CN111953637B - Application service method and device - Google Patents

Abstract

The present application provides an application service method, comprising: in a rich execution environment, judging whether a target application has a registered service, if so, obtaining a service request of the target application, obtaining the current identification information of the target application according to the service request, and using Obtain the current signature information of the target application from the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is consistent with the initial identification information when the target application was registered, then In the trusted execution environment, it is judged whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, and if so, it is processed according to the service request of the target application. Using the application service method of the present application, by comparing whether the current information of the target application is consistent with the initial information during registration, and processing the service request when they are consistent, the security of the user using the target application service is ensured.

Description

Application service method and device

technical field

The present application relates to the field of application services, in particular to an application service method and device.

Background technique

In recent years, there have been more and more artificial intelligence services in terminal devices, and these artificial intelligence services usually need to have very good personalized functions in order to be favored by consumers. In this regard, manufacturers of terminal equipment or enterprises that develop Internet all hope to provide personalized services at different levels of terminal equipment (including operating system layer, framework layer, application layer, etc.).

Most of the personalized services of terminal devices in the current technology adopt the following design ideas: first, obtain the feedback data of the user using the terminal device, and then upload the feedback data to the backend server, and the backend server builds a model according to the received feedback data Then, according to the trained model, the feedback data is used to make decisions; finally, the decision result is fed back to the terminal device, so that the user can receive the decision result.

The above-mentioned existing personalized services have obvious technical defects. First of all, most of these services need to obtain the user's usage and operation logs and send them back to the background server (not limited to cloud servers), and then build a cloud-based personalized model, and then upgrade the software. The way of package or upgrade application program is pushed back to the terminal device, so as to realize the upgrade of personalized service function. However, this method is not only costly, but also violates the user's personal privacy to a certain extent. Even if the terminal device is equipped with an artificial intelligence chip, if the design of the personalized service solution is flawed, it is easy to be exploited by hackers, resulting in the inability to use the functions of the terminal device, and even the hidden danger of loss and leakage of property and private data.

SUMMARY OF THE INVENTION

The present application provides an application service method to solve the problems of insecurity and high transmission cost in the existing application data transmission process. The present application also relates to an application service device.

This application provides an application service method, including:

In the rich execution environment, determine whether the target application has a registered service, if so, obtain the service request of the target application, obtain the current identification information of the target application according to the service request, and obtain the current identification information of the target application through the current identification information. Obtain the current signature information of the target application; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered;

If the current identification information of the target application is consistent with the initial identification information at the time of registration of the target application, determine in the trusted execution environment whether the current signature information of the target application and the initial signature information at the time of registration of the target application are not If it is consistent, if it is, it will be processed according to the service request of the target application.

Optionally, also include:

In the rich execution environment, the service registration request of the target application is obtained, the initial identification information of the target application is obtained according to the service registration request, and the initial signature information of the target application is obtained through the initial identification information;

In a trusted execution environment, according to the initial signature information and the initial identification information, a service identifier that needs to register a service is generated, and the service identifier is returned to the target application.

Optionally, obtaining the initial identification information of the target application according to the service registration request includes:

Obtain the identification information of the target application at a higher authority layer than the target application;

The identification information is used as the initial identification information of the target application.

Optionally, obtaining the initial signature information of the target application by using the initial identification information includes:

Obtain the code segment and the code segment location of the target application according to the initial identification information;

Obtain initial signature information of the target application according to the code segment and the location of the code segment.

Optionally, obtaining the initial signature information of the target application according to the code segment and the location of the code segment includes:

Splicing the code segment and the code segment position to obtain the spliced code information;

Obtain the signature information of the code segment according to the spliced code information;

The signature information of the code segment is used as the initial signature information of the target application.

Optionally, obtaining the code segment and the location of the code segment of the target application according to the initial identification information includes:

Determine the target application according to the initial identification information;

At least one code segment is selected from the code of the target application as the code segment of the target application.

Optionally, also include:

Determine whether the target application has the permission to obtain the code segment;

The obtaining the code segment of the target application through the initial identification information includes:

If it is determined that the target application has the right to acquire the code segment, the code segment of the target application is acquired through the initial identification information.

Optionally, in the trusted execution environment, according to the initial signature information and the initial identification information, a service identifier that needs to register a service is generated, including:

storing the initial signature information and the initial identification information in the database of the trusted execution environment;

In the trusted execution environment, a service identifier corresponding to the initial signature information and the initial identification information that needs to register a service is generated.

Optionally, the returning the service identifier to the target application includes:

In the rich execution environment, using the service identifier as an index, the initial identification information and the initial signature information of the registered target application are stored; The service identifier is returned to the target application.

Optionally, the service registration request includes at least one of the following information:

Name information of the service that needs to be registered in the target application;

Information on whether data encryption is enabled for the service that needs to be registered;

Data encryption algorithm information for the service that needs to be registered;

The public key information is decrypted for the data of the service that needs to be registered.

Optionally, the initial identification information of the target application includes at least a unique identifier of the target application, and the unique identifier is a unique identifier of the target application in the kernel permission layer.

Optionally, the judging whether the target application has a registered service includes:

Obtain information about all services of the target application;

Determine whether all services of the target application have service identifiers.

Optionally, the judging whether the current identification information of the target application is consistent with the initial identification information when the target application was registered includes:

Obtain the identification information of the target application at a higher authority layer than the target application, and use the identification information as the current identification information of the target application;

Obtain the initial identification information when the target application is registered;

Determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

Optionally, judging whether the current signature information of the target application is consistent with the initial signature information when the target application was registered in the trusted execution environment includes:

Obtain the current signature information of the target application according to the current identification information of the target application;

Obtain the initial signature information when the target application is registered;

Determine whether the current signature information of the target application is consistent with the initial signature information when the target application was registered.

Optionally, obtaining the current signature information of the target application according to the current identification information of the target application includes:

Acquire a code segment and a code segment location of the target application according to the current identification information;

Obtain current signature information of the target application according to the code segment and the location of the code segment.

Optionally, the obtaining the current signature information of the target application according to the code segment and the location of the code segment includes:

Splicing the code segment and the code segment position to obtain the spliced code information;

Obtain the signature information of the code segment according to the spliced code information;

The signature information of the code segment is used as the current signature information of the target application.

Optionally, obtaining the code segment and code segment location of the target application according to the current identification information includes:

Determine the target application according to the current identification information;

At least one code segment is selected from the code of the target application as the code segment of the target application.

Optionally, also include:

Determine whether the target application has the permission to obtain the code segment;

The obtaining the code segment of the target application through the current identification information includes:

If it is determined that the target application has the right to acquire the code segment, the code segment of the target application is acquired through the current identification information.

Optionally, the obtaining the service request of the target application includes:

In the rich execution environment, the feedback data sample of the target application is obtained; the obtained feedback data sample of the target application is used as the service request of the obtained target application;

The processing according to the service request of the target application includes: in a trusted execution environment, training a decision model for obtaining a service decision result according to the feedback data of the target application according to the feedback data sample; The decision model of the service decision result is used as the processing result.

Optionally, also include:

In the rich execution environment, obtain feedback data of the target application;

In the trusted execution environment, according to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, also include:

In the trusted execution environment, the feedback data of the target application is stored in a database;

Judging whether the collection of the feedback data is completed, if the judgment result is yes, delete all the feedback data in the database;

According to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, also include:

Determine whether the feedback data is encrypted, and if so, decrypt the feedback data;

The obtaining, according to the feedback data of the target application and the decision-making model, a service decision result for the feedback data of the target application includes:

According to the decrypted feedback data and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the obtaining the service request of the target application includes:

In the rich execution environment, the feedback data of the target application is obtained, the candidate object is obtained according to the feedback data, and the decision request of the target application is obtained; the decision request for obtaining the target application is used as the target application's Request for service;

The processing according to the service request of the target application includes: in a trusted execution environment, obtaining a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and according to the candidate object and the decision-making model to obtain a decision-making result; the obtained decision-making result is used as a processing result.

Optionally, the obtaining the candidate object according to the feedback data includes:

obtaining the set of objects corresponding to the feedback data;

Filtering conditions for the feedback data are obtained, objects that meet the filtering conditions are filtered out from the object set, and the objects that meet the filtering conditions are used as candidate objects.

Optionally, obtaining a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application includes:

Obtain the service identifier contained in the decision request;

The decision model is obtained by using the service identifier as an index.

Optionally, obtaining a decision result according to the candidate object and the decision model includes:

Scoring each element of the candidate object according to the decision model to obtain a scoring result;

Sort each element according to the scoring result to obtain a sorting result;

The scoring result and the ranking result are used as the decision result.

Correspondingly, the present application also provides an application service device, including:

a service judging unit, configured to judge whether the target application has a registered service in the rich execution environment, if so, obtain a service request of the target application, and obtain the current identification information of the target application according to the service request, Obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; If the initial identification information when the target application is registered is consistent, then in the trusted execution environment, determine whether the current signature information of the target application is consistent with the initial signature information when the target application is registered;

The service processing unit is configured to perform processing according to the service request of the target application if the judgment result is yes.

The application also provides a terminal, including:

A service judgment unit, configured to judge whether the target application has a registered service in the rich execution environment of the terminal, if so, obtain the service request of the target application, and obtain the current status of the target application according to the service request identification information, obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is consistent If the information is consistent with the initial identification information when the target application is registered, then determine whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in the trusted execution environment in the terminal;

The service processing unit is configured to perform processing according to the service request of the target application if the judgment result is yes.

Compared with the prior art, the present application has the following advantages:

The present application provides an application service method, comprising: in a rich execution environment, judging whether a target application has a registered service, if so, obtaining a service request of the target application, obtaining the current identification information of the target application according to the service request, and using Obtain the current signature information of the target application from the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is consistent with the initial identification information when the target application was registered, then In the trusted execution environment, it is determined whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, and if so, it is processed according to the service request of the target application. By using the application service method of the present application, by comparing whether the current information of the target application is consistent with the initial information at the time of registration, and processing the service request when they are consistent, the security guarantee is provided for the target application using the service of the present application to prevent The service of the target application is tampered with in the process of data transmission, so as to ensure the security of the user using the service of the target application.

In the further improved technical solution of the present application, before using the application service of the present application, the application needs to be registered. When registering the service of the target application of the present application, the initial identification information of the target application used is in It is obtained from a permission layer higher than that of the target application, thus further reducing the possibility of data being tampered with when using the service of the target application to transmit data.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments described in this application. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings.

FIG. 1 is a flowchart of an application service method according to Embodiment 1 of the present application.

FIG. 2 is a flowchart of a service registration method for an application according to Embodiment 2 of the present application.

FIG. 3 is a flowchart of a method for processing feedback data for a target application according to Embodiment 3 of the present application.

FIG. 4 is a flowchart of an online decision-making method according to Embodiment 4 of the present application.

FIG. 5 is a flowchart of a service deregistration method of an application according to Embodiment 5 of the present application.

FIG. 6 is a schematic diagram of an application service apparatus according to Embodiment 6 of the present application.

FIG. 7 is a schematic diagram of a terminal according to Embodiment 8 of the present application.

FIG. 8 is a schematic diagram of components of a system for application services according to Embodiment 9 of the present application.

Detailed ways

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, the present application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar promotions without violating the connotation of the present application. Therefore, the present application is not limited by the specific implementation disclosed below.

The present application provides an application service method and device, the following are specific embodiments:

As shown in FIG. 1 , it is a flowchart of an embodiment of an application service method according to Embodiment 1 of the present application. The method includes the following steps.

Step S101: In the rich execution environment, determine whether the target application has a registered service, if so, obtain the service request of the target application, obtain the current identification information of the target application according to the service request, and obtain the current identification information of the target application through the current identification information. Signature information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

Step S102: if the current identification information of the target application is consistent with the initial identification information when the target application was registered, then judge in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, and if so, then It is processed according to the service request of the target application.

The application service method of the present application includes a service registration process of a target application, a feedback data processing process, and an online decision-making process. In the following description, three embodiments are respectively used to describe the three processes one by one.

As shown in FIG. 2 , it is a flowchart of an embodiment of an application service registration method according to Embodiment 2 of the present application. The method includes the following steps.

Step S201: In the rich execution environment, a service registration request of the target application is obtained, initial identification information of the target application is obtained according to the service registration request, and initial signature information of the target application is obtained through the initial identification information.

When the application service registration method of this embodiment is used to register the service of the application, the service registration request of the target application is obtained first, and the service registration request includes at least one of the following information: name information of the service that needs to be registered in the target application. information on whether data encryption is enabled for the service that needs to be registered, the data encryption algorithm information for the service that needs to be registered, and the public key information for data decryption for the service that needs to be registered.

Taking a service of a target application registered using the method of this embodiment as an example, assuming that the target application is APP1, in practice, the service functions of APP1 may be various. Taking a service registration as an example, the name information of the service to be registered in the target application can be placed in the service registration request, so as to determine which service function of the target application is to be registered with the method of this embodiment. In order to ensure that after the method of this embodiment is used for registration, the data will be free from the risk of being tampered with during the subsequent transmission of the data of the target application, the information on whether data encryption is enabled for the service that needs to be registered may also be placed in the service registration request. . Similarly, if the information for enabling data encryption is placed in the service registration request, the data encryption algorithm information for the service that needs to be registered and the data decryption public key information for the service that needs to be registered can also be placed in the service registration request. .

Specifically, the service registration request may be a request including name information of the above-mentioned service, information on whether data encryption is enabled for the service that needs to be registered, data encryption algorithm information of the service that needs to be registered, and public key information for data decryption of the service that needs to be registered. string information. Since the algorithms involved in encryption, decryption, and encryption have been researched to a relatively mature degree in the prior art, they will not be repeated here.

After that, according to the service registration request, the initial identification information of the target application is acquired. Specifically, obtaining the initial identification information of the target application may be obtaining the identification information of the target application at a higher authority layer than the target application, and using the identification information at a higher authority layer than the target application as the initial identification information of the target application. The authority layer higher than the target may be the kernel layer of the system running the target application, or other layers of the system. It can be understood here that as long as the authority layer is higher than the target application, of course, in this embodiment , the system here refers to the system used in this application to register, cancel and serve the service of the target application. It should be noted that the initial identification information of the target application in this part can be the unique identifier of the target application in the system used to register, log out and serve the service of the target application, for example, it can be the target application in the system kernel permission layer. Uniquely identifies.

After the identification information of the target application is obtained, the initial signature information of the target application is obtained according to the initial identification information. Specifically, the initial signature information may be obtained by the following description.

First, the code segment and the location of the code segment of the target application are obtained according to the initial identification information.

After that, the initial signature information of the target application is obtained according to the code segment and the location of the code segment. Specifically, as one of the ways to obtain the initial signature information of the target application according to the code segment and the position of the code segment, the code segment and the location of the code segment can be spliced to obtain the spliced code information, and the signature information of the code segment can be calculated by the HASH algorithm. , take the signature information of the code segment as the initial signature information of the target application.

In this embodiment, the initial signature information is used to ensure the security of the data during registration and subsequent data processing and logout of the service of the target application, and also to ensure the privacy of the user when using the target application. Therefore, in the registration process The initial signature information of the target application needs to be obtained. Here, the initial signature information further ensures the security of the service of the target application using the system of the present application.

In order to obtain the code segment of the target application, when obtaining the code segment of the target application and the location of the code segment according to the initial identification information, the target application to be registered needs to be confirmed, that is, the target application is determined according to the initial identification information. For example, when multiple applications register services at the same time, if there are three applications to register services, and the three applications are APP1, APP2 and APP3 in sequence, then the corresponding three applications must have their own initial identification information. Assuming that the initial identification information of APP1 is A1, the initial identification information of APP2 is A2, and the initial identification information of APP3 is A3, then when A1 acquires the code segment and the location of the code segment of the target application, it can be speculated that the code of APP1 is to be acquired here. segment and the location of the code segment. In the same way, when A2 obtains the code segment and code segment location of the target application, it is presumed to obtain the code segment and code segment location of APP2; and so on, when A3 obtains the code segment and code segment location of the target application , it is presumed to obtain the code segment of APP3 and the location of the code segment.

After the target application for which the code segment is to be obtained is determined, at least one code segment is selected from the codes of the target application as the code segment of the target application. Of course, when acquiring the code segment and the location of the code segment of the target application, acquiring the code segment of the target application may be obtained by randomly acquiring a segment of the program of the target application. While acquiring a segment of the target application, the location corresponding to the code segment can also be acquired. Since the technology of randomly obtaining the code segment of the application is relatively mature, it will not be repeated here.

In this embodiment, before acquiring the code segment of the target application, it is necessary to judge whether the target application has the right to obtain the code segment; if it is determined that the target application has the right to obtain the code segment, the code of the target application is obtained through the initial identification information part.

Specifically, when using the method of this embodiment to register the service of the target application, in order to ensure that the code segment of the target application can be obtained, before obtaining the code segment of the target application, it is necessary to determine whether the target application has the permission to obtain the code segment. The judgment process here is to ensure the successful acquisition of the code segment of the target application. For example, if the executor of the service registration method in this embodiment determines that the current target application has the right to obtain the code segment, the code segment of the target application is obtained through the initial identification information; otherwise, the code segment of the target application cannot be obtained.

Step S202: In the trusted execution environment, according to the initial signature information and the initial identification information, a service identifier that needs to be registered for a service is generated, and the service identifier is returned to the target application.

After acquiring the initial signature information and the initial identification information in step S201, a service identifier that needs to register a service is generated in the trusted execution environment according to the initial signature information and the initial identification information.

Specifically, the foregoing manner of generating the service identifier may be described in the following manner.

First, the initial signature information and initial identification information of the target application are transferred into the trusted execution environment. The rich execution environment has been mentioned in step S201 of this embodiment, and the trusted execution environment is involved in this step, and the two together constitute the operating system used to register the service in this embodiment. A rich execution environment generally refers to an untrusted operating environment, such as the common Android operating system; and a trusted execution environment refers to a specific operating environment isolated by hardware. Although a rich execution environment is more secure, its storage and computing resources are limited. Therefore, the operating system that executes the service registration method in this embodiment combines the two, some of the steps are executed in the rich execution environment, and the other part of the steps are executed in the trusted execution environment, so as to ensure high security and high computing power of data transmission. rate.

Introducing the initial signature information and initial identification information of the target application into the trusted execution environment may be to first store the initial signature information and initial identification information of the target application in a database in the trusted execution environment; In the letter execution environment, the service identifier that needs to register the service is generated, that is, the service identifier that needs to be registered is generated according to the initial signature information and the initial identification information in the database. For example, if the target application is APP1, register the service APP1FUNC1 in it, first obtain its initial identification information as A1, initial signature information as B1, and the service ID generated according to A1 and B1 is D1, then D1 is the service ID of APP1FUNC1.

Afterwards, the service identity is returned to the target application.

After the trusted execution environment generates the service identifier of the target application service, the service identifier needs to be returned to the target application, so as to identify the service registered by the target application.

Specifically, one of the ways to return the service identifier to the target application may be: first, in the rich execution environment, using the service identifier as an index to store the initial identification information and initial signature information of the registered target application; The service identity in the rich execution environment is returned to the target application.

The above-mentioned use the service identifier as an index to store the initial identification information and initial signature information of the registered target application is to first establish a connection between the registered service identifier and the relevant information of the target application, and then return the service identifier to the target application.

By adopting the application service registration method of this embodiment, the service identifier corresponding to the service of the target application can be obtained through the initial identification information of the target application and the initial signature information, thereby providing security guarantee for the target application using the service of the present application to prevent the target application from being targeted. The application's service is tampered with during data transmission, thereby ensuring the security of the user's use of the target application's service.

The second embodiment above is a description of the service registration of the application service method. After the registration, the present application also provides a method for processing feedback data for the target application, as shown in FIG. A flowchart of an embodiment of a method for processing feedback data of a target application service method. The method includes the following steps.

Step S301: In the rich execution environment, obtain feedback data samples of the target application, determine whether the target application has a registered service, and if so, determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

If the method provided in this embodiment is adopted to process the feedback data of the target application, the first step is to obtain the feedback data samples of the target application in the rich execution environment, and the feedback data samples are used to train the model, so as to facilitate the feedback of users using the target application data processing.

Before training the model on the feedback data samples, firstly, the service of the target application is judged for service registration. The judgment process is to ensure the security of user data. The judgment in this embodiment is divided into three levels, and the three levels of judgment are as follows. They are explained in order in the description.

The first level of judgment is to judge whether there is a registered service in the target application.

As one of the ways of judging whether the target application has registered services, it may be to first obtain all the services of the target application, and then sequentially determine whether all the services of the target application have service identifiers.

As mentioned in the second embodiment, the services that are successfully registered all have service identifiers in the rich execution environment, so the registration situation of the service can be preliminarily determined according to whether there is a service with a service identifier in the target application. Of course, in the first-level judgment, if there is no registered service identifier in all services of the target application, the judgment process of the target application is directly exited. If it exists, enter into the judgment of the second level, that is, judge whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

The second-level judgment is to judge whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

When it is judged at the first level that the target application meets the conditions, the judgment of the second level is entered.

As mentioned in the second embodiment, a service that has successfully registered has initial identification information in the rich execution environment during the registration process. Therefore, after the first-level judgment meets the conditions, the current target application registration can be extracted in the rich execution environment. initial identification information.

Similarly, when judging whether the current identification information of the target application is consistent with the initial identification information when the target application was registered, the current identification information of the current target application can also be determined in the rich execution environment according to the current target application. Similar to the way in which the initial identification information is obtained in the second embodiment, the current identification information of the current target application can be obtained in the same way, that is, the identification information of the current target application is obtained at a higher authority layer than the current target application, and the identification information is used as the current target application. The current identifying information for the app.

After acquiring the current identification information and the initial identification information, it is determined whether the current identification information of the target application is consistent with the initial identification information when the target application was registered. For example, the initial identification information of APP1 when registering the service is A1, and if the current identification information is also A1, it is determined that the current identification information of the target application is consistent with the initial identification information when the target application is registered; the initial identification information of APP1 when registering the service is A1 , if the current identification information is also A ₀ 1, it is determined that the current identification information of the target application is inconsistent with the initial identification information when the target application was registered.

Step S302: If the current identification information of the target application is consistent with the initial identification information when the target application was registered, then determine in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, and if so, then A decision model for obtaining a service decision result based on the feedback data of the target application is trained according to the feedback data samples.

In step S301, if it is determined that the current identification information of the target application is consistent with the initial identification information when the target application was registered, the third level of judgment is entered, that is, it is judged whether the current signature information of the target application and the initial signature information when the target application is registered are not Consistent.

The third-level judgment is to judge whether the current signature information of the target application is consistent with the initial signature information when the target application was registered.

When it is judged at the second level that the target application meets the conditions, the judgment of the third level is entered.

Similarly, it has been mentioned in the second embodiment that the service successfully registered has initial signature information in the rich execution environment during the registration process. Therefore, after the second-level judgment meets the conditions, the current service can be extracted in the rich execution environment. Initial signature information when the target application is registered.

When judging in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, it is also necessary to determine the current signature of the current target application in the rich execution environment according to the current identification information of the current target application. Current signature information. Similar to the way of obtaining the initial signature information in the second embodiment, the current signature information of the current target application can be obtained in the same way, that is, the current signature information of the target application is obtained according to the current identification information of the target application.

As a way to obtain the current signature information of the target application according to the current identification information of the target application, first obtain the code segment and the code segment position of the target application according to the current identification information, and then obtain the target application's code segment and the code segment position according to the current identification information. Current signature information.

Specifically, as one of the ways to obtain the current signature information of the target application according to the code segment and the location of the code segment, the code segment and the location of the code segment can be spliced together, the signature information of the code segment is calculated by the HASH algorithm, and the signature information of the code segment is As the current signature information of the target application.

In this embodiment, the current signature information is used to ensure the data security of the service of the target application in the data processing process, and also to ensure the privacy of the user when using the target application. Therefore, the current signature information of the target application needs to be obtained during the data processing process. Signature information. Here, the current signature information further ensures the security of the service of the target application using the system of the present application.

In order to obtain the code segment of the target application, when obtaining the code segment of the target application and the location of the code segment according to the current identification information, the target application to be registered needs to be confirmed, that is, the target application is determined according to the current identification information. For example, when multiple applications process data at the same time, assuming that there are three applications to process data, and the three applications are APP1, APP2, and APP3 in sequence, then corresponding current identification information must exist for the three applications. Assuming that the current identification information of APP1 is A1, the current identification information of APP2 is A2, and the current identification information of APP3 is A3, then when A1 acquires the code segment and the location of the code segment of the target application, it can be speculated that the code of APP1 is to be acquired here. segment and the location of the code segment. In the same way, when A2 obtains the code segment and code segment location of the target application, it is presumed to obtain the code segment and code segment location of APP2; and so on, when A3 obtains the code segment and code segment location of the target application , it is presumed to obtain the code segment of APP3 and the location of the code segment.

After the target application for which the code segment is to be obtained is determined, at least one code segment is selected from the codes of the target application as the code segment of the target application. Of course, when acquiring the code segment and the location of the code segment of the target application, acquiring the code segment of the target application may be obtained by randomly acquiring a segment of the program of the target application. While acquiring a segment of the target application, the location corresponding to the code segment can also be acquired. Since the technology of randomly obtaining the code segment of the application is relatively mature, it will not be repeated here.

In this embodiment, before acquiring the code segment of the target application, it is necessary to determine whether the target application has the right to obtain the code segment; if it is determined that the target application has the right to obtain the code segment, the code of the target application is obtained through the current identification information part.

Specifically, when using the method of this embodiment to perform data processing after the service of the target application is registered, in order to ensure that the code segment of the target application can be obtained, before obtaining the code segment of the target application, it is necessary to determine whether the target application has an acquisition code. segment permissions. The judgment process here is to ensure the successful acquisition of the code segment of the target application. For example, if it is determined that the current target application has the right to obtain the code segment, the code segment of the target application is obtained through the current identification information; otherwise, the code segment of the target application cannot be obtained.

After obtaining the current signature information and the initial signature information when the target application was registered, it is judged in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered. For example, the initial signature information when APP1 registers for a service is B1, and if the current signature information is also B1, it is determined that the current signature information of the target application is consistent with the initial signature information when the target application is registered; the initial signature information when APP1 registers for a service is B1 , if the current signature information is also B ₀ 1, it is determined that the current signature information of the target application is inconsistent with the initial signature information when the target application was registered. It should be noted that this judgment process is performed in a trusted execution environment, and the acquisition of signature information is performed in a rich execution environment. In a word, in the process of data processing, the final judgment in the three-level judgment is executed in a trusted execution environment to fully ensure that the data of the target application will not be tampered with during the processing.

After verifying that the three levels meet the conditions, that is, the target application has a registered service, the current identification information of the target application is consistent with the registered initial identification information, and the current signature information of the target application is consistent with the registered initial signature information: A decision model for obtaining a service decision result based on the feedback data of the target application is trained according to the feedback data samples.

Specifically, as one of the implementation manners of training a decision model for obtaining service decision results according to the feedback data of the target application, first, in the trusted execution environment, the feedback data samples are processed online or in batch processing. way to learn. After that, the learned decision model is obtained, and the decision model is stored in the trusted execution environment with the service identifier of the target application as an index.

After the decision model is stored in the trusted execution environment, in the rich execution environment, the feedback data of the target application is obtained, and the service decision result for the feedback data of the target application is obtained according to the feedback data of the target application and the decision model.

When acquiring the feedback data, the feedback data of the target application may be temporarily stored in the database in the trusted execution environment. Then it is judged whether the collection of the feedback data is completed, and if the judgment result is yes, delete all the feedback data in the database. In this way, the used feedback data can be deleted in time, on the one hand, the storage space can be saved, and on the other hand, the safety of the feedback data can be ensured.

Before processing the feedback data, it is necessary to judge whether the feedback data is encrypted, and if so, decrypt the feedback data; and obtain the service decision result of the feedback data for the target application according to the decrypted feedback data and the decision model.

By using the method for processing feedback data for the target application in this embodiment, data can be processed in a trusted execution environment with a higher security level, and the security of the feedback data for the target application is ensured; The processing method of the feedback data is for the services that have already registered the target application, so it is necessary to check whether the target application has registered the service level by level, whether the initial identification information of the target application at the time of registration is consistent with the current identification information of the current target application, and whether the target application is registered. In the trusted execution environment, verify whether the initial signature information of the target application during registration is consistent with the current signature information of the current target application, further preventing the service of the target application from being maliciously tampered with during the transmission of feedback data, thereby further ensuring that users can use the target application. security of services.

The above-mentioned third embodiment is an illustration of the processing of the feedback data of the application service method. After the processing of the feedback data, the present application also provides a method for online decision-making for the target application, as shown in FIG. 4 , which is implemented in the present application. Example 4 is a flowchart of an embodiment of an online decision-making method for a target application service method. The method includes the following steps.

Step S401: in a rich execution environment, obtain feedback data of a target application, obtain a candidate object according to the feedback data, obtain a decision request of the target application, and determine whether the target application has registered a service for the decision request; If so, it is judged whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

When using the method of this embodiment to obtain the decision result, firstly, the feedback data of the target application is obtained in the rich execution environment, and the candidate object is obtained according to the feedback data.

Specifically, obtaining candidate objects according to the feedback data may be in the following manner.

First, the corresponding object set of the feedback data is obtained.

After that, the filter conditions for the feedback data are obtained, the objects that meet the filter conditions are filtered out from the object set, and the objects that meet the filter conditions are used as candidate objects.

Since the method in this embodiment is a method for obtaining a decision result, when the feedback data is obtained, the decision request for the target application that triggers the method is also obtained at the same time.

Of course, before the feedback data is obtained, the service registration of the target application is also judged first. The judgment process is also to ensure the security of user data. The judgment in this embodiment is also divided into three levels. The three levels of judgment are the same as Judgment in Example 3.

The judgment of the first two levels is to judge whether the target application has registered the service for the decision request; if so, judge whether the current identification information of the target application is consistent with the initial identification information when the target application was registered. . The description manner of the specific judgment has been described in detail in the third embodiment, which is not repeated here. For details, please refer to the description of this part in the third embodiment.

Step S402: If the current identification information of the target application is consistent with the initial identification information when the target application was registered, then determine in a trusted execution environment that the current signature information of the target application is the same as the initial identification information when the target application was registered. Whether the signature information is consistent, and if so, obtain a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and obtain a decision result according to the candidate object and the decision model.

Similarly, if it is determined that the current identification information of the target application is consistent with the initial identification information when the target application was registered, then it is judged in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered. , for the detailed description of this part, refer to the description of this part corresponding to Embodiment 3, and details are not repeated here.

After judging in the trusted execution environment that the current signature information of the target application is consistent with the initial signature information when the target application was registered, the decision model for obtaining the decision result according to the candidate object is obtained according to the decision request of the target application and the previously obtained candidate object. The specific way to obtain the decision model can be as described below.

First, get the service ID contained in the decision request. The decision request obtained in step S401 includes the service identifier of the registered service of the target application.

After the service identifier is acquired, the feedback data is obtained by using the service identifier as an index to process the pre-stored decision model, and the decision model is used as the decision model for obtaining the decision result according to the candidate object. After the training of the decision-making model in the third embodiment, the obtained decision-making model has been stored in the trusted execution environment with the service ID as the index. Therefore, in the decision-making process, only the service ID is needed as the index, and the obtained decision model is obtained in the trusted execution environment. Feedback data processing pre-stored decision model can be.

After the decision model is obtained, the decision result is obtained according to the candidate object and the decision model. The obtained decision result includes scoring each element of the candidate object according to the decision model, and sorting each element according to the score, and using the scoring and sorting result of each element as the decision result.

Using the online decision-making method of this embodiment, it is also possible to make decisions in a trusted execution environment with a higher security level. Since the online decision-making using this embodiment is aimed at the services that have registered the target application, it is necessary to check the service level by level. Verify whether the target application is registered with the service, whether the initial identification information of the target application during registration is consistent with the current identification information of the current target application, and verify in the trusted execution environment whether the initial signature information of the target application during registration is the same as the current target application. Whether the current signature information is consistent further prevents malicious tampering of the target application's service in the decision-making process, thereby further ensuring the security of the user's use of the target application's service.

Corresponding to the service registration of the second embodiment, in order to further ensure the safety of the application service of the present application, the present application also provides a service deregistration method of the application, as shown in FIG. The flowchart of the embodiment of the logout method. The method includes the following steps.

Step S501: In the rich execution environment, obtain the service deregistration request of the target application, determine whether the target application has a registered service according to the service deregistration request, and if so, determine the current identification information of the target application and the initial identification when the target application is registered Is the information consistent.

In this embodiment, using the service logout method of the application, firstly, the service logout request of the target application is obtained, and subsequent operations are performed according to the logout request.

Similar to Embodiment 3, when the logout method of this embodiment is adopted, three levels of judgment are also required. The following is a brief description of the three levels of judgment. For detailed description, please refer to the relevant description of Embodiment 3.

The first level of judgment is to judge whether there is a registered service in the target application.

As one of the ways of judging whether the target application has registered services, it may be to first obtain all the services of the target application, and then sequentially determine whether all the services of the target application have service identifiers. If it exists, enter into the judgment of the second level, that is, judge whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

The second-level judgment is to judge whether the current identification information of the target application is consistent with the initial identification information when the target application was registered. When it is judged at the first level that the target application meets the conditions, the judgment of the second level is entered.

Specifically, one of the above-mentioned ways of judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered may be: first, the identification information of the target application is obtained at a higher authority layer than the target application itself, and Take the identification information as the current identification information of the target application; then, obtain the initial identification information when the target application is registered; after obtaining the initial identification information and the current identification information, determine the current identification information of the target application and the initial identification information when the target application is registered Is it consistent.

Step S502: if the current identification information of the target application is consistent with the initial identification information when the target application was registered, then determine in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, and if so, then Delete feedback data and decision models for the target application.

In step S501, if it is determined that the current identification information of the target application is consistent with the initial identification information when the target application was registered, the third level of judgment is entered, that is, it is judged whether the current signature information of the target application and the initial signature information when the target application is registered are not Consistent.

The third-level judgment is to judge whether the current signature information of the target application is consistent with the initial signature information when the target application was registered.

When it is judged at the second level that the target application meets the conditions, the judgment of the third level is entered.

Similarly, it has been mentioned in the second embodiment that the service successfully registered has initial signature information in the rich execution environment during the registration process. Therefore, after the second-level judgment meets the conditions, the current service can be extracted in the rich execution environment. Initial signature information when the target application is registered.

When judging in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered, it is also necessary to determine the current signature of the current target application in the rich execution environment according to the current identification information of the current target application. Current signature information. Similar to the way of obtaining the initial signature information in the second embodiment, the current signature information of the current target application can be obtained in the same way, that is, the current signature information of the target application is obtained according to the current identification information of the target application.

As a way to obtain the current signature information of the target application according to the current identification information of the target application, first obtain the code segment and the code segment position of the target application according to the current identification information, and then obtain the target application's code segment and the code segment position according to the current identification information. Current signature information.

Specifically, as one of the ways to obtain the current signature information of the target application according to the code segment and the location of the code segment, the code segment and the location of the code segment can be spliced together, the signature information of the code segment is calculated by the HASH algorithm, and the signature information of the code segment is As the current signature information of the target application.

In this embodiment, the current signature information is used to ensure the data security of the service of the target application during the logout process, and also to ensure the privacy of the user when using the target application. Therefore, the current signature information of the target application needs to be obtained during the logout process. . Here, the current signature information further ensures the security of the service of the target application using the system of the present application.

In order to obtain the code segment of the target application, when obtaining the code segment of the target application and the location of the code segment according to the current identification information, the target application to be registered needs to be confirmed, that is, the target application is determined according to the current identification information. After the target application for which the code segment is to be obtained is determined, at least one code segment is selected from the codes of the target application as the code segment of the target application. Of course, when acquiring the code segment and the location of the code segment of the target application, acquiring the code segment of the target application may be obtained by randomly acquiring a segment of the program of the target application. While acquiring a segment of the target application, the location corresponding to the code segment can also be acquired. Since the technology of randomly obtaining the code segment of the application is relatively mature, it will not be repeated here.

In this embodiment, before acquiring the code segment of the target application, it is necessary to determine whether the target application has the right to obtain the code segment; if it is determined that the target application has the right to obtain the code segment, the code of the target application is obtained through the current identification information part.

Specifically, in order to ensure that the code segment of the target application can be obtained when the service of the target application is deregistered by using the method of this embodiment, before obtaining the code segment of the target application, it is necessary to determine whether the target application has an acquisition code segment. permission. The judgment process here is to ensure the successful acquisition of the code segment of the target application. For example, if it is determined that the current target application has the right to obtain the code segment, the code segment of the target application is obtained through the current identification information; otherwise, the code segment of the target application cannot be obtained.

After obtaining the current signature information and the initial signature information when the target application was registered, it is judged in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application was registered. It should be noted that this judgment process is performed in a trusted execution environment, and the acquisition of signature information is performed in a rich execution environment. In a word, during the logout process, the final judgment in the three-level judgment is executed in a trusted execution environment, so as to fully ensure that the data of the target application will not be tampered with during the logout process.

After verifying that the three levels meet the conditions, that is, the target application has a registered service, the current identification information of the target application is consistent with the registered initial identification information, and the current signature information of the target application is consistent with the registered initial signature information, Then delete the feedback data and decision model for the target application.

By using the method for deregistering an application service in this embodiment, the deregistration can also be performed in a trusted execution environment with a higher security level. It is necessary to check whether the target application is registered with the service level by level, whether the initial identification information of the target application during registration is consistent with the current identification information of the current target application, and verify that the initial signature information of the target application during registration is consistent with the current identification information of the current target application in the trusted execution environment. Whether the current signature information of the current target application is consistent, further prevents the service of the target application from being maliciously tampered with during the logout process or before logout, thereby further ensuring the security of the user using the service of the target application.

In a word, in the above-mentioned Embodiments 2 to 5, the application services of the present application are divided into registration process, data processing process, online decision-making process and cancellation process, and each stage after registration is verified to ensure that The security of users using the services of the target application.

Corresponding to the above application service method, the present application further provides an application service device. Please refer to FIG. 6 , which is a schematic diagram of an embodiment of an application service apparatus according to Embodiment 6 of the present application. Since the apparatus embodiment is basically similar to the method embodiment, the description is relatively simple. For related details, please refer to the part of the method embodiment The description is sufficient, and the device embodiments described below are merely illustrative. An application service device provided by this application includes the following parts.

The present application provides an application service device, including:

The service judgment unit 601 is configured to judge whether the target application has a registered service in the rich execution environment, if so, obtain the service request of the target application, and obtain the current identification information of the target application according to the service request , obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is the same as If the initial identification information when the target application is registered is consistent, then determine whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in a trusted execution environment;

The service processing unit 602 is configured to perform processing according to the service request of the target application if the judgment result is yes.

Optionally, also include:

The initial signature information obtaining unit is configured to obtain the service registration request of the target application in the rich execution environment, obtain the initial identification information of the target application according to the service registration request, and obtain the information of the target application through the initial identification information. Initial signature information.

A service identifier generating unit is configured to generate, in a trusted execution environment, a service identifier that needs to register a service according to the initial signature information and the initial identification information.

An identity returning unit, configured to return the service identity to the target application.

Optionally, the initial signature information acquisition unit is specifically used for:

Obtain the identification information of the target application at a higher authority layer than the target application;

The identification information is used as the initial identification information of the target application.

Optionally, the initial signature information acquisition unit is specifically used for:

Obtain the code segment and the code segment location of the target application according to the initial identification information;

Obtain initial signature information of the target application according to the code segment and the location of the code segment.

Optionally, the initial signature information acquisition unit is specifically used for:

Splicing the code segment and the code segment position to obtain the spliced code information;

Obtain the signature information of the code segment according to the spliced code information;

The signature information of the code segment is used as the initial signature information of the target application.

Optionally, the initial signature information acquisition unit is specifically used for:

Determine the target application according to the initial identification information;

At least one code segment is selected from the code of the target application as the code segment of the target application.

Optionally, the initial signature information acquisition unit is also used for:

Determine whether the target application has the permission to obtain the code segment;

The obtaining the code segment of the target application through the initial identification information includes:

If it is determined that the target application has the right to acquire the code segment, the code segment of the target application is acquired through the initial identification information.

Optionally, the service identifier generating unit is specifically used for:

storing the initial signature information and the initial identification information in the database of the trusted execution environment;

In the trusted execution environment, a service identifier corresponding to the initial signature information and the initial identification information that needs to register a service is generated.

Optionally, the identifier returning unit is specifically used for:

In the rich execution environment, using the service identifier as an index, the initial identification information and the initial signature information of the registered target application are stored; The service identifier is returned to the target application.

Optionally, the registration service request includes at least one of the following information:

Name information of the service that needs to be registered in the target application;

Information on whether data encryption is enabled for the service that needs to be registered;

Data encryption algorithm information for the service that needs to be registered;

The public key information is decrypted for the data of the service that needs to be registered.

Optionally, the initial identification information of the target application includes at least a unique identifier of the target application, and the unique identifier is a unique identifier of the target application in the kernel permission layer.

Optionally, the service judgment unit is specifically used for:

Obtain information about all services of the target application;

Determine whether all services of the target application have service identifiers.

Optionally, the service judgment unit is specifically used for:

Obtain the identification information of the target application at a higher authority layer than the target application, and use the identification information as the current identification information of the target application;

Obtain the initial identification information when the target application is registered;

Determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered.

Optionally, the service judgment unit is specifically used for:

Obtain the current signature information of the target application according to the current identification information of the target application;

Obtain the initial signature information when the target application is registered;

Determine whether the current signature information of the target application is consistent with the initial signature information when the target application was registered.

Optionally, the service judgment unit is specifically used for:

Acquire a code segment and a code segment location of the target application according to the current identification information;

Obtain current signature information of the target application according to the code segment and the location of the code segment.

Optionally, the service judgment unit is specifically used for:

Splicing the code segment and the code segment position to obtain the spliced code information;

Obtain the signature information of the code segment according to the spliced code information;

The signature information of the code segment is used as the current signature information of the target application.

Optionally, the service judgment unit is specifically used for:

Determine the target application according to the current identification information;

At least one code segment is selected from the code of the target application as the code segment of the target application.

Optionally, the service judgment unit is specifically used for:

Determine whether the target application has the permission to obtain the code segment;

If it is determined that the target application has the right to acquire the code segment, the code segment of the target application is acquired through the current identification information.

Optionally, the service judgment unit is specifically configured to: in a rich execution environment, obtain a feedback data sample of the target application, and use the obtained feedback data sample of the target application as the obtained service request of the target application;

The service processing unit is specifically configured to: in a trusted execution environment, train a decision model for obtaining a service decision result according to the feedback data of the target application according to the feedback data sample; Decision model as the processing result.

Optionally, it also includes a decision-making unit, and the decision-making unit is specifically used for:

In the rich execution environment, obtain feedback data of the target application;

In the trusted execution environment, according to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the decision-making unit is specifically used for:

In the trusted execution environment, the feedback data of the target application is collected into a database;

Judging whether the collection of the feedback data is completed, if the judgment result is yes, delete all the feedback data in the database;

According to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the decision-making unit further includes a decryption unit, and the decryption unit is specifically used for:

Determine whether the feedback data is encrypted, and if so, decrypt the feedback data;

The decision-making unit is specifically used for:

According to the decrypted feedback data and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the service judgment unit is specifically configured to: in a rich execution environment, obtain feedback data of a target application, and obtain a candidate object according to the feedback data; obtain a decision request of the target application; The decision request of the target application is used as the service request of the obtained target application;

The service processing unit is specifically configured to: in a trusted execution environment, obtain a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and according to the candidate object and the decision model , obtain the decision result; take the obtained decision result as the processing result.

Optionally, the service judgment unit is specifically used for:

obtaining the set of objects corresponding to the feedback data;

Filtering conditions for the feedback data are obtained, objects that meet the filtering conditions are filtered out from the object set, and the objects that meet the filtering conditions are used as candidate objects.

Optionally, the service processing unit is specifically used for:

Obtain the service identifier contained in the decision request;

The decision model is obtained by using the service identifier as an index.

Optionally, the service processing unit is specifically used for:

Scoring each element of the candidate object according to the decision model to obtain a scoring result;

Sort each element according to the scoring result to obtain a sorting result;

The scoring result and the ranking result are used as the decision result.

The application service method of the present application can be applied to a terminal. Correspondingly, the present application also provides a terminal. Please refer to FIG. 7 , which is a schematic diagram of a terminal according to Embodiment 7 of the present application, because the terminal embodiment is basically similar to Method Embodiments 1 to 5 are described in a relatively simple manner. For relevant parts, please refer to the partial descriptions of Embodiments 1 to 5. The method embodiments described below are only illustrative.

The terminal provided by this application includes the following parts.

The service judgment unit 701 is configured to judge whether the target application has a registered service in the rich execution environment of the terminal, and if so, obtain the service request of the target application, and obtain the service request of the target application according to the service request. Current identification information, obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is consistent If the identification information is consistent with the initial identification information when the target application is registered, then determine whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in the trusted execution environment in the terminal;

The service processing unit 702 is configured to perform processing according to the service request of the target application if the judgment result is yes.

The present application further provides a system for application service, as shown in FIG. 8 , which is a schematic diagram of components of an embodiment of a system for application service according to Embodiment 8 of the present application. The system includes the following components: a feedback data collector, a service manager, an end-side decision TA, a feedback learner, a decision maker, and a data and model manager.

The feedback data collector and service manager are located in the rich execution environment of the system. The feedback data collector is used to collect the feedback data of the target application according to the identification information at the authority layer higher than the target application, and the service manager is used to transmit the service request type to the trusted application according to the identification information at the authority layer higher than the target application. execution environment.

End-to-end decision TA, feedback learner, decider, and data and model manager are all located in a trusted execution environment. The end-side decision TA is used to call the feedback learner, decider, data and model manager according to the request type of the service, and process the request type of the service. Service request types include: service registration/deregistration, feedback data processing, and online decision-making. The feedback learner is used to train a decision model for obtaining a service decision result according to the feedback data of the target application according to the feedback data samples. The decider is used to obtain the service decision result of the feedback data for the target application according to the feedback data and the decision model. The data and model manager is used to store feedback data and decision models.

In the system of the present application, each component is allocated to different execution environments, which ensures the safety of applications using the system during data transmission, and prevents data from being tampered with during data transmission when using the services of the target application.

Although the present application is disclosed above with preferred embodiments, it is not intended to limit the present application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the present application The scope of protection shall be subject to the scope defined by the claims of this application.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. Memory may include non-persistent memory in computer readable media, random access memory (RAM) and/or non-volatile memory in the form of, for example, read only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

1. Computer readable media includes both persistent and non-permanent, removable and non-removable media. Information storage can be implemented by any method or technology. Information may be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Flash Memory or other memory technology, Compact Disc Read Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable storage media, such as modulated data signals and carrier waves.

2. Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

Claims (28)

1. an application service method, is characterized in that, comprises: In the rich execution environment, it is judged whether the target application has a registered service, if so, the service request of the target application is obtained, the current identification information of the target application is obtained according to the service request, and the current identification information is obtained through the current identification information. the current signature information of the target application; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; If the current identification information of the target application is consistent with the initial identification information at the time of registration of the target application, determine in the trusted execution environment whether the current signature information of the target application and the initial signature information at the time of registration of the target application are not If it is consistent, if so, process it according to the service request of the target application; Wherein, the initial identification information of the target application is obtained at a higher authority layer than the target application. 2. The application service method according to claim 1, further comprising: In the rich execution environment, the service registration request of the target application is obtained, the initial identification information of the target application is obtained according to the service registration request, and the initial signature information of the target application is obtained through the initial identification information; In a trusted execution environment, according to the initial signature information and the initial identification information, a service identifier that needs to register a service is generated, and the service identifier is returned to the target application. 3. The application service method according to claim 2, wherein the obtaining initial identification information of the target application according to the service registration request comprises: Obtain the identification information of the target application at a higher authority layer than the target application; The identification information is used as the initial identification information of the target application. 4. The application service method according to claim 2, wherein the obtaining the initial signature information of the target application through the initial identification information comprises: Obtain the code segment and the code segment location of the target application according to the initial identification information; Obtain initial signature information of the target application according to the code segment and the location of the code segment. 5. The application service method according to claim 4, wherein the obtaining the initial signature information of the target application according to the code segment and the location of the code segment comprises: Splicing the code segment and the code segment position to obtain the spliced code information; Obtain the signature information of the code segment according to the spliced code information; The signature information of the code segment is used as the initial signature information of the target application. 6. The application service method according to claim 4, wherein the acquiring the code segment and the code segment position of the target application according to the initial identification information comprises: Determine the target application according to the initial identification information; At least one code segment is selected from the code of the target application as the code segment of the target application. 7. The application service method according to claim 4, further comprising: Determine whether the target application has the permission to obtain the code segment; The obtaining the code segment of the target application through the initial identification information includes: If it is determined that the target application has the right to acquire the code segment, the code segment of the target application is acquired through the initial identification information. 8. The application service method according to claim 2, wherein, in the trusted execution environment, according to the initial signature information and the initial identification information, generating a service identifier that needs to register a service, comprising: storing the initial signature information and the initial identification information in the database of the trusted execution environment; In the trusted execution environment, a service identifier corresponding to the initial signature information and the initial identification information that needs to register a service is generated. 9. The application service method according to claim 2, wherein the returning the service identifier to the target application comprises: In the rich execution environment, using the service identifier as an index, the initial identification information and the initial signature information of the registered target application are stored; The service identifier is returned to the target application. 10. The application service method according to claim 2, wherein the service registration request includes at least one of the following information: Name information of the service that needs to be registered in the target application; Information on whether data encryption is enabled for the service that needs to be registered; Data encryption algorithm information for the service that needs to be registered; The public key information is decrypted for the data of the service that needs to be registered. 11. The application service method according to claim 2 or 3, wherein the initial identification information of the target application includes at least a unique identifier of the target application, and the unique identifier is the target application in the kernel. Unique identifier for the permission layer. 12. The application service method according to claim 2, wherein the judging whether the target application has a registered service comprises: Obtain information about all services of the target application; Determine whether all services of the target application have service identifiers. 13. The application service method according to claim 1, wherein the judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered comprises: Obtain the identification information of the target application at a higher authority layer than the target application, and use the identification information as the current identification information of the target application; Obtain the initial identification information when the target application is registered; Determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered. 14. The application service method according to claim 13, wherein the determining in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered comprises: Obtain the current signature information of the target application according to the current identification information of the target application; Obtain the initial signature information when the target application is registered; Determine whether the current signature information of the target application is consistent with the initial signature information when the target application was registered. 15. The application service method according to claim 14, wherein the acquiring the current signature information of the target application according to the current identification information of the target application comprises: Acquire a code segment and a code segment location of the target application according to the current identification information; Obtain current signature information of the target application according to the code segment and the location of the code segment. 16. The application service method according to claim 15, wherein the obtaining the current signature information of the target application according to the code segment and the location of the code segment comprises: Splicing the code segment and the code segment position to obtain the spliced code information; Obtain the signature information of the code segment according to the spliced code information; The signature information of the code segment is used as the current signature information of the target application. 17. The application service method according to claim 15, wherein the acquiring the code segment and the code segment location of the target application according to the current identification information comprises: Determine the target application according to the current identification information; At least one code segment is selected from the code of the target application as the code segment of the target application. 18. The application service method according to claim 15, further comprising: Determine whether the target application has the permission to obtain the code segment; The obtaining the code segment of the target application through the current identification information includes: If it is determined that the target application has the right to acquire the code segment, the code segment of the target application is acquired through the current identification information. 19. The application service method according to claim 1, wherein the acquiring the service request of the target application comprises: In the rich execution environment, the feedback data sample of the target application is obtained; the obtained feedback data sample of the target application is used as the service request of the obtained target application; The processing according to the service request of the target application includes: in a trusted execution environment, training a decision model for obtaining a service decision result according to the feedback data of the target application according to the feedback data sample; The decision model of the service decision result is used as the processing result. 20. The application service method according to claim 19, further comprising: In the rich execution environment, obtain feedback data of the target application; In the trusted execution environment, according to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained. 21. The application service method according to claim 20, further comprising: In the trusted execution environment, the feedback data of the target application is stored in a database; Judging whether the collection of the feedback data is completed, if the judgment result is yes, delete all the feedback data in the database; According to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained. 22. The application service method according to claim 21, further comprising: Determine whether the feedback data is encrypted, and if so, decrypt the feedback data; The obtaining, according to the feedback data of the target application and the decision-making model, a service decision result for the feedback data of the target application includes: According to the decrypted feedback data and the decision model, a service decision result for the feedback data of the target application is obtained. 23. The application service method according to claim 1, wherein the acquiring the service request of the target application comprises: In the rich execution environment, the feedback data of the target application is obtained, the candidate object is obtained according to the feedback data, and the decision request of the target application is obtained; the decision request for obtaining the target application is used as the target application's Request for service; The processing according to the service request of the target application includes: in a trusted execution environment, obtaining a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and according to the candidate object and the decision-making model to obtain a decision-making result; the obtained decision-making result is used as a processing result. 24. The application service method according to claim 23, wherein the obtaining a candidate object according to the feedback data comprises: obtaining the set of objects corresponding to the feedback data; Filtering conditions for the feedback data are obtained, objects that meet the filtering conditions are filtered out from the object set, and the objects that meet the filtering conditions are used as candidate objects. 25. The application service method according to claim 23, wherein the obtaining a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application comprises: Obtain the service identifier contained in the decision request; The decision model is obtained with the service identifier as an index. 26. The application service method according to claim 23, wherein the obtaining a decision result according to the candidate object and the decision model comprises: Scoring each element of the candidate object according to the decision model to obtain a scoring result; Sort each element according to the scoring result to obtain a sorting result; The scoring result and the ranking result are used as the decision result. 27. An application service device, comprising: The service judgment unit is used to judge whether the target application has a registered service in the rich execution environment, if so, obtain the service request of the target application, obtain the current identification information of the target application according to the service request, and obtain the current identification information of the target application according to the service request. Obtain the current signature information of the target application from the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is consistent with the target application If the initial identification information at the time of application registration is consistent, then judge in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information at the time of registration of the target application; a service processing unit, configured to determine if the result is yes, then process it according to the service request of the target application; Wherein, the initial identification information of the target application is obtained at a higher authority layer than the target application. 28. A terminal, characterized in that, comprising: A service judgment unit, configured to judge whether the target application has a registered service in the rich execution environment of the terminal, if so, obtain the service request of the target application, and obtain the current status of the target application according to the service request identification information, obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application was registered; if the current identification information of the target application is consistent If the information is consistent with the initial identification information when the target application is registered, then determine whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in the trusted execution environment in the terminal; A service processing unit, configured to determine if the result is yes, process the service request according to the target application; Wherein, the initial identification information of the target application is obtained at a higher authority layer than the target application.

Images