CN112434301A

Movatterモバイル変換

Info

Publication number: CN112434301A
Application number: CN202011335338.4A
Authority: CN
Inventors: 廖盼
Original assignee: Ping An Puhui Enterprise Management Co Ltd
Current assignee: Ping An Puhui Enterprise Management Co Ltd
Priority date: 2020-11-24
Filing date: 2020-11-24
Publication date: 2021-03-02

Abstract

The embodiment of the application provides a risk assessment method and a device, wherein the risk assessment method comprises the following steps: carrying out at least one risk check on the terminal equipment to obtain respective corresponding risk values of the at least one risk check; the at least one risk check is at least one of checking whether the terminal device is connected with an agent, checking whether the terminal device is connected with a Virtual Private Network (VPN), and checking whether the terminal device is provided with a hook frame; calculating a total risk value of the terminal equipment according to the risk value corresponding to the at least one risk check; and evaluating the risk level of the terminal equipment according to the total risk value of the terminal equipment and at least one risk level threshold value. By implementing the embodiment of the application, the network condition and the system environment of the current equipment can be known more comprehensively and objectively, so that the risk condition of the equipment can be evaluated more objectively and comprehensively, and user information leakage, property loss and the like can be effectively avoided.

Description

Risk assessment method and device

Technical Field

The present disclosure relates to the field of risk assessment technologies, and in particular, to a risk assessment method and apparatus.

Background

With the rapid development of mobile Applications (APPs), various APPs for e-commerce payment and mobile finance emerge endlessly, in order to ensure the information and property safety of users, firstly, correct risk assessment should be performed on Android (Android) equipment currently used by users, and according to a risk assessment result, users are reasonably prompted and guided to clear high-risk items, or users are limited to perform sensitive operations such as loan and account transfer in a high-risk equipment environment. The traditional Android equipment risk assessment method is that an equipment number of a current user is recorded at a server, if the equipment number is found to be inconsistent with a historical equipment number of a server, the current risk value of the user is judged to be high, the user is required to further input a mobile phone number to eliminate risks through a verification code, or a blacklist equipment number list is maintained, if the current equipment number is in a blacklist and belongs to high-risk equipment, further verification can be adopted to remove risks or limit the use of limited product functions.

However, the existing risk assessment has single dimension, and the risk assessment on the current Android device cannot be carried out comprehensively and accurately.

Therefore, how to realize more comprehensive and accurate risk assessment on the Android device is a problem to be solved urgently.

Disclosure of Invention

In view of the above, the present application is proposed to provide a risk assessment method and apparatus that overcomes or at least partially solves the above mentioned problems.

In a first aspect, an embodiment of the present application provides a risk assessment method, which may include:

carrying out at least one risk check on the terminal equipment to obtain respective corresponding risk values of the at least one risk check; the at least one risk check is at least one of checking whether the terminal device is connected with an agent, checking whether the terminal device is connected with a Virtual Private Network (VPN), and checking whether the terminal device is provided with a hook frame;

calculating a total risk value of the terminal equipment according to the risk value corresponding to the at least one risk check;

and evaluating the risk level of the terminal equipment according to the total risk value of the terminal equipment and at least one risk level threshold value.

In a possible implementation manner, the checking whether the terminal device is connected to an agent corresponds to a first risk value; wherein the first risk value of the terminal device to which the proxy is connected is greater than the first risk value of the terminal device to which the proxy is not connected;

checking whether the terminal equipment is connected with a second risk value corresponding to VPN or not; wherein the second risk value for VPN connected terminal devices is greater than the second risk value for non-VPN connected terminal devices;

checking whether the terminal equipment is provided with a hook frame corresponding to a third risk value or not; wherein the third risk value of the terminal device with a hook frame installed is greater than the third risk value of the terminal device without a hook frame installed; the higher the total risk value is, the higher the risk level of the terminal device is.

In one possible implementation, the method further includes:

acquiring a unique identifier of the terminal equipment;

and uploading the unique identifier and the risk level of the terminal equipment to a server.

In one possible implementation, the method further includes:

receiving indication information sent by the server, wherein the indication information is used for indicating the terminal equipment to carry out security verification; the indication information is information sent to the terminal equipment when the server detects that the terminal equipment corresponding to the unique identifier carries out sensitive operation and the risk level is greater than a preset level.

In one possible implementation, the method further includes:

receiving a prohibition command sent by the server, wherein the prohibition command is used for prohibiting the terminal equipment from carrying out sensitive operation; the prohibition command is a command sent to the terminal equipment when the server detects that the terminal equipment corresponding to the unique identifier performs the sensitive operation and the risk level is greater than a preset level.

In a possible implementation manner, the unique identifier of the terminal device is an international mobile equipment identity IMEI of the terminal device, an Android identification number Android _ ID of the terminal device, or a target character string generated by a random algorithm according to the current timestamp of the terminal device.

In one possible implementation, the sensitive operations include one or more of login, balance inquiry, loan, and transfer; the safety verification comprises one or more of fingerprint verification, face verification and short message verification code verification.

In a second aspect, an embodiment of the present application provides a risk assessment apparatus, where the apparatus includes:

the checking unit is used for carrying out at least one risk check on the terminal equipment to obtain a risk value corresponding to each at least one risk check; the at least one risk check is at least one of checking whether the terminal device is connected with an agent, checking whether the terminal device is connected with a Virtual Private Network (VPN) and checking whether the terminal device is provided with a hook frame;

a calculating unit, configured to calculate a total risk value of the terminal device according to the risk value corresponding to each of the at least one risk check;

and the evaluation unit is used for evaluating the risk level of the terminal equipment according to the total risk value of the terminal equipment and at least one risk level threshold value.

In one possible implementation, the apparatus further includes:

the acquisition unit is used for acquiring the unique identifier of the terminal equipment;

and the uploading unit is used for uploading the unique identifier and the risk level of the terminal equipment to a server.

In one possible implementation, the apparatus further includes:

a first receiving unit, configured to receive indication information sent by the server, where the indication information is used to indicate the terminal device to perform security verification; the indication information is information sent to the terminal equipment when the server detects that the terminal equipment corresponding to the unique identifier carries out sensitive operation and the risk level is greater than a preset level.

In one possible implementation, the apparatus further includes:

a second receiving unit, configured to receive a prohibition command sent by the server, where the prohibition command is used to prohibit the terminal device from performing a sensitive operation; the prohibition command is a command sent to the terminal equipment when the server detects that the terminal equipment corresponding to the unique identifier performs the sensitive operation and the risk level is greater than a preset level.

In a third aspect, an embodiment of the present application provides a terminal device, which includes a storage component, a processing component and a communication component, where the storage component, the processing component and the communication component are connected to each other, the storage component is used for storing a computer program, and the communication component is used for performing information interaction with an external device; the processing component is configured to invoke a computer program to perform the method according to the first aspect, which is not described herein again.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and the computer program is executed by a processor to implement the method in the first aspect, which is not described herein again.

According to the method and the system, the network condition and the system environment of the current terminal equipment can be more comprehensively and objectively known through establishing a multi-dimensional terminal equipment risk assessment system, specifically through multi-aspect risk checks such as whether to connect an agent, whether to connect a VPN and whether to install a hook frame, so that the risk condition of the terminal equipment can be more objectively and comprehensively assessed, user information leakage, property loss and the like are effectively avoided, and a safe information interaction environment is established. In some possible embodiments, the terminal device may be an Android device, such as an Android mobile phone or a tablet computer.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments or the background art of the present application, the drawings required to be used in the embodiments or the background art of the present application will be described below.

Fig. 1 is a schematic system architecture diagram of a risk assessment method according to an embodiment of the present application;

fig. 2 is a schematic flowchart of a risk assessment method according to an embodiment of the present application;

FIG. 3 is a schematic flow chart diagram of another risk assessment method provided in the embodiments of the present application;

fig. 4a is an interface schematic diagram of a terminal device for performing security verification according to an embodiment of the present application;

fig. 4b is a schematic interface diagram of another terminal device for performing security verification according to the embodiment of the present application;

fig. 4c is a schematic interface diagram of another terminal device for security verification according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of a risk assessment device according to an embodiment of the present disclosure;

fig. 6 is a schematic structural diagram of a terminal device according to an embodiment of the present application.

Detailed Description

The embodiments of the present application will be described below with reference to the drawings.

The terms "first," "second," and "third," etc. in the description and claims of this application and in the accompanying drawings are used for distinguishing between different objects and not for describing a particular order. Furthermore, "include" and "have" and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those steps or elements listed, but may alternatively include other steps or elements not listed, or inherent to such process, method, article, or apparatus.

Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.

As used in this application, the terms "server," "unit," "system," and the like are intended to refer to a computer-related entity, either hardware, firmware, a combination of hardware and software, or software in execution. For example, a server may be, but is not limited to, a processor, a data processing platform, a computing device, a computer, two or more computers, and the like.

First, some terms in the present application are explained so as to be easily understood by those skilled in the art.

(1) The International Mobile Equipment identity Number (IMEI) is one of unique identifiers of Android devices. The IMEI is a mark that distinguishes the terminal equipment, is stored in the terminal equipment, and can be used to monitor stolen or invalid terminal equipment. The IMEI may be obtained by the telephonymanager. getdeviceid method in the Android official Application Program Interface (API), but this method usually requires user authorization.

(2) Android identification number (Android _ ID), is one of the unique identifications of Android devices. When the device is started for the first time, the system randomly generates a 64-bit number, and stores the number in the form of a 16-system character string, wherein the 16-system character string is the Android _ ID, and the Android _ ID is reset after the device is wipe (factory reset). It should be noted that, in general, the Android _ ID of the device may be obtained without user authorization.

(3) Proxy (Proxy), otherwise known as network Proxy, is a special network service that allows one network terminal (typically a client) to make an indirect connection with another network terminal (typically a server) through the service. Devices to which agents are connected may be at risk of data being packetized or network requests being tampered with.

(4) Virtual Private Network (VPN) is a technology for establishing a private network on a public network. The connection between any two nodes of the whole VPN network does not have an end-to-end physical link required by the traditional private network, but is constructed on a network platform provided by a public network service provider, and user data is transmitted in a logical link. VPNs encompass extensions of private networks that encapsulate, encrypt, and authenticate links across shared or public networks. The VPN mainly adopts a tunnel technology, an encryption and decryption technology, a key management technology and a user and equipment identity authentication technology. With VPN connected devices, all network requests of its users may risk being intercepted or altered by a third party.

(5) The hook framework is mainly applied to analysis, and although secondary packaging and code re-modification can also be achieved, on one hand, the efficiency is low, and on the other hand, if the APP has verified logic, the APP needs to be further bypassed, so that the whole process is time-consuming and labor-consuming. However, the APP file can be not directly modified in a dynamic hook mode, and the method is convenient. The following are relatively mature several hook frameworks and their applications: xposed, frida, substrate. It should be noted that the hook framework can enable the Api of the hijacking system to add a self-defined logic code, and it is very likely that the user is at risk of being monitored or changing the user behavior in an unauthorized manner.

Next, a system architecture of one of the risk assessment methods based on the embodiments of the present application is described.

Referring to fig. 1, fig. 1 is a schematic diagram of a system architecture of a risk assessment method according to an embodiment of the present disclosure. As shown in fig. 1, the system architecture may include a server 101 and a plurality of terminal devices, and specifically may include a terminal device 201 (for example, a smartphone in fig. 1) and a terminal device 202 (for example, a smartphone in fig. 1), and the like. Both the terminal device 201 and the terminal device 202 may run related application software, such as various instant messaging application software and payment application software (e.g., palm bank, pocket bank, etc.). The user 1 may log in the application software running on the terminal device 201 through the account number and the password of the user, and perform corresponding operations, such as loan, balance inquiry, transfer and the like; the user 2 may also log in the application software running on the terminal device 202 through its own account number and password, and perform corresponding operations, such as loan, balance inquiry, transfer, and the like. As shown in fig. 1, the server 101 may establish a connection with the terminal device 201 and the terminal device 202 through a network, where the server 101 may be a background server of the application software, the server 101 may be a server, or a server cluster composed of a plurality of servers, and the like, and this is not particularly limited in this embodiment of the present application.

In summary, the terminal device in the embodiment of the present application may include, but is not limited to, any electronic product based on an intelligent operating system, which can perform human-computer interaction with a user through an input device such as a keyboard, a virtual keyboard, a touch pad, a touch screen, and a voice control device. The terminal device in the embodiment of the application can be an intelligent wearable device, a smart phone, a tablet computer, a notebook computer, a desktop computer and the like with the functions. The intelligent operating system includes, but is not limited to, any operating system that enriches device functions by providing various mobile applications to the mobile device, for example, the intelligent operating system in the embodiment of the present application may be an Android device, that is, the terminal device in the embodiment of the present application may be an Android device. Optionally, the risk assessment method provided by the application can also be appliedFor iOS^TMAnd Windows Phone^TMAnd other terminal devices of the intelligent operating system, which is not specifically limited in this embodiment of the present application.

It should also be understood that the system architecture of the risk assessment method shown in fig. 1 is only a partial exemplary implementation manner in the embodiment of the present application, and the system architecture of the risk assessment method in the embodiment of the present application includes, but is not limited to, the system architecture of the risk assessment method above.

Referring to fig. 2, fig. 2 is a schematic view illustrating a flow of a risk assessment method according to an embodiment of the present disclosure. Applicable to the system of fig. 1 described above, and described below with reference to fig. 2 from a single side of the terminal device. The method may include the following steps S201 to S203.

Step S201: and carrying out at least one risk check on the terminal equipment to obtain a risk value corresponding to each at least one risk check.

Specifically, when the terminal device performs operations such as login, loan, or transfer, at least one risk check may be performed on the terminal device to obtain a risk value corresponding to each of the at least one risk check. Optionally, the at least one risk check may comprise checking whether the terminal device is connected to an agent, checking whether the terminal device is connected to a virtual private network, VPN, and checking whether the terminal device is installed with a hook frame, etc.

Alternatively, the system Api may be called to obtain the current http. proxyhost and http. proxyport attributes, and if the values obtained by the two attribute values are not equal to null or-1, it represents that the current terminal device is connected to the proxy, and there may be a risk that data is captured or the network request is tampered with.

Alternatively, the current set may be traversed by checking the getNetworkInterfaces network information set of the current terminal device, and if tu 0 or ppp0 is matched, the network representing the current terminal device is connected to the VPN, and the network request sent by the user through the terminal device is most likely to be subject to the risk of being intercepted or altered by a third party.

Alternatively, in one aspect, if the XposedBridge or substrate can be matched, it represents that the hook framework is installed on the current terminal device by traversing all the currently installed applications of the terminal device and the currently running processes of the terminal device. On the other hand, by analyzing the stack data of the memory space of the current terminal device, if the XposedBridge or substrate key information can be matched, it also represents that the hook frame is installed on the current terminal device, and it is possible for the user to be at risk of being monitored or changing the user behavior without authorization.

Step S202: and calculating the total risk value of the terminal equipment according to the risk value corresponding to the at least one risk check.

Specifically, the terminal device may calculate a total risk value of the terminal device according to the risk value corresponding to each of the at least one risk check.

Optionally, it is checked whether the terminal device is connected to the agent and may correspond to the first risk value, and in general, the first risk value of the terminal device connected to the agent is greater than the first risk value of the terminal device not connected to the agent. For example, the first risk value may be 0 if the terminal device is checked to be not connected to the agent, and may be 20 if the terminal device is connected to the agent.

Optionally, checking whether the terminal device is connected to the VPN may correspond to a second risk value, where in general, the second risk value of the terminal device connected to the VPN is greater than the second risk value of the terminal device not connected to the VPN. For example, if the terminal device is checked to have no VPN connected, the second risk value may be 0, and if the terminal device has VPN connected, the second risk value may be 30.

Optionally, checking whether the terminal device is installed with the hook frame may correspond to a third risk value, where in general, the third risk value of the terminal device with the hook frame installed is greater than the third risk value of the terminal device without the hook frame installed. For example, if the check indicates that the hook frame is not installed in the terminal device, the third risk value may be 0, and if the hook frame is installed in the terminal device, the third risk value may be 40.

Optionally, after completing the risk check on whether the terminal device connects to the agent, whether the terminal device connects to the VPN, and whether the hook frame is installed, the total risk value of the terminal device may be obtained by calculating a sum of the first risk value, the second risk value, and the third risk value.

As described above, the risk values corresponding to the risk checks may be set according to a certain weight, that is, different risk checks may correspond to different risk values. For example, the risk resulting from installing the hook frame is often greater than connecting the VPN, and the risk value for installing the hook frame may be set to be greater than connecting the VPN. For example, the initial risk value of the terminal device may be set to 0, the risk value is increased by 20 if the agent is connected, the risk value is increased by 30 if the VPN is connected, the risk value is increased by 40 if the hook frame is installed, and the like, which is not specifically limited in this embodiment of the present application.

Step S203: and evaluating the risk level of the terminal equipment according to the total risk value of the terminal equipment and at least one risk level threshold value.

Specifically, the risk level of the terminal device may be evaluated according to at least one risk check, a final calculated total risk value of the terminal device, and at least one preset risk level threshold. Optionally, if the total risk value is greater than or equal to a primary risk level threshold (for example, 60), the risk level of the terminal device may be a primary risk level; if the total risk value is greater than or equal to a secondary risk level threshold (e.g., 40), the risk level of the terminal device may be a secondary risk level; if the total risk value is greater than or equal to the third-level risk level threshold (for example, 20), the risk level of the terminal device may be a third-level risk level, and so on, which is not described herein again. For example, if the terminal device is checked to have no agent or VPN connected, but a hook frame is installed, the total risk value of the terminal device may be 40, and the risk level of the terminal device is a secondary risk level.

It will be appreciated that in general, the primary risk level threshold is greater than the secondary risk level threshold, the secondary risk level threshold is greater than the tertiary risk level threshold, and so on. In addition, the first-level risk level is higher than the second-level risk level, the second-level risk level is higher than the third-level risk level, and the like, which are not described herein again, that is, the higher the total risk value of the terminal device is, the higher the risk level thereof is, the more easily the leakage of user information and property loss are caused. Therefore, when the terminal device performs sensitive operation (such as login, loan or transfer operation), safety verification can be performed according to the risk level requirement of the terminal device or the user is directly prohibited from performing the sensitive operation, so that the information and property safety of the user can be protected.

Referring to fig. 3, fig. 3 is a schematic view illustrating another process of a risk assessment method according to an embodiment of the present disclosure. The system applicable to the above-mentioned fig. 1 will be described below from the interactive side of the terminal device and the server in conjunction with fig. 3. The method may comprise the following steps S301-S307.

Step S301: the terminal equipment acquires the unique identification of the terminal equipment.

Specifically, the terminal device may optionally use the unique identifier as an IMEI of the terminal device, an Android identification number Android _ ID of the terminal device, or a target character string generated by a random algorithm according to a current timestamp of the terminal device, and the like.

Optionally, the terminal device may obtain an IMEI of the terminal device by using a telephonymanager. However, in general, since the method requires user authorization, if the user is not authorized, the Android _ ID of the terminal device may be obtained, and the Android _ ID may also be used as a unique identifier of the terminal device. It should be noted that although the method for obtaining the Android _ ID of the terminal device does not require user authorization, some vendors may modify the method to return an empty string in this manner. Therefore, if a valid unique identifier is not obtained by the first two methods, a 16-bit character string (or a 32-bit character string, etc.) may be generated by a random algorithm with the current timestamp of the terminal device as a standard, and the 16-bit character string may be used as the unique identifier of the terminal device.

It should be noted that, in the embodiment of the present application, the execution sequence of step S301 is not specifically limited, for example, the unique identifier of the terminal device may be obtained before performing risk check, the unique identifier of the terminal device may also be obtained after completing each risk check, the unique identifier of the terminal device may also be obtained after evaluating the risk level of the terminal device, and the like, which are not described herein again.

Step S302: the terminal equipment carries out at least one risk check on the terminal equipment to obtain the risk value corresponding to each at least one risk check.

Specifically, step S302 may refer to the embodiment corresponding to step S201 in fig. 2, which is not described herein again.

Optionally, the risk check may further include checking whether the terminal device is a historical frequently-used device, checking whether a current location of the terminal device is a different location, and the like, which is not specifically limited in this embodiment of the application.

Step S303: and the terminal equipment evaluates the risk level of the terminal equipment according to the risk value and the at least one risk level threshold value which are respectively corresponding to the at least one risk check.

Specifically, step S303 may refer to the above embodiment corresponding to step S202 and step S203 in fig. 2, and details are not repeated here.

Step S304: and the terminal equipment uploads the unique identifier and the risk level of the terminal equipment to the server.

Specifically, after obtaining the unique identifier and the risk level of the terminal device, the terminal device may upload the unique identifier and the risk level of the terminal device to the server.

Step S305: the server records the unique identification and the risk level of the terminal device.

Specifically, the server receives the unique identifier and the risk level uploaded by the terminal device, and records (i.e., stores) the unique identifier and the risk level of the terminal device. Optionally, the server may receive and record the unique identifier and the risk level of each of the plurality of terminal devices.

Step S306: and if the server detects that the terminal equipment carries out sensitive operation and the risk level exceeds the preset level, sending indication information to the terminal equipment.

Specifically, if the server detects that the terminal device corresponding to the unique identifier performs a sensitive operation (for example, it detects that the user wants to perform a loan), and the risk level of the terminal device exceeds a preset level, the server may send indication information to the terminal device, where the indication information may be used to indicate the terminal device to perform security verification.

Optionally, the terminal device may be instructed to perform different security verifications according to different risk levels of the terminal device, for example, if the risk level of the terminal device is a higher level, the terminal device may be instructed to perform face verification, and if the risk level of the terminal device is a lower level, the terminal device may be instructed to perform short message verification code verification, and the like. Alternatively, the server may directly send a prohibition command to the terminal device, thereby directly prohibiting the terminal device from performing operations such as loan or transfer.

Step S307: and the terminal equipment performs security verification according to the indication information.

Specifically, the terminal device receives indication information sent by the server, and performs security verification according to the indication information.

Optionally, please refer to fig. 4a, where fig. 4a is a schematic interface diagram of a terminal device for performing security verification according to an embodiment of the present application. As shown in fig. 4a, the terminal device displays atransfer interface 401, the user inputs payee information (for example, "zhang san 645782 x 1100 china xx bank" shown in fig. 4 a) and transfer amount (for example, 5000.00 shown in fig. 4 a) through thetransfer interface 401, and clicks the confirmation transfer control 402, and if the risk level of the terminal device is evaluated to be the secondary risk level, as shown in fig. 4a, the terminal device may display afingerprint verification interface 403. The user can input the fingerprint through thefingerprint verification interface 403 to perform security verification, and if the fingerprint passes the verification, the user can perform a transfer operation.

Referring to fig. 4b, fig. 4b is a schematic interface diagram of another terminal device for performing security verification according to an embodiment of the present disclosure. As shown in fig. 4b, the terminal device displays alogin interface 404, and after the user inputs an account, a password, and an authentication code through thelogin interface 404 and clicks alogin control 405, if the risk level of the terminal device is obtained through evaluation as a secondary risk level, as shown in fig. 4b, the terminal device may display afingerprint authentication interface 406. The user can input the fingerprint through thefingerprint verification interface 406 to perform security verification, and if the fingerprint passes the verification, the user can perform login operation.

Referring to fig. 4c, fig. 4c is a schematic interface diagram of another terminal device for performing security verification according to an embodiment of the present disclosure. As shown in fig. 4c, the terminal device displays aloan interface 407, and the user can select a loan bank, a loan amount (e.g., 25000.00 shown in fig. 4 c), a loan time (e.g., 1 year shown in fig. 4 c), a loan interest rate (e.g., 4.35% shown in fig. 4 c), and so on through theloan interface 407. After the user clicks theloan confirmation control 408, if the risk level of the terminal device is evaluated to be the first-level risk level, the terminal device may display aface verification interface 409 as shown in fig. 4 c. The user can identify a face through theface verification interface 409 to perform security verification, and if the face verification passes, a loan operation can be performed. Alternatively, the user may further limit the loan amount, for example, the loan amount is intelligently below 5000 yuan, and so on, which will not be described herein.

According to the method and the system, the network condition and the system environment of the current terminal equipment can be more comprehensively and objectively known through establishing a multi-dimensional terminal equipment risk assessment system, specifically through multi-aspect risk checks such as whether to connect an agent, whether to connect a VPN and whether to install a hook frame, so that the risk condition of the terminal equipment can be more objectively and comprehensively assessed, user information leakage, property loss and the like are effectively avoided, and a safe information interaction environment is established.

The method of the embodiment of the present application is explained in detail above, and a risk assessment device related to the embodiment of the present application is provided below, where the risk assessment device may be a terminal device that assesses the risk level of the current device through multi-aspect risk check. Referring to fig. 5, fig. 5 is a schematic structural diagram of a risk assessment apparatus according to an embodiment of the present disclosure. Therisk assessment arrangement 50 may comprise anexamination unit 501, acalculation unit 502 and anassessment unit 503.

Achecking unit 501, configured to perform at least one risk check on a terminal device, to obtain a risk value corresponding to each of the at least one risk check; the at least one risk check is at least one of checking whether the terminal device is connected with an agent, checking whether the terminal device is connected with a Virtual Private Network (VPN) and checking whether the terminal device is provided with a hook frame;

a calculatingunit 502, configured to calculate a total risk value of the terminal device according to the risk value corresponding to each of the at least one risk check;

an evaluatingunit 503, configured to evaluate a risk level of the terminal device according to the total risk value of the terminal device and at least one risk level threshold.

In one possible implementation, the apparatus further includes:

an obtainingunit 504, configured to obtain a unique identifier of the terminal device;

anuploading unit 505, configured to upload the unique identifier and the risk level of the terminal device to a server.

In one possible implementation, the apparatus further includes:

afirst receiving unit 506, configured to receive indication information sent by the server, where the indication information is used to indicate the terminal device to perform security verification; the indication information is information sent to the terminal equipment when the server detects that the terminal equipment corresponding to the unique identifier carries out sensitive operation and the risk level is greater than a preset level.

In one possible implementation, the apparatus further includes:

asecond receiving unit 507, configured to receive a prohibition command sent by the server, where the prohibition command is used to prohibit the terminal device from performing a sensitive operation; the prohibition command is a command sent to the terminal equipment when the server detects that the terminal equipment corresponding to the unique identifier performs the sensitive operation and the risk level is greater than a preset level.

It should be noted that implementation of each operation may also correspond to corresponding description of the method embodiments shown in fig. 2 and fig. 3, and details are not described here again.

Referring to fig. 6, fig. 6 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure, where theterminal device 60 includes at least oneprocessor 601, at least onememory 602, and at least onecommunication interface 603. In addition, the device may also include common components such as an antenna, which will not be described in detail herein.

Theprocessor 601 may be a general purpose Central Processing Unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of programs according to the above schemes.

Communication interface 603 is used for communicating with other devices or communication Networks, such as ethernet, Radio Access Network (RAN), core network, Wireless Local Area Networks (WLAN), etc.

TheMemory 602 may be a Read-Only Memory (ROM) or other type of static storage device that can store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that can store information and instructions, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical Disc storage, optical Disc storage (including Compact Disc, laser Disc, optical Disc, digital versatile Disc, blu-ray Disc, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to these. The memory may be self-contained and coupled to the processor via a bus. The memory may also be integral to the processor.

Thememory 602 is used for storing application program codes for executing the above scheme, and theprocessor 601 controls the execution. Theprocessor 601 is used to execute application program code stored in thememory 602.

The code stored in thememory 602 may perform the risk assessment method provided in fig. 2 or fig. 3, for example, theterminal device 60 may perform at least one risk check on the terminal device, to obtain a risk value corresponding to each of the at least one risk check; the at least one risk check is at least one of checking whether the terminal device is connected with an agent, checking whether the terminal device is connected with a Virtual Private Network (VPN), and checking whether the terminal device is provided with a hook frame; calculating a total risk value of the terminal equipment according to the risk value corresponding to the at least one risk check; and evaluating the risk level of the terminal equipment according to the total risk value of the terminal equipment and at least one risk level threshold value.

It should be noted that, for the functions of each functional unit in theterminal device 60 described in the embodiment of the present application, reference may be made to corresponding descriptions of the method embodiments shown in fig. 2 and fig. 3, and details are not repeated here.

In this application, the units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiments of the present application.

In addition, functional components in the embodiments of the present application may be integrated into one component, or each component may exist alone physically, or two or more components may be integrated into one component. The integrated components can be realized in a form of hardware or a form of software functional units.

The integrated components, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially or partially implemented in the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method described in the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.

While the invention has been described with reference to specific embodiments, the scope of the invention is not limited thereto, and those skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the invention. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

It should be understood that, in the various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. While the present application has been described herein in conjunction with various embodiments, other variations to the disclosed embodiments may be understood and effected by those skilled in the art in practicing the present application as claimed herein.

Claims

Translated fromChinese

1.一种风险评估方法，其特征在于，包括：1. a risk assessment method, is characterized in that, comprises:

对终端设备进行至少一项风险检查，得到所述至少一项风险检查各自对应的风险值；所述至少一项风险检查为检查所述终端设备是否连接代理、检查所述终端设备是否连接虚拟专用网络VPN和检查所述终端设备是否安装hook框架中的至少一项；Perform at least one risk check on the terminal device, and obtain the risk value corresponding to the at least one risk check; the at least one risk check is to check whether the terminal device is connected to an agent, and whether the terminal device is connected to a virtual private At least one of network VPN and checking whether the terminal device is installed with the hook framework;

根据所述至少一项风险检查各自对应的风险值，计算所述终端设备的风险总值；Calculate the total risk value of the terminal device according to the respective corresponding risk values of the at least one risk check;

根据所述终端设备的所述风险总值和至少一个风险等级阈值，评估所述终端设备的风险等级。The risk level of the terminal device is evaluated based on the total risk value of the terminal device and at least one risk level threshold.

2.根据权利要求1所述的方法，其特征在于，2. The method according to claim 1, wherein

所述检查所述终端设备是否连接代理对应第一风险值；其中，已连接代理的所述终端设备的所述第一风险值大于未连接代理的所述终端设备的所述第一风险值；The checking whether the terminal device is connected to an agent corresponds to a first risk value; wherein, the first risk value of the terminal device connected to the agent is greater than the first risk value of the terminal device not connected to the agent;

所述检查所述终端设备是否连接VPN对应第二风险值；其中，已连接VPN的所述终端设备的所述第二风险值大于未连接VPN的所述终端设备的所述第二风险值；The checking whether the terminal device is connected to a VPN corresponds to a second risk value; wherein the second risk value of the terminal device connected to the VPN is greater than the second risk value of the terminal device not connected to the VPN;

所述检查所述终端设备是否安装hook框架对应第三风险值；其中，已安装hook框架的所述终端设备的所述第三风险值大于未安装hook框架的所述终端设备的所述第三风险值；所述风险总值越高，则所述终端设备的风险等级越高。The checking whether the hook framework is installed on the terminal device corresponds to a third risk value; wherein, the third risk value of the terminal device with the hook framework installed is greater than the third risk value of the terminal device without the hook framework installed. Risk value; the higher the total risk value, the higher the risk level of the terminal device.

3.根据权利要求1所述的方法，其特征在于，所述方法还包括：3. The method according to claim 1, wherein the method further comprises:

获取所述终端设备的唯一标识；Obtain the unique identifier of the terminal device;

将所述终端设备的所述唯一标识和所述风险等级上传至服务器。Uploading the unique identification of the terminal device and the risk level to the server.

4.根据权利要求3所述的方法，其特征在于，所述方法还包括：4. The method according to claim 3, wherein the method further comprises:

接收所述服务器发送的指示信息，所述指示信息用于指示所述终端设备进行安全验证；所述指示信息为所述服务器检测到所述唯一标识对应的所述终端设备进行敏感操作，且所述风险等级大于预设等级时，向所述终端设备发送的信息。Receive indication information sent by the server, where the indication information is used to instruct the terminal device to perform security verification; the indication information is that the server detects that the terminal device corresponding to the unique identifier performs a sensitive operation, and the information sent to the terminal device when the risk level is greater than a preset level.

5.根据权利要求3所述的方法，其特征在于，所述方法还包括：5. The method according to claim 3, wherein the method further comprises:

接收所述服务器发送的禁止命令，所述禁止命令用于禁止所述终端设备进行敏感操作；所述禁止命令为所述服务器检测到所述唯一标识对应的所述终端设备进行所述敏感操作，且所述风险等级大于预设等级时，向所述终端设备发送的命令。receiving a prohibition command sent by the server, where the prohibition command is used to prohibit the terminal device from performing the sensitive operation; the prohibition command is that the server detects that the terminal device corresponding to the unique identifier performs the sensitive operation, And the command sent to the terminal device when the risk level is greater than a preset level.

6.根据权利要求5所述的方法，其特征在于，所述终端设备的唯一标识为所述终端设备的国际移动设备识别码IMEI、所述终端设备的安卓标识号Android_ID或者根据所述终端设备当前的时间戳通过随机算法生成的目标字符串。6. The method according to claim 5, wherein the unique identification of the terminal device is the International Mobile Equipment Identity code IMEI of the terminal device, the Android identification number Android_ID of the terminal device or according to the terminal device The current timestamp is the target string generated by a random algorithm.

7.根据权利要求6所述的方法，其特征在于，所述敏感操作包括登录、余额查询、贷款和转账中的一种或者多种；所述安全验证包括指纹验证、人脸验证和短信验证码验证中的一种或者多种。7. The method according to claim 6, wherein the sensitive operation comprises one or more of login, balance inquiry, loan and transfer; and the security verification comprises fingerprint verification, face verification and SMS verification One or more of code verification.

8.一种风险评估装置，其特征在于，包括：8. A risk assessment device, comprising:

检查单元，用于对终端设备进行至少一项风险检查，得到所述至少一项风险检查各自对应的风险值；所述至少一项风险检查为检查所述终端设备是否连接代理、检查所述终端设备是否连接虚拟专用网络VPN和检查所述终端设备是否安装hook框架中的至少一种；The checking unit is configured to perform at least one risk check on the terminal device, and obtain the corresponding risk value of the at least one risk check; the at least one risk check is to check whether the terminal device is connected to an agent, check the terminal Whether the device is connected to a virtual private network VPN and at least one of checking whether the terminal device is installed with a hook framework;

计算单元，用于根据所述至少一项风险检查各自对应的风险值，计算所述终端设备的风险总值；a calculation unit, configured to check the respective corresponding risk values according to the at least one risk item, and calculate the total risk value of the terminal device;

评估单元，用于根据所述终端设备的所述风险总值和至少一个风险等级阈值，评估所述终端设备的风险等级。An evaluation unit, configured to evaluate the risk level of the terminal device according to the total risk value of the terminal device and at least one risk level threshold.

9.一种终端设备，其特征在于，所述终端设备包括处理器、存储器，其中，存储器用于存储计算机程序，处理器被配置用于调用所述计算机程序，执行如权利要求1-7任意一项所述的方法。9. A terminal device, characterized in that the terminal device comprises a processor and a memory, wherein the memory is used to store a computer program, and the processor is configured to call the computer program to execute any one of claims 1-7. one of the methods described.

10.一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行以实现权利要求1-7任意一项所述的方法。10. A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method of any one of claims 1-7.