WO2016206393A1

WO2016206393A1 - Method and apparatus for managing application and method and apparatus for implementing read-write operation

Info

Publication number: WO2016206393A1
Application number: PCT/CN2016/074131
Authority: WO
Inventors: 张金昕
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-06-26
Filing date: 2016-02-19
Publication date: 2016-12-29
Also published as: CN106326733A

Abstract

A method and apparatus for managing an application, comprising: a packager performing first processing on an installation package of an application, so as to obtain a target code; and the packager performing second processing on the target code, so as to obtain an installation package of a secure application, wherein a code for implementing a secure data transmission function is added in the installation package of the secure application.

Description

Method and device for managing application, method and device for implementing read and write operations

Technical field

This document relates to, but is not limited to, the field of communications, and in particular, to a method and apparatus for managing applications, and a method and apparatus for implementing read and write operations.

Background technique

At present, the development of enterprise information technology (IT, Information Technology) to mobile terminals, enterprise mobile applications occupy an increasingly important position in the daily work of enterprises, and the demand for mobile office is becoming more and more common. Enterprise mobile applications are different from ordinary mobile applications (app, Application). Firstly, the diversification and individualization requirements of enterprise applications are strong, such as access control of core systems, and enterprise users tend to solve the problem of full value chain. Program. Since there is no unified standard planning at the beginning of enterprise mobile application development, many enterprises have a large number of isolated mobile applications. How to flexibly and conveniently add new capabilities to mobile applications to adapt to the changing needs of enterprises becomes more difficult.

With the increase of Android (Andriod) users, more and more malware for Android. Security is the main reason why Android is difficult to enter the enterprise. The main problem is privacy leakage, such as the contents of files that are manipulated and read in enterprise applications, and some important company information may be stolen by malware.

There are a lot of detections for privacy leaks for Android, including static analysis tools and dynamic analysis tools for analyzing Android installation packages (APK, Android Package). Static analysis is mainly to decompile the APK and analyze the code after decompilation. Dynamic analysis is mainly to let the program run and obtain the application programming interface (API) call generated during the running of the program to obtain its behavior information. Although there are many analysis tools available to analyze and detect malicious mobile software, there is currently no mature solution to ensure the security of mobile office.

Summary of the invention

The following is an overview of the topics detailed in this document. This summary is not intended to limit the claims The scope of protection.

Embodiments of the present invention provide a method and apparatus for managing an application, and a method and apparatus for implementing a read/write operation, which can improve the security of an application in a mobile terminal.

An embodiment of the present invention provides a method for managing an application, including:

The packager performs the first processing on the application installation package to obtain the target code;

The packager performs a second processing on the target code to obtain an installation package of the security application, wherein a code for implementing the data security transmission function is added to the installation package of the security application.

Optionally, the packager performs the first processing on the installation package of the application to obtain the target code, including:

The packager unpacks, decompiles, and disassembles the installation package of the application to obtain the target code.

Optionally, the packager performs a second process on the target code to obtain an installation package of the security application, including:

The packer determines a location of the first interface code in the target code; wherein the first interface code comprises: an input/output I/O operation of the application in the target code is invoked in an operating system of the mobile terminal Code

The packager replaces the first interface code with a second interface code invoked in a pre-installed secure operation platform in the mobile terminal according to the determined location, wherein the first interface code is replaced with a pre-stored I/O operation of the application; The second interface code includes the code for implementing a data secure transmission function;

The packager replaces the first interface code with the target code after the second interface code to link, compile, and package the installation package of the security application.

Optionally, replacing the first interface code with the second interface code comprises: replacing the first interface code with the second interface code by a code injection manner and/or a function hook manner.

Optionally, the code for implementing the data secure transmission function includes an encryption code for encrypting the output unencrypted information and/or a decryption code for decrypting the received encrypted information.

Optionally, the code for implementing the data security transmission function further includes: code for processing the I/O operation by using the secure operation platform.

The embodiment of the invention further provides a method for implementing a read and write operation, comprising:

The mobile terminal receives an instruction from the user to read the file of the security application, decrypts the file of the read security application, and performs a read operation on the decrypted file.

Optionally, it also includes:

The mobile terminal receives an instruction from the user to write a file of the security application, and the mobile terminal encrypts the file of the written security application and performs a write operation on the encrypted file.

Optionally, the writing of the encrypted file includes: writing the encrypted file by using a secure running platform.

Optionally, performing the reading operation on the decrypted file includes: performing a read operation on the decrypted file by using a secure running platform.

An embodiment of the present invention further provides an apparatus for managing an application, including:

a first processing module, configured to perform a first processing on the installation package of the application to obtain a target code;

And a second processing module, configured to perform a second processing on the target code to obtain an installation package of the security application, wherein, after the second processing, the installation package of the security application includes code for implementing a data security transmission function.

Optionally, the second processing module is configured to

Determining a location of the first interface code in the target code; wherein the first interface code comprises: a code invoked in an operating system of the mobile terminal by an input/output I/O operation of the target code;

Replacing the first interface code with a second interface code invoked in a pre-installed secure operating platform in the mobile terminal according to the determined location; wherein the second interface code is replaced by a pre-stored I/O operation of the application; The interface code includes the code for implementing a data secure transmission function;

Substituting the first interface code with the target code after the second interface code for linking, Compile and package the installation package of the security application.

The embodiment of the invention further provides a mobile terminal, including:

a receiving module, configured to receive an instruction from a user to read a file of the security application;

The encryption and decryption module is configured to decrypt the file of the read security application;

The read/write operation module is set to read the decrypted file.

Optionally, the receiving module is further configured to:

Receiving an instruction from the user to write a file of the secure application;

The encryption and decryption module is further configured to:

Encrypt the file of the written secure application;

The read/write operation module is further configured to: write the encrypted file.

Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions for use in any of the methods described above.

The embodiment provided by the present invention obtains the target code by performing the first processing on the installation package of the application, and then performs the second processing on the target code to obtain the installation package of the security application, because the installation package of the security application contains data security for data security. The code of the transmission function, so that when the application runs on the mobile terminal, the data of the security application cannot be stolen by the third party, thereby improving the security of the application in the mobile terminal.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a flowchart of a method for managing an application according to an embodiment of the present invention;

2 is a flowchart of a method for implementing a read/write operation according to an embodiment of the present invention;

3 is a schematic diagram of a method for managing an application according to an embodiment of the present invention;

4 is a schematic diagram of a method for a mobile terminal to control a security application through an enterprise security container according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an apparatus for managing an application according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a mobile terminal according to an embodiment of the present invention.

Embodiments of the invention

The invention will be further described in detail below with reference to the drawings and specific embodiments. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

FIG. 1 is a flowchart of a method for managing an application according to an embodiment of the present invention. The method shown in Figure 1 includes:

Step 101: The packager performs the first processing on the installation package of the application to obtain the target code.

In this step, the object code includes the object code of one or more files.

In this step, the application may be a text application, a Word application, an Excel application, or the like.

In this step, the packager performs the first processing on the application installation package to obtain the target code, including:

The packager unpacks, decompiles, and disassembles the application's installation package to get the target code.

In this step, how to unpack, decompile, and disassemble the installation package of the application may be implemented by using the well-known techniques of the present invention, and is not intended to limit the scope of the present invention, and details are not described herein again.

Step 102: The packager performs a second process on the target code to obtain an installation package of the security application, where, after the second process, the installation package of the security application includes code for implementing a data security transmission function.

In this step, the packager performs the second processing on the target code to obtain the installation package of the security application, including:

The packager determines a location of the first interface code in the target code; wherein the first interface code comprises: an input/output (I/O, Input/Output) operation of the target code in the operating system of the mobile terminal Code called in ;

The packager replaces the first interface code with the second interface code invoked in the secure operation platform pre-installed in the mobile terminal by the pre-stored I/O operation of the application according to the determined location;

The second interface code includes code for implementing a data secure transmission function.

Specifically, since the operating system of the mobile terminal is often open, in order to avoid application in the operation By being attacked by malware in the system, by running the security application on a secure running platform, the possibility of being attacked can be effectively reduced. Since the I/O interface code configured in the initial stage of the application is configured for the operating system of the mobile terminal, in order to ensure that the security application can be run on the secure running platform, the configuration of the I/O interface needs to be changed, according to the target. The code can effectively obtain the position of the first interface code called by the I/O operation in the operating system of the mobile terminal in the target code, and then replace the first interface code in the target code with the second interface code.

In this step, the code for implementing the data secure transmission function includes an encryption code for encrypting the output unencrypted information, and/or a decryption code for decrypting the received encrypted information.

The code for implementing the secure transfer function of data may also include code for handling I/O operations using a secure runtime platform.

In this step, if the security application installation package includes an encryption code, the output data may be encrypted data, and since the output data is encrypted, even if the output data is stolen by a third-party application, it cannot be used by a third party application. Cracking, thus ensuring the security of the data sent by the application, and improving the security of the application; if the installation package of the security application includes the decryption code, it can receive the encrypted data, and since the local decryption function can decrypt the encrypted data to obtain the plaintext, The third party is able to decrypt the plaintext, thus ensuring the security of the data received by the application and improving the security of the application.

The second interface code may replace the first interface code in the target code by means of code injection and/or function hook.

Specifically, the code injecting mode and the function hooking method in the related art may be applied to the embodiment of the present invention, and details are not described herein again.

By replacing the first interface code with the second interface code in the above manner, it is not necessary to re-develop a new application, and the original enterprise application can be conveniently and flexibly added to the enterprise mobile application to read, write, decrypt, and decrypt files, and Need to have the source code of the original application.

Referring to FIG. 2, an embodiment of the present invention further provides a method for implementing a read/write operation, including:

Step 200: The mobile terminal receives an instruction from the user to read the file of the security application, decrypts the file of the read security application, and performs a read operation on the decrypted file.

In this step, the instruction to read the file of the secure application may be an instruction to open the file, an instruction to slide the file, or the like.

When the mobile terminal receives an instruction from the user to write a file of the secure application, the file of the written secure application is encrypted, and the encrypted file is written.

In the above method, the read operation and/or the write operation can be performed through the secure operation platform, so that the mobile terminal needs to be able to read and/or write the file of the security application, and the security operation platform needs to be installed in the mobile terminal in advance, so that the security application is opened. It will then run on a secure operating platform.

The secure operation platform is obtained by:

Obtain applications with information isolation (such as enterprise security containers);

The application with the information isolation function is run to obtain the secure operation platform.

In practical applications, the secure operation platform can be developed by itself or by installing an application with information isolation function.

The method provided by the embodiment of the present invention obtains the target code by performing the first processing on the installation package of the application, and then obtains the installation package of the security application by performing the second processing on the target code, because the installation package of the security application is included for implementation. The code information of the data security transmission function, so that after the installation package of the application is installed on the mobile terminal, the data of the security application cannot be stolen by the third party, thereby improving the security of the application in the mobile terminal.

The method provided by the present invention is further illustrated by the following specific embodiments:

Take the Android system as an example, install the enterprise security container (ByodHome.APK) on the mobile phone as a secure operation platform as an example:

FIG. 3 is a schematic diagram of a method for managing an application according to an embodiment of the present invention. The method shown in Figure 3 includes:

Step 301: The packager performs the first processing on the installation package of the application to obtain the target code.

In this step, the mobile application is unpacked, decompiled, and disassembled using the APK decompile tool (Apktool) to obtain the smali code (ie, the target code).

Step 302: The packager determines a location of the first interface code called in the target code of the I/O operation applied in the target code in the operating system of the mobile terminal.

In this step, the first interface code is retrieved in the above smali code; the first interface to be retrieved The location of the code in the target code is recorded for use.

Wherein, the location of the first interface code in the target code may be one or more. At least two of input and output.

Step 303: The packager replaces the first interface code in the object code with the second interface code.

In this step, the second interface code includes an encryption code, and/or a decryption code, and a code that processes the I/O operation using the secure container.

The second interface code is injected into the location of the corresponding first interface code in the target code.

Step 304: The packager modifies the target code of the AndroidManifest.xml file, plus the secure container identifier.

In this step, after the security container identifier is added to the target code of the AndroidManifest.xml file, the security application is only displayed on the secure desktop corresponding to the secure container, but not on the normal desktop.

Step 305: The packager regenerates the installation package of the security application.

In this step, the packager can use the Android resource packaging tool (aapt, Android Asset Packaging Tool) to replace the first interface code with the target code after the second interface code for linking, compiling, packaging with apktool, and regenerating the security application. Installation package.

Step 306: The packager re-signs the mobile application. The packager can re-sign the mobile app using the signature tool signapk and the default signature file, or a user-specified signature file.

Specifically, the first interface code in the object code can be replaced with the second interface code by a code injection and a function hook method. It is modified to automatically encrypt unencrypted files and automatically decrypt encrypted files when using the application for file reading and writing and editing. Once the file leaves the usage environment, the third-party application cannot be opened because it cannot obtain the service of automatic decryption, thereby protecting the content of the file.

It can be seen from the above that the first interface code in the object code is replaced with the second interface code by using code injection technology or API hook (HOOK) technology, so that it can accept the file encryption and decryption capability, and the application file operation interface is The original calling system interface was replaced with a pointer to the Enterprise Security container. The first application is implemented by enabling the controlled application to accept enterprise security container management.

FIG. 4 is a schematic diagram of a method for a mobile terminal to control a security application through an enterprise security container according to an embodiment of the present invention. The method shown in Figure 4 includes:

Step 401: The mobile terminal acquires an installation package of the enterprise security container and installs it.

Step 402: The mobile terminal acquires an installation package of the security application and installs it.

Step 403: The mobile terminal receives an instruction from the user to read the file of the security application, decrypts the file of the read security application, and sends the decrypted file to the enterprise security container through the Android IBinder interface, and the enterprise security container pairs The decrypted file is read.

When the mobile terminal receives an instruction from the user to write a file of the security application, the file of the written security application is encrypted, and the encrypted file is sent to the enterprise security container through the Android IBinder interface, and the enterprise security container is encrypted. The file is written.

Among them, the enterprise security container management refers to installing the enterprise security container application on the mobile phone, replacing the interface for reading and writing the system in the original application with the interface for reading and writing by the secure container, and writing the encrypted file into the sandbox isolation area of the enterprise security container. .

The quarantine sandbox provides a layer of protection that allows your software program to be protected from system modifications. Malware or Trojans, in addition to trying to break through the sandboxed virtual system and restricted permissions, also have security applications. Decode. Encryption of the security container's quarantine sandbox and security application files creates a solid defense against the Trojan. Play the highest defenses.

Install the enterprise security container byodHome.APK and use the Enterprise Security container to manage security applications. Through the kernel space API interception, the user space API intercepts, the security application runs only in the quarantine sandbox of the enterprise security container, the quarantine sandbox provides a copy of the system environment and reduces some of the permissions, all operations of the program in the sandbox are new Adding files, modifying files, registry, etc. are not really modified to the system, but instead changed to a copy, this copy is invisible to the normal program of the real system. There is no change to the system, so the Trojan can't survive. Disappears as the sandbox is cleared. The second protection is achieved by the isolation sandbox of the safety container.

In the related art, when a normal application performs a read/write operation, the local code is directly written to the mobile phone and saved to a file, which is not only intercepted or modified by other malware during the writing process, but also has no files stored in the hard disk. Protection measures, any application has permission to read it.

By adopting the invention, the new application can be re-developed without providing a new application, and the original enterprise application can be conveniently and flexibly added with the ability of reading and decrypting and decrypting files for the enterprise mobile application, and the source code of the original application is not needed. File read and write encryption is achieved by simple security hardening, not used In the case of a system read/write interface, double-layer protection is provided by the enterprise security container for file operations in the sandbox quarantine area, which can reduce the possibility that the application is modified. In addition to trying to break through the virtual system of the quarantine sandbox and the restricted permissions, malware or trojans cannot be cracked by the file encryption of the mobile application. Encryption of the security container's isolation sandbox and security-enhanced files creates a solid defensive surface for the virus Trojan. Play the highest defenses.

The invention provides a system for securing the operation of mobile application files. File encryption and sandboxed dual protection.

The system is simple to operate, and only needs to perform security hardening of file encryption for the controlled application, and the enterprise security container can be installed on the mobile phone.

Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions for performing any of the methods described above.

FIG. 5 is a schematic structural diagram of an apparatus for managing an application according to an embodiment of the present invention. The device shown in Figure 5 includes:

In the device of the present invention, the second processing module is configured to

The first interface code is replaced with the target code after the second interface code, and the installation package of the security application is obtained by linking, compiling, and packaging.

Referring to FIG. 6, an embodiment of the present invention further provides a mobile terminal, including:

The read/write operation module is set to read the decrypted file.

In the mobile terminal of the present invention, the receiving module is further configured to:

The encryption and decryption module is further configured to:

Encrypt the file of the written secure application;

The read/write operation module is further configured to: write the encrypted file. One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by an integrated circuit to implement its corresponding function. It can also be implemented in the form of a software function module, for example, by a processor executing a program/instruction in the memory and memory to implement its corresponding function. The invention is not limited to any specific form of combination of hardware and software.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

The embodiment of the invention improves the security of the application in the mobile terminal.

Claims

A method of managing applications, including:

The packager performs the first processing on the application installation package to obtain the target code;

The packager performs a second process on the target code to obtain an installation package of the security application, wherein, after the second process, the installation package of the security application includes code for implementing a data security transmission function.
The method according to claim 1, wherein the packetizer performs a first process on the installation package of the application to obtain the target code, including:

The packager unpacks, decompiles, and disassembles the installation package of the application to obtain the target code.
The method according to claim 1, wherein the packager performs a second process on the target code to obtain an installation package of the security application, including:

The packer determines a location of the first interface code in the target code; wherein the first interface code comprises: an input/output I/O operation of the application in the target code is invoked in an operating system of the mobile terminal Code

The packager replaces the first interface code with a second interface code invoked in a pre-installed secure operation platform in the mobile terminal according to the determined location, wherein the first interface code is replaced with a pre-stored I/O operation of the application; The second interface code includes the code for implementing a data secure transmission function;

The packager replaces the first interface code with the target code after the second interface code to link, compile, and package the installation package of the security application.
The method of claim 3 wherein replacing the first interface code with the second interface code comprises:

The first interface code is replaced with the second interface code by a code injection method and/or a function hook.
The method according to claim 1, wherein said code for implementing a data secure transmission function comprises an encryption code for encrypting the outputted unencrypted information and/or a decryption for decrypting the received encrypted information. Code.
The method of claim 5, wherein the code for implementing the data secure transfer function further comprises code for processing the I/O operation using the secure runtime platform.
A method of implementing read and write operations, including:

The mobile terminal receives an instruction from the user to read the file of the security application, decrypts the file of the read security application, and performs a read operation on the decrypted file.
The method of claim 7 further comprising:

The mobile terminal receives an instruction from the user to write a file of the security application, and the mobile terminal encrypts the file of the written security application and performs a write operation on the encrypted file.
The method of claim 8 wherein the writing to the encrypted file comprises:

The encrypted file is written to the secure operating platform.
The method of claim 7 or 8, wherein the reading the decrypted file comprises:

The decrypted file is read by a secure operation platform.
A device for managing applications, including:

a first processing module, configured to perform a first processing on the installation package of the application to obtain a target code;

And a second processing module, configured to perform a second processing on the target code to obtain an installation package of the security application, wherein, after the second processing, the installation package of the security application includes code for implementing a data security transmission function.
The apparatus of claim 11 wherein said second processing module is configured to

Determining a location of the first interface code in the target code; wherein the first interface code comprises: an input/output I/O operation applied in the target code is adjusted in an operating system of the mobile terminal Code used;

Replacing the first interface code with a second interface code invoked in a pre-installed secure operating platform in the mobile terminal according to the determined location; wherein the second interface code is replaced by a pre-stored I/O operation of the application; The interface code includes the code for implementing a data secure transmission function;

The first interface code is replaced with the target code after the second interface code, and the installation package of the security application is obtained by linking, compiling, and packaging.
A mobile terminal includes:

a receiving module, configured to receive an instruction from a user to read a file of the security application;

The encryption and decryption module is configured to decrypt the file of the read security application;

The read/write operation module is set to read the decrypted file.
The mobile terminal according to claim 13, wherein the receiving module is further configured to:

Receiving an instruction from the user to write a file of the secure application;

The encryption and decryption module is further configured to:

Encrypt the file of the written secure application;

The read/write operation module is further configured to: write the encrypted file.
A computer readable storage medium storing computer executable instructions for performing the method of any one of claims 1 to 10.