CN107403114B - Input locking structure and method - Google Patents

Abstract

The invention discloses a structure and method for locking input, which is applied to a computer system or an electronic system including a mobile phone, and includes a locking module for locking the input of the system, and in the locked state, any device input to the system is in an invalid state ; The control module is used to logically control the locking and unlocking of the system input, by judging whether the current system state is in a safe state, when the system is in a safe state, the system performs normal device input, and when it is in a non-safe state, the system locks the device input through the locking module . Compared with the prior art, the structure and method for locking input of the present invention can effectively prevent attack means such as credential stuffing, avoid data loss caused by password leakage, avoid complex secondary verification process, and effectively improve the The system is safe, practical, widely applicable, and easy to popularize.

Description

A structure and method for locking input

technical field

The invention relates to the technical field of information security, in particular to a structure and method for locking input that can be applied to a computer system or a mobile phone system.

Background technique

Computers (computers) and mobile phones have become indispensable and important equipment in daily work and life. These electronic devices have improved our office efficiency and facilitated our production and life through real-time interconnection and information sharing. In our work, production and life, a large amount of private data and information are stored in the corresponding electronic devices. How to prevent the peeping and theft by criminals and protect our information security has become a serious issue of common concern to the whole society and various fields. .

At this stage, in order to avoid prying eyes from others, the most common method used by the system is to introduce a user name and secret key verification mechanism. Users need to verify if they want to access the data, and they can access if the verification is successful.

At this stage, the authentication mechanism of username and key is the most widely used security method. Unfortunately, this authentication mechanism is not secure. The user's password is leaked, and malicious credential stuffing can be easily cracked to log in to obtain data, resulting in the loss of private information. .

The current security method is shown in Figure 1: first obtain the data information request, then perform password authentication, and then obtain the data after the password authentication is successful. to obtain private information.

To sum up, the existing technology has been unable to meet people's needs for security, and then enhanced protection strategies have emerged, the most extensive of which is secondary authentication, which strengthens security to a certain extent, but relies on other intelligent electronic devices. , and the safety of the device itself as a secondary authentication cannot be guaranteed. For example, through SMS secondary authentication, the attacker can successfully intrude the system by disguising the base station or hacking the mobile phone to obtain the secondary authentication code without the user knowing it.

To sum up, the security system is still easy to be broken, and there is no effective prevention of intrusion.

Based on this, there is an urgent need for a solution that can effectively improve the security performance of the system.

SUMMARY OF THE INVENTION

The technical task of the present invention is to provide a structure and method that can effectively improve the security performance of the system and lock the input in view of the above shortcomings.

A structure for locking input, applied in a computer system or an electronic system including a mobile phone, the structure comprising,

The locking module is used to lock the system input, and any device input to the system is invalid in the locked state;

The control module is used to logically control the locking and unlocking of the system input. By judging whether the current system state is in a safe state, the system performs normal device input when it is in a safe state, and locks the device input through the locking module when it is not in a safe state.

The devices used for system input include keyboard, mouse, touchpad, and network. When the locking module locks the system, the device input is in an abandoned state, that is, the system and the device are isolated from each other.

The process of the system input is: first, the content input by the device is obtained by the input device driver, then the input content is converted into a kernel general key value through the input content processing module, and finally the input content is distributed to the application program; when the locking module locks the input content. When the device of the system is input, the function of locking the input is achieved by inserting the locking module before the distribution of the input content.

The locking module is inserted into the input content distribution stage through the hook mechanism, specifically: the locking module inserts a checkpoint hook point on the content processing flow, and the processing flow refers to before the input content is distributed, to decide whether to allow or not according to the judgment of the control module This content continues to be distributed, implementing the prohibition of input while the system is locked.

The process of the control module judging whether the current system state is safe is as follows: the control module takes whether there is a safety device connected to the system as a trigger condition, when there is a safety device connected to the system, and after the safety device has passed the safety certification, the current system is in a safe state. status, unlock the device, the system can input content through the device; when no security device is connected to the system, or the security device connected to the system has not passed security authentication, the current system is in a non-secure state, the device is locked, and the system cannot input content through the device.

The security authentication is fingerprint authentication, that is, after the security device is connected to the system, it is checked whether the fingerprint information of the security device itself matches the fingerprint information entered in the system, and when it is completely matched, the control module is triggered to unlock the device. The content is distributed normally, otherwise the steps of content distribution cannot be performed.

A method for locking input, based on the above structure of locking input, the implementation process is as follows: first, judge whether the state of the system is safe through a control module, and when the system is in a safe state, the system performs normal device input, that is, the system and the input device are in a connected state , the device can normally input content to the system; when the system is in an unsafe state, the device input is locked through the locking module to isolate the system from the device.

When the system is in a safe state, the process of normal device input by the system is: firstly input content through the device; then the input content is obtained by the input device driver, and then the input content is converted into the kernel general key value through the input content processing module, Finally distribute the input to the application.

When the system is in a non-secure state, the process of locking the system to prevent device input is: insert the locking module before the input content distribution through the hook mechanism, so that the system cannot enter the content distribution step, so as to achieve the function of locking input.

The specific process of inserting through the hook mechanism is as follows: the locking module inserts a checkpoint hook point before the distribution of the input content, to decide whether to allow the content to continue to be distributed according to the judgment of the control module, so as to prohibit input in the system locked state.

Compared with the prior art, a structure and method for locking input of the present invention has the following beneficial effects:

A structure and method for locking the input of the present invention, the locking module in the method inserts the hook process in the kernel module, directly and effectively locks the distribution of the input, thereby realizing the locking of the input; the control module can automatically calculate the parameters through the device. The fingerprint information of the device does not depend on the key and other information stored in the external device, which effectively prevents attacks such as credential stuffing, avoids data loss caused by password leakage, and avoids the complex secondary verification process. The security of the system is improved, the practicability is strong, the scope of application is wide, and it is easy to popularize.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without creative work.

FIG. 1 is a flow chart of the realization of information security means in the prior art.

Figure 2 is a schematic diagram of a specific implementation of the structure of the present invention.

Fig. 3 is the implementation flow chart of the method of the present invention.

Figure 4 is a flow chart of the specific implementation of the method of the present invention.

FIG. 5 is an example diagram of the logic judgment process of the control module in the method of the present invention.

Detailed ways

In order to make those skilled in the art better understand the solution of the present invention, the present invention will be further described in detail below with reference to specific embodiments. Obviously, the described embodiments are only some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

As shown in FIG. 2, a structure for locking input is applied in a computer system or an electronic system including a mobile phone, and its structure includes,

The locking module is used to lock the system input. In the locked state, any device input to the system is in an invalid state, that is, in the locked state, the input control to the system, such as keyboard and mouse input, input control from a remote, is abandoned. Do a good job of system isolation.

The control module is used to logically control the locking and unlocking of the system input. By judging whether the current system state is in a safe state, the system performs normal device input when it is in a safe state, and locks the device input through the locking module when it is not in a safe state.

The devices used for system input include keyboard, mouse, touchpad, and network. When the locking module locks the system, the device input is in an abandoned state, that is, the system and the device are isolated from each other.

The process of the system input is: first, the content input by the device is obtained by the input device driver, then the input content is converted into a kernel general key value through the input content processing module, and finally the input content is distributed to the application program; when the locking module locks the input content. When the device of the system is input, the function of locking the input is achieved by inserting the locking module before the distribution of the input content.

键盘驱动获取输入并将其转换为内核通用键值代码

内核输入事件处理(如封装成特定的格式)

输入时间分发（如将输入时间写入一个文件）

应用程序从文件中获取输入信息(按键值)。The following takes keyboard input as an example. The general processing flow of the system kernel for input devices is as follows: Keyboard input

The keyboard driver takes the input and converts it to kernel generic key-value codes

Kernel input event processing (eg encapsulated into a specific format)

Input time distribution (eg writing input time to a file)

The application gets input information (key values) from a file.

The locking module is inserted into the input content distribution stage through the hook mechanism, specifically: the locking module inserts a checkpoint hook point on the content processing flow, and the processing flow refers to before the input content is distributed, to decide whether to allow or not according to the judgment of the control module This content continues to be distributed, implementing the prohibition of input while the system is locked.

The process of the control module judging whether the current system state is safe is as follows: the control module takes whether there is a safety device connected to the system as a trigger condition, when there is a safety device connected to the system, and after the safety device has passed the safety certification, the current system is in a safe state. status, unlock the device, the system can input content through the device; when no security device is connected to the system, or the security device connected to the system has not passed security authentication, the current system is in a non-secure state, the device is locked, and the system cannot input content through the device.

The security authentication is fingerprint authentication, that is, after the security device is connected to the system, it is checked whether the fingerprint information of the security device itself matches the fingerprint information entered in the system, and when it is completely matched, the control module is triggered to unlock the device. The content is distributed normally, otherwise the steps of content distribution cannot be performed.

A method for locking input, as shown in FIG. 3 , based on the above-mentioned structure for locking input, its implementation process is:

The structure of the above lock input is installed in a computer system or a mobile phone system.

Insert the peripheral you want to use as a trigger device, generally including U disk, wifi network card and other devices that can support hot swap.

Open the setting interface, select a specific trigger device, and check whether the system can match the trigger device.

Finally lock or unlock.

Further, as shown in Figure 4 and Figure 5, in this method, first determine whether the state of the system is safe through the control module, when the system is in a safe state, the system performs normal device input, that is, the system and the input device are in a connected state, The device can normally input content to the system; when the system is in an unsafe state, the device input is locked through the locking module to isolate the system from the device.

When the system is in a safe state, the process of normal device input by the system is: firstly input content through the device; then the input content is obtained by the input device driver, and then the input content is converted into the kernel general key value through the input content processing module, Finally distribute the input to the application.

When the system is in a non-secure state, the process of locking the system to prevent device input is: insert the locking module before the input content distribution through the hook mechanism, so that the system cannot enter the content distribution step, so as to achieve the function of locking input.

The specific process of inserting through the hook mechanism is as follows: the locking module inserts a checkpoint hook point before the distribution of the input content, to decide whether to allow the content to continue to be distributed according to the judgment of the control module, so as to prohibit input in the system locked state.

By inserting a specific security module into the system kernel, the present invention locks the system input when needed, that is, in the locked state, any input information is discarded and realized, the main security mechanism works with the kernel state, and the security of the security system itself is obtained. greatly improved. Compared with the existing solution, even if the user password is leaked, if the system input is still locked, the attacker still cannot control the system and cannot log in by entering the password. Even if it is cracked by malicious credential stuffing method, it will not be realized because it cannot input the system, which effectively improves the security of the system. Again, the present invention avoids complicated secondary authentication mechanisms (such as short messages, telephone calls, etc.), and prevents the possibility of re-invasion.

Through the above specific embodiments, those skilled in the art can easily implement the present invention. The principles and implementations of the present invention are described herein by using specific examples, and the descriptions of the above embodiments are only used to help understand the method and the core idea of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, several improvements and modifications can also be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (4)

1. A structure for locking input, which is applied to a computer system or an electronic system comprising a mobile phone, is characterized in that the structure comprises,

the locking module is used for locking the system input and is in an invalid state for any equipment input of the system in a locking state;

the control module is used for carrying out logic control on locking and unlocking of system input, judging whether the current system state is in a safe state, carrying out normal equipment input by the system in the safe state, and locking the equipment input by the system through the locking module in the non-safe state;

the system input process comprises the following steps: firstly, the content input by the equipment is acquired by the input equipment driver, then the input content is converted into a kernel general key value through an input content processing module, and finally the input content is distributed to an application program; when the locking module locks the equipment input of the system, the locking module is inserted before the input content is distributed to achieve the function of locking the input;

the locking module is inserted into an input content distribution stage through a hook mechanism, and specifically comprises the following steps: the locking module inserts a check point hook point in a content processing flow, wherein the processing flow is to determine whether to allow the content to be continuously distributed according to the judgment of the control module before the input content is distributed, so that the input is forbidden in a system locking state;

the process that the control module judges whether the current system state is safe is as follows: the control module takes whether a safety device is accessed into the system as a trigger condition, when the safety device is accessed into the system and passes safety authentication, the current system is in a safety state, the device is unlocked, and the system can input content through the device; when no safety equipment is accessed to the system or the safety equipment accessed to the system fails to pass safety authentication, the current system is in a non-safety state, the equipment is locked, and the system cannot input contents through the equipment.

2. The structure of claim 1, wherein the device for system input comprises a keyboard, a mouse, a touch pad, and a network, and when the locking module locks the system, the device input is in a throw-away state, i.e. the system is isolated from the device.

3. The input locking structure according to claim 1, wherein the security authentication is fingerprint authentication, that is, after the security device accesses the system, it checks whether the fingerprint information of the security device itself matches the fingerprint information entered in the system, and when the fingerprint information matches the fingerprint information, the control module is triggered to unlock the device, and the content input by the device is normally distributed, otherwise, the step of content distribution cannot be performed.

4. A method for locking input is characterized in that based on the structure of the locking input, the implementation process is as follows: firstly, judging whether the state of the system is safe or not through a control module, and when the system is in the safe state, the system carries out normal equipment input, namely the system is in a connection state with input equipment, and the equipment can normally input contents to the system; when the system is in an unsafe state, the device input is locked through the locking module, and the system is isolated from the device;

when the system is in a safe state, the process of normal equipment input by the system is as follows: firstly, inputting content through equipment; then the input content is obtained by the drive of the input equipment, the input content is converted into a kernel general key value through an input content processing module, and finally the input content is distributed to an application program;

when the system is in an unsafe state, the process of locking the system to make the system unable to perform equipment input is as follows: the locking module is inserted into the input content distribution through a hook mechanism, so that the system cannot enter the content distribution step, and the input locking function is achieved;

the specific process of insertion by hook mechanism is: the locking module inserts a checkpoint hotspot before the input content is distributed to determine whether to allow the content to be continuously distributed according to the judgment of the control module, so that the input is forbidden in the system locking state.

Images