WO2013075458A1 - 一种管理资费安全的方法及移动终端 - Google Patents

一种管理资费安全的方法及移动终端 Download PDF

Info

Publication number
WO2013075458A1
WO2013075458A1 PCT/CN2012/074554 CN2012074554W WO2013075458A1 WO 2013075458 A1 WO2013075458 A1 WO 2013075458A1 CN 2012074554 W CN2012074554 W CN 2012074554W WO 2013075458 A1 WO2013075458 A1 WO 2013075458A1
Authority
WO
WIPO (PCT)
Prior art keywords
application software
payment function
permission
policy
tariff
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2012/074554
Other languages
English (en)
French (fr)
Inventor
雷明剑
王巍
徐立锋
古幼鹏
钟声
胡炜
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to EP12852113.5A priority Critical patent/EP2744244A4/en
Priority to US14/350,619 priority patent/US20140258128A1/en
Publication of WO2013075458A1 publication Critical patent/WO2013075458A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/405—Establishing or using transaction specific rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/14—Charging, metering or billing arrangements specially adapted for data communications, e.g. authentication, authorisation and accounting [AAA] framework
    • H04L12/1453—Methods or systems for payment or settlement of the charges for data transmission involving significant interaction with the data transmission network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/43—Billing software details
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/47—Fraud detection or prevention means
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/48—Secure or trusted billing, e.g. trusted elements or encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/24—Accounting or billing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/70—Administration or customization aspects; Counter-checking correct charges
    • H04M15/73—Validating charges

Definitions

  • the present invention relates to a rights control technology in a mobile terminal, and in particular, to a method for managing tariff security and a mobile terminal. Background technique
  • Mobile terminals such as mobile phones have entered the era of intelligence, and a variety of application software can be installed and run on mobile phones to enhance the convenience of mobile phone users.
  • the number of malicious applications that are maliciously deducted from the virus code is increasing in the application software installed on the mobile phone.
  • These malicious applications run through the covert in the background, call the payment function that can generate the mobile phone fee consumption, and use the user's mobile phone fee if the user does not notice it in time; for example, these malicious application software can automatically send the business customized short message to the background.
  • An illegal supplier SP, Service Provider
  • a background silently dialing the number of an illegal SP will cause the mobile phone tariff to be deducted without the user's awareness.
  • an object of the present invention is to provide a method for managing tariff security and a mobile terminal, which can control the malicious application in the mobile terminal to use the right of the payment function in the mobile terminal, thereby avoiding the loss of the mobile user fee.
  • the present invention provides a method of managing tariff security, the method comprising: Generating a tariff security control policy according to a configuration file of a preset tariff security control policy; and detecting a payment function defined in the tariff security control policy when using the application software, the usage control policy according to the permission function of the payment function used in the tariff security control policy Control the permissions of the paid features used by the application.
  • the method before the detecting that the application software uses the payment function defined in the tariff security control policy, the method further includes: determining, in real time, whether the currently accessed application software uses the payment function, and if yes, detecting the payment used by the application software. Whether the permission corresponding to the function matches the tariff security control policy; otherwise, it continues to determine whether the currently accessed application software uses the payment function.
  • whether the permission corresponding to the payment function used by the application software is consistent with the tariff security control policy includes: viewing the payment function permission control list under the corresponding trust level in the tariff security control policy according to the trust level of the application software; Determining whether the payment function used by the application software is the same as the payment function to be controlled in the payment function permission control list, and if there is the same item, detecting that the application software uses the payment function defined in the tariff security control policy; Item allows the application to use the payment function.
  • the method before the viewing of the payment function permission control list in the tariff security control policy corresponding to the trust level, the method further includes: determining to install the new application software, decompressing the installation package of the new application software, and extracting the new The signature information of the application software is used to authenticate the signature information of the application software, and the trust level of the application software is determined according to the authentication result; and the trust level is saved in the attribute configuration file corresponding to the application software.
  • the method before the controlling the right to use the payment function to be used by the application software according to the permission use control policy of the payment function in the tariff security control policy, the method further includes: determining the payment for the application software Whether the function has a corresponding permission use control policy, and if so, the control policy is used according to the permission to control the permission of the payment function to be used by the application software; if not, the permission use control policy for the payment function Enter Line settings and save.
  • the present invention also provides a mobile terminal, where the mobile terminal includes: a rights usage policy module and a rights usage control module;
  • the permission use policy module is configured to generate a tariff security control policy according to a preset profile of the tariff security control policy, and provide a tariff security control policy for the rights usage control module; and a permission usage control module, configured to detect the use of the application software
  • the permission usage control policy of the payment function described in the tariff security control policy controls the authority of the payment function to be used by the application software.
  • the mobile terminal further includes:
  • the application processing module is configured to determine in real time whether the currently accessed application software uses the payment function, and if yes, send the name of the payment function used by the application software to the permission use control module; otherwise, continue to determine whether the currently accessed application software uses the paid function.
  • the permission use control module is specifically configured to receive a name of a payment function used by the application software sent by the application processing module, and detect whether the payment function is consistent with a tariff security control policy.
  • the permission use control module is specifically configured to view, according to the trust level of the application software, a payment function permission control list under a corresponding trust level in the tariff security control policy in the permission use policy module; determining the use of the application software Whether the payment function is the same as the payment function to be controlled in the payment function permission control list. If there is the same item, it detects that the application software uses the payment function defined in the tariff security control policy; if there is no identical item, the application processing module is notified. Allowing the application to use the payment function;
  • the application processing module is further configured to: receive the permission application software sent by the permission usage control module to use the payment function;
  • the permission usage policy module is specifically used to provide a fee for the permission use control module. Full control strategy.
  • the mobile terminal further includes: an application trust level authentication module, configured to receive an installation package of a new application software sent by the application processing module, decompress a new application software installation package, and extract a new application software. Signature information; use the signature information of the application software for authentication, determine the trust level of the application software according to the authentication result; and then save the trust level in the attribute configuration file corresponding to the application software;
  • an application trust level authentication module configured to receive an installation package of a new application software sent by the application processing module, decompress a new application software installation package, and extract a new application software.
  • Signature information use the signature information of the application software for authentication, determine the trust level of the application software according to the authentication result; and then save the trust level in the attribute configuration file corresponding to the application software
  • the application processing module is further configured to: when the installation of the new application software is performed, send the installation package of the new application software to the application trust level authentication module.
  • the privilege use control module is specifically configured to determine whether there is a corresponding privilege use control policy for the payment function used by the application software, and if yes, use the control policy according to the privilege to use the application software.
  • the permission of the payment function is controlled; if not, the permission usage control policy of the payment function is set, and the permission use control policy of the payment function is saved to the permission use policy module;
  • the privilege usage policy module is specifically configured to receive the privilege usage control policy sent by the privilege usage control module, and save the privilege usage control policy to the corresponding payment function item in the payment function privilege control list.
  • the method for managing tariff security and the mobile terminal provided by the present invention, by setting a tariff security control policy for application software of different trust levels, focusing on detecting the use of some payment functions that the user cares about; using the application software to the mobile terminal
  • the control policy is used according to the specific permission of the payment function; thus, the application software on the mobile terminal can be classified and controlled according to the trust level of the application.
  • the tariff security control policy can be modified or deleted according to the actual situation, so that the usage rights of the payment function can be flexibly controlled.
  • FIG. 1 is a schematic flow chart of a method for managing tariff security according to the present invention
  • FIG. 2 is a schematic structural diagram of a mobile terminal according to the present invention. detailed description
  • the mobile terminal generates a tariff security control policy according to the configuration file of the preset tariff security control policy; and when the mobile terminal detects the payment function defined in the application security control policy, the mobile terminal is based on the tariff security.
  • the permissions that control the features used in the policy use the control policy to control the permissions of the paid features used by the application.
  • the tariff security control policy is a specific payment function of the required control corresponding to the payment function recorded by the mobile terminal, and a permission usage control policy of the payment function;
  • the permission use control policy is: a permission control method for using any one of the payment security control policies, which may include: always allowing, always rejecting, or asking each time.
  • the following is an example in which the mobile terminal is a mobile phone.
  • the method for managing the security of the present invention is as shown in FIG. 1 and includes the following steps:
  • Step 101 Preset the configuration file of the tariff security control policy in the mobile phone.
  • the configuration file of the tariff security control policy writes the usage authority of the function to be controlled, and may include the type of the permission, the trust level, the name of the permission group, and the payment function to be controlled under the permission group,
  • the format can be in the Extensible Markup Language (XML) format
  • Step 102 After the mobile phone is started, the tariff security control policy is generated according to the configuration file of the tariff security control policy.
  • step 103 After the mobile phone is started, check whether there is a configuration file of the new tariff security control policy from the specified directory, if not, directly execute step 103;
  • step 103 If yes, read the configuration file of the tariff security control policy, and extract the trust level, the permission group name, and the specific control function under the permission group from the configuration file of the tariff security control policy; And the specific control function under the permission group is added to the payment function permission control list; finally, the payment function permission control list is saved in the phone memory to form a tariff security control policy, and then step 103 is performed.
  • the specified directory is: a file directory of a configuration file that stores a tariff security control policy, for example, the specified directory may be a root directory of a mobile phone memory card.
  • Step 103 Real-timely determine whether the currently used application software uses any one of the mobile phones. The fee function, if yes, step 104 is performed; otherwise, step 103 is repeated.
  • the mobile phone monitors the running process of the application software in real time, and determines whether the calling information of any one of the payment functions is issued during the running of the application software, so that it can determine whether the currently used application software uses any one of the mobile phones.
  • the payment function if issued, perform step 104, and extract the payment function to be used in the call information of the payment function; if not, repeat step 103;
  • the calling information for any one of the payment functions includes: a payment function to be called; a method for generating the call information is prior art, and no praise is made here.
  • Step 104 Detect whether the right corresponding to the payment function used by the application software matches any one of the tariff security control policies. If yes, execute step 105; otherwise, allow the application software to use the payment function to end the processing flow.
  • the step is specifically: the mobile phone checks the payment function permission control list under the corresponding trust level in the tariff security control policy according to the trust level of the application software; determines whether the payment function used by the application software and any one of the payment function permission control list needs to be controlled.
  • the payment function is the same, if there is the same item, step 105 is performed; if not, the application software is allowed to use the payment function, and the access application software is subsequently processed according to the prior art;
  • the mobile phone determines that the currently used application software uses the Internet access function
  • the mobile phone checks the payment function permission control list under the corresponding trust level in the tariff security control policy according to the trust level of the application software; when the application software trust level is untrusted If the Internet access function entry is recorded in the payment function permission control list corresponding to the untrustable level, step 105 is performed; when the application software trust level is trusted, if the corresponding trusted level is in the payment function permission control list If the Internet access function item is recorded, go to step 105.
  • Step 105 The mobile phone determines whether there is a corresponding authority for the payment function used by the application software, and uses the control policy. If yes, step 106 is performed; if not, step 107 is performed.
  • Step 106 The mobile phone uses the control policy according to the permission, and the payment to be used by the application software is used. The authority of the function is controlled, and the processing flow is ended.
  • control is: viewing the specific setting in the permission use control policy, when the specific setting is always allowed, the application software is allowed to use the payment function, and then the application software is followed according to the prior art; In the case of always rejecting, the application software is refused to use the payment function, and then the application software is subsequently operated according to the prior art; when specifically set to each inquiry, a selection box pops up for the user, and the user selects whether to allow the application to use the software.
  • the payment function allows or denies the application software to use the payment function according to the user's selection, and then performs subsequent operations on the application software according to the prior art.
  • Step 107 The mobile phone sets the permission usage control policy of the payment function.
  • the step is specifically as follows: the mobile phone pops up a prompt dialog box for the user, reminding the user that the permission for the paid function is always allowed, always refused, or set each time, and the current application processing flow is suspended; The permission setting is saved as the permission usage control policy, added in the corresponding payment function item in the tariff security control policy, and the current application is subsequently processed according to the set authority usage control policy.
  • the specific authentication process includes the following steps:
  • Step a The mobile phone determines in real time whether the operation selected by the user is to install any new application software or use any application software. If any new application software is installed, step b is performed; if any application software is accessed, the steps are executed. 103.
  • Step b The mobile phone decompresses the installation package of the new application software, and extracts the signature information of the new application software.
  • the installation package of the decompressed new application software is prior art, and no comment is made here; the new application is extracted.
  • the signature information of the software is: After extracting the installation package of the new application software, extracting the signature information therein;
  • the signature information is: using a special tool to write the signature information into the application software.
  • the specific fields are divided into three types: Saipan
  • Step c The mobile phone first uses the signature information of the application software to perform authentication, and determines the trust level of the application software according to the authentication result; then saves the trust level in the attribute configuration file corresponding to the application software, and continues to install the application software according to the prior art, and returns step&.
  • the performing the authentication by using the signature information of the application software includes: matching the signature information of the application software with the signature information of the plurality of certificates preset in the mobile phone, if the signature information of the application is the same as the signature information of any one of the certificates. , the authentication result is passed; otherwise the authentication result is not passed;
  • Determining the trust level of the application software according to the authentication result includes: setting the trust level of the application software according to the specific signature information when the authentication result is passed; setting the application software as untrustable when the authentication result is not passed Level
  • the trust level includes two categories, namely, an untrustworthy level and a trusted level.
  • the trusted level of the application is set according to the specific signature information: the mobile phone manufacturer customizes the preset certificate according to actual needs.
  • Signature information, the trust level corresponding to different signature information may include: "vendor trust level”, “operator trust level”, “third-party partner trust level”, and the like.
  • the tariff security control policy may be modified or deleted according to actual conditions, specifically: when any one of the tariff security control policies needs to be modified or deleted, the configuration file of the original tariff security control policy is found. , make specific modifications in the configuration file, and then perform step 102.
  • the present invention further provides a mobile terminal.
  • the mobile terminal includes: a rights usage policy module 21 and a rights usage control module 22;
  • the privilege usage policy module 21 is configured to generate a tariff security control policy according to the configuration file of the preset tariff security control policy, and provide tariff security control for the privilege usage control module 22.
  • the permission use control module 22 is configured to use the control policy to apply according to the permission of the payment function in the tariff security control policy when detecting the payment function defined by the tariff security control policy in the application software usage right policy module 21
  • the software is controlled by the permissions of the paid features.
  • the permission usage policy module 21 is specifically configured to save a configuration file of the preset tariff security control policy; when the mobile terminal is powered on, generate a system connection permission control policy according to the configuration file of the tariff security control policy.
  • the permission usage policy module 21 is specifically configured to check whether there is a configuration file of a new tariff security control policy from a specified directory, and if not, end the processing flow; if yes, read the configuration file of the tariff security control policy, From the configuration file of the tariff security control policy, extract the trust function, the permission group name, and the specific control payment function under the permission group; add the payment function to the payment function by using the trust level as the identifier, the permission group name, and the specific control group under the permission group. In the permission control list; finally save the payment function permission control list to form the tariff security control strategy.
  • the mobile terminal further includes: an application processing module 23, configured to determine in real time whether the currently accessed application software uses any one of the payment functions, and if yes, send the name of the payment function used by the application software to the rights usage control module 22; Otherwise, it is determined whether the currently accessed application software uses any of the payment functions; correspondingly, the permission usage control module 22 is specifically configured to receive the name of the payment function used by the application software sent by the application processing module 23, and detect Whether the payment function matches any of the tariff security control policies.
  • an application processing module 23 configured to determine in real time whether the currently accessed application software uses any one of the payment functions, and if yes, send the name of the payment function used by the application software to the rights usage control module 22; Otherwise, it is determined whether the currently accessed application software uses any of the payment functions; correspondingly, the permission usage control module 22 is specifically configured to receive the name of the payment function used by the application software sent by the application processing module 23, and detect Whether the payment function matches any of the tariff security control policies.
  • the application processing module 23 is specifically configured to monitor the running process of the application software in real time, determine whether the calling information of any one of the payment functions is issued during the running of the application software, to determine whether the currently used application software uses any one of the applications.
  • the item payment function if yes, sends the name of the payment function used by the application software to the rights usage control module 22; otherwise, it continues to determine whether the currently accessed application software uses any of the payment functions.
  • the privilege usage control module 22 is configured to check whether the payment function is consistent with any one of the tariff security control policies, and view the corresponding trust level in the tariff security control policy of the privilege usage policy module 21 according to the trust level of the application software.
  • the payment function permission control list under the payment function determining whether the payment function used by the application software is the same as the payment function to be controlled by any one of the payment function permission control lists, and if there is the same item, determining whether the payment function used by the application software has The corresponding authority uses the control policy; if there is no identical item, the notification application processing module 23 allows the application software to use the payment function;
  • the application processing module 23 is further configured to receive the permission application software sent by the permission usage control module 22 to use the payment function, and then perform subsequent processing on the access application software according to the prior art.
  • the privilege use control module 22 is specifically configured to use the privilege control policy in the tariff security control policy of the policy module 21 according to the privilege to use the control policy when the privilege corresponding to the payment function used by the application software is used.
  • the permission of the payment function to be used by the software is controlled, and the operation flow is ended; if not, the permission use control policy of the payment function is set, and the permission use control policy of the payment function is saved to the authority use policy module 21;
  • the privilege usage policy module 21 is specifically configured to receive the privilege usage control policy sent by the privilege usage control module 22, and save the privilege usage control policy to the corresponding payment function item in the payment function privilege control list.
  • the privilege usage control module 22 is specifically configured to view specific settings in the privilege usage control policy.
  • the specific setting is always allowed, the application software is allowed to use the payment function, and then the application software is subsequently operated according to the prior art.
  • the specific setting is always rejected, the application software is refused to use the payment function, and then the application software is followed by the prior art;
  • the specific setting is for each inquiry, the user pops up a selection box, and the user selects whether Allow the application to use the paid feature, and then allow or deny the application to use the paid work according to the user's choice Yes, and then follow up the application according to the prior art.
  • the privilege use control module 22 is further configured to remind the user to set the privilege usage control policy of the payment function, and pause the processing flow of the current application; and receive the user's privilege usage control policy for the function, and The authority of the application to be used by the application is controlled according to the rights set by the user.
  • the mobile terminal further includes: an application trust level authentication module 24, configured to receive an installation package of the application software sent by the application processing module 23; correspondingly, the application processing module 23 is further configured to determine, in real time, that the operation selected by the user is Install any new application software or access any application software. If any new application software is installed, the installation package of the application software is sent to the application trust level authentication module 24, and if any application software is accessed, it is determined. Whether the currently accessed application uses any of the paid features.
  • an application trust level authentication module 24 configured to receive an installation package of the application software sent by the application processing module 23; correspondingly, the application processing module 23 is further configured to determine, in real time, that the operation selected by the user is Install any new application software or access any application software. If any new application software is installed, the installation package of the application software is sent to the application trust level authentication module 24, and if any application software is accessed, it is determined. Whether the currently accessed application uses any of the paid features.
  • the application trust level authentication module 24 is further configured to decompress the installation package of the new application software, extract signature information of the new application software, authenticate the application by using the signature information of the application software, and determine the trust level of the application software according to the authentication result. Then, the trust level is saved in the attribute configuration file corresponding to the application software, and the installation package of the decompressed application software and the attribute configuration file of the application software are sent back to the application processing module 23; correspondingly, the application processing module 23
  • the utility model is further configured to receive an installation package of the decompressed application software sent by the application trust level authentication module 24 and an attribute configuration file of the application software, and then continue to install the application software according to the prior art on the decompressed application software.
  • the application trust level authentication module 24 is specifically configured to match signature information of the application software with signature information of multiple certificates preset in the module. If the signature information of the application is the same as the signature information of any one of the certificates, The authentication result is passed; otherwise, the authentication result is not passed.
  • the application trust level authentication module 24 is specifically configured to: when the authentication result is passed, set the trusted level of the application software according to the specific signature information; when the authentication result is not passed, Then set the application to an untrustworthy level.
  • the use of the payment function by the application of the mobile terminal can be classified and controlled according to the trust level of the application, and the payment function of the mobile terminal can be effectively prevented from being used by the malware, thereby ensuring the information data of the mobile terminal user. safety.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Accounting & Taxation (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Finance (AREA)
  • Software Systems (AREA)
  • Economics (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Development Economics (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种管理资费安全的方法，包括：根据预置的资费安全控制策略的配置文件，生成资费安全控制策略；检测到应用软件使用到资费安全控制策略中所限定的付费功能时，根据资费安全控制策略中所使用付费功能的权限使用控制策略对应用软件所使用付费功能的权限进行控制。本发明还同时公开了一种移动终端，采用本发明能对移动终端中的恶意应用软件使用移动终端中付费功能的权限进行控制，进而避免移动终端资费上的损失。

Description

一种管理资费安全的方法及移动终端 技术领域
本发明涉及移动终端中的权限控制技术， 尤其涉及一种管理资费安全 的方法及移动终端。 背景技术
移动终端如手机已进入智能时代， 可以在手机上安装运行多种应用软 件， 以提升手机用户的使用便利性。
目前， 手机上安装运行的应用软件中， 植入恶意扣费病毒代码的恶意 应用软件数量越来越多。 这些恶意应用软件通过隐蔽在后台运行， 调用能 够产生手机资费消费的付费功能， 在用户不及时察觉的情况下， 使用用户 的手机资费； 比如， 这些恶意应用软件可以在后台自动发送业务定制短信 到非法供应商 （SP, Service Provider ) , 或者是后台静默拨打非法 SP的号 码， 如此， 将会导致手机资费在用户没有察觉的情况下被扣除。
可见， 由于目前没有对手机中的恶意应用软件使用手机中会扣除资费 的付费功能的权限进行控制， 导致手机资费在用户没有察觉的情况下被扣 除， 从而给用户造成手机资费上的损失。 发明内容
有鉴于此， 本发明的目的在于提供一种管理资费安全的方法及移动终 端， 能对移动终端中的恶意应用软件使用移动终端中付费功能的权限进行 控制， 进而避免移动用户资费的损失。
为达到上述目的， 本发明的技术方案是这样实现的：
本发明提供了一种管理资费安全的方法， 该方法包括： 根据预置的资费安全控制策略的配置文件， 生成资费安全控制策略； 检测到应用软件使用资费安全控制策略中所限定的付费功能时， 根据 资费安全控制策略中所使用付费功能的权限使用控制策略对应用软件所使 用付费功能的权限进行控制。
上述方案中， 所述检测到应用软件使用资费安全控制策略中所限定的 付费功能之前， 该方法还包括： 实时判断当前访问的应用软件是否使用到 付费功能， 若是， 则检测应用软件使用的付费功能对应的权限是否与资费 安全控制策略相符； 否则， 继续判断当前访问的应用软件是否使用到付费 功能。
上述方案中， 所述检测应用软件使用的付费功能对应的权限是否与资 费安全控制策略相符， 包括： 根据应用软件的信任级别， 查看资费安全控 制策略中对应信任级别下的付费功能权限控制列表； 判断所述应用软件使 用的付费功能是否与付费功能权限控制列表中需要控制的付费功能相同， 若有相同项， 则检测到应用软件使用到资费安全控制策略中所限定的付费 功能； 若没有相同项， 则允许应用软件使用所述付费功能。
上述方案中， 所述查看资费安全控制策略中对应信任级别下的付费功 能权限控制列表之前， 该方法还包括： 确定进行新应用软件的安装时， 解 压新的应用软件的安装包， 提取新的应用软件的签名信息； 利用应用软件 的签名信息进行认证， 根据认证结果确定应用软件的信任级别； 再将信任 级别保存在与应用软件对应的属性配置文件中。
上述方案中， 所述根据资费安全控制策略中的所述付费功能的权限使 用控制策略对应用软件要使用到的付费功能的权限进行控制之前， 该方法 还包括： 判断对于应用软件所使用的付费功能是否有对应的权限使用控制 策略， 若有， 则根据所述权限使用控制策略， 对应用软件要使用到的付费 功能的权限进行控制； 若没有， 则对所述付费功能的权限使用控制策略进 行设定并保存。
本发明还提供了一种移动终端， 该移动终端包括： 权限使用策略模块 和权限使用控制模块； 其中，
权限使用策略模块，用于根据预置的资费安全控制策略的配置文件， 生成资费安全控制策略， 为权限使用控制模块提供资费安全控制策略； 权限使用控制模块， 用于在检测到有应用软件使用权限使用策略模 块中的系统连接权限控制策略中所限定的付费功能时， 根据资费安全控 制策略中所述付费功能的权限使用控制策略对应用软件要使用到的付费功 能的权限进行控制。
上述方案中， 所述移动终端， 进一步包括：
应用处理模块， 用于实时判断当前访问的应用软件是否使用到付费功 能， 若是， 则向权限使用控制模块发送应用软件使用的付费功能的名称； 否则， 继续判断当前访问的应用软件是否使用到付费功能；
相应的， 所述权限使用控制模块， 具体用于接收应用处理模块发来的 应用软件使用的付费功能的名称， 检测所述付费功能是否与资费安全控制 策略相符。
上述方案中， 所述权限使用控制模块， 具体用于根据应用软件的信任 级别 , 查看权限使用策略模块中资费安全控制策略中对应信任级别下的付 费功能权限控制列表； 判断所述应用软件使用的付费功能是否与付费功能 权限控制列表中需要控制的付费功能相同， 若有相同项， 则检测到应用软 件使用到资费安全控制策略中所限定的付费功能； 若没有相同项， 则通知 应用处理模块允许应用软件使用所述付费功能；
相应的， 所述应用处理模块， 还用于接收到权限使用控制模块发来的 允许应用软件使用所述付费功能；
所述权限使用策略模块， 具体用于为权限使用控制模块提供资费安 全控制策略。
上述方案中， 所述移动终端， 还包括： 应用信任等级认证模块， 用于 接收应用处理模块发来的新的应用软件的安装包， 解压新的应用软件的安 装包， 提取新的应用软件的签名信息； 利用应用软件的签名信息进行认证， 根据认证结果确定应用软件的信任级别； 再将信任级别保存在与应用软件 对应的属性配置文件中；
相应的， 所述应用处理模块， 还用于确定进行新应用软件的安装时， 将所述新的应用软件的安装包发送给应用信任等级认证模块。
上述方案中， 所述权限使用控制模块， 具体用于判断对于应用软件所 使用的付费功能是否有对应的权限使用控制策略， 若有， 则根据所述权限 使用控制策略， 对应用软件要使用到的付费功能的权限进行控制； 若没有， 则对所述付费功能的权限使用控制策略进行设定， 再将所述付费功能的权 限使用控制策略保存到权限使用策略模块中；
相应的， 所述权限使用策略模块， 具体用于接收权限使用控制模块发 来的权限使用控制策略， 并将所述权限使用控制策略保存到付费功能权限 控制列表中对应的付费功能项目中。
本发明所提供的管理资费安全的方法及移动终端， 通过针对不同信任 级别的应用软件设置资费安全控制策略， 对用户关心的一些付费功能的使 用进行重点检测； 在有应用软件使用到移动终端的资费安全控制策略中的 任意一项付费功能时 , 根据该项付费功能的具体的权限使用控制策略进行 处理； 如此， 就能根据应用的信任级别， 分类控制及管理移动终端上的应 用软件对付费功能的使用， 进而避免移动用户资费的损失。 另外， 还可以 根据实际情况对资费安全控制策略进行修改或删除， 从而可以灵活控制付 费功能的使用权限。 附图说明
图 1为本发明管理资费安全的方法流程示意图；
图 2为本发明移动终端的结构示意图。 具体实施方式
本发明的基本思想是： 移动终端根据预置的资费安全控制策略的配置 文件， 生成资费安全控制策略； 该移动终端检测到应用软件使用资费安全 控制策略中所限定的付费功能时， 根据资费安全控制策略中所使用功能的 权限使用控制策略对应用软件所使用的付费功能的权限进行控制。
其中， 所述资费安全控制策略为， 移动终端记录的在不同信任级别下、 付费功能中对应的所需控制的具体付费功能， 以及该付费功能的权限使用 控制策略；
所述权限使用控制策略为， 对使用资费安全控制策略中任意一项付费 功能的权限控制方式， 可以包括： 总是允许、 总是拒绝、 或每次询问。
下面结合附图及具体实施例对本发明再作进一步详细的说明。
以下以移动终端是手机为例， 本发明管理资费安全的方法如图 1所示， 包括以下步驟：
步驟 101 : 在手机中预置资费安全控制策略的配置文件。
这里， 所述资费安全控制策略的配置文件， 根据实际情况对所需控制 的功能的使用权限进行编写， 可以包括权限的类型、 信任等级、 权限组名 称、 权限组下需要控制的付费功能， 编写的格式可以为可扩展标记语言 ( XML, Extensible Markup Language )格式；
比如， 可以按如下格式编写资费安全控制策略的配置文件：
<?xml version- 1.0' encoding='utf-8' standalone='yes' ?>
<sysControlPermission>
<trustLevel name="unApproved"> <permissionGroup name=" cost— money" />
permission name=" SEND— SMS" />
permission name=" CALL— PHONE" />
permission name="ACCESS— INTERNET" />
< /permissionGroup >
</trustLevel >
</sysControlPermission>
其中， <sysControlPermission>表示权限的类型属于系统默认控制的权 限 , <trustLevel name="unApproved">表示信任等级为 不可信任 ( unApproved ), <permissionGroup name=" cost— money " /> 表示权限组名 称为付费类 ( cost— money ), <permission name:" SEND— SMS " />、 permission name=" CALL— PHONE" / <permission name=" ACCESS— INTERNET" /> 表示付费类权限组下所需控制的是发送短信 （ SEND— SMS )、 通话 ( CALL PHONE )和上网 （ ACCESS_ INTERNET ) 功能。
步驟 102: 手机启动后，根据资费安全控制策略的配置文件生成资费安 全控制策略。
具体的， 手机启动后， 从指定的目录查看是否有新的资费安全控制策 略的配置文件， 如果没有， 则直接执行步驟 103;
如果有， 则读取资费安全控制策略的配置文件， 从资费安全控制策略 的配置文件中， 提取信任等级、 权限组名称和权限组下具体控制的功能； 以信任级别为标识， 将权限组名称和权限组下具体控制的功能添加到付费 功能权限控制列表中； 最后将付费功能权限控制列表保存在手机内存中， 形成资费安全控制策略， 然后执行步驟 103。
这里， 所述指定的目录为： 保存资费安全控制策略的配置文件的文件 目录， 比如， 指定的目录可以为手机存储卡的根目录。
步驟 103 :实时判断当前使用的应用软件是否使用到手机中任意一项付 费功能， 若是， 则执行步驟 104; 否则， 重复执行步驟 103。
具体的， 手机实时监测应用软件的运行过程， 判断在应用软件的运行 过程中是否发出对任意一项付费功能的调用信息， 如此， 即可判断当前使 用的应用软件是否使用到手机中任意一项付费功能， 如果发出， 则执行步 驟 104, 并提取出该付费功能的调用信息中所要用到的付费功能； 如果没有 发出， 则重复执行步驟 103;
这里， 所述对任意一项付费功能的调用信息包括： 所要调用的付费功 能； 产生调用信息的方法为已有技术， 这里不做赞述。
步驟 104:检测应用软件使用的付费功能对应的权限是否与资费安全控 制策略中任意一项相符， 如果是， 则执行步驟 105; 否则， 允许应用软件使 用该付费功能， 结束处理流程。
本步驟具体为： 手机根据应用软件的信任级别， 查看资费安全控制策 略中对应信任级别下的付费功能权限控制列表； 判断该应用软件使用的付 费功能是否与付费功能权限控制列表中任意一个需要控制的付费功能相 同， 若有相同项， 则执行步驟 105; 若没有， 则允许应用软件使用该付费功 能， 按照已有技术对访问应用软件进行后续处理；
比如， 手机判断出当前使用的应用软件使用到上网功能， 则手机根据 应用软件的信任级别， 查看资费安全控制策略中对应信任级别下的付费功 能权限控制列表； 当应用软件的信任级别为不可信任时， 若不可信任级别 对应的付费功能权限控制列表中记录有上网功能项， 则执行步驟 105; 当应 用软件的信任级别为可信任时， 若对应的可信任级别中的付费功能权限控 制列表中记录有上网功能项， 则执行步驟 105。
步驟 105:手机判断对于应用软件所使用的付费功能是否有对应的权限 使用控制策略， 若有， 则执行步驟 106; 若没有， 则执行步驟 107。
步驟 106: 手机根据该权限使用控制策略，对应用软件要使用到的付费 功能的权限进行控制， 结束处理流程。
这里， 所述控制为： 查看权限使用控制策略中的具体设置， 当具体设 置为总是允许时， 则允许应用软件使用付费功能， 然后按照已有技术对该 应用软件做后续操作； 当具体设置为总是拒绝时， 则拒绝应用软件使用付 费功能， 然后按照已有技术对该应用软件做后续操作； 当具体设置为每次 询问， 则为用户弹出选择框， 由用户选择是否允许应用软件使用该付费功 能， 再根据用户的选择允许或拒绝应用软件使用该付费功能， 然后按照已 有技术对该应用软件做后续操作。
步驟 107: 手机设定该付费功能的权限使用控制策略。
本步驟具体为： 手机为用户弹出提示对话框， 提醒用户对该付费功能 的权限为总是允许、 总是拒绝或每次询问进行设定， 同时将当前应用的处 理流程暂停； 将用户对于该权限的设定保存为权限使用控制策略， 添加在 资费安全控制策略中对应的付费功能项中， 并且根据设定的权限使用控制 策略对当前应用进行后续处理。
另外， 上述步驟 103之前， 还需要对应用软件的信任级别进行认证， 具体认证的过程包括下述步驟：
步驟 a: 手机实时判断用户选择的操作为安装任意一个新应用软件、还 是使用任意一个应用软件 ,如果为安装任意一个新应用软件 ,则执行步驟 b; 如果为访问任意一个应用软件， 则执行步驟 103。
步驟 b: 手机解压新的应用软件的安装包，提取新的应用软件的签名信 这里， 所述解压新的应用软件的安装包为已有技术， 这里不做赞述； 所述提取新的应用软件的签名信息为： 解压新的应用软件的安装包后， 提取其中的签名信息；
其中， 所述签名信息为： 使用专用工具将签名信息写入应用软件的特 定字段， 表示该应用已经通过签署者的审核， 所述特定字段分三种： 塞班
( Symbian ) 收费证书签名、 作者使用公共免费证书签名和用户签名。
步驟 c: 手机先利用应用软件的签名信息进行认证， 根据认证结果确定 应用软件的信任级别； 再将信任级别保存在与应用软件对应的属性配置文 件中， 按照已有技术继续安装应用软件， 返回步驟&。
这里， 所述利用应用软件的签名信息进行认证包括： 将应用软件的签名 信息、 与预置在手机中的多个证书的签名信息进行匹配， 如果应用的签名 信息与任意一个证书的签名信息相同， 则认证结果为通过； 否则认证结果 为不通过；
所述根据认证结果确定应用软件的信任级别包括： 当认证结果为通过 时， 则根据具体的签名信息设置应用软件的可信任级别； 当认证结果为不 通过时， 则设置该应用软件为不可信任级别；
其中， 所述信任级别包括两大类， 分别为不可信任级别和可信任级别； 所述根据具体的签名信息设置应用的可信任级别为： 手机生产厂商按 照实际需要自定义预置的证书中的签名信息， 不同的签名信息对应的可信 任级别可以包括： "厂商信任级别"、 "运营商信任级别"、 "第三方合作厂商 信任级别"等。
另外， 上述步驟 102之前， 还可以根据实际情况修改或删除资费安全 控制策略， 具体为： 当需要修改或删除资费安全控制策略中的任意一项时， 查找到原始的资费安全控制策略的配置文件， 在该配置文件中作具体修改， 然后执行步驟 102。
本发明还提供了一种移动终端， 如图 2所示， 该移动终端包括： 权 限使用策略模块 21和权限使用控制模块 22; 其中，
权限使用策略模块 21 , 用于根据预置的资费安全控制策略的配置文 件， 生成资费安全控制策略， 为权限使用控制模块 22提供资费安全控制 策略；
权限使用控制模块 22 , 用于在检测到有应用软件使用权限使用策略 模块 21 中资费安全控制策略所限定的付费功能时， 根据资费安全控制策 略中的该付费功能的权限 , 使用控制策略对应用软件要使用到的付费功能 的权限进行控制。
所述权限使用策略模块 21 ,具体用于保存预置的资费安全控制策略的 配置文件； 当所在移动终端开机后， 根据资费安全控制策略的配置文件生 成系统连接权限控制策略。
所述权限使用策略模块 21 ,具体用于从指定的目录查看是否有新的资 费安全控制策略的配置文件， 如果没有， 则结束处理流程； 如果有， 则读 取资费安全控制策略的配置文件， 从资费安全控制策略的配置文件中， 提 取信任等级、 权限组名称和权限组下具体控制的付费功能； 以信任级别为 标识、 以权限组名称和权限组下具体控制的付费功能添加到付费功能权限 控制列表中； 最后保存付费功能权限控制列表， 形成资费安全控制策略。
所述移动终端， 进一步包括： 应用处理模块 23 , 用于实时判断当前访 问的应用软件是否使用到任意一项付费功能， 若是， 则向权限使用控制模 块 22发送应用软件使用的付费功能的名称； 否则， 继续判断当前访问的应 用软件是否使用到任意一项付费功能；相应的，所述权限使用控制模块 22 , 具体用于接收应用处理模块 23发来的应用软件使用的付费功能的名称， 检 测该付费功能是否与资费安全控制策略中任意一项相符。
所述应用处理模块 23 , 具体用于实时监测应用软件的运行过程， 判断 在应用软件的运行过程中是否发出对任意一项付费功能的调用信息， 以判 断当前使用的应用软件是否使用到任意一项付费功能， 若是， 则向权限使 用控制模块 22发送应用软件使用的付费功能的名称； 否则，继续判断当前 访问的应用软件是否使用到任意一项付费功能。 所述权限使用控制模块 22 , 具体用于检测该付费功能是否与资费安 全控制策略中任意一项相符时， 根据应用软件的信任级别， 查看权限使用 策略模块 21 的资费安全控制策略中对应信任级别下的付费功能权限控制 列表； 判断该应用软件使用的付费功能是否与付费功能权限控制列表中任 意一个需要控制的付费功能相同， 若有相同项， 则确定对于应用软件所使 用的付费功能是否有对应的权限使用控制策略； 若没有相同项， 则通知应 用处理模块 23允许应用软件使用该付费功能；
相应的， 所述应用处理模块 23 ,还用于接收到权限使用控制模块 22发 来的允许应用软件使用该付费功能， 然后按照已有技术对访问应用软件进 行后续处理。
所述权限使用控制模块 22 , 具体用于当应用软件所使用的付费功能 对应的权限有权限使用控制策略时， 根据查看权限使用策略模块 21 的资 费安全控制策略中该权限使用控制策略， 对应用软件要使用的付费功能的 权限进行控制， 结束操作流程； 若没有， 则设定该付费功能的权限使用控 制策略，再将该付费功能的权限使用控制策略保存到权限使用策略模块 21 中；
相应的， 所述权限使用策略模块 21 , 具体用于接收权限使用控制模块 22发来的权限使用控制策略， 并将该权限使用控制策略保存到付费功能权 限控制列表中对应的付费功能项目中。
所述权限使用控制模块 22 ,具体用于查看权限使用控制策略中的具体 设置， 当具体设置为总是允许时， 则允许应用软件使用付费功能， 然后按 照已有技术对该应用软件做后续操作； 当具体设置为总是拒绝时， 则拒绝 应用软件使用付费功能， 然后按照已有技术对该应用软件做后续操作； 当 具体设置为每次询问， 则为用户弹出选择框， 由用户选择是否允许应用软 件使用该付费功能， 再根据用户的选择允许或拒绝应用软件使用该付费功 能， 然后按照已有技术对该应用软件做后续操作。
所述权限使用控制模块 22 ,还用于提醒用户对该付费功能的权限使用 控制策略进行设定， 同时将当前应用的处理流程暂停； 接收用户对于该功 能的权限使用控制策略进行设定， 并根据用户设定的权限使用策略的对应 用软件要使用的功能的权限进行控制。
所述移动终端还包括： 应用信任等级认证模块 24, 用于接收应用处理 模块 23发来的应用软件的安装包； 相应的， 所述应用处理模块 23 , 还用于 实时判断用户选择的操作为安装任意一个新应用软件、 还是访问任意一个 应用软件， 如果为安装任意一个新应用软件， 则将该应用软件的安装包发 送给应用信任等级认证模块 24, 如果为访问任意一个应用软件， 则判断当 前访问的应用软件是否使用到任意一项付费功能。
所述应用信任等级认证模块 24, 还用于解压新的应用软件的安装包， 提取新的应用软件的签名信息， 利用应用软件的签名信息对应用进行认证， 根据认证结果确定应用软件的信任级别， 再将信任级别保存在与应用软件 对应的属性配置文件中， 将解压后的应用软件的安装包及应用软件的属性 配置文件发回给应用处理模块 23; 相应的， 所述应用处理模块 23 , 还用于 接收应用信任等级认证模块 24发来的解压后的应用软件的安装包及应用软 件的属性配置文件， 然后对解压后的应用软件按照已有技术继续安装应用 软件。
所述应用信任等级认证模块 24, 具体用于将应用软件的签名信息、 与 预置在本模块中的多个证书的签名信息进行匹配， 如果应用的签名信息与 任意一个证书的签名信息相同， 则认证结果为通过； 否则认证结果为不通 过。
所述应用信任等级认证模块 24, 具体用于当认证结果为通过时， 则根 据具体的签名信息设置应用软件的可信任级别； 当认证结果为不通过时， 则设置该应用软件为不可信任级别。
可见， 使用上述方案， 就可以根据应用的信任等级， 分类控制及管理 移动终端的应用对付费功能的使用， 能够有效防止对移动终端付费功能被 恶意软件使用， 从而保证移动终端用户的信息数据的安全性。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围。

Claims

权利要求书
1、 一种管理资费安全的方法， 其特征在于， 该方法包括：
根据预置的资费安全控制策略的配置文件， 生成资费安全控制策略； 检测到应用软件使用资费安全控制策略中所限定的付费功能时， 根据 资费安全控制策略中所使用付费功能的权限使用控制策略对应用软件所使 用付费功能的权限进行控制。
2、 根据权利要求 1所述的方法， 其特征在于， 所述检测到应用软件使 用资费安全控制策略中所限定的付费功能之前， 该方法还包括： 实时判断 当前访问的应用软件是否使用到付费功能， 若是， 则检测应用软件使用的 付费功能对应的权限是否与资费安全控制策略相符； 否则， 继续判断当前 访问的应用软件是否使用到付费功能。
3、 根据权利要求 2所述的方法， 其特征在于， 所述检测应用软件使用 的付费功能对应的权限是否与资费安全控制策略相符， 包括： 根据应用软 件的信任级别， 查看资费安全控制策略中对应信任级别下的付费功能权限 控制列表； 判断所述应用软件使用的付费功能是否与付费功能权限控制列 表中需要控制的付费功能相同， 若有相同项， 则检测到应用软件使用到资 费安全控制策略中所限定的付费功能； 若没有相同项， 则允许应用软件使 用所述付费功能。
4、 根据权利要求 3所述的方法， 其特征在于， 所述查看资费安全控制 策略中对应信任级别下的付费功能权限控制列表之前， 该方法还包括： 确 定进行新应用软件的安装时， 解压新的应用软件的安装包， 提取新的应用 软件的签名信息； 利用应用软件的签名信息进行认证， 根据认证结果确定 应用软件的信任级别； 再将信任级别保存在与应用软件对应的属性配置文 件中。
5、 根据权利要求 1所述的方法， 其特征在于， 所述根据资费安全控制 策略中的所述付费功能的权限使用控制策略对应用软件要使用到的付费功 能的权限进行控制之前， 该方法还包括： 判断对于应用软件所使用的付费 功能是否有对应的权限使用控制策略， 若有， 则根据所述权限使用控制策 略， 对应用软件要使用到的付费功能的权限进行控制； 若没有， 则对所述 付费功能的权限使用控制策略进行设定并保存。
6、 一种移动终端， 其特征在于， 该移动终端包括： 权限使用策略模 块和权限使用控制模块； 其中，
权限使用策略模块，用于根据预置的资费安全控制策略的配置文件， 生成资费安全控制策略， 为权限使用控制模块提供资费安全控制策略； 权限使用控制模块， 用于在检测到有应用软件使用权限使用策略模 块中的系统连接权限控制策略中所限定的付费功能时， 根据资费安全控 制策略中所述付费功能的权限使用控制策略对应用软件要使用到的付费功 能的权限进行控制。
7、 根据权利要求 6所述的移动终端， 其特征在于， 所述移动终端， 进 一步包括：
应用处理模块， 用于实时判断当前访问的应用软件是否使用到付费功 能， 若是， 则向权限使用控制模块发送应用软件使用的付费功能的名称； 否则， 继续判断当前访问的应用软件是否使用到付费功能；
相应的， 所述权限使用控制模块， 具体用于接收应用处理模块发来的 应用软件使用的付费功能的名称， 检测所述付费功能是否与资费安全控制 策略相符。
8、 根据权利要求 6所述的移动终端， 其特征在于，
所述权限使用控制模块， 具体用于根据应用软件的信任级别， 查看权 限使用策略模块中资费安全控制策略中对应信任级别下的付费功能权限控 制列表； 判断所述应用软件使用的付费功能是否与付费功能权限控制列表 中需要控制的付费功能相同， 若有相同项， 则检测到应用软件使用到资费 安全控制策略中所限定的付费功能； 若没有相同项， 则通知应用处理模块 允许应用软件使用所述付费功能；
相应的， 所述应用处理模块， 还用于接收到权限使用控制模块发来的 允许应用软件使用所述付费功能；
所述权限使用策略模块， 具体用于为权限使用控制模块提供资费安 全控制策略。
9、 根据权利要求 8所述的移动终端， 其特征在于， 所述移动终端， 还 包括： 应用信任等级认证模块， 用于接收应用处理模块发来的新的应用软 件的安装包， 解压新的应用软件的安装包， 提取新的应用软件的签名信息； 利用应用软件的签名信息进行认证， 根据认证结果确定应用软件的信任级 别； 再将信任级别保存在与应用软件对应的属性配置文件中；
相应的， 所述应用处理模块， 还用于确定进行新应用软件的安装时， 将所述新的应用软件的安装包发送给应用信任等级认证模块。
10、 根据权利要求 9所述的移动终端， 其特征在于，
所述权限使用控制模块， 具体用于判断对于应用软件所使用的付费功 能是否有对应的权限使用控制策略， 若有， 则根据所述权限使用控制策略， 对应用软件要使用到的付费功能的权限进行控制； 若没有， 则对所述付费 功能的权限使用控制策略进行设定， 再将所述付费功能的权限使用控制策 略保存到权限使用策略模块中；
相应的 , 所述权限使用策略模块 , 具体用于接收权限使用控制模块发 来的权限使用控制策略 , 并将所述权限使用控制策略保存到付费功能权限 控制列表中对应的付费功能项目中。
PCT/CN2012/074554 2011-11-24 2012-04-23 一种管理资费安全的方法及移动终端 Ceased WO2013075458A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP12852113.5A EP2744244A4 (en) 2011-11-24 2012-04-23 METHOD OF MANAGING BILLING SECURITY AND MOBILE TERMINAL
US14/350,619 US20140258128A1 (en) 2011-11-24 2012-04-23 Method for managing fund security and mobile terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110378725.0 2011-11-24
CN201110378725.0A CN102404706B (zh) 2011-11-24 2011-11-24 一种管理资费安全的方法及移动终端

Publications (1)

Publication Number Publication Date
WO2013075458A1 true WO2013075458A1 (zh) 2013-05-30

Family

ID=45886394

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/074554 Ceased WO2013075458A1 (zh) 2011-11-24 2012-04-23 一种管理资费安全的方法及移动终端

Country Status (4)

Country Link
US (1) US20140258128A1 (zh)
EP (1) EP2744244A4 (zh)
CN (1) CN102404706B (zh)
WO (1) WO2013075458A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110390198A (zh) * 2019-07-31 2019-10-29 阿里巴巴集团控股有限公司 一种对小程序的风险巡检方法、装置及电子设备

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404706B (zh) * 2011-11-24 2014-08-13 中兴通讯股份有限公司 一种管理资费安全的方法及移动终端
CN103220662B (zh) 2012-01-20 2016-01-20 腾讯科技（深圳）有限公司 一种应用程序的处理方法和移动终端
CN102905264B (zh) * 2012-10-11 2015-01-21 东信和平科技股份有限公司 一种基于sim卡的网络服务保护方法及系统
CN102970407B (zh) * 2012-11-16 2016-07-06 广东欧珀移动通信有限公司 一种自动防止盗拨电话的方法及系统
CN104519469A (zh) * 2013-10-08 2015-04-15 华为技术有限公司 短信吸费行为检测方法、装置及终端
FR3023400A1 (fr) * 2014-07-04 2016-01-08 Schneider Electric Ind Sas Procede de gestion de l'installation d'une application sur un dispositif electronique
US9521153B2 (en) * 2014-08-18 2016-12-13 Dell Products L.P. Platform trust extension
CN104796877B (zh) * 2015-03-23 2018-05-01 广东欧珀移动通信有限公司 一种防恶意扣费的方法和装置
CN104869236A (zh) * 2015-04-29 2015-08-26 努比亚技术有限公司 终端防止误扣费的方法及装置
US10127403B2 (en) * 2015-07-30 2018-11-13 Samsung Electronics Co., Ltd. Computing system with privacy control mechanism and method of operation thereof
US11227045B2 (en) * 2016-06-27 2022-01-18 International Business Machines Corporation System, method and apparatus for extracting usage-based fine grained permissions
CN107666393B (zh) * 2016-07-27 2020-09-08 深圳市斯凯荣科技有限公司 便携式路由器控制网站访问的方法及便携式路由器
US11082491B2 (en) * 2016-10-07 2021-08-03 Microsoft Technology Licensing, Llc Propagating origin information for applications during application installation
US11206185B2 (en) * 2019-06-23 2021-12-21 Juniper Networks, Inc. Rules driven software deployment agent
CN110473103B (zh) * 2019-08-16 2022-07-29 中国工商银行股份有限公司 应用管理方法、装置、计算机系统和介质
US12488103B2 (en) * 2023-08-30 2025-12-02 Gen Digital, Inc. Protecting against malicious application encounters on mobile devices

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088679A (zh) * 2009-12-08 2011-06-08 北京网秦天下科技有限公司 自学习的移动终端智能化短信防火墙的工作方法及系统
CN102186167A (zh) * 2011-04-11 2011-09-14 中兴通讯股份有限公司 一种对应用进行监控的方法及系统
CN102209326A (zh) * 2011-05-20 2011-10-05 北京中研瑞丰信息技术研究所(有限合伙) 基于智能手机无线电接口层的恶意行为检测方法及系统
CN102404706A (zh) * 2011-11-24 2012-04-04 中兴通讯股份有限公司 一种管理资费安全的方法及移动终端

Family Cites Families (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5838563A (en) * 1996-04-12 1998-11-17 Fisher-Rosemont Systems, Inc. System for configuring a process control environment
US6393569B1 (en) * 1996-12-18 2002-05-21 Alexander S. Orenshteyn Secured system for accessing application services from a remote station
WO2000008841A1 (en) * 1998-08-05 2000-02-17 Takanobu Kunugi Communication control system and communication control method
US8832852B2 (en) * 2000-08-28 2014-09-09 Contentguard Holdings, Inc. Method and apparatus for dynamic protection of static and dynamic content
US6714778B2 (en) * 2001-05-15 2004-03-30 Nokia Corporation Context sensitive web services
WO2003054654A2 (en) * 2001-12-21 2003-07-03 Nokia Corporation Location-based novelty index value and recommendation system and method
US8136155B2 (en) * 2003-04-01 2012-03-13 Check Point Software Technologies, Inc. Security system with methodology for interprocess communication control
US8103592B2 (en) * 2003-10-08 2012-01-24 Microsoft Corporation First computer process and second computer process proxy-executing code on behalf of first process
EP1536606A1 (fr) * 2003-11-27 2005-06-01 Nagracard S.A. Méthode d'authentification d'applications
US7434256B2 (en) * 2003-12-18 2008-10-07 Intel Corporation Security management for wireless clients
NZ549544A (en) * 2004-03-22 2008-03-28 Samsung Electronics Co Ltd Method and apparatus for digital rights management using certificate revocation list
WO2005101162A1 (ja) * 2004-04-15 2005-10-27 Matsushita Electric Industrial Co., Ltd. アクセス制御装置及び電子機器
US8745199B1 (en) * 2005-06-01 2014-06-03 Netapp, Inc. Method and apparatus for management and troubleshooting of a processing system
US20070073874A1 (en) * 2005-09-07 2007-03-29 Ace Comm Consumer configurable mobile communication solution
DE602005015328D1 (de) * 2005-10-04 2009-08-20 Swisscom Ag Verfahren zur Anpassung der Sicherheitseinstellungen einer Kommunikationsstation und Kommunikationsstation
US7613445B1 (en) * 2005-12-22 2009-11-03 Symantec Corporation Cost control system for access to mobile services
US8290433B2 (en) * 2007-11-14 2012-10-16 Blaze Mobile, Inc. Method and system for securing transactions made through a mobile communication device
EP1998269A4 (en) * 2006-02-21 2012-02-29 Nec Corp PROGRAM EXECUTION MONITORING SYSTEM, EXECUTION MONITORING METHOD, COMPUTER CONTROL PROGRAM
KR100871619B1 (ko) * 2006-09-21 2008-12-02 삼성전자주식회사 이동통신 단말기에서 멀티미디어 메시지를 통해 컨텐트권리를 수신하는 장치 및 방법
EP2082519B1 (en) * 2006-10-20 2018-02-21 BlackBerry Limited A method and apparatus to control the use of applications on handheld devices based on network service
US8078515B2 (en) * 2007-05-04 2011-12-13 Michael Sasha John Systems and methods for facilitating electronic transactions and deterring fraud
US7895463B2 (en) * 2007-08-28 2011-02-22 Cisco Technology, Inc. Redundant application network appliances using a low latency lossless interconnect link
US9292306B2 (en) * 2007-11-09 2016-03-22 Avro Computing, Inc. System, multi-tier interface and methods for management of operational structured data
CN101946452A (zh) * 2007-12-13 2011-01-12 塞尔蒂卡姆公司 用于控制器件上的特征的系统和方法
WO2009154526A1 (en) * 2008-06-19 2009-12-23 Telefonaktiebolaget Lm Ericsson (Publ) A method and a device for protecting private content
US9286604B2 (en) * 2008-09-22 2016-03-15 Visa International Service Association Over the air management of payment application installed in mobile device
US8713705B2 (en) * 2009-08-03 2014-04-29 Eisst Ltd. Application authentication system and method
WO2011047722A1 (en) * 2009-10-22 2011-04-28 Telefonaktiebolaget Lm Ericsson (Publ) Method for managing access to protected resources in a computer network, physical entities and computer programs therefor
WO2011103916A1 (en) * 2010-02-24 2011-09-01 Telefonaktiebolaget Lm Ericsson (Publ) Method for managing access to protected resources and delegating authority in a computer network
KR20110110055A (ko) * 2010-03-31 2011-10-06 한국전자통신연구원 방송 또는 통신 채널별로 서로 다른 보안 클라이언트를 원격 설치 및 갱신하는 방법 및 장치
KR101136525B1 (ko) * 2010-11-02 2012-04-17 플러스기술주식회사 휴대용 단말장치의 보안 방법
US8626597B2 (en) * 2010-11-30 2014-01-07 Verizon Patent And Licensing Inc. Automatic tab payment from a user device
US8666895B2 (en) * 2011-01-31 2014-03-04 Bank Of America Corporation Single action mobile transaction device
CN102186152A (zh) * 2011-05-19 2011-09-14 深圳市五巨科技有限公司 一种防止移动终端恶意扣费的方法和装置
US9106650B2 (en) * 2011-11-09 2015-08-11 Microsoft Technology Licensing, Llc User-driven access control

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088679A (zh) * 2009-12-08 2011-06-08 北京网秦天下科技有限公司 自学习的移动终端智能化短信防火墙的工作方法及系统
CN102186167A (zh) * 2011-04-11 2011-09-14 中兴通讯股份有限公司 一种对应用进行监控的方法及系统
CN102209326A (zh) * 2011-05-20 2011-10-05 北京中研瑞丰信息技术研究所(有限合伙) 基于智能手机无线电接口层的恶意行为检测方法及系统
CN102404706A (zh) * 2011-11-24 2012-04-04 中兴通讯股份有限公司 一种管理资费安全的方法及移动终端

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110390198A (zh) * 2019-07-31 2019-10-29 阿里巴巴集团控股有限公司 一种对小程序的风险巡检方法、装置及电子设备
CN110390198B (zh) * 2019-07-31 2023-09-29 创新先进技术有限公司 一种对小程序的风险巡检方法、装置及电子设备

Also Published As

Publication number Publication date
EP2744244A1 (en) 2014-06-18
US20140258128A1 (en) 2014-09-11
CN102404706A (zh) 2012-04-04
EP2744244A4 (en) 2015-04-22
CN102404706B (zh) 2014-08-13

Similar Documents

Publication Publication Date Title
WO2013075458A1 (zh) 一种管理资费安全的方法及移动终端
CN102521548B (zh) 一种管理功能使用权限的方法及移动终端
CN102420902B (zh) 一种分类管理功能使用权限的方法及移动终端
CN102413221B (zh) 一种保护隐私信息的方法及移动终端
CN111064757B (zh) 应用访问方法、装置、电子设备以及存储介质
CN103686722B (zh) 访问控制方法及装置
CN102413220B (zh) 一种控制连接功能的使用权限的方法及移动终端
CN103744686B (zh) 智能终端中应用安装的控制方法和系统
CN111079091A (zh) 一种软件的安全管理方法、装置、终端及服务器
CN107256356A (zh) 支付类应用程序管理方法、装置及移动终端
CN103020854A (zh) 一种服务功能授权的方法及系统
CN112417402A (zh) 权限控制方法、权限控制装置、权限控制设备及存储介质
CN102006597B (zh) 一种软件使用权的控制方法、系统及移动终端
WO2013107301A1 (zh) 一种应用程序的处理方法和移动终端
CN106713234A (zh) 一种智能电网移动终端动态授权系统
CN101888623B (zh) 一种基于安全服务的移动网络安全防护方法
CN115941207A (zh) 签名认证方法和装置
CN1322388C (zh) 对具有拷贝导出权限的版权进行限制的方法及装置
CN116975805A (zh) 一种数据处理方法、装置、设备、存储介质及产品
CN114844758A (zh) 一种基于sdp的电力物联网的技术架构系统及构建方法
CN106603460B (zh) 一种认证方式授权方法及装置
CN113297629B (zh) 一种鉴权方法、装置、系统、电子设备和存储介质
CN115102771B (zh) 数据处理方法、终端设备、系统、设备和存储介质
KR101440285B1 (ko) 스마트폰 도용방지 서비스 방법 및 시스템
WO2024007096A1 (zh) 一种用于安卓系统的隐私数据保护方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12852113

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 14350619

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE