Method, apparatus, and system of detecting unauthorized data modification

• US 9,633,227 B2
• Filed: 08/04/2014
• Issued: 04/25/2017
• Est. Priority Date: 07/29/2013
• Status: Active Grant

• Current Assignee: Tencent Technology Shenzhen Company Limited (Tencent Holdings Limited)
• Original Assignee: Tencent Technology Shenzhen Company Limited (Tencent Holdings Limited)
• Inventors: Liu, Le, Cai, Cheng, Tang, Wen, Wang, Xuxin, Yao, Jianhui, Zhang, Jin
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Tsang, Henry
• Application Number:
  US14/451,170
• Publication Number:
  US 20150033334A1
• Time in Patent Office: 995 Days
• Field of Search: None
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2109 Game systems

Abstract

Methods, apparatus and system of detecting data security are provided herein. Data for detection are acquired. Whether the data for detection are to be updated for a first time is determined. When the data for detection are to be updated for the first time, the data for detection can be updated, encrypted, and stored as first encrypted data. When the data for detection are not to be updated for the first time, the data for detection can be acquired and encrypted to provide second encrypted data. The second encrypted data are compared with the stored first encrypted data to determine whether the second encrypted data having been unauthorizedly modified. The present disclosure is simple to be implemented without relying on specific logical of a certain application. Development costs, maintenance costs and occupancy of server resources can be reduced. System performance and user experience can be improved.

Claims

1. A method of detecting unauthorized data modification implemented on a game client, the game client is installed on a computing device and executed by one or more processors of the computing device, comprising:

monitoring, by the game client, data updating events for to-be-updated game data;

determining, by the game client, whether the to-be-updated game data need security detection;

updating, by a game logic module of the game client, the to-be-updated game data normally when a detecting module of the game client determines that the to-be-updated game data do not need the security detection;

when the to-be-updated game data needs the security detection, acquiring, by the game client, data for detection, wherein the data for detection is the to-be-updated game data that needs the security detection;

determining whether the data for detection are to be updated for a first time by searching for a historical update record corresponding to the data for detection or searching for an updated data corresponding to the data for detection, wherein when the historical update record or the updated data exists, the data for detection are determined not to be updated for the first time; and

when the historical update record or the updated data does not exist, the data for detection are determined to be updated for the first time; and

when the data for detection are to be updated for the first time,

updating the data for detection,

obtaining the updated data for detection,

encrypting the updated data for detection to provide first encrypted data, and

storing the first encrypted data;

or

when the data for detection are not to be updated for the first time,

acquiring an original value of the data for detection,

encrypting the original value to provide second encrypted data,

acquiring the stored first encrypted data, and

determining that the data for detection have been unauthorizedly modified, after determining that the second encrypted data do not equal to the first encrypted data.

2. The method according to claim 1, wherein the acquiring of data for detection includes:

acquiring data that need to be updated, and determining that the data that need to be updated are the data for detection;

or

acquiring data that need to be updated, and after determining that the data that need to be updated are key data, determining that the data that need to be updated are the data for detection.

3. The method according to claim 1, further including:

receiving address configuration information of data that need to be monitored sent from a server; and

determining whether the security detection is needed for the data, according to the address configuration information of the data;

wherein the acquiring of data for detection includes;

after determining that the security detection is needed for the data, acquiring the data as the data for detection.

4. The method according to claim 1, wherein, after determining that the data for detection have been unauthorizedly modified, the method further includes:

sending a notification message to the server, wherein the notification message indicates that the data have been unauthorizedly modified.

5. The method according to claim 1, further including:

storing the second encrypted data, when that the second encrypted data do not equal to the first encrypted data is determined.

6. The method according to claim 1, further comprising:

reading and writing, by the game logic module, game data through a game data managing module of the game client;

running, by the game logic module, the game data;

managing, by the game data managing module, the game data;

providing, by the game data managing module, the game data to the game logic module and the detecting module; and

receiving, by the detecting module, the to-be-updated game data from the game data managing module when the to-be-updated game data needs the security detection.

7. An apparatus of detecting unauthorized data modification, a game client is installed on the apparatus, comprising:

at least a hardware processor and a plurality of program units of the game client to be executed by the processor for detecting unauthorized data modification, the plurality of program units comprising;

an acquiring unit configured to;

monitor data updating events for to-be-updated game data;

determine whether the to-be-updated game data need security detection; and

when the to-be-updated game data needs the security detection, acquire data for detection, wherein the data for detection is the to-be-updated game data that needs the security detection;

a determining unit configured to determine whether the data for detection are to be updated for a first time by searching for a historical update record corresponding to the data for detection or searching for an updated data corresponding to the data for detection, wherein when the historical update record or the updated data exists, the determining unit determines that the data for detection are not to be updated for the first time; and

when the historical update record or the updated data does not exist, the determining unit determines that the data for detection is to be updated for the first time;

a first processing unit configured, after determining that the data for detection are to be updated for the first time, to update the data for detection, to obtain the updated data for detection, to encrypt the updated data for detection to provide first encrypted data, and to save the first encrypted data; and

a second processing unit configured, after determining that the data for detection are not to be updated for the first time, to acquire an original value of the data for detection, to encrypt the original value to provide second encrypted data, to acquire the stored first encrypted data, and to determine that the data for detection have been unauthorizedly modified, after determining that the second encrypted data do not equal to the first encrypted data;

wherein the game client further includes a game logic module and a detecting module, the game logic module is configured to;

update the to-be-updated game data normally when the detecting module determines that the to-be-updated game data do not need the security detection.

8. The apparatus according to claim 7, wherein:

the acquiring unit is configured to acquire data that need to be updated, and determine that the data that need to be updated are the data for detection.

9. The apparatus according to claim 7, wherein:

the acquiring unit is configured to acquire data that need to be updated, and, after determining that the data that need to be updated are key data, determine that the data that need to be updated are the data for detection.

10. The apparatus according to claim 7, the plurality of program units further including a receiving unit, wherein

the receiving unit is configured to receive address configuration information of data that need to be monitored sent from a server;

the determining unit is configured to determine whether the security detection is needed for the data, according to the address configuration information of the data; and

the acquiring unit is configured, after determining that the security detection is needed for the data, to acquire the data as the data for detection.

11. The apparatus according to claim 7, wherein:

the second processing unit is further configured to send a notification message to the server after determining that the data for detection have been unauthorizedly modified, wherein the notification message indicates that the data have been unauthorizedly modified.

12. The apparatus according to claim 7, wherein:

the second processing unit is further configured to store the second encrypted data, when that the second encrypted data do not equal to the first encrypted data is determined.

13. The apparatus according to claim 7, wherein:

the game client further includes a game data managing module, wherein;

the game logic module is configured to;

read and write game data through the game data managing module; and

run the game data;

the game data managing module is configured to manage the game data, and provide the game data to the game logic module and the detecting module; and

the detecting module is configured to;

monitor the data updating events of the game data managing module for the to-be-updated game data;

determine whether the to-be-updated game data need the security detection;

receive the to-be-updated game data from the game data managing module when the to-be-updated game data needs the security detection.

14. A non-transitory computer-readable medium having computer program of a game client for, when being executed by a processor, performing a method of detecting unauthorized data modification, the method comprising:

monitoring, by the game client, data updating events for to-be-updated game data;

determining, by the game client, whether the to-be-updated game data need security detection;

updating, by a game logic module of the game client, the to-be-updated game data normally when a detecting module of the game client determines that the to-be-updated game data do not need the security detection;

when the to-be-updated game data needs the security detection, acquiring data for detection, wherein the data for detection is the to-be-updated game data that needs the security detection;

determining whether the data for detection are to be updated for a first time by searching for a historical update record corresponding to the data for detection or searching for an updated data corresponding to the data for detection, wherein when the historical update record or the updated data exists, the data for detection are determined not to be updated for the first time; and

when the historical update record or the updated data does not exist, the data for detection are determined to be updated for the first time; and

when the data for detection are to be updated for the first time,

updating the data for detection,

obtaining the updated data for detection,

encrypting the updated data for detection to provide first encrypted data, and

storing the first encrypted data;

or

when the data for detection are not to be updated for the first time,

acquiring an original value of the data for detection,

encrypting the original value to provide second encrypted data,

acquiring the stored first encrypted data, and

determining that the data for detection have been unauthorizedly modified, after determining that the second encrypted data do not equal to the first encrypted data.

15. The non-transitory computer-readable medium according to claim 14, wherein the acquiring of data for detection includes:

acquiring data that need to be updated, and determining that the data that need to be updated are the data for detection;

or

acquiring data that need to be updated, and after determining that the data that need to be updated are key data, determining that the data that need to be updated are the data for detection.

16. The non-transitory computer-readable medium according to claim 14, the method further including:

receiving address configuration information of data that need to be monitored sent from a server; and

determining whether the security detection is needed for the data, according to the address configuration information of the data;

wherein the acquiring of data for detection includes;

after determining that the security detection is needed for the data, acquiring the data as the data for detection.

17. The non-transitory computer-readable medium according to claim 14, wherein, after determining that the data for detection have been unauthorizedly modified, the method further includes:

sending a notification message to the server, wherein the notification message indicates that the data have been unauthorizedly modified.

18. The non-transitory computer-readable medium according to claim 14, the method further including:

storing the second encrypted data, when that the second encrypted data do not equal to the first encrypted data is determined.