can effectively reflect the number of types of hidden identifiers that are attempted to be obtained, and the purpose of obtaining hidden identifiers by malicious applications is to uniquely determine the identity of a certain terminal through the combination of multiple hidden identifiers, therefore , in the embodiment of the present invention, it can be determined whether the application program has a tendency of maliciously accessing the hidden identifier according to the size management between the above-mentioned various quantity parameters and the respective corresponding thresholds, that is, it is determined according to the above-mentioned access situation whether there is Tendency for malicious access to cryptic identifiers.

在一种可能的设计中，访问情况包括每个隐性标识符种类的权重。那么，上述满足一个或多个恶意访问判断条件，以及不满足恶意访问判断条件还可以包括更多选项。比如，满足一个或多个恶意访问判断条件包括：第二参数大于第十三阈值，其中，y_j用于表示隐性标识符种类j的权重，q用于表示第二数量，j、q都为大于或等于1的整数；不满足恶意访问判断条件包括：第二参数小于或等于第十三阈值；或者，满足一个或多个恶意访问判断条件包括：第二比值大于第十四阈值，其中，p用于表示第一总数量，p为大于或等于1的整数，且q小于或等于p；不满足恶意访问判断条件包括：第二比值小于或等于第十四阈值；或者，满足一个或多个恶意访问判断条件包括：第二参数大于第十五阈值，以及第二比值大于第十六阈值；不满足恶意访问判断条件包括：第二参数小于或等于第十五阈值，以及第二比值小于或等于十六阈值。In one possible design, the access profile includes a weight for each implicit identifier category. Then, satisfying one or more malicious access judging conditions and not satisfying the malicious access judging conditions may further include more options. For example, meeting one or more malicious access judgment conditions includes: the second parameter greater than the thirteenth threshold, where y _j is used to represent the weight of the type j of the implicit identifier, q is used to represent the second quantity, and j and q are both integers greater than or equal to 1; conditions for judging malicious access that do not meet include: second parameter less than or equal to the thirteenth threshold; or, meeting one or more malicious access judgment conditions includes: the second ratio Greater than the fourteenth threshold, where p is used to represent the first total quantity, p is an integer greater than or equal to 1, and q is less than or equal to p; the conditions for judging malicious access are not satisfied include: the second ratio less than or equal to the fourteenth threshold; or, satisfying one or more malicious access judgment conditions includes: the second parameter greater than the fifteenth threshold, and the second ratio greater than the sixteenth threshold; the conditions for judging malicious access are not met include: the second parameter less than or equal to the fifteenth threshold, and the second ratio Less than or equal to the sixteenth threshold.

在一种可能的设计中，在提示用户决定是否允许应用程序访问隐性标识符之前，该方法还包括：记录操作指令。那么，提示用户决定是否允许应用程序访问隐性标识符，可以实现为：在满足指定条件后，提示用户决定是否允许应用程序访问隐性标识符。其中，指定条件至少包括操作指令的数量大于第十七阈值和截获操作指令的时间超过预设时间范围中的一项。也就意味着，在提示用户决定是否允许应用程序访问隐性标识符时，还可以通过不断存储操作指令，之后统一询问用户的方式来实现。这样一来，能够在恶意应用程序频繁请求获取隐性标识符时，避免在终端显示界面上不断弹出提示对话框，影响用户操作。比如，在用户正在运行游戏软件或是其他不可随时中断的应用程序时，批量反馈能够在确保终端安全性的情况下，尽可能不影响用户对终端的操作过程。In a possible design, before the user is prompted to decide whether to allow the application program to access the implicit identifier, the method further includes: recording an operation instruction. Then, prompting the user to decide whether to allow the application program to access the hidden identifier may be implemented as: prompting the user to decide whether to allow the application program to access the hidden identifier after a specified condition is met. Wherein, the designated condition includes at least one of the number of operating instructions greater than a seventeenth threshold and the time of intercepting the operating instructions exceeding a preset time range. That is to say, when prompting the user to decide whether to allow the application to access the hidden identifier, it can also be realized by continuously storing operation instructions and then uniformly asking the user. In this way, when a malicious application program frequently requests to obtain a hidden identifier, it is possible to avoid continuously popping up prompt dialog boxes on the terminal display interface and affecting user operations. For example, when the user is running game software or other applications that cannot be interrupted at any time, batch feedback can ensure the security of the terminal without affecting the user's operation of the terminal as much as possible.

在一种可能的设计中，伪造信息至少包括随机生成的虚假隐性标识符或预先设置的虚假隐性标识符中的一种。由此可见，通过利用隐性标识符在使用过程中的特点，即获取隐性标识符的一方需要通过多个隐性标识符的组合才能唯一确定某一终端的身份，将那些频繁获取隐性标识符、或是获取大量隐性标识符的应用程序，确定为具有恶意访问隐性标识符趋势的应用程序，之后为了保证终端使用过程中的安全性，避免大量隐性标识符的泄露，向该应用程序反馈错误的隐性标识符或是空白信息，也可以通过提醒用户的方式，让用户自行判断应用程序获取隐性标识符的过程是否存在安全隐患。这样一来，对于频繁或是大量获取隐性标识符的应用程序而言，并不一定能够成功访问终端真实的隐性标识符，从而解决因任何应用程序都能够成功访问隐性标识符，而导致在终端使用过程中存在安全隐患的问题。In a possible design, the fake information includes at least one of randomly generated false hidden identifiers or preset false hidden identifiers. It can be seen that by utilizing the characteristics of hidden identifiers in the use process, that is, the party who acquires hidden identifiers needs to combine multiple hidden identifiers to uniquely determine the identity of a certain terminal, and those who frequently obtain hidden identifiers Identifiers, or applications that obtain a large number of hidden identifiers, are determined to be applications with a tendency to maliciously access hidden identifiers. In order to ensure the security of the terminal during use and avoid the leakage of a large number of hidden identifiers, the The app feeds back wrong hidden identifiers or blank information, and can also remind the user to let the user judge whether there is a security risk in the process of the app obtaining the hidden identifier. In this way, for applications that obtain hidden identifiers frequently or in large quantities, they may not be able to successfully access the real hidden identifiers of the terminal, so as to solve the problem that any application can successfully access hidden identifiers and It leads to the problem of potential safety hazards in the process of using the terminal.

在一种可能的设计中，隐性标识符包括未被设置访问权限的标识符，以及被设置了访问权限、但在应用程序进行身份认证的过程中无需通知终端呈现给用户的标识符中的至少一种。在本发明实施例中，应用程序可以通过多个隐性标识符的组合，区分不同用户。也就意味着，应用程序除了可以通过显性标识符区分不同用户，还可以根据多个隐性标识符的组合区分不同用户。这样一来，无论是特定应用程序还是恶意应用程序，都能够成功获取终端的隐性标识符，之后通过多个隐性标识符的组合，区分不同用户。对于恶意应用程序而言，该恶意应用程序能够了解各个终端的信息，并跟踪用户行为，从而在未经用户同意的情况下，过度收集用户行为数据，增加用户在终端使用过程中的安全隐患。然而，在本发明实施例中，采用上述各种可能的设计方案后，可以限制恶意应用程序访问部分或是全部隐性标识符，从而解决因任何应用程序都能够成功访问隐性标识符，而导致在终端使用过程中存在安全隐患的问题。In a possible design, implicit identifiers include identifiers for which access rights are not set, and identifiers for which access rights are set but do not need to be notified to the terminal to be presented to the user during the identity authentication process of the application program. at least one. In the embodiment of the present invention, the application program can distinguish different users through the combination of multiple implicit identifiers. That is to say, in addition to distinguishing different users through explicit identifiers, the application can also distinguish different users based on the combination of multiple implicit identifiers. In this way, whether it is a specific application or a malicious application, it can successfully obtain the hidden identifier of the terminal, and then distinguish different users through the combination of multiple hidden identifiers. For a malicious application, the malicious application can understand the information of each terminal and track user behavior, thereby excessively collecting user behavior data without the user's consent, increasing the security risk of the user in the process of using the terminal. However, in the embodiment of the present invention, after adopting the above-mentioned various possible design schemes, it is possible to restrict malicious applications from accessing part or all of the hidden identifiers, so as to solve the problem that any application can successfully access the hidden identifiers. It leads to the problem of potential safety hazards in the process of using the terminal.

在一种可能的设计中，隐性标识符具体可以为终端内置芯片的型号、终端屏幕的分辨率、运行在终端上操作系统OS的版本、终端所处的时区、终端支持的字体大小、终端上已安装应用程序app种类、终端当前使用的提示铃声、终端的存储空间、终端的蓝牙标识、终端接入无线局域网WLAN的标识等不需要告知用户即可获取的参数。In a possible design, the implicit identifier can specifically be the model of the built-in chip of the terminal, the resolution of the terminal screen, the version of the operating system OS running on the terminal, the time zone where the terminal is located, the font size supported by the terminal, the Parameters that can be obtained without notifying the user, such as the type of application program installed on the device, the prompt ringtone currently used by the terminal, the storage space of the terminal, the Bluetooth identification of the terminal, and the identification of the terminal accessing the wireless local area network WLAN.

在一种可能的设计中，若需要设置每个隐性标识符的权重，那么所有隐性标识符的权重之和一般设置为1，同理，若需要设置每个隐性标识符种类的权重，那么所有种类的权重之和一般设置为1。在实际设置权重的过程中，可以将恶意应用程序频繁获取的一个或是多个隐性标识符，以及一个或是多个种类的隐性标识符的权重设置为较高的数值，同理，对于恶意应用程序获取频次较低的隐性标识符，以及那一种类的隐性标识符，可以将权重设置为较低的数值，甚至接近于0。由此可见，上述所示的几种确定应用程序是否具有恶意访问隐性标识符的趋势的实现方式，不仅可以考虑到用户或是工作人员对于终端使用安全性的需求，还能考虑到单个隐性标识符或是归属于同一种类的隐性标识符的重要性。其中，这里的重要性主要是指恶意应用程序对于这类隐性标识符的需求较高，即获取这类隐性标识符的次数较多。这样一来，就能够便于用户或是工作人员控制提供给各个应用程序获取隐性标识符的数量，并在满足用户或是工作人员需求的情况下，尽可能避免恶意应用程序获取足够的隐性标识符。In a possible design, if it is necessary to set the weight of each implicit identifier, the sum of the weights of all implicit identifiers is generally set to 1. Similarly, if it is necessary to set the weight of each implicit identifier type , then the sum of all types of weights is generally set to 1. In the process of actually setting the weight, the weight of one or more hidden identifiers frequently obtained by malicious applications and one or more types of hidden identifiers can be set to a higher value. Similarly, For the hidden identifiers obtained by malicious applications with low frequency, and the hidden identifiers of that type, the weight can be set to a lower value, even close to 0. It can be seen that the implementation methods for determining whether an application program has a tendency to maliciously access hidden identifiers shown above can not only consider the needs of users or staff for terminal use security, but also consider the individual hidden identifiers. The importance of gender identifiers or implicit identifiers belonging to the same category. Wherein, the importance here mainly refers to that malicious applications have higher requirements for such hidden identifiers, that is, the frequency of obtaining such hidden identifiers is relatively large. In this way, it is easy for users or staff to control the number of hidden identifiers provided to each application, and to avoid malicious applications from obtaining enough hidden identifiers while meeting the needs of users or staff. identifier.

第二方面，本发明实施例提供一种隐性标识符的获取装置。该装置可以实现上述方法实施例中所实现的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的模块。In a second aspect, an embodiment of the present invention provides a device for obtaining a hidden identifier. The device can implement the functions implemented in the foregoing method embodiments, and the functions can be implemented by hardware, or by executing corresponding software on the hardware. The hardware or software includes one or more modules with corresponding functions above.

第三方面，本发明实施例提供一种计算机设备，该计算机设备包括存储器、处理器及在存储器上并可在处理器上运行的计算机程序，该处理器在执行程序时可以实现上述第一方面中所涉及的方法步骤。In a third aspect, an embodiment of the present invention provides a computer device, the computer device includes a memory, a processor, and a computer program on the memory that can run on the processor, and the processor can implement the above first aspect when executing the program The method steps involved in.

第四方面，本发明实施例提供一种计算机存储介质，用于储存为实现上述功能所用的计算机软件指令，其包含用于执行上述方面所设计的程序。In a fourth aspect, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for realizing the above functions, including the program designed for executing the above aspects.

附图说明Description of drawings

图1为本发明实施例提供的一种具体应用场景示意图；FIG. 1 is a schematic diagram of a specific application scenario provided by an embodiment of the present invention;

图2为本发明实施例提供的一种隐性标识符的获取方法流程图；FIG. 2 is a flowchart of a method for obtaining a hidden identifier provided by an embodiment of the present invention;

图3、图4为本发明实施例提供的另一种隐性标识符的获取方法流程图；Fig. 3 and Fig. 4 are flowcharts of another method for acquiring a hidden identifier provided by an embodiment of the present invention;

图5为本发明实施例提供的一种隐性标识符的获取装置的结构示意图；FIG. 5 is a schematic structural diagram of a device for acquiring a hidden identifier provided by an embodiment of the present invention;

图6为本发明实施例提供的另一种隐性标识符的获取装置的结构示意图。Fig. 6 is a schematic structural diagram of another device for acquiring a hidden identifier provided by an embodiment of the present invention.

具体实施方式Detailed ways

下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述。本文所涉及的技术术语的中英文对照参见表一内容。The technical solutions in the embodiments of the present invention will be described below with reference to the drawings in the embodiments of the present invention. For the Chinese-English comparison of the technical terms involved in this article, please refer to Table 1.

表一Table I

本发明实施例可以用于一种通信网络系统，在该通信网络系统中，至少包括终端和恶意服务器。其中，恶意服务器表示那些企图通过恶意应用程序，从用户使用的终端中获取隐形标识符的设备；在终端上通常运行着至少一个应用程序，供用户使用，在本发明实施例中，终端具体可以为智能手机、电脑等具有提供隐性标识符的设备。其中，隐性标识符包括未被设置访问权限的标识符，以及被设置了访问权限、但在应用程序进行身份认证的过程中无需通知终端呈现给用户的标识符中的至少一种。The embodiment of the present invention can be used in a communication network system, in which at least a terminal and a malicious server are included. Among them, the malicious server refers to those devices that attempt to obtain invisible identifiers from the terminal used by the user through a malicious application program; at least one application program is usually running on the terminal for the user to use. In the embodiment of the present invention, the terminal can specifically Devices that provide implicit identifiers for smartphones, computers, etc. Wherein, the implicit identifier includes at least one of identifiers with no access rights set, and at least one of identifiers with access rights set but not required to be notified to the terminal to be presented to the user during the identity authentication process of the application program.

应用程序可以通过多个隐性标识符的组合，区分不同用户。也就意味着，应用程序除了可以通过显性标识符区分不同用户，还可以根据多个隐性标识符的组合区分不同用户。这样一来，无论是特定应用程序还是恶意应用程序，都能够成功获取终端的隐性标识符，之后通过多个隐性标识符的组合，区分不同用户。对于恶意应用程序而言，该恶意应用程序能够了解各个终端的信息，并跟踪用户行为，从而在未经用户同意的情况下，过度收集用户行为数据，增加用户在终端使用过程中的安全隐患。Applications can distinguish different users through the combination of multiple implicit identifiers. That is to say, in addition to distinguishing different users through explicit identifiers, the application can also distinguish different users based on the combination of multiple implicit identifiers. In this way, whether it is a specific application or a malicious application, it can successfully obtain the hidden identifier of the terminal, and then distinguish different users through the combination of multiple hidden identifiers. For a malicious application, the malicious application can understand the information of each terminal and track user behavior, thereby excessively collecting user behavior data without the user's consent, increasing the security risk of the user in the process of using the terminal.

在本发明实施例中，采用后文提出的技术方案后，可以限制恶意应用程序访问部分或是全部隐性标识符，从而解决因任何应用程序都能够成功访问隐性标识符，而导致在终端使用过程中存在安全隐患的问题。In the embodiment of the present invention, after adopting the technical solution proposed later, it is possible to restrict malicious applications from accessing part or all of the hidden identifiers, thereby solving the problem that any application can successfully access the hidden There are potential safety hazards during use.

如图1所示的应用场景中，至少由用户和一种可能的通信网络系统组成。在该应用场景中，恶意服务器与终端之间可以进行数据交互，该恶意服务器试图通过应用程序1至n中的至少一个恶意应用程序，从终端的系统资源中获取隐性标识符。其中，n为大于或等于1的整数，实际取值大小主要取决于终端上安装的应用程序的数量，或是终端当前正在运行的应用程序的数量。In the application scenario shown in FIG. 1 , it consists of at least a user and a possible communication network system. In this application scenario, data interaction may be performed between the malicious server and the terminal, and the malicious server tries to obtain a hidden identifier from the system resources of the terminal through at least one malicious application program in the application programs 1 to n. Wherein, n is an integer greater than or equal to 1, and the actual value mainly depends on the number of application programs installed on the terminal, or the number of application programs currently running on the terminal.

无论是恶意服务器借助恶意应用程序，试图获取隐性标识符，或是在用户正常使用某一应用程序时，诸如背景技术中描述的特定应用程序(即应用程序1至n中的至少一个应用程序)试图跟踪用户的操作，恶意应用程序和特定应用程序都需要在操作系统的管理机制下，由访问监控器(也可以称作隐性标识符访问监控器)截获恶意应用程序和特定应用程序访问隐性标识符的操作指令。Whether it is a malicious server trying to obtain a hidden identifier with the help of a malicious application, or when a user uses a certain application normally, such as the specific application described in the background technology (that is, at least one of the applications 1 to n ) trying to track user operations, both malicious applications and specific applications need to be intercepted by access monitors (also called hidden identifier access monitors) under the management mechanism of the operating system. Instructions for manipulating implicit identifiers.

需要说明的是，访问监控器虽然不确定哪个或是哪些应用程序属于恶意应用程序，但访问监控器可以了解每个应用程序的访问情况，即在一个应用程序启动后，访问监控器可以掌握该应用程序所有试图访问隐性标识符的动态。访问监控器能够根据各个应用程序的访问情况，区分哪个或是哪些应用程序有可能属于恶意应用程序，以及哪个或是哪些应用程序属于普通应用程序。其中，普通应用程序中包括特定应用程序，普通应用程序是指用户在终端上运行应用程序时，该应用程序为了方便用户操作，或是为了减少用户等待时间而读取用户基础数据等的应用程序，即不需要将访问到的隐性标识符反馈给恶意服务器的应用程序。It should be noted that although the access monitor does not determine which or which applications are malicious applications, the access monitor can understand the access situation of each application, that is, after an application is started, the access monitor can grasp the All attempts by the application to access implicit identifiers. The access monitor can distinguish which application program or applications may belong to a malicious application program and which application program or applications belong to a normal application program according to the access status of each application program. Among them, common applications include specific applications, and normal applications refer to applications that read user basic data for the convenience of user operations or to reduce user waiting time when users run applications on the terminal. , that is, applications that do not need to feed back accessed implicit identifiers to malicious servers.

之后，被访问监控器确定为普通应用程序的应用程序，能够直接访问系统资源中的隐性标识符；而被访问监控器确定为可能为恶意应用程序的应用程序，则会获取到转换器(也可以称作隐性标识符转换器)提供的伪造信息或空白信息。其中，转换器能够与访问监控器之间进行数据交互，转换器可以将伪造信息或空白信息反馈给访问监控器，以便于访问监控器将得到的信息反馈给可能属于恶意应用程序的应用程序。Afterwards, the application program determined by the access monitor as a common application program can directly access the hidden identifier in the system resource; and the application program determined by the access monitor as a possibly malicious application program will obtain the converter ( Can also be referred to as fake or blank information provided by the Identifier Converter). Wherein, the converter can perform data interaction with the access monitor, and the converter can feed back fake information or blank information to the access monitor, so that the access monitor can feed back the obtained information to applications that may belong to malicious applications.

另外，需要说明的是，隐性标识符具体可以为终端内置芯片的型号、终端屏幕的分辨率、运行在终端上OS的版本、终端所处的时区、终端支持的字体大小、终端上已安装app种类、终端当前使用的提示铃声、终端的存储空间、终端的蓝牙标识、终端接入WLAN的标识等不需要告知用户即可获取的参数。In addition, it should be noted that the implicit identifier can specifically be the model of the built-in chip of the terminal, the resolution of the terminal screen, the version of the OS running on the terminal, the time zone where the terminal is located, the font size supported by the terminal, and the font size installed on the terminal. Parameters that can be obtained without notifying the user, such as the app type, the prompt ringtone currently used by the terminal, the storage space of the terminal, the Bluetooth identification of the terminal, and the identification of the terminal accessing WLAN.

本发明实施例提供一种隐性标识符的获取方法，如图2所示，该方法可以由如图1所示终端执行，该方法具体包括：An embodiment of the present invention provides a method for obtaining a hidden identifier. As shown in FIG. 2, the method can be executed by the terminal shown in FIG. 1, and the method specifically includes:

步骤101、截获应用程序访问隐性标识符的操作指令。Step 101, intercepting an operation instruction for an application program to access a hidden identifier.

在应用程序的运行过程中，若该应用程序试图从如图1所示的系统资源中获取隐性标识符，则该应用程序会生成操作指令，而终端的访问监控器可以在该操作指令的传输过程中，将该操作指令截获。需要说明的是，该操作指令中至少携带有应用程序试图获取的隐性标识符的类型、和/或隐性标识符的内容。During the running of the application program, if the application program attempts to obtain the implicit identifier from the system resources shown in Figure 1, the application program will generate an operation instruction, and the access monitor of the terminal can During transmission, the operation instruction is intercepted. It should be noted that the operation instruction at least carries the type of the implicit identifier that the application program tries to obtain and/or the content of the implicit identifier.

步骤102、根据操作指令，确定在应用程序启动后，应用程序的访问情况。Step 102, according to the operation instruction, determine the access status of the application program after the application program is started.

其中，访问情况至少包括第一数量以及第二数量中的至少一个，第一数量为应用程序访问隐性标识符的数量，第二数量为应用程序访问隐性标识符种类的数量。在本发明实施例中，确定应用程序的访问情况，主要是依据操作指令中携带的信息来确定的，比如，若操作指令携带有隐性标识符的内容，则访问情况可以包括第一数量，同理，若操作指令携带有隐性标识符的类型，则访问情况可以包括第二数量。需要说明的是，具体确定访问情况的方式会在后文，针对操作指令中携带内容的不同而分别提出相应的实现方案，在此不再赘述。Wherein, the access situation includes at least one of a first quantity and a second quantity, the first quantity is the quantity of implicit identifiers accessed by applications, and the second quantity is the quantity of types of implicit identifiers accessed by applications. In the embodiment of the present invention, the determination of the access status of the application program is mainly determined based on the information carried in the operation instruction. For example, if the operation instruction carries the content of the implicit identifier, the access status may include the first number, Similarly, if the operation instruction carries a type of implicit identifier, the access condition may include the second quantity. It should be noted that the method of specifically determining the access status will be described later, and corresponding implementation solutions will be proposed for different contents carried in the operation instructions, which will not be repeated here.

另外，属于同一种类的两个隐性标识符之间的相关性大于两个隐性标识符中每个隐性标识符与其他种类中任意一个隐性标识符之间的相关性；用于划分隐性标识符种类的划分依据包括隐性标识符的来源、生成时间、使用方式中的至少一个，隐性标识符种类包括UI设置以及用户习惯中的至少一个。其中，相关性用于表示至少两个隐性标识符之间的关联关系，比如，相关性较高的至少两个隐性标识符的共性相对较高，反之，相关性较低的至少两个隐性标识符的共性相对较低。比如，采用隐性标识符的生成时间对隐性标识符的种类进行划分，那么生成时间点相近的多个隐性标识符能够被划分为同一类别。其中，生成时间点是否相近可以由用户或是工作人员预先设置相应的规则进行判断，比如，若两个隐性标识符生成的时间间隔小于预设的时长，则认为这两个隐性标识符的生成时间点相近。在本发明实施例中，上述内容仅作为一种可能的示例，并不作为上述各个名词或是参数的限定。In addition, the correlation between two implicit identifiers belonging to the same category is greater than the correlation between each implicit identifier of the two implicit identifiers and any one of the other categories; used to divide The basis for classifying the types of implicit identifiers includes at least one of the source, generation time, and usage of the implicit identifiers, and the types of implicit identifiers include at least one of UI settings and user habits. Among them, the correlation is used to indicate the association relationship between at least two implicit identifiers, for example, the commonality of at least two implicit identifiers with high correlation is relatively high, and on the contrary, at least two implicit identifiers with low correlation Implicit identifiers have relatively low commonality. For example, if the generation time of the implicit identifier is used to classify the types of the implicit identifier, then multiple implicit identifiers with similar generation time points can be classified into the same category. Among them, whether the generation time points are similar can be judged by the corresponding rules preset by the user or the staff. For example, if the time interval between the generation of two implicit identifiers is less than the preset duration, the two implicit identifiers are considered The generation time point is close. In the embodiment of the present invention, the foregoing content is only used as a possible example, and is not intended as a limitation of the foregoing terms or parameters.

需要说明的是，隐性标识符种类可以由用户或是工作人员预先划分，比如，终端屏幕的分辨率和终端支持的字体大小，属于“UI设置”类，终端当前使用的提示铃声和终端所处的时区，属于“用户习惯”类。另外，每个隐性标识符可以归属于至少一个隐性标识符种类，且一个隐性标识符种类中包括至少一个隐性标识符；对于隐性标识符种类的划分，可以根据隐性标识符的来源、生成时间、使用方式等进行划分，其目的主要在于，将具有相关性或是相关性较高的多个隐性标识符划分至同一类别，具体的划分依据在此不做限定。It should be noted that the types of implicit identifiers can be pre-divided by users or staff, for example, the resolution of the terminal screen and the font size supported by the terminal belong to the category of "UI settings", the prompt ringtone currently used by the terminal and the font size supported by the terminal. The time zone at , which belongs to the category of "user habits". In addition, each implicit identifier can belong to at least one implicit identifier category, and one implicit identifier category includes at least one implicit identifier; for the division of implicit identifier categories, it can be based on the implicit identifier The source, generation time, usage method, etc. of the identifiers are classified mainly for the purpose of classifying multiple implicit identifiers with correlation or high correlation into the same category, and the specific basis for classification is not limited here.

步骤103、根据访问情况确定应用程序是否具有恶意访问隐性标识符的趋势。Step 103. Determine whether the application program has a tendency to maliciously access the hidden identifier according to the access situation.

由于访问情况能够有效反映某一应用程序企图获取隐性标识符的数量、或是企图获取的隐性标识符所属类型的数量，且恶意应用程序获取隐性标识符的目的在于，通过多个隐性标识符的组合来唯一确定某一终端的身份，因此，在本发明实施例中，可以根据上述各种数量参数确定应用程序是否具有恶意访问隐性标识符的趋势，也就是根据上述访问情况来确定是否具有恶意访问隐性标识符的趋势。其中，确定方式会在后文提出具体的实现方案，在此不再赘述。Since the access situation can effectively reflect the number of hidden identifiers that an application attempts to obtain, or the number of types of hidden identifiers that an application attempts to obtain, and the purpose of obtaining hidden identifiers by malicious applications is to Therefore, in the embodiment of the present invention, it can be determined whether the application program has a tendency to maliciously access the hidden identifier according to the above-mentioned various quantitative parameters, that is, according to the above-mentioned access situation To determine whether there is a tendency to maliciously access implicit identifiers. Wherein, the determination method will provide a specific implementation scheme later, and will not be repeated here.

步骤104、在根据访问情况确定应用程序具有恶意访问隐性标识符的趋势后，向应用程序反馈伪造信息或空白信息，或提示用户决定是否允许应用程序访问隐性标识符。Step 104: After determining that the application has a tendency to maliciously access the hidden identifier according to the access situation, feed back forged or blank information to the application, or prompt the user to decide whether to allow the application to access the hidden identifier.

在本发明实施例中，伪造信息至少包括随机生成的虚假隐性标识符或预先设置的虚假隐性标识符中的一种。其中，随机生成虚假隐性标识符的方式可以由用户或是工作人员预先设定，比如，在真实的隐性标识符的内容上，更改某一字符或是字符串，从而生成虚假隐性标识符，或是，将除该终端以外的其他设备上的隐性标识符作为此时恶意应用程序企图获取的隐性标识符的反馈消息等，具体设置方式在此不做限定。In the embodiment of the present invention, the fake information includes at least one of a randomly generated false hidden identifier or a preset false hidden identifier. Among them, the method of randomly generating false hidden identifiers can be preset by users or staff, for example, on the content of real hidden identifiers, a certain character or character string is changed to generate false hidden identifiers Identifier, or using the hidden identifier on other devices other than the terminal as the feedback message of the hidden identifier that the malicious application program attempts to obtain at this time, etc. The specific setting method is not limited here.

由此可见，通过利用隐性标识符在使用过程中的特点，即获取隐性标识符的一方需要通过多个隐性标识符的组合才能唯一确定某一终端的身份，将那些频繁获取隐性标识符、或是获取大量隐性标识符的应用程序，确定为具有恶意访问隐性标识符趋势的应用程序，之后为了保证终端使用过程中的安全性，避免大量隐性标识符的泄露，向该应用程序反馈错误的隐性标识符或是空白信息，也可以通过提醒用户的方式，让用户自行判断应用程序获取隐性标识符的过程是否存在安全隐患。这样一来，对于频繁或是大量获取隐性标识符的应用程序而言，并不一定能够成功访问终端真实的隐性标识符，从而解决因任何应用程序都能够成功访问隐性标识符，而导致在终端使用过程中存在安全隐患的问题。It can be seen that by utilizing the characteristics of hidden identifiers in the use process, that is, the party who acquires hidden identifiers needs to combine multiple hidden identifiers to uniquely determine the identity of a certain terminal, and those who frequently obtain hidden identifiers Identifiers, or applications that obtain a large number of hidden identifiers, are determined to be applications with a tendency to maliciously access hidden identifiers. In order to ensure the security of the terminal during use and avoid the leakage of a large number of hidden identifiers, the The app feeds back wrong hidden identifiers or blank information, and can also remind the user to let the user judge whether there is a security risk in the process of the app obtaining the hidden identifier. In this way, for applications that obtain hidden identifiers frequently or in large quantities, they may not be able to successfully access the real hidden identifiers of the terminal, so as to solve the problem that any application can successfully access hidden identifiers and It leads to the problem of potential safety hazards in the process of using the terminal.

针对访问情况包括第一数量的方案而言，在如图2所示的实现方式的基础上，还可以实现为如图3所示的实现方式。其中，步骤103根据访问情况确定应用程序是否具有恶意访问隐性标识符的趋势，具体可以实现为步骤201或步骤202，或者，实现为步骤203或步骤204：For the scheme that the access situation includes the first quantity, on the basis of the implementation manner shown in FIG. 2 , the implementation manner shown in FIG. 3 may also be implemented. Wherein, step 103 determines whether the application program has a tendency to maliciously access the hidden identifier according to the access situation, which can be specifically implemented as step 201 or step 202, or as step 203 or step 204:

步骤201、当满足一个或多个恶意访问判断条件时，确定应用程序具有恶意访问隐性标识符的趋势。Step 201. When one or more malicious access judging conditions are met, determine that the application has a tendency to maliciously access the hidden identifier.

步骤202、当不满足恶意访问判断条件时，确定应用程序不具有恶意访问隐性标识符的趋势。Step 202, when the malicious access judging condition is not satisfied, determine that the application program does not have a tendency of malicious access to the hidden identifier.

其中，满足一个或多个恶意访问判断条件包括：第一数量大于第一阈值；不满足恶意访问判断条件包括：第一数量小于或等于第一阈值；Wherein, meeting one or more malicious access judgment conditions includes: the first number is greater than the first threshold; not satisfying the malicious access judgment condition includes: the first number is less than or equal to the first threshold;

或者，满足一个或多个恶意访问判断条件包括：第一数量与第一总数量的比值大于第二阈值，其中，第一总数量为隐性标识符的总数量；不满足恶意访问判断条件包括：第一数量与第一总数量的比值小于或等于第二阈值；Alternatively, satisfying one or more malicious access judgment conditions includes: the ratio of the first quantity to the first total quantity is greater than a second threshold, wherein the first total quantity is the total quantity of hidden identifiers; not satisfying the malicious access judgment condition includes : the ratio of the first quantity to the first total quantity is less than or equal to the second threshold;

或者，满足一个或多个恶意访问判断条件包括：第一数量大于第三阈值，以及第一数量与第一总数量的比值大于第四阈值；不满足恶意访问判断条件包括：第一数量小于或等于第三阈值，以及第一数量与第一总数量的比值小于或等于第四阈值。Alternatively, meeting one or more malicious access judgment conditions includes: the first number is greater than the third threshold, and the ratio of the first number to the first total number is greater than the fourth threshold; not satisfying the malicious access judgment condition includes: the first number is less than or is equal to the third threshold, and the ratio of the first quantity to the first total quantity is less than or equal to the fourth threshold.

若访问情况包括每个隐性标识符的权重，那么满足一个或多个恶意访问判断条件，以及不满足恶意访问判断条件还可以包括更多选项。If the access situation includes the weight of each implicit identifier, then satisfying one or more malicious access judging conditions and not satisfying the malicious access judging conditions may further include more options.

即满足一个或多个恶意访问判断条件包括：第一参数大于第五阈值，其中，x_i用于表示隐性标识符i的权重，n用于表示第一数量，i、n都为大于或等于1的整数；不满足恶意访问判断条件包括：第一参数小于或等于第五阈值；That is, satisfying one or more malicious access judgment conditions includes: the first parameter is greater than the fifth threshold, where x _i is used to represent the weight of the implicit identifier i, n is used to represent the first number, i and n are both integers greater than or equal to 1; conditions for judging malicious access that do not meet include: the first parameter less than or equal to the fifth threshold;

或者，满足一个或多个恶意访问判断条件包括：第一比值大于第六阈值，其中，m用于表示第一总数量，m为大于或等于1的整数，且n小于或等于m；不满足恶意访问判断条件包括：第一比值小于或等于第六阈值；Alternatively, satisfying one or more malicious access judgment conditions includes: the first ratio Greater than the sixth threshold, where m is used to represent the first total quantity, m is an integer greater than or equal to 1, and n is less than or equal to m; the conditions for judging malicious access include: the first ratio less than or equal to the sixth threshold;

或者，满足一个或多个恶意访问判断条件包括：第一参数大于第七阈值，以及第一比值大于第八阈值；不满足恶意访问判断条件包括：第一参数小于或等于第七阈值，以及第一比值小于或等于第八阈值。Alternatively, satisfying one or more malicious access judgment conditions includes: the first parameter greater than the seventh threshold, and the first ratio greater than the eighth threshold; the conditions for judging malicious access are not satisfied include: the first parameter less than or equal to the seventh threshold, and the first ratio less than or equal to the eighth threshold.

针对访问情况包括第二数量而言，满足一个或多个恶意访问判断条件包括：第二数量大于第九阈值；不满足恶意访问判断条件包括：第二数量小于或等于第九阈值；Regarding the access situation including the second number, meeting one or more malicious access judgment conditions includes: the second number is greater than the ninth threshold; not satisfying the malicious access judgment condition includes: the second number is less than or equal to the ninth threshold;

或者，满足一个或多个恶意访问判断条件包括：第二数量与第二总数量的比值大于第十阈值；不满足恶意访问判断条件包括：第二数量与第二总数量的比值小于或等于第十阈值；Alternatively, meeting one or more malicious access judgment conditions includes: the ratio of the second number to the second total number is greater than the tenth threshold; not satisfying the malicious access judgment condition includes: the ratio of the second number to the second total number is less than or equal to the tenth threshold tenthreshold;

或者，满足一个或多个恶意访问判断条件包括：第二数量大于第十一阈值，以及第二数量与第二总数量的比值大于第十二阈值；不满足恶意访问判断条件包括：第二数量小于或等于第十一阈值，以及第二数量与第二总数量的比值小于或等于第十二阈值。Alternatively, meeting one or more malicious access judgment conditions includes: the second number is greater than the eleventh threshold, and the ratio of the second number to the second total number is greater than the twelfth threshold; not meeting the malicious access judgment condition includes: the second number is less than or equal to the eleventh threshold, and the ratio of the second number to the second total number is less than or equal to the twelfth threshold.

若访问情况包括每个隐性标识符种类的权重，那么满足一个或多个恶意访问判断条件，以及不满足恶意访问判断条件还可以包括更多选项。If the access situation includes the weight of each type of implicit identifier, then satisfying one or more malicious access judging conditions and not satisfying the malicious access judging conditions may also include more options.

即满足一个或多个恶意访问判断条件包括：第二参数大于第十三阈值，其中，y_j用于表示隐性标识符种类j的权重，q用于表示第二数量，j、q都为大于或等于1的整数；不满足恶意访问判断条件包括：第二参数小于或等于第十三阈值；That is, satisfying one or more malicious access judgment conditions includes: the second parameter greater than the thirteenth threshold, where y _j is used to represent the weight of the type j of the implicit identifier, q is used to represent the second quantity, and j and q are both integers greater than or equal to 1; conditions for judging malicious access that do not meet include: second parameter less than or equal to the thirteenth threshold;

或者，满足一个或多个恶意访问判断条件包括：第二比值大于第十四阈值，其中，p用于表示第一总数量，p为大于或等于1的整数，且q小于或等于p；不满足恶意访问判断条件包括：第二比值小于或等于第十四阈值；Alternatively, satisfying one or more malicious access judgment conditions includes: the second ratio greater than the fourteenth threshold, where p is used to represent the first total quantity, p is an integer greater than or equal to 1, and q is less than or equal to p; the conditions for judging malicious access are not satisfied include: the second ratio less than or equal to the fourteenth threshold;

或者，满足一个或多个恶意访问判断条件包括：第二参数大于第十五阈值，以及第二比值大于第十六阈值；不满足恶意访问判断条件包括：第二参数小于或等于第十五阈值，以及第二比值小于或等于十六阈值。Alternatively, satisfying one or more malicious access judgment conditions includes: the second parameter greater than the fifteenth threshold, and the second ratio greater than the sixteenth threshold; the conditions for judging malicious access are not met include: the second parameter less than or equal to the fifteenth threshold, and the second ratio Less than or equal to the sixteenth threshold.

需要说明的是，上述第一至第十六阈值的取值，可以由用户或是工作人员预先设定，具体可以参考历史经验值。比如，超过80％的恶意应用程序会获取5个及以上的隐性标识符，那么第一阈值可以被设置为4个；超过90％的恶意应用程序获取隐性标识符的数量占所有隐性标识符总数量的比例大于1/4，那么第二阈值可以被设置为1/4。另外，是考虑超过80％的恶意应用程序的共性，还是考虑超过90％的恶意应用程序的共性，在本发明实施例中不做限定。其中，80％和90％可以被视为用于衡量大部分恶意应用程序共性的置信度，该置信度的设置方式可以考虑用户或是工作人员对终端使用安全性的需求，对于安全性需求较高的终端而言，可以将置信度设置为相对较低的数值，同理，对于安全性需求较低的终端而言，可以尽可能的将置信度设置为较高的数值，甚至设置成100％。It should be noted that the values of the above-mentioned first to sixteenth thresholds may be preset by a user or a staff member, for details, reference may be made to historical experience values. For example, if more than 80% of malicious applications obtain 5 or more hidden identifiers, then the first threshold can be set to 4; more than 90% of malicious applications obtain the number of hidden identifiers accounting for all If the ratio of the total number of identifiers is greater than 1/4, then the second threshold may be set to 1/4. In addition, it is not limited in this embodiment of the present invention whether to consider the commonality of more than 80% of malicious applications or the commonality of more than 90% of malicious applications. Among them, 80% and 90% can be regarded as the confidence level used to measure the commonality of most malicious applications. For terminals with high security, you can set the confidence level to a relatively low value. Similarly, for terminals with low security requirements, you can set the confidence level as high as possible, even 100 %.

对于每个隐性标识符的权重，及每个隐性标识符种类的权重，也需要用户或是工作人员预先根据历史经验值进行设置，并在设置后存储在终端本地或是存储在其他能够与终端进行数据交互的设备等。需要说明的是，若需要设置每个隐性标识符的权重，那么所有隐性标识符的权重之和一般设置为1，同理，若需要设置每个隐性标识符种类的权重，那么所有种类的权重之和一般设置为1。在实际设置权重的过程中，可以将恶意应用程序频繁获取的一个或是多个隐性标识符，以及一个或是多个种类的隐性标识符的权重设置为较高的数值，同理，对于恶意应用程序获取频次较低的隐性标识符，以及那一种类的隐性标识符，可以将权重设置为较低的数值，甚至接近于0。For the weight of each hidden identifier, and the weight of each type of hidden identifier, users or staff also need to pre-set according to the historical experience value, and after setting, store it locally in the terminal or in other capable Devices for data interaction with terminals, etc. It should be noted that if the weight of each implicit identifier needs to be set, the sum of the weights of all implicit identifiers is generally set to 1. Similarly, if the weight of each implicit identifier type needs to be set, then all The sum of the weights of categories is generally set to 1. In the process of actually setting the weight, the weight of one or more hidden identifiers frequently obtained by malicious applications and one or more types of hidden identifiers can be set to a higher value. Similarly, For the hidden identifiers obtained by malicious applications with low frequency, and the hidden identifiers of that type, the weight can be set to a lower value, even close to 0.

由此可见，上述所示的几种确定应用程序是否具有恶意访问隐性标识符的趋势的实现方式，不仅可以考虑到用户或是工作人员对于终端使用安全性的需求，还能考虑到单个隐性标识符或是归属于同一种类的隐性标识符的重要性。其中，这里的重要性主要是指恶意应用程序对于这类隐性标识符的需求较高，即获取这类隐性标识符的次数较多。这样一来，就能够便于用户或是工作人员控制提供给各个应用程序获取隐性标识符的数量，并在满足用户或是工作人员需求的情况下，尽可能避免恶意应用程序获取足够的隐性标识符。It can be seen that the implementation methods for determining whether an application program has a tendency to maliciously access hidden identifiers shown above can not only consider the needs of users or staff for terminal use security, but also consider the individual hidden identifiers. The importance of gender identifiers or implicit identifiers belonging to the same category. Wherein, the importance here mainly refers to that malicious applications have higher requirements for such hidden identifiers, that is, the frequency of obtaining such hidden identifiers is relatively large. In this way, it is easy for users or staff to control the number of hidden identifiers provided to each application, and to avoid malicious applications from obtaining enough hidden identifiers while meeting the needs of users or staff. identifier.

为了节省终端内部各部件进行数据交互时所耗费的能耗，在本发明实施例的一个实现方式中，终端中的访问监控器可以在完成一批操作指令的记录后，统一询问用户是否允许应用程序的获取需求。因此，在如图2和图3所示的实现方式的基础上，以图2为例，还可以实现为如图4所示的实现方式。In order to save the energy consumed by the internal components of the terminal for data interaction, in an implementation of the embodiment of the present invention, the access monitor in the terminal can uniformly ask the user whether to allow the application after recording a batch of operation instructions. Program acquisition requirements. Therefore, on the basis of the implementation manners shown in FIG. 2 and FIG. 3 , taking FIG. 2 as an example, the implementation manner shown in FIG. 4 may also be implemented.

其中，步骤104在根据访问情况确定应用程序具有恶意访问隐性标识符的趋势后，向应用程序反馈伪造信息或空白信息，或提示用户决定是否允许应用程序访问隐性标识符，可以具体实现为步骤301，或执行步骤401和步骤402：Among them, step 104, after determining that the application program has a tendency to maliciously access the hidden identifier according to the access situation, feeds back fake information or blank information to the application program, or prompts the user to decide whether to allow the application program to access the hidden identifier, which can be specifically implemented as Step 301, or execute steps 401 and 402:

步骤301、在根据访问情况确定应用程序具有恶意访问隐性标识符的趋势后，向应用程序反馈伪造信息或空白信息。Step 301 , after determining that the application program has a tendency to maliciously access the hidden identifier according to the access situation, feeding back forged or blank information to the application program.

由此可见，在访问监控器将应用程序确定为具有恶意访问隐性标识符的趋势的应用程序后，若该应用程序仍然试图访问系统资源中的隐性标识符，那么，监控器可以向该应用程序提供由转换器生成的伪造信息或是空白信息，当然，这些信息也可以由用户或是工作人员预存，之后由转换器从相应存储位置获取，并提供给监控器。It can be seen that after the access monitor determines that the application program is an application program with a tendency to maliciously access the hidden identifier, if the application program still tries to access the hidden identifier in the system resource, then the monitor can send the application program to the hidden identifier. The application program provides fake information or blank information generated by the converter. Of course, the information can also be pre-stored by the user or staff, and then the converter obtains it from the corresponding storage location and provides it to the monitor.

需要说明的是，对于伪造信息的存储位置，在此不做限定，可以直接存储在系统资源中用于存储真实的隐性标识符的存储空间中，被划分出的单独用于存储伪造信息的存储空间。为了方便转换器提供伪造信息，还可以在存储时，直接存储每条伪造信息以及与每条伪造信息对应的真实的隐性标识符，这样，每当恶意应用程序试图访问这一条真实的隐性标识符时，转换器能够直接依据预存的匹配关系，将于这一条真实的隐性标识符存在对应关系的那一条伪造信息提供给监控器。It should be noted that the storage location of the forged information is not limited here, and it can be directly stored in the storage space used to store the real hidden identifier in the system resources, and the storage space for storing the forged information is divided into storage. In order to facilitate the converter to provide fake information, it is also possible to directly store each piece of fake information and the real hidden identifier corresponding to each piece of fake information when storing, so that whenever a malicious application tries to access this real hidden When identifying an identifier, the converter can directly provide the forged information to the monitor based on the pre-stored matching relationship.

步骤401、在根据访问情况确定应用程序具有恶意访问隐性标识符的趋势后，记录操作指令。Step 401, after determining that the application program has a tendency to maliciously access the hidden identifier according to the access situation, record the operation instruction.

步骤402、在满足指定条件后，提示用户决定是否允许应用程序访问隐性标识符。Step 402, prompting the user to decide whether to allow the application program to access the implicit identifier after the specified condition is satisfied.

其中，指定条件至少包括操作指令的数量大于第十七阈值和截获操作指令的时间超过预设时间范围中的一项。Wherein, the designated condition includes at least one of the number of operating instructions greater than a seventeenth threshold and the time of intercepting the operating instructions exceeding a preset time range.

在本发明实施例中，可以将记录的操作指令存储至终端的存储空间内，在存储的操作指令的条数大于第十七阈值后反馈给用户；或是，在恶意应用程序运行的时间达到某一特定时长后即获取操作指令的时间超过预设时间范围后反馈给用户。其中，上述第十七阈值与预设时间范围同样可以由工作人员或用户，根据历史经验值进行预先设置，对于设置方式、设置时机等，在本发明实施例中不进行限定。In the embodiment of the present invention, the recorded operation instructions can be stored in the storage space of the terminal, and fed back to the user after the number of stored operation instructions is greater than the seventeenth threshold; After a certain period of time, the operation command is obtained and fed back to the user after the time exceeds the preset time range. Wherein, the above-mentioned seventeenth threshold and the preset time range can also be preset by staff or users based on historical experience values, and the setting method, setting timing, etc. are not limited in this embodiment of the present invention.

由于在向用户反馈之前，需要存储这段时间内获取到的操作指令，而终端的存储空间是有限的，因此，可以在记录操作指令前、或是在记录操作指令时、或是在记录操作后的一段时间内，设置操作指令的记录数量上限，当达到这一上限后，可以统一向用户询问是否允许访问。也就意味着，即使当前情况未满足指定条件，但出于终端存储空间有限的考虑，仍然可以结合存储空间当前的存储情况，提前给予用户提示。Since the operation instructions obtained during this period need to be stored before giving feedback to the user, and the storage space of the terminal is limited, it is possible to record the operation instructions before, or when recording the operation instructions, or when recording the operation instructions. In the next period of time, set the upper limit of the number of records of operation instructions. When this upper limit is reached, the user can be uniformly asked whether to allow access. That is to say, even if the current situation does not meet the specified conditions, due to the limited storage space of the terminal, it is still possible to give the user a reminder in advance in combination with the current storage situation of the storage space.

由此可见，在提示用户决定是否允许应用程序访问隐性标识符时，还可以通过不断存储操作指令，之后统一询问用户的方式来实现。这样一来，能够在恶意应用程序频繁请求获取隐性标识符时，避免在终端显示界面上不断弹出提示对话框，影响用户操作。比如，在用户正在运行游戏软件或是其他不可随时中断的应用程序时，批量反馈能够在确保终端安全性的情况下，尽可能不影响用户对终端的操作过程。It can be seen that when prompting the user to decide whether to allow the application program to access the hidden identifier, it can also be realized by continuously storing operation instructions and then uniformly asking the user. In this way, when a malicious application program frequently requests to obtain a hidden identifier, it is possible to avoid continuously popping up prompt dialog boxes on the terminal display interface and affecting user operations. For example, when the user is running game software or other applications that cannot be interrupted at any time, batch feedback can ensure the security of the terminal without affecting the user's operation of the terminal as much as possible.

在上述终端中可以设置有隐性标识符的获取装置。隐性标识符的获取装置为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。A device for obtaining a hidden identifier may be provided in the above terminal. In order to realize the above-mentioned functions, the device for obtaining the implicit identifier includes corresponding hardware structures and/or software modules for performing various functions. Those skilled in the art should easily realize that the present invention can be realized in the form of hardware or a combination of hardware and computer software in combination with the units and algorithm steps of each example described in the embodiments disclosed herein. Whether a certain function is executed by hardware or computer software drives hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

本发明实施例可以根据上述方法示例对隐性标识符的获取装置进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本发明实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。In the embodiment of the present invention, according to the above-mentioned method example, the device for obtaining the implicit identifier can be divided into functional modules. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. middle. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. It should be noted that the division of modules in the embodiment of the present invention is schematic, and is only a logical function division, and there may be another division manner in actual implementation.

如图5所示，为上述实施例中所涉及的隐性标识符的获取装置的一种可能的结构示意图。隐性标识符的获取装置10包括：获取模块11、确定模块12、发送模块13和存储模块14。其中，获取模块11用于支持隐性标识符的获取装置10执行图2至图4中的步骤101；确定模块12用于支持隐性标识符的获取装置10执行图2至图4中的步骤102，图2、图4中的步骤103，图3中的步骤201和步骤202；发送模块13用于支持隐性标识符的获取装置10执行图2和图3的步骤104，图4中的步骤301和步骤402；存储模块14用于支持隐性标识符的获取装置10执行图4中的步骤401。As shown in FIG. 5 , it is a schematic structural diagram of a possible structure of the device for acquiring a hidden identifier involved in the above-mentioned embodiment. The device 10 for obtaining a hidden identifier includes: an obtaining module 11 , a determining module 12 , a sending module 13 and a storage module 14 . Among them, the acquisition module 11 is used to support the acquisition device 10 of the implicit identifier to perform step 101 in Figure 2 to Figure 4; the determination module 12 is used to support the acquisition device 10 of the implicit identifier to perform the steps in Figure 2 to Figure 4 102, step 103 in Fig. 2 and Fig. 4, step 201 and step 202 in Fig. 3; the sending module 13 is used to support the acquisition device 10 of the implicit identifier to execute step 104 in Fig. 2 and Fig. 3, and step 104 in Fig. 4 Step 301 and step 402; the storage module 14 is used to support the acquisition device 10 of the implicit identifier to execute step 401 in FIG. 4 .

需要说明的是，获取模块11与发送模块13除了可以分开部署外，还可以集成在通信模块20上，由通信模块20实现获取模块11与发送模块13所能实现的功能，和/或用于支持隐性标识符的获取装置10与终端中各个模块之间进行数据交互，和/或支持终端与其他网元之间的通信；确定模块12可以实现为处理模块21，还用于实现本文所描述的技术的其它过程；存储模块14还可以用于存储基站的程序代码和数据。It should be noted that, in addition to being deployed separately, the acquisition module 11 and the sending module 13 can also be integrated on the communication module 20, and the communication module 20 realizes the functions that the acquisition module 11 and the sending module 13 can realize, and/or is used for The acquisition device 10 that supports the implicit identifier performs data interaction with various modules in the terminal, and/or supports communication between the terminal and other network elements; the determination module 12 can be implemented as a processing module 21, and is also used to realize the Other processes of the technology described; the storage module 14 can also be used to store program codes and data of the base station.

其中，处理模块21可以实现为处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块20可以实现为收发电路或通信接口等。存储模块14可以实现为存储器，其中，该存储器应为非瞬态存储器。Wherein, the processing module 21 may be implemented as a processor or a controller, such as a CPU, a general processor, DSP, ASIC, FPGA or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, a combination of one or more microprocessors, a combination of DSP and a microprocessor, and so on. The communication module 20 can be realized as a transceiver circuit or a communication interface, and the like. The storage module 14 can be implemented as a memory, wherein the memory should be a non-transitory memory.

若处理模块21实现为处理器、存储模块14实现为存储器，则如图6所示，隐性标识符的获取装置30包括：处理器31、存储器32，以及总线33。其中，处理器31、存储器32通过总线33相互连接；总线33可以是PCI总线或EISA总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图6中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。If the processing module 21 is implemented as a processor and the storage module 14 is implemented as a memory, then as shown in FIG. Wherein, the processor 31 and the memory 32 are connected to each other through a bus 33; the bus 33 may be a PCI bus or an EISA bus or the like. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 6 , but it does not mean that there is only one bus or one type of bus.

结合本发明公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM、闪存、ROM、EPROM、EEPROM、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以部署在同一设备中，或者，处理器和存储介质也可以作为分立组件部署在于不同的设备中。The steps of the methods or algorithms described in conjunction with the disclosure of the present invention may be implemented in the form of hardware, or may be implemented in the form of a processor executing software instructions. The software instructions may consist of corresponding software modules, and the software modules may be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable hard disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may be deployed in the same device, or the processor and the storage medium may also be deployed in different devices as separate components.

本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明实施例所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。Those skilled in the art should be aware that, in the above one or more examples, the functions described in the embodiments of the present invention may be implemented by hardware, software, firmware or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.

以上所述的具体实施方式，对本发明实施例的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明实施例的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明实施例的保护范围之内。The specific implementation manners described above have further described the purpose, technical solutions and beneficial effects of the embodiments of the present invention in detail. It should be understood that the above descriptions are only specific implementation modes of the present invention and are not intended to limit this In the protection scope of the invention, any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of the present invention shall be included in the protection scope of the embodiments of the present invention.

1. A method for acquiring an implicit identifier, the method comprising:

intercepting an operation instruction of an application program for accessing a recessive identifier;

determining the access condition of the application program after the application program is started according to the operation instruction, and determining whether the application program has a trend of maliciously accessing the recessive identifier or not according to the access condition;

and after determining that the application program has a trend of maliciously accessing the covert identifier according to the access condition, feeding fake information or blank information back to the application program, or prompting a user to decide whether to allow the application program to access the covert identifier.

2. The method of claim 1, wherein the access condition comprises at least one of a first number and a second number, the first number being a number of the application access covert identifiers, and the second number being a number of the application access covert identifier categories.

3. The method according to claim 2, characterized in that the correlation between two covert identifiers belonging to the same category is greater than the correlation between each of said two covert identifiers and any one covert identifier of the other category; the division for dividing the recessive identifier category includes at least one of a source, a generation time, and a usage manner of the recessive identifier, and the recessive identifier category includes at least one of a user interface UI setting and a user habit.

4. A method according to claim 2 or 3, wherein the access condition comprises the first number; the trend of determining whether the application program has a malicious access recessive identifier according to the access condition comprises the following steps:

when one or more malicious access judgment conditions are met, determining that the application program has a trend of a malicious access recessive identifier, and when the one or more malicious access judgment conditions are not met, determining that the application program does not have the trend of the malicious access recessive identifier;

wherein,

the satisfying of the one or more malicious access determination conditions includes: the first number is greater than a first threshold; the unsatisfied malicious access judgment condition comprises: the first number is less than or equal to the first threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the ratio of the first number to a first total number is greater than a second threshold, wherein the first total number is the total number of the recessive identifiers; the unsatisfied malicious access judgment condition comprises: the ratio of the first number to the first total number is less than or equal to a second threshold;

or, the meeting of one or more malicious access judgment conditions includes: the first number is greater than a third threshold, and a ratio of the first number to the first total number is greater than a fourth threshold; the unsatisfied malicious access judgment condition comprises: the first number is less than or equal to the third threshold, and a ratio of the first number to the first total number is less than or equal to the fourth threshold.

5. The method of claim 4, wherein the access condition comprises a weight for each covert identifier;

the satisfying of the one or more malicious access determination conditions includes: first parameterGreater than a fifth threshold value, where x_iA weight for representing an implicit identifier i, n being for representing the first number, both i, n being integers greater than or equal to 1; the unsatisfied malicious access judgment condition comprises: the first parameterLess than or equal to the fifth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: first ratioGreater than a sixth threshold, where m is used to represent the first total number, m is an integer greater than or equal to 1, and n is less than or equal to m; the unsatisfied malicious access judgment condition comprises: the first mentionedA ratio ofLess than or equal to the sixth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the first parameterGreater than a seventh threshold value, and the first ratioGreater than an eighth threshold; the unsatisfied malicious access judgment condition comprises: the first parameterLess than or equal to a seventh threshold value, and the first ratioLess than or equal to an eighth threshold.

6. A method according to claim 2 or 3, wherein the access situation comprises the second number; the trend of determining whether the application program has a malicious access recessive identifier according to the access condition comprises the following steps:

when one or more malicious access judgment conditions are met, determining that the application program has a trend of a malicious access recessive identifier, and when the one or more malicious access judgment conditions are not met, determining that the application program does not have the trend of the malicious access recessive identifier;

wherein,

the satisfying of the one or more malicious access determination conditions includes: the second number is greater than a ninth threshold; the unsatisfied malicious access judgment condition comprises: the second number is less than or equal to the ninth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: a ratio of the second number to the second total number is greater than a tenth threshold; the unsatisfied malicious access judgment condition comprises: the ratio of the second number to the second total number is less than or equal to the tenth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the second number is greater than an eleventh threshold and a ratio of the second number to the second total number is greater than a twelfth threshold; the unsatisfied malicious access judgment condition comprises: the second number is less than or equal to the eleventh threshold, and a ratio of the second number to the second total number is less than or equal to the twelfth threshold.

7. The method of claim 6, wherein the access profile includes a weight for each implicit identifier category;

the satisfying of the one or more malicious access determination conditions includes: second parameterGreater than a thirteenth threshold value, wherein y_jA weight for representing a recessive identifier category j, q for representing said second number, j, q both being integers greater than or equal to 1; the unsatisfied malicious access judgment condition comprises: the second parameterLess than or equal to the thirteenth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: second ratioGreater than a fourteenth threshold, where p is used to represent the first total number, p is an integer greater than or equal to 1, and q is less than or equal to p; the dissatisfaction with aversionThe intentional access judgment condition includes: the second ratioLess than or equal to the fourteenth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the second parameterGreater than a fifteenth threshold, and the second ratioGreater than a sixteenth threshold; the unsatisfied malicious access judgment condition comprises: the second parameterLess than or equal to the fifteenth threshold, and the second ratioLess than or equal to the sixteen thresholds.

8. The method of any of claims 1-7, wherein prior to the prompting the user to decide whether to allow the application to access an implicit identifier, the method further comprises:

recording the operation instruction;

the prompting the user to decide whether to allow the application program to access the recessive identifier specifically includes:

and prompting a user to decide whether to allow the application program to access the recessive identifier after a specified condition is met, wherein the specified condition at least comprises one of the condition that the number of the operation instructions is greater than a seventeenth threshold value and the condition that the time for intercepting the operation instructions exceeds a preset time range.

9. The method of any one of claims 1 to 8, wherein the fake information comprises at least one of a randomly generated false covert identifier or a preset false covert identifier.

10. The method according to any one of claims 1 to 9, wherein the recessive identifier comprises at least one of an identifier without access right set and an identifier with access right set but without notifying the terminal of the user during the authentication of the application.

11. An apparatus for obtaining an implicit identifier, the apparatus comprising:

the acquisition module is used for intercepting an operation instruction of the application program for accessing the recessive identifier;

the determining module is used for determining the access condition of the application program after the application program is started according to the operation instruction intercepted by the acquiring module, and determining whether the application program has a trend of malicious access to the recessive identifier according to the access condition;

and the sending module is used for feeding back fake information or blank information to the application program or prompting a user to decide whether to allow the application program to access the recessive identifier or not after the determining module determines that the application program has the trend of malicious access to the recessive identifier according to the access condition intercepted by the acquisition module.

12. The apparatus of claim 11, wherein the access condition comprises at least one of a first number and a second number, the first number being a number of the application access covert identifiers, and the second number being a number of the application access covert identifier categories.

13. The apparatus of claim 12, wherein a correlation between two covert identifiers belonging to the same category is greater than a correlation between each of the two covert identifiers and any one of the other categories; the division for dividing the recessive identifier category includes at least one of a source, a generation time, and a usage manner of the recessive identifier, and the recessive identifier category includes at least one of a user interface UI setting and a user habit.

14. The apparatus of claim 12 or 13, wherein the access condition comprises the first number; the determining module is further configured to:

when one or more malicious access judgment conditions are met, determining that the application program has a trend of a malicious access recessive identifier, and when the one or more malicious access judgment conditions are not met, determining that the application program does not have the trend of the malicious access recessive identifier;

wherein,

the satisfying of the one or more malicious access determination conditions includes: the first number is greater than a first threshold; the unsatisfied malicious access judgment condition comprises: the first number is less than or equal to the first threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the ratio of the first number to a first total number is greater than a second threshold, wherein the first total number is the total number of the recessive identifiers; the unsatisfied malicious access judgment condition comprises: the ratio of the first number to the first total number is less than or equal to a second threshold;

or, the meeting of one or more malicious access judgment conditions includes: the first number is greater than a third threshold, and a ratio of the first number to the first total number is greater than a fourth threshold; the unsatisfied malicious access judgment condition comprises: the first number is less than or equal to the third threshold, and a ratio of the first number to the first total number is less than or equal to the fourth threshold.

15. The apparatus of claim 14, wherein the access condition comprises a weight for each covert identifier;

the satisfying of the one or more malicious access determination conditions includes: first parameterGreater than a fifth threshold value, where x_iA weight for representing an implicit identifier i, n being for representing the first number, both i, n being integers greater than or equal to 1; the unsatisfied malicious access judgment condition comprises: the first parameterLess than or equal to the fifth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: first ratioGreater than a sixth threshold, where m is used to represent the first total number, m is an integer greater than or equal to 1, and n is less than or equal to m; the unsatisfied malicious access judgment condition comprises: the first ratioLess than or equal to the sixth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the first parameterGreater than a seventh threshold value, and the first ratioGreater than an eighth threshold; the unsatisfied malicious access judgment condition comprises: the first parameterLess than or equal to a seventh threshold value, and the first ratioLess than or equal to an eighth threshold.

16. The apparatus of claim 12 or 13, wherein the access condition comprises the second number; the determining module is further configured to:

when one or more malicious access judgment conditions are met, determining that the application program has a trend of a malicious access recessive identifier, and when the one or more malicious access judgment conditions are not met, determining that the application program does not have the trend of the malicious access recessive identifier;

wherein,

the satisfying of the one or more malicious access determination conditions includes: the second number is greater than a ninth threshold; the unsatisfied malicious access judgment condition comprises: the second number is less than or equal to the ninth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: a ratio of the second number to the second total number is greater than a tenth threshold; the unsatisfied malicious access judgment condition comprises: the ratio of the second number to the second total number is less than or equal to the tenth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the second number is greater than an eleventh threshold and a ratio of the second number to the second total number is greater than a twelfth threshold; the unsatisfied malicious access judgment condition comprises: the second number is less than or equal to the eleventh threshold, and a ratio of the second number to the second total number is less than or equal to the twelfth threshold.

17. The apparatus of claim 16, wherein the access profile comprises a weight for each implicit identifier category;

the satisfying of the one or more malicious access determination conditions includes: second parameterGreater than a thirteenth threshold value, wherein y_jA weight for representing a recessive identifier category j, q for representing said second number, j, q both being integers greater than or equal to 1; the unsatisfied malicious access judgment condition comprises: the second parameterLess than or equal to the thirteenth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: second ratioGreater than a fourteenth threshold, where p is used to represent the first total number, p is an integer greater than or equal to 1, and q is less than or equal to p; the unsatisfied malicious access judgment condition comprises: the second ratioLess than or equal to the fourteenth threshold;

or,

the satisfying of the one or more malicious access determination conditions includes: the second parameterGreater than a fifteenth threshold, and the second ratioGreater than a sixteenth threshold; the unsatisfied malicious access judgment condition comprises: the second parameterLess than or equal to the fifteenth threshold, and the second ratioLess than or equal to the sixteen thresholds.

18. The apparatus of any one of claims 11 to 17, further comprising:

the storage module is used for recording the operation instruction;

the sending module is further configured to:

and prompting a user to decide whether to allow the application program to access the recessive identifier after a specified condition is met, wherein the specified condition at least comprises one of the condition that the number of the operation instructions is greater than a seventeenth threshold value and the condition that the time for intercepting the operation instructions exceeds a preset time range.

19. The apparatus of any of claims 11 to 18, wherein the fake information comprises at least one of a randomly generated false covert identifier or a preset false covert identifier.

20. The apparatus according to any one of claims 11 to 19, wherein the recessive identifier comprises at least one of an identifier in which no access right is set and an identifier in which an access right is set but the terminal does not need to be notified of the presentation to the user during the authentication of the application.

• 2017
  • 2017-04-28 CN CN201710297568.8A patent/CN108804911B/en active Active

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4