CN109033820A - User rs credentials guard method, device and equipment - Google Patents

Abstract

The present invention provides a kind of user rs credentials guard method, device and equipment, wherein this method comprises: being read out when monitor user rs credentials, obtains reading process；Safety detection is carried out to the reading process, obtains safety detection result；Security protection processing is carried out to the user rs credentials according to safety detection result.The protection to user rs credentials may be implemented in technical solution provided by the invention, reduces threat suffered by the property and terminal security of user.

Description

User credential protection method, device and equipment

technical field

The present invention relates to the field of computer technology, in particular to a user credential protection method, device and equipment.

Background technique

Credential management is a function provided by Windows. In the Windows system, when the user enters the user name and password to access a server for the first time, the Windows credential manager can save these access credentials locally, so that the server can be accessed again. At this time, windows will automatically help to complete the authentication process of the credentials to facilitate the user's use.

However, Microsoft did not protect the user credentials stored locally, so that some malicious programs can directly read these credentials through the interface provided by Microsoft, steal them and use them, posing a serious threat to users' property and terminal security. .

Contents of the invention

In view of this, the present invention provides a user credential protection method, device, and equipment for security protection of user credential.

In order to achieve the above purpose, in the first aspect, the embodiment of the present invention provides a user credential protection method, including:

When it is monitored that user credentials are read, obtain the reading process;

Performing security testing on the reading process to obtain a security testing result;

Perform security protection processing on the user credentials according to the security detection result.

By obtaining the reading process when the user credential is read through monitoring; performing security detection on the reading process, and performing security protection processing on the user credential according to the security detection result, the protection of the user credential can be realized and the user's property can be reduced and threats to endpoint security.

As an optional implementation manner of the embodiment of the present invention, before acquiring the reading process when monitoring that the user credential is read, the method further includes;

Monitor preset application programming interface API functions;

When it is monitored that any one of the preset API functions is called, it is determined that the user credentials are read.

By monitoring the preset API functions, the operation of reading user credentials can be discovered in time to improve the security of user credentials.

As an optional implementation manner of the embodiment of the present invention, the preset API functions include: all API functions that the reading process can call when reading the user credentials.

This improves the comprehensiveness of reading process detection, which in turn increases the security of user credentials.

As an optional implementation of the embodiment of the present invention, the preset API functions include: a credential set enumeration function, a domain credential reading function, and an optimal credential set search function.

As an optional implementation manner of the embodiment of the present invention, performing security detection on the reading process to obtain a security detection result includes:

extracting characteristic information of the reading process;

Matching the reading process with the feature information in the preset black and white lists;

The security detection result is determined according to the matching result.

By adopting the feature matching method for security detection, the accuracy of reading process security detection results can be improved.

As an optional implementation manner of the embodiment of the present invention, the performing security protection processing on the user credential according to the security detection result includes:

When the security detection result indicates that the reading process is a risky process, output risk prompt information and prompt the user whether to block the reading process;

When an instruction from the user to prevent the reading process is received, the reading process is prevented from continuing to read user credentials.

In the above implementation manner, how to handle the reading process is determined according to the user's operation instruction, which can improve user experience while protecting user credentials.

As an optional implementation manner of the embodiment of the present invention, the method further includes:

The pop-up window provides an interface for scanning and killing the entire system for the user to choose whether to perform a full-scale scanning and killing of the system.

By providing a full-scale scanning and killing interface for users to choose, the system can be better protected in an all-round way and user experience can be improved.

In a second aspect, an embodiment of the present invention provides a user credential protection device, including:

The obtaining module is used to obtain the reading process when the user credentials are monitored to be read;

A detection module, configured to perform security detection on the reading process obtained by the acquisition module, and obtain a security detection result;

The processing module is configured to perform security protection processing on the user credential according to the security detection result detected by the detection module.

As an optional implementation manner of the embodiment of the present invention, the device further includes;

A monitoring module, configured to monitor preset application programming interface API functions; when any one of the preset API functions is monitored to be called, determine that the user credentials are read.

As an optional implementation manner of the embodiment of the present invention, the preset API functions include: all API functions that the reading process can call when reading the user credentials.

As an optional implementation of the embodiment of the present invention, the preset API functions include: a credential set enumeration function, a domain credential reading function, and an optimal credential set search function.

As an optional implementation manner of the embodiment of the present invention, the detection module is specifically used for:

extracting the feature information of the reading process acquired by the acquiring module;

Matching the reading process with the feature information in the preset black and white lists;

The security detection result is determined according to the matching result.

As an optional implementation manner of the embodiment of the present invention, the device further includes: a prompt module, and the processing module is specifically configured to:

When the security detection result detected by the detection module indicates that the reading process is a risky process, instruct the prompting module to output risk prompt information, and prompt the user whether to block the reading process;

When an instruction from the user to prevent the reading process is received, the reading process is prevented from continuing to read user credentials.

As an optional implementation manner of the embodiment of the present invention, the prompt module is also used for:

The pop-up window provides an interface for scanning and killing the entire system for the user to choose whether to perform a full-scale scanning and killing of the system.

The beneficial effects of the device provided by the above second aspect and each possible implementation manner of the above second aspect can be referred to the beneficial effects brought by the above first aspect and each possible implementation manner of the first aspect, and will not be repeated here. repeat.

In a third aspect, an embodiment of the present invention provides a user credential protection device, including: a memory and a processor, the memory is used to store a computer program; the processor is used to execute any one of the first aspect or the first aspect when calling the computer program The method described in the embodiment.

The beneficial effects of the equipment provided by the above third aspect and each possible implementation manner of the above third aspect can be referred to the beneficial effects brought by the above first aspect and each possible implementation manner of the first aspect, and will not be repeated here. repeat.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in the first aspect or any implementation manner of the first aspect is implemented.

For the beneficial effects of the computer-readable storage medium provided by the above fourth aspect and each possible implementation manner of the above fourth aspect, please refer to the above first aspect and the beneficial effects brought by each possible implementation manner of the first aspect, I won't repeat them here.

Description of drawings

FIG. 1 is a schematic flowchart of a user credential protection method provided by an embodiment of the present invention;

Fig. 2 is a schematic diagram of a prompt interface provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a user credential protection device provided by an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a user credential protection device provided by an embodiment of the present invention.

Detailed ways

The Windows credential manager can save information such as the user name and password entered by the user when accessing the server locally, so that the credential authentication process can be automatically completed when the server is accessed again. The credentials stored in Ontology generally display information such as website address, user name, and password.

And some malicious programs can directly read these credentials through the interface provided by Microsoft. For Windows XP and later systems, attackers can directly obtain user credentials in the following two ways: first, enumerate all credentials associated with the current account through the credential set enumeration function (CredEnumerate); second, through domain The credential read function (CredReadDomainCredentials) reads the domain credentials associated with the current account. For Windows Vista and later systems, attackers can use the best credential set search function (CredFindBestCredential) to search the credential manager for the common credential set that is associated with the current login session and best matches the specified target resource.

After the malicious program steals these credentials, it may perform some illegal operations or blackmail the user, which will pose a serious threat to the user's property and terminal security.

In order to solve the above technical problems, the embodiments of the present invention provide a user credential protection method, device and equipment, mainly by obtaining the reading process when the user credential is read through monitoring; performing security detection on the reading process, according to the security Security protection processing is performed on user credentials based on security detection results to protect user credentials and reduce threats to user property and terminal security.

Embodiments of the present invention will be described below in conjunction with the accompanying drawings.

FIG. 1 is a schematic flowchart of a user credential protection method provided by an embodiment of the present invention, and the method may be executed by a user credential protection device or device. As shown in Figure 1, the method provided in this embodiment may include the following steps:

S101. Obtain a reading process when it is monitored that the user credential is read.

In this embodiment, in order to protect the user credentials, the read operation of the user credentials is monitored. During specific implementation, preset application programming interface (Application Programming Interface, API) functions may be monitored; when any one of the preset API functions is monitored to be called, it is determined that the user credentials are read.

Wherein, the preset API functions include: all API functions that can be called by the reading process when reading the user credentials. Specifically, the preset API functions may include: a credential set enumeration function (CredEnumerate), a domain credential reading function (CredReadDomainCredentials), and a best credential set search function (CredFindBestCredential). Among them, the CredEnumerate function specifically includes: CredEnumerateA function and CredEnumerateW function, the CredReadDomainCredentials function specifically includes: CredReadDomainCredentialsA function and CredReadDomainCredentialsW function, and the CredFindBestCredential function specifically includes CredFindBestCredentialA function and CredFindBestCredentialW function.

When it is monitored that any one of the above-mentioned preset API functions is called, the reading process of reading the user credentials is obtained, that is, the process of calling the above-mentioned API functions is obtained.

S102. Perform security detection on the reading process to obtain a security detection result.

Specifically, when the reading process is acquired, the Trojan horse detection and killing engine can be called to detect the security of the reading process, and after determining whether the insertion and reading process is safe through the security detection results, it is decided how to deal with the reading process. read operation.

In specific detection, the characteristic information of the reading process can be extracted first; then the reading process can be matched with the characteristic information in the preset black and white list; and then the security detection result can be determined according to the matching result.

Wherein, the characteristic information of the reading process may include the name of the reading process, message digest algorithm (Message Digest Algorithm 5, MD5) value, size, content, signature and version information, and the like.

The black and white lists can store characteristic information of risky processes, can also store characteristic information of safe processes, and can also store characteristic information of risky processes and safe processes at the same time, which is not particularly limited in this embodiment.

When matching the characteristic information of the reading process with the characteristic information in the black and white list, it can be matched according to one characteristic information (such as signature), or multiple characteristic information (such as: name, MD5 value, signature and version) Matching; when using multiple feature information for matching, it can be that the matching of multiple feature information indicates that the matching is successful, and it can also be that the matching of the preset number of feature information in the multiple feature information indicates that the matching is successful. It needs to be determined actually, and this embodiment does not specifically limit it.

Take the characteristic information of the risky process stored in the black and white list as an example. When the matching is successful, it means that the reading process of the current user credential is a risky process; when the matching is unsuccessful, it means that the reading process of the user credential is a safe process. The security detection result may indicate whether the reading process is a risky process or a safe process.

S103. Perform security protection processing on the user credential according to the security detection result.

After the security detection result is obtained, the user credential can be processed for security protection according to the security detection result.

Specifically, when the security detection result indicates that the reading process is a risky process, the reading process can be prevented from continuing to read user credentials, or a risk prompt message can be output, and the user can be prompted whether to block the reading process; When blocking the instructions of the reading process, prevent the reading process from continuing to read user credentials, so as to improve user experience while protecting user credentials.

When prompting, it can be prompted in the form of a pop-up window, can also be prompted in a voice mode, or can be prompted in other ways such as a pop-up window plus voice. Fig. 2 is a schematic diagram of a prompt interface provided by an embodiment of the present invention. As shown in Fig. 2, the figure schematically shows a schematic diagram of a pop-up window interface, and risk prompt information can be displayed in the pop-up window, for example, it can include a title : "A program is obtaining your account password, it is recommended to stop" and the specific prompt content: "Account password is read by a suspicious program, which may lead to fraudulent use and theft of your account-related content, causing you losses, if not You actively authorize, establish block". Wherein, the specific prompt content may also include information about the reading process, for example, it may display: "Suspicious program: C\Trojan.exe". The pop-up window also provides operation options to prompt the user whether to block the reading process, such as: "Allow" and "Block". For default selection items, such as "block" in the figure, the remaining selection time can be displayed on the operation options. The pop-up window may also display other information to improve user experience, for example, a close button “×” may be displayed in the upper right corner of the pop-up window for the user to click to close the pop-up window, which is not limited in this embodiment.

In this embodiment, when the security detection result indicates that the reading process is a risky process, it means that there are risky files in the system. At this time, a pop-up window can also provide a full-scale scanning and killing interface for the user to choose whether to perform a full-scale scanning and killing of the system. , in order to better protect the system.

Wherein, the interface for scanning and killing the entire disk may be combined and displayed in the pop-up window shown in FIG. 2 above, or may be displayed in a new pop-up window. The specific implementation method is not particularly limited in this embodiment.

When the user selects the interface of full-disk scanning and killing, the device will invoke each scanning and killing engine to scan all drive letters.

In the user credential protection method provided in this embodiment, by obtaining the reading process when the user credential is read through monitoring; performing security detection on the reading process, and performing security protection processing on the user credential according to the security detection result, it can realize The protection of user credentials reduces the threat to user property and terminal security.

Fig. 3 is a schematic structural diagram of a user credential protection device provided by an embodiment of the present invention. As shown in Fig. 3, the device provided by this embodiment includes:

The obtaining module 110 is used to obtain the reading process when monitoring that the user credentials are read;

The detection module 120 is configured to perform security detection on the reading process acquired by the acquisition module 110, and obtain a security detection result;

The processing module 130 is configured to perform security protection processing on the user credential according to the security detection result detected by the detection module 120 .

As an optional implementation manner of the embodiment of the present invention, the device further includes;

The monitoring module 140 is configured to monitor preset application programming interface API functions; when any API function in the preset API functions is monitored, it is determined that the user credentials are read.

As an optional implementation manner of the embodiment of the present invention, the preset API functions include: all API functions that the reading process can call when reading the user credentials.

As an optional implementation of the embodiment of the present invention, the preset API functions include: a credential set enumeration function, a domain credential reading function, and an optimal credential set search function.

As an optional implementation manner of the embodiment of the present invention, the detection module 120 is specifically used for:

Extracting the feature information of the reading process acquired by the acquiring module 110;

Match the reading process with the feature information in the preset black and white lists;

A security detection result is determined according to the matching result.

As an optional implementation manner of the embodiment of the present invention, the device further includes: a prompt module 150, and the processing module 130 is specifically used for:

When the safety detection result detected by the detection module 120 indicates that the reading process is a risky process, the instruction prompt module 150 outputs risk prompt information, and prompts the user whether to block the reading process;

When a user's instruction to prevent the reading process is received, the reading process is prevented from continuing to read user credentials.

As an optional implementation manner of the embodiment of the present invention, the prompting module 150 is also used to:

The pop-up window provides an interface for scanning and killing the entire system for the user to choose whether to perform a full-scale scanning and killing of the system.

The user credential protection device provided in this embodiment of the present invention may be a separate device, or may be integrated into a user credential protection device, which is not particularly limited in this embodiment.

The user credential protection device provided in this embodiment can execute the above-mentioned method embodiment, and its implementation principle and technical effect are similar, and will not be repeated here.

FIG. 4 is a schematic structural diagram of a user credential protection device provided by an embodiment of the present invention. As shown in FIG. The device 220 is configured to execute the methods described in the above method embodiments when calling a computer program.

The user credential protection device provided in this embodiment can execute the above-mentioned method embodiment, and its implementation principle and technical effect are similar, and will not be repeated here.

An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described in the foregoing method embodiments is implemented.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read only memory (ROM) or flash RAM. The memory is an example of a computer readable medium.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (10)

1. a kind of user rs credentials guard method characterized by comprising

It is read out when monitoring user rs credentials, obtains reading process；

Safety detection is carried out to the reading process, obtains safety detection result；

Security protection processing is carried out to the user rs credentials according to safety detection result.

2. being obtained the method according to claim 1, wherein being read out described when monitoring user rs credentials Before reading process, the method also includes；

Monitor preset application programming interface api function；

When monitor any one api function in the preset api function it is called when, determine that the user rs credentials are read It takes.

3. according to the method described in claim 2, it is characterized in that, the preset api function includes: that reading process is being read All api functions that can be called when the user rs credentials.

4. according to the method described in claim 3, it is characterized in that, the preset api function includes: that authority collection enumerates letter Number, domain authority function reading and best authority collection search function.

5. being obtained the method according to claim 1, wherein described carry out safety detection to the reading process To safety detection result, comprising:

Extract the characteristic information of the reading process；

The reading process is matched with the characteristic information in preset black and white lists；

The safety detection result is determined according to matching result.

6. method according to claim 1-5, which is characterized in that it is described according to safety detection result to described User rs credentials carry out security protection processing, comprising:

When the safety detection result indicates that the reading process is risk process, indicating risk information is exported, and prompt Whether user prevents the reading process；

When receiving the instruction of the prevention reading process of user, the reading process is prevented to continue to read user rs credentials.

7. according to the method described in claim 6, it is characterized in that, the method also includes:

Pop-up provides the interface of overall killing, whether carries out overall killing to system for selection by the user.

8. a kind of user rs credentials protective device characterized by comprising

Module is obtained, is read out for user rs credentials ought to be monitored, reading process is obtained；

Detection module obtains safety detection result for carrying out safety detection to the reading process；

Processing module, for carrying out security protection processing to the user rs credentials according to safety detection result.

9. a kind of user rs credentials protect equipment characterized by comprising memory and processor, the memory is for storing Computer program；The processor is used to executed when calling the computer program as claim 1-7 is described in any item Method.

10. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the computer program The method according to claim 1 to 7 is realized when being executed by processor.