WO2020228564A1 - Application service method and device - Google Patents

Abstract

An application service method and device. The method comprises: in a rich execution environment, determining whether a registered service exists in a target application, if yes, obtaining a service request of the target application, obtaining the current identification information of the target application according to the service request, and obtaining the current signature information of the target application by means of the current identification information; determining whether the current identification information of the target application is consistent with initial identification information of the target application when being registered; if the current identification information of the target application is consistent with the initial identification information of the target application when being registered, determining, in a trusted execution environment, whether the current signature information of the target application is consistent with initial signature information of the target application when being registered, and if yes, performing processing according to the service request of the target application. By the adoption of the application service method of the present application, whether the current information of the target application is consistent with the initial information at the time of registration is compared, and the service request is processed when the current information and the initial information are consistent, thereby ensuring the security of using a target application service by a user.

Description

Application service method and device

This application claims the priority of a Chinese patent application filed on May 16, 2019 with the application number 201910411135.X and the invention title "An application service method and device", the entire content of which is incorporated into this application by reference.

Technical field

This application relates to the field of application services, in particular to an application service method and device.

Background technique

In recent years, there have been more and more artificial intelligence services in terminal devices. These artificial intelligence services usually require very good personalized functional services to be favored by consumers. In this regard, terminal equipment manufacturers or Internet-developed companies all hope to provide personalized services at different levels of terminal equipment (including operating system layer, framework layer, application layer, etc.).

Most of the personalized services of terminal devices in the current technology adopt the following design ideas: first, obtain the feedback data of the user using the terminal device, and then upload the feedback data to the back-end server, and the back-end server builds a model based on the received feedback data After that, the feedback data is used to make decisions according to the trained model; the final result of the decision is fed back to the terminal device so that the user can receive the decision result.

The above-mentioned existing personalized services have obvious technical defects. First, most of these services need to obtain user usage and operation logs and send them back to back-end servers (not limited to cloud servers), then build a cloud personalized model, and then upgrade the software The package or application upgrade is pushed back to the terminal device to realize the upgrade of personalized service functions. However, this method is not only costly, but also violates the user's personal privacy to a certain extent. Even if the artificial intelligence chip is mounted on the terminal device, if the personalized service plan design has defects, it is easy to be used by hackers, resulting in the unusable functions of the terminal device, and there are even hidden dangers of property and privacy data loss and leakage.

Summary of the invention

This application provides an application service method to solve the problems of insecurity and high transmission cost in the existing application data transmission process. This application also relates to an application service device.

This application provides an application service method, including:

In a rich execution environment, it is determined whether the target application has a registered service, if so, the service request of the target application is obtained, and the current identification information of the target application is obtained according to the service request, and the current identification information Acquiring the current signature information of the target application; judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered;

If the current identification information of the target application is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application and the initial signature information when the target application is registered If they are consistent, the processing is performed according to the service request of the target application.

Optional, also includes:

In a rich execution environment, acquiring a service registration request of a target application, acquiring initial identification information of the target application according to the service registration request, and acquiring initial signature information of the target application through the initial identification information;

In a trusted execution environment, based on the initial signature information and the initial identification information, a service identification that requires a service to be registered is generated, and the service identification is returned to the target application.

Optionally, the obtaining the initial identification information of the target application according to the service registration request includes:

Acquiring the identification information of the target application at a higher authority level than the target application;

The identification information is used as the initial identification information of the target application.

Optionally, the obtaining the initial signature information of the target application through the initial identification information includes:

Acquiring the code segment and code segment location of the target application according to the initial identification information;

Obtain the initial signature information of the target application according to the code segment and the location of the code segment.

Optionally, the obtaining the initial signature information of the target application according to the code segment and the location of the code segment includes:

Splicing the code segment with the position of the code segment to obtain spliced code information;

Obtaining the signature information of the code segment according to the spliced code information;

Use the signature information of the code segment as the initial signature information of the target application.

Optionally, the obtaining the code segment and the code segment location of the target application according to the initial identification information includes:

Determining the target application according to the initial identification information;

At least one code segment is selected from the codes of the target application as the code segment of the target application.

Optional, also includes:

Determine whether the target application has the authority to obtain the code segment;

The obtaining the code segment of the target application through the initial identification information includes:

If it is determined that the target application has the authority to acquire the code segment, the code segment of the target application is acquired through the initial identification information.

Optionally, in the trusted execution environment, according to the initial signature information and the initial identification information, generating a service identifier that requires a registered service includes:

Storing the initial signature information and the initial identification information in the database of the trusted execution environment;

In the trusted execution environment, a service identifier corresponding to the initial signature information and the initial identification information that requires a registered service is generated.

Optionally, the returning the service identifier to the target application includes:

In the rich execution environment, use the service identifier as an index to store the initial identification information and the initial signature information of the registered target application; store all the information stored in the rich execution environment The service identifier is returned to the target application.

Optionally, the service registration request includes at least one of the following information:

The name information of the service that needs to be registered in the target application;

Whether to enable data encryption for the service that needs to be registered;

Data encryption algorithm information for the service that needs to be registered;

Decrypt the public key information for the data of the service that needs to be registered.

Optionally, the initial identification information of the target application includes at least a unique identifier of the target application, and the unique identifier is a unique identifier of the target application at the kernel authority layer.

Optionally, the judging whether the target application has a registered service includes:

Obtain information about all services of the target application;

Determine whether all services of the target application have service identifiers.

Optionally, the judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered includes:

Acquiring the identification information of the target application at a higher authority level than the target application, and using the identification information as the current identification information of the target application;

Acquiring initial identification information when the target application is registered;

It is determined whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

Optionally, the judging whether the current signature information of the target application in the trusted execution environment is consistent with the initial signature information when the target application is registered includes:

Acquiring the current signature information of the target application according to the current identification information of the target application;

Acquiring initial signature information when the target application is registered;

It is determined whether the current signature information of the target application is consistent with the initial signature information when the target application is registered.

Optionally, the acquiring the current signature information of the target application according to the current identification information of the target application includes:

Acquiring the code segment and the code segment location of the target application according to the current identification information;

Obtain the current signature information of the target application according to the code segment and the location of the code segment.

Optionally, the obtaining the current signature information of the target application according to the code segment and the position of the code segment includes:

Splicing the code segment with the position of the code segment to obtain spliced code information;

Obtaining the signature information of the code segment according to the spliced code information;

Use the signature information of the code segment as the current signature information of the target application.

Optionally, the obtaining the code segment and the code segment location of the target application according to the current identification information includes:

Determining the target application according to the current identification information;

At least one code segment is selected from the codes of the target application as the code segment of the target application.

Optional, also includes:

Determine whether the target application has the authority to obtain the code segment;

The obtaining the code segment of the target application through the current identification information includes:

If it is determined that the target application has the authority to acquire the code segment, the code segment of the target application is acquired through the current identification information.

Optionally, the obtaining the service request of the target application includes:

In a rich execution environment, obtain feedback data samples of the target application; use the obtained feedback data samples of the target application as the service request of the obtained target application;

The processing according to the service request of the target application includes: in a trusted execution environment, training a decision model for obtaining service decision results according to the feedback data of the target application according to the feedback data sample; The decision model of the service decision result is taken as the processing result.

Optional, also includes:

In the rich execution environment, obtaining feedback data of the target application;

In the trusted execution environment, a service decision result for the feedback data of the target application is obtained according to the feedback data of the target application and the decision model.

Optional, also includes:

In the trusted execution environment, storing the feedback data of the target application in a database;

Determine whether the collection of the feedback data is completed, and if the result of the determination is yes, delete all the feedback data in the database;

According to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained.

Optional, also includes:

Determine whether the feedback data is encrypted, and if so, decrypt the feedback data;

The obtaining a service decision result for the feedback data of the target application according to the feedback data of the target application and the decision model includes:

According to the decrypted feedback data and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the obtaining the service request of the target application includes:

In a rich execution environment, the feedback data of the target application is obtained, candidate objects are obtained according to the feedback data, and the decision request of the target application is obtained; the decision request of obtaining the target application is taken as the obtained target application Request for service;

The processing according to the service request of the target application includes: in a trusted execution environment, obtaining a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and according to the candidate object And the decision model to obtain a decision result; and use the obtained decision result as a processing result.

Optionally, the obtaining candidate objects according to the feedback data includes:

Obtaining a set of objects corresponding to the feedback data;

A filter condition for the feedback data is obtained, objects meeting the filter condition are selected from the object set, and the objects meeting the filter condition are used as candidate objects.

Optionally, the obtaining a decision model used to obtain a decision result according to the candidate object according to the decision request of the target application includes:

Acquiring the service identifier included in the decision request;

Obtain the decision model using the service identifier as an index.

Optionally, the obtaining a decision result according to the candidate object and the decision model includes:

Scoring each element of the candidate object according to the decision model to obtain a scoring result;

Sorting each element according to the scoring result to obtain a sorting result;

The scoring result and the ranking result are used as the decision result.

Correspondingly, this application also provides an application service device, including:

The service judging unit is used to judge whether the target application has a registered service in the rich execution environment, if so, obtain the service request of the target application, and obtain the current identification information of the target application according to the service request, Obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification information of the target application is If the initial identification information when the target application is registered is consistent, it is determined in a trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered;

The service processing unit is used for processing according to the service request of the target application if the judgment result is yes.

This application also provides a terminal, including:

The service judging unit is used to judge whether the target application has a registered service in the rich execution environment in the terminal, if so, obtain the service request of the target application, and obtain the current target application according to the service request Identification information, obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification information of the target application If the information is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment in the terminal whether the current signature information of the target application is consistent with the initial signature information when the target application is registered;

The service processing unit is used for processing according to the service request of the target application if the judgment result is yes.

Compared with the prior art, this application has the following advantages:

This application provides an application service method, including: in a rich execution environment, judging whether the target application has a registered service, if so, obtaining the service request of the target application, obtaining the current identification information of the target application according to the service request, and passing The current identification information obtains the current signature information of the target application; determines whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification information of the target application is consistent with the initial identification information when the target application is registered, then In the trusted execution environment, it is judged whether the current signature information of the target application is consistent with the initial signature information when the target application is registered, and if so, it is processed according to the service request of the target application. Using the application service method of this application, by comparing whether the current information of the target application is consistent with the initial information at the time of registration, and processing the service request when they are consistent, the security guarantee is provided for the target application using the service of this application to prevent The service of the target application is tampered with during data transmission, so as to ensure the safety of the user using the service of the target application.

In the further improved technical solution of this application, before using the application service of this application, the application needs to be registered. When registering the service of the target application of this application, the initial identification information of the target application used is It is higher than the permission level of the target application, which further reduces the possibility of data tampering when using the service of the target application to transmit data.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments described in this application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

FIG. 1 is a flowchart of an application service method according to Embodiment 1 of the application;

FIG. 2 is a flowchart of the service registration method of the application in the second embodiment of the application;

3 is a flowchart of a method for processing feedback data for a target application according to Embodiment 3 of the application;

FIG. 4 is a flowchart of the online decision-making method according to the fourth embodiment of the application;

FIG. 5 is a flowchart of a service deregistration method of an application according to Embodiment 5 of this application;

Fig. 6 is a schematic diagram of an application service device according to a sixth embodiment of the application;

FIG. 7 is a schematic diagram of a terminal according to Embodiment 8 of this application;

FIG. 8 is a schematic diagram of components of a system for application services according to Embodiment 9 of the present application.

Detailed ways

In the following description, many specific details are explained in order to fully understand this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar promotion without violating the connotation of this application. Therefore, this application is not limited by the specific implementation disclosed below.

This application provides an application service method and device. The following are specific embodiments:

As shown in FIG. 1, it is a flowchart of an application service method embodiment in Embodiment 1 of the present application. The method includes the following steps.

Step S101: In the rich execution environment, determine whether the target application has a registered service, if so, obtain the service request of the target application, obtain the current identification information of the target application according to the service request, and obtain the current identification information of the target application through the current identification information. Signature information: Determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

Step S102: If the current identification information of the target application is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered, and if so, then Process according to the service request of the target application.

The application service method of this application includes the service registration process of the target application, the feedback data processing process, and the online decision process. In the following description, three embodiments are used to illustrate the three processes one by one.

As shown in FIG. 2, it is a flowchart of a service registration embodiment of the application service method of the second embodiment of the application. The method includes the following steps.

Step S201: In the rich execution environment, obtain the service registration request of the target application, obtain the initial identification information of the target application according to the service registration request, and obtain the initial signature information of the target application through the initial identification information.

When the application service registration method of this embodiment is used to register the service of the application, the service registration request of the target application is first obtained. The service registration request includes at least one of the following information: the name information of the service that needs to be registered in the target application, The information about whether to enable data encryption for the service, the data encryption algorithm information for the service that needs to be registered, and the public key information for the data decryption of the service that needs to be registered.

Taking the registration of a service of the target application using the method of this embodiment as an example, assuming that the target application is APP1, in practice, the service functions of APP1 may be diverse. Taking a certain service registration as an example, the name information of the service that needs to be registered in the target application can be placed in the service registration request, so as to determine which service function of the target application will register with the method of this embodiment. In order to ensure that after registering with the method of this embodiment, the data is free from the risk of tampering during the subsequent transmission of the target application's data, it is also possible to put information on whether data encryption is enabled for the service that needs to be registered in the service registration request. . Similarly, if the information to enable data encryption is placed in the service registration request, the data encryption algorithm information for the service that needs to be registered and the data decryption public key information for the service that needs to be registered can also be placed in the service registration request. .

Specifically, the service registration request may include the name information of the aforementioned service, information about whether to enable data encryption for the service that needs to be registered, data encryption algorithm information of the service that needs to be registered, and a request for data decryption public key information for the service that needs to be registered String information. Since the algorithms involved in encryption, decryption, and encryption have been studied to a relatively mature degree in the prior art, they will not be repeated here.

After that, according to the service registration request, the initial identification information of the target application is obtained. Specifically, obtaining the initial identification information of the target application may be obtaining the identification information of the target application at a higher authority level than the target application, and using the identification information higher than the authority level of the target application as the initial identification information of the target application. The permission layer higher than the target can be the kernel layer of the system running the target application, or other layers of the system. It can be understood here that as long as it is higher than the permission layer of the target application, of course, in this embodiment , The system here refers to the system used for registration, deregistration and services of the target application in this application. It should be noted that the initial identification information of the target application in this part can be the unique identifier of the target application in the system used to register, deregister, and serve the service of the target application. For example, it can be the target application's unique identifier in the system kernel authority layer. Uniquely identifies.

After acquiring the identification information of the target application, the initial signature information of the target application is acquired according to the initial identification information. Specifically, the initial signature information can be acquired by the following description.

First, obtain the code segment and code segment location of the target application according to the initial identification information.

Afterwards, the initial signature information of the target application is obtained according to the code segment and the location of the code segment. Specifically, as one of the ways to obtain the initial signature information of the target application according to the code segment and the position of the code segment, the code segment can be spliced with the position of the code segment to obtain the spliced code information, and the signature information of the code segment is calculated by the HASH algorithm , Use the signature information of the code segment as the initial signature information of the target application.

In this embodiment, the initial signature information is used to ensure that the service of the target application is registered and the subsequent data processing after registration and the data security during the logout process, and also to ensure the privacy of the user when using the target application. Therefore, during the registration process Need to obtain the initial signature information of the target application. Here, the initial signature information further ensures the security of the service of the target application using the system of this application.

In order to obtain the code segment of the target application, when obtaining the code segment of the target application and the location of the code segment according to the initial identification information, the target application to be registered needs to be confirmed, that is, the target application is determined according to the initial identification information. For example, when multiple applications register for services at the same time, if there are three applications to register for services here, and the three applications are APP1, APP2, and APP3 in sequence, then there must be respective initial identification information for the three applications. Assuming that the initial identification information of APP1 is A1, the initial identification information of APP2 is A2, and the initial identification information of APP3 is A3, then when A1 is acquiring the code segment of the target application and the location of the code segment, it can be inferred here to obtain the code of APP1 Segment and code segment location. In the same way, when A2 is obtaining the code segment and code segment location of the target application, it is speculated to obtain the code segment and code segment location of APP2; and so on, when A3 is obtaining the code segment and code segment location of the target application , Presumably, to get the code segment and code segment location of APP3.

After determining the target application of the code segment to be obtained, at least one code segment is selected from the code of the target application as the code segment of the target application. Of course, when acquiring the code segment and the location of the code segment of the target application, acquiring the code segment of the target application may be a program of randomly acquiring the target application. While acquiring a section of the target application program, the location corresponding to the code section can also be acquired. Since the technology of randomly obtaining application code segments is relatively mature, I won't go into details here.

In this embodiment, before obtaining the code segment of the target application, it is necessary to determine whether the target application has the permission to obtain the code segment; if it is determined that the target application has the permission to obtain the code segment, the code of the target application is obtained through the initial identification information. segment.

Specifically, when using the method of this embodiment to register the service of the target application, in order to ensure that the code segment of the target application can be obtained, before obtaining the code segment of the target application, it is necessary to determine whether the target application has the authority to obtain the code segment. The judgment process here is to ensure the smooth acquisition of the code segment of the target application. For example, if it is judged that the execution subject of the service registration method in this embodiment judges that the current target application has the authority to obtain the code segment, the code segment of the target application is obtained through the initial identification information; otherwise, the code segment of the target application cannot be obtained.

Step S202: In the trusted execution environment, according to the initial signature information and the initial identification information, generate a service identifier that requires a registered service, and return the service identifier to the target application.

After obtaining the initial signature information and initial identification information in step S201, a service identification that requires a registered service is generated in a trusted execution environment based on the initial signature information and initial identification information.

Specifically, the foregoing manner of generating the service identifier may be in the manner described below.

First, the initial signature information and initial identification information of the target application are passed into the trusted execution environment. The rich execution environment has been mentioned in step S201 of this embodiment, and this step involves a trusted execution environment, and the two together constitute the operating system used to register the service in this embodiment. A rich execution environment generally refers to an untrusted operating environment, such as a common Android operating system; and a trusted execution environment refers to a specific hardware-isolated operating environment. Although a richer execution environment is safer, storage and computing resources are limited. Therefore, the operating system that executes the service registration method in this embodiment combines the two, some of the steps are executed in a rich execution environment, and some of the steps are executed in a trusted execution environment, so as to ensure high security and high computing for data transmission. rate.

Passing the initial signature information and initial identification information of the target application into the trusted execution environment may be performed by first storing the initial signature information and initial identification information of the target application in a database in the trusted execution environment; In the letter execution environment, the service ID that needs to be registered is generated, that is, the service ID that needs to be registered is generated according to the initial signature information and initial identification information in the database. For example, if the target application is APP1, register the service APP1FUNC1 in it, first obtain its initial identification information as A1, initial signature information as B1, and the service ID generated from A1 and B1 as D1, then D1 is the service ID of APP1FUNC1.

After that, the service ID is returned to the target application.

After the service identification of the target application service is generated by the trusted execution environment, the service identification needs to be returned to the target application in order to identify the service registered by the target application.

Specifically, one of the ways to return the service identifier to the target application may be: first, in the rich execution environment, use the service identifier as an index to store the initial identification information and initial signature information of the registered target application; The service identifier in the rich execution environment is returned to the target application.

The above mentioned service identification is used as an index to store the initial identification information and initial signature information of the registered target application. The registered service identification and the related information of the target application are first established, and then the service identification is returned to Target application.

Using the service registration method of the application of this embodiment, the service identification corresponding to the service of the target application can be obtained through the initial identification information and initial signature information of the target application, thereby providing security guarantee for the target application using the service of this application to prevent the target The service of the application is tampered with in the process of data transmission, so as to ensure the safety of the user using the service of the target application.

The second embodiment above is an explanation of the service registration of the application service method. After registration, this application also provides a processing method for the feedback data of the target application, as shown in FIG. 3, which is the target application of the third embodiment of the application. A flowchart of an embodiment of a method for processing feedback data of the target application service method. The method includes the following steps.

Step S301: In the rich execution environment, obtain the feedback data sample of the target application, determine whether the target application has a registered service, and if so, determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

If the method provided in this embodiment is used to process the feedback data of the target application, the first step is to obtain the feedback data sample of the target application in the rich execution environment, and the feedback data sample is used to train the model to facilitate the feedback of the user using the target application data processing.

Before training the model on the feedback data sample, first perform a service registration judgment on the service of the target application. The judgment process is to ensure the security of user data. The judgment in this embodiment is divided into three levels. The three levels of judgment are as follows The descriptions are given in order.

The first level of judgment is to judge whether there are registered services in the target application.

As one of the ways to determine whether the target application has registered services, it may be to obtain all the services of the target application first, and then sequentially determine whether all the services of the target application have service identifiers.

Since it has been mentioned in the second embodiment that all successfully registered services have a service identifier in the rich execution environment, the registration situation of the service can be preliminarily determined according to whether there is a service with a service identifier in the target application. Of course, in the first level of judgment, if there is no registered service identifier in all services of the target application, the judgment process of this target application is directly exited. If it exists, it enters the second level of judgment, that is, whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

The second level of judgment is to judge whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

When it is judged that the target application meets the conditions at the first level, it enters the second level of judgment.

As mentioned in the second embodiment, a successfully registered service has initial identification information in the rich execution environment during the registration process. Therefore, after the first level of judgment meets the conditions, the current target application registration can be extracted in the rich execution environment The initial identification information at the time.

Similarly, when judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered, the current identification information of the current target application can be determined in a rich execution environment based on the current target application. Similar to the method of obtaining the initial identification information in the second embodiment, the current identification information of the current target application can be obtained in the same way, that is, the identification information of the current target application is obtained at a higher authority level than the current target application, and the identification information is used as the current target The current identification information of the application.

After obtaining the current identification information and the initial identification information, it is determined whether the current identification information of the target application is consistent with the initial identification information when the target application is registered. For example, the initial identification information when APP1 registers for the service is A1. If the current identification information is also A1, it is determined that the current identification information of the target application is consistent with the initial identification information when the target application is registered; the initial identification information when APP1 registers for the service is A1 If the current identification information is also A01, it is determined that the current identification information of the target application is inconsistent with the initial identification information when the target application is registered.

Step S302: If the current identification information of the target application is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered, and if so, then Train a decision model based on feedback data samples to obtain service decision results based on the feedback data of the target application.

In step S301, if it is determined that the current identification information of the target application is consistent with the initial identification information when the target application is registered, the third level of judgment is entered, that is, whether the current signature information of the target application and the initial signature information when the target application is registered are determined Consistent.

The third level of judgment is to judge whether the current signature information of the target application is consistent with the initial signature information when the target application is registered.

When the target application meets the conditions at the second level, it enters the third level of judgment.

Similarly, as mentioned in the second embodiment, a successfully registered service has initial signature information in the rich execution environment during the registration process. Therefore, after the second level of judgment meets the conditions, the current signature information can be extracted in the rich execution environment. The initial signature information when the target application is registered.

When judging whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in the trusted execution environment, the current identification information of the target application can be used to determine the current target application in the rich execution environment. Current signature information. Similar to the method of obtaining the initial signature information in the second embodiment, the current signature information of the current target application can be obtained in the same manner, that is, the current signature information of the target application is obtained according to the current identification information of the target application.

As a way to obtain the current signature information of the target application according to the current identification information of the target application, first obtain the code segment and the code segment location of the target application according to the current identification information, and then obtain the target application's signature information according to the code segment and the code segment location. Current signature information.

Specifically, as one of the ways to obtain the current signature information of the target application according to the code segment and the position of the code segment, the code segment can be spliced with the position of the code segment, the signature information of the code segment is calculated by the HASH algorithm, and the signature information of the code segment As the current signature information of the target application.

In this embodiment, the current signature information is used to ensure the data security of the target application's service during data processing, and also to ensure the privacy of the user when using the target application. Therefore, the current signature of the target application needs to be obtained during data processing. Signature information. Here, the current signature information further ensures the security of the service of the target application using the system of this application.

In order to obtain the code segment of the target application, when obtaining the code segment and the code segment location of the target application according to the current identification information, the target application to be registered needs to be confirmed, that is, the target application is determined according to the current identification information. For example, when multiple applications are processing data at the same time, suppose there are three applications to process data, and the three applications are APP1, APP2, and APP3 in turn, then there must be respective current identification information corresponding to the three applications. Assuming that the current identification information of APP1 is A1, the current identification information of APP2 is A2, and the current identification information of APP3 is A3, then when A1 is acquiring the code segment of the target application and the position of the code segment, it can be inferred here to obtain the code of APP1 Segment and code segment location. In the same way, when A2 is obtaining the code segment and code segment location of the target application, it is speculated to obtain the code segment and code segment location of APP2; and so on, when A3 is obtaining the code segment and code segment location of the target application , Presumably, to get the code segment and code segment location of APP3.

After determining the target application of the code segment to be obtained, at least one code segment is selected from the code of the target application as the code segment of the target application. Of course, when acquiring the code segment and the location of the code segment of the target application, acquiring the code segment of the target application may be a program of randomly acquiring the target application. While acquiring a section of the target application program, the location corresponding to the code section can also be acquired. Since the technology of randomly obtaining application code segments is relatively mature, I won't repeat it here.

In this embodiment, before obtaining the code segment of the target application, it is necessary to determine whether the target application has the permission to obtain the code segment; if it is determined that the target application has the permission to obtain the code segment, the code of the target application is obtained through the current identification information. segment.

Specifically, when using the method of this embodiment to perform data processing after registration of the service of the target application, in order to ensure that the code segment of the target application can be obtained, it is necessary to determine whether the target application has the acquisition code before obtaining the code segment of the target application. The permissions of the segment. The judgment process here is to ensure the smooth acquisition of the code segment of the target application. For example, if it is determined that the current target application has the authority to obtain the code segment, the code segment of the target application is obtained through the current identification information; otherwise, the code segment of the target application cannot be obtained.

After obtaining the current signature information and the initial signature information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered. For example, the initial signature information when APP1 registers for the service is B1, if the current signature information is also B1, it is judged that the current signature information of the target application is consistent with the initial signature information when the target application is registered; the initial signature information when APP1 registers for the service is B1 If the current signature information is also B01, it is determined that the current signature information of the target application is inconsistent with the initial signature information when the target application is registered. It should be noted that this judgment process is performed in a trusted execution environment, and the acquisition of signature information is performed in a rich execution environment. In short, in the process of data processing, the final judgment of the three levels of judgment is executed in a trusted execution environment to fully ensure that the data of the target application will not be tampered with during the processing.

After verifying that all three levels meet the conditions, that is, the target application has registered services, the current identification information of the target application is consistent with the registered initial identification information, and the current signature information of the target application is consistent with the registered initial signature information, Train a decision model based on feedback data samples to obtain service decision results based on the feedback data of the target application.

Specifically, as one of the implementation ways of training a decision model for obtaining service decision results based on the feedback data of the target application, first, in the trusted execution environment, the feedback data samples are processed online or batched. Way to learn. After that, the learned decision model is obtained, and the decision model is stored in the trusted execution environment using the service identifier of the target application as an index.

After the decision model is stored in the trusted execution environment, in the rich execution environment, the feedback data of the target application is obtained, and the service decision result for the feedback data of the target application is obtained according to the feedback data of the target application and the decision model.

When obtaining feedback data, you can temporarily store the feedback data of the target application in a database in a trusted execution environment. Then it is judged whether the collection of feedback data is completed, and if the judgment result is yes, all the feedback data in the database is deleted. In this way, the used feedback data can be deleted in time, on the one hand, storage space can be saved, and on the other hand, the safety of the feedback data can be ensured.

Before processing the feedback data, it is necessary to determine whether the feedback data is encrypted, and if so, decrypt the feedback data; and obtain the service decision result of the feedback data for the target application according to the decrypted feedback data and the decision model.

Using the method for processing feedback data for the target application in this embodiment can process data in a trusted execution environment with a higher security level, ensuring the safety of the feedback data of the target application; The processing method of the feedback data is for the service of the registered target application. Therefore, it is necessary to check whether the target application is registered for the service, whether the initial identification information of the target application at the time of registration is consistent with the current identification information of the current target application, and In the trusted execution environment, it is verified whether the initial signature information of the target application at the time of registration is consistent with the current signature information of the current target application, which further prevents the service of the target application from being maliciously tampered with during the transmission of feedback data, thereby further ensuring that users use the target application The security of the service.

The third embodiment above is the description of the processing of the feedback data of the application service method. Following the processing of the feedback data, this application also provides an online decision-making method for the target application, as shown in Figure 4, which is implemented for this application Example 4 is a flowchart of an embodiment of an online decision method for the target application service method. The method includes the following steps.

Step S401: In the rich execution environment, obtain feedback data of the target application, obtain candidate objects according to the feedback data, obtain the decision request of the target application, and determine whether the target application has registered the service for the decision request; If so, it is determined whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

When using the method of this embodiment to obtain the decision result, firstly, the feedback data of the target application is obtained in the rich execution environment, and the candidate object is obtained according to the feedback data.

Specifically, the candidate object can be obtained according to the feedback data in the manner described below.

First, obtain the corresponding object set of the feedback data.

After that, the filtering conditions for the feedback data are obtained, the objects that meet the filtering conditions are screened in the object collection, and the objects that meet the filtering conditions are used as candidates.

Since the method in this embodiment is a method for obtaining a decision result, while obtaining feedback data, a decision request for a target application that triggers the method is also obtained at the same time.

Of course, before obtaining the feedback data, the service registration judgment is also performed on the service of the target application. The judgment process is also to ensure the security of user data. The judgment in this embodiment is also divided into three levels, and the three levels of judgment are the same. The judgment in the third embodiment.

The first two levels of judgment are to determine whether the target application has registered the service for the decision request; if so, determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered . The description method of the specific judgment has been described in detail in the third embodiment, and will not be repeated here. For details, refer to the description of this part in the third embodiment.

Step S402: If the current identification information of the target application is consistent with the initial identification information when the target application is registered, determine in a trusted execution environment that the current signature information of the target application is consistent with the initial identification information when the target application is registered. Whether the signature information is consistent, if so, obtain a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and obtain a decision result according to the candidate object and the decision model.

Similarly, if it is determined that the current identification information of the target application is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered. For the detailed description of this part, please refer to the description of this part corresponding to the third embodiment, which will not be repeated here.

After judging that the current signature information of the target application is consistent with the initial signature information when the target application is registered in the trusted execution environment, the decision model used to obtain the decision result according to the candidate object is obtained according to the decision request of the target application and the previously obtained candidate objects. The specific method of obtaining the decision model can be as described below.

First, obtain the service identifier contained in the decision request. The decision request obtained in step S401 includes the service identifier of the registered service of the target application.

After obtaining the service identifier, the service identifier is used as an index to obtain a pre-stored decision model for feedback data processing, and the decision model is used as a decision model for obtaining decision results according to the candidate object. After the decision model training in the third embodiment, the obtained decision model has been stored in the trusted execution environment using the service identifier as an index. Therefore, in the decision-making process, only the service identifier is used as the index to obtain it in the trusted execution environment. Feedback data processing pre-stored decision model can be.

After the decision model is obtained, the decision result is obtained according to the candidate object and the decision model. Among them, the obtained decision result includes scoring each element of the candidate object according to the decision model, and sorting each element according to the scoring, and taking the scoring and sorting result of each element as the decision result.

Using the online decision-making method of this embodiment, it is also possible to make decisions in a trusted execution environment with a higher security level. Since the online decision-making using this embodiment is for services that have registered target applications, it needs to be calibrated level by level. Verify whether the target application is registered for the service, whether the initial identification information of the target application at the time of registration is consistent with the current identification information of the current target application, and verify that the initial signature information of the target application at the time of registration and the current target application’s Whether the current signature information is consistent or not can further prevent the service of the target application from being maliciously tampered with during the decision-making process, thereby further ensuring the safety of users using the service of the target application.

Corresponding to the service registration of Embodiment 1, and in order to further ensure the security of the application service of this application, this application also provides an application service deregistration method, as shown in FIG. 5, which is the application service of the fifth embodiment of this application. A flowchart of an embodiment of the logout method. The method includes the following steps.

Step S501: In the rich execution environment, obtain the service deregistration request of the target application, determine whether the target application has a registered service according to the service deregistration request, and if so, determine the current identification information of the target application and the initial identification of the target application during registration Whether the information is consistent.

In this embodiment, the application service deregistration method is adopted. First, the service deregistration request of the target application is obtained, and subsequent operations are performed according to the deregistration request.

Similar to the third embodiment, when the log-off method of this embodiment is adopted, three levels of judgment are also required. The three levels of judgment are briefly described below. For the detailed description, please refer to the relevant description of the third embodiment.

The first level of judgment is to judge whether there are registered services in the target application.

As one of the ways to determine whether the target application has registered services, it may be to obtain all the services of the target application first, and then sequentially determine whether all the services of the target application have service identifiers. If it exists, it enters the second level of judgment, that is, it is judged whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

The second level of judgment is to judge whether the current identification information of the target application is consistent with the initial identification information when the target application is registered. When it is judged that the target application meets the conditions at the first level, it enters the second level of judgment.

Specifically, one of the methods for judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered may be: first, obtaining the identification information of the target application at a higher authority level than the target application itself, and Use the identification information as the current identification information of the target application; then, obtain the initial identification information when the target application is registered; after obtaining the initial identification information and the current identification message, determine the current identification information of the target application and the initial identification information when the target application is registered Is it consistent?

Step S502: If the current identification information of the target application is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered, and if so, then Delete the feedback data and decision model for the target application.

In step S501, if it is judged that the current identification information of the target application is consistent with the initial identification information when the target application is registered, then the third level of judgment is entered, that is, whether the current signature information of the target application is determined to be the same as the initial signature information of the target application when the target application is registered. Consistent.

The third level of judgment is to judge whether the current signature information of the target application is consistent with the initial signature information when the target application is registered.

When the target application meets the conditions at the second level, it enters the third level of judgment.

Similarly, as mentioned in the second embodiment, a successfully registered service has initial signature information in the rich execution environment during the registration process. Therefore, after the second level of judgment meets the conditions, the current signature information can be extracted in the rich execution environment. The initial signature information when the target application is registered.

When judging whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in the trusted execution environment, the current identification information of the target application can be used to determine the current target application in the rich execution environment. Current signature information. Similar to the method of obtaining the initial signature information in the second embodiment, the current signature information of the current target application can be obtained in the same manner, that is, the current signature information of the target application is obtained according to the current identification information of the target application.

As a way to obtain the current signature information of the target application according to the current identification information of the target application, first obtain the code segment and the code segment location of the target application according to the current identification information, and then obtain the target application's signature information according to the code segment and the code segment location. Current signature information.

Specifically, as one of the ways to obtain the current signature information of the target application according to the code segment and the position of the code segment, the code segment can be spliced with the position of the code segment, the signature information of the code segment is calculated by the HASH algorithm, and the signature information of the code segment As the current signature information of the target application.

In this embodiment, the current signature information is used to ensure the data security of the service of the target application during the logout process, and also to ensure the privacy of the user when using the target application. Therefore, the current signature information of the target application needs to be obtained during the logout process. . Here, the current signature information further ensures the security of the service of the target application using the system of this application.

In order to obtain the code segment of the target application, when obtaining the code segment and the code segment location of the target application according to the current identification information, the target application to be registered needs to be confirmed, that is, the target application is determined according to the current identification information. After determining the target application of the code segment to be obtained, at least one code segment is selected from the code of the target application as the code segment of the target application. Of course, when acquiring the code segment and the location of the code segment of the target application, acquiring the code segment of the target application may be a program of randomly acquiring the target application. While obtaining a section of the target application program, you can also obtain the location of the code section. Since the technology of randomly obtaining application code segments is relatively mature, I won't go into details here.

In this embodiment, before obtaining the code segment of the target application, it is necessary to determine whether the target application has the permission to obtain the code segment; if it is determined that the target application has the permission to obtain the code segment, the code of the target application is obtained through the current identification information. segment.

Specifically, when using the method of this embodiment to log out after registering the service of the target application, in order to ensure that the code segment of the target application can be obtained, before obtaining the code segment of the target application, it is necessary to determine whether the target application has an acquisition code segment. permission. The judgment process here is to ensure the smooth acquisition of the code segment of the target application. For example, if it is determined that the current target application has the authority to obtain the code segment, the code segment of the target application is obtained through the current identification information; otherwise, the code segment of the target application cannot be obtained.

After obtaining the current signature information and the initial signature information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered. It should be noted that this judgment process is performed in a trusted execution environment, and the acquisition of signature information is performed in a rich execution environment. In short, during the logout process, the final judgment among the three levels of judgment is executed in a trusted execution environment to fully ensure that the data of the target application will not be tampered with during the logout process.

After verifying that all three levels meet the conditions, that is, when the target application has registered services, the current identification information of the target application is consistent with the registered initial identification information, and when the current signature information of the target application is consistent with the registered initial signature information, Then delete the feedback data and decision model for the target application.

Using the application service deregistration method of this embodiment, it is also possible to perform deregistration in a trusted execution environment with a higher security level. Because the application service deregistration method using this embodiment is for services that have registered the target application, It is necessary to verify step by step whether the target application is registered for the service, whether the initial identification information of the target application at the time of registration is consistent with the current identification information of the current target application, and verify the initial signature information of the target application at the time of registration in a trusted execution environment and Whether the current signature information of the current target application is consistent, to further prevent the service of the target application from being maliciously tampered with during the logout process or before the logout, thereby further ensuring the safety of the user using the service of the target application.

In short, in the above-mentioned Embodiment 2 to Embodiment 5, the application service of this application is divided into the registration process, the data processing process, the online decision process and the cancellation process, and each stage after registration is verified to ensure The safety of users using the services of the target application.

Corresponding to the above application service method, this application also provides an application service device. Please refer to FIG. 6, which is a schematic diagram of an embodiment of an application service device according to the sixth embodiment of this application. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple, and the related parts are referred to the method embodiment. The description is sufficient, and the device embodiments described below are only illustrative. An application service device provided by this application includes the following parts.

This application provides an application service device, including:

The service judging unit 601 is used to judge whether the target application has a registered service in the rich execution environment, if so, obtain the service request of the target application, and obtain the current identification information of the target application according to the service request , Obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification information of the target application is If the initial identification information when the target application is registered is consistent, it is determined in a trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered;

The service processing unit 602 is configured to perform processing according to the service request of the target application if the judgment result is yes.

Optional, also includes:

The initial signature information obtaining unit is used to obtain the service registration request of the target application in the rich execution environment, obtain the initial identification information of the target application according to the service registration request, and obtain the information of the target application through the initial identification information Initial signature information.

The service identification generating unit is configured to generate a service identification that requires a registered service in a trusted execution environment based on the initial signature information and the initial identification information.

The identifier returning unit is used to return the service identifier to the target application.

Optionally, the initial signature information obtaining unit is specifically configured to:

Acquiring the identification information of the target application at a higher authority level than the target application;

The identification information is used as the initial identification information of the target application.

Optionally, the initial signature information obtaining unit is specifically configured to:

Acquiring the code segment and code segment location of the target application according to the initial identification information;

Obtain the initial signature information of the target application according to the code segment and the location of the code segment.

Optionally, the initial signature information obtaining unit is specifically configured to:

Splicing the code segment with the position of the code segment to obtain spliced code information;

Obtaining the signature information of the code segment according to the spliced code information;

Use the signature information of the code segment as the initial signature information of the target application.

Optionally, the initial signature information obtaining unit is specifically configured to:

Determining the target application according to the initial identification information;

At least one code segment is selected from the codes of the target application as the code segment of the target application.

Optionally, the initial signature information obtaining unit is further configured to:

Determine whether the target application has the authority to obtain the code segment;

The obtaining the code segment of the target application through the initial identification information includes:

If it is determined that the target application has the authority to acquire the code segment, the code segment of the target application is acquired through the initial identification information.

Optionally, the service identification generating unit is specifically configured to:

Storing the initial signature information and the initial identification information in the database of the trusted execution environment;

In the trusted execution environment, a service identifier corresponding to the initial signature information and the initial identification information that requires a registered service is generated.

Optionally, the identification return unit is specifically used for:

In the rich execution environment, use the service identifier as an index to store the initial identification information and the initial signature information of the registered target application; store all the information stored in the rich execution environment The service identifier is returned to the target application.

Optionally, the registration service request includes at least one of the following information:

The name information of the service that needs to be registered in the target application;

Whether to enable data encryption for the service that needs to be registered;

Data encryption algorithm information for the service that needs to be registered;

Decrypt the public key information for the data of the service that needs to be registered.

Optionally, the initial identification information of the target application includes at least a unique identifier of the target application, and the unique identifier is a unique identifier of the target application at the kernel authority layer.

Optionally, the service judgment unit is specifically configured to:

Obtain information about all services of the target application;

Determine whether all services of the target application have service identifiers.

Optionally, the service judgment unit is specifically configured to:

Acquiring the identification information of the target application at a higher authority level than the target application, and using the identification information as the current identification information of the target application;

Acquiring initial identification information when the target application is registered;

It is determined whether the current identification information of the target application is consistent with the initial identification information when the target application is registered.

Optionally, the service judgment unit is specifically configured to:

Acquiring the current signature information of the target application according to the current identification information of the target application;

Acquiring initial signature information when the target application is registered;

It is determined whether the current signature information of the target application is consistent with the initial signature information when the target application is registered.

Optionally, the service judgment unit is specifically configured to:

Acquiring the code segment and the code segment location of the target application according to the current identification information;

Obtain the current signature information of the target application according to the code segment and the location of the code segment.

Optionally, the service judgment unit is specifically configured to:

Splicing the code segment with the position of the code segment to obtain spliced code information;

Obtaining the signature information of the code segment according to the spliced code information;

Use the signature information of the code segment as the current signature information of the target application.

Optionally, the service judgment unit is specifically configured to:

Determining the target application according to the current identification information;

At least one code segment is selected from the codes of the target application as the code segment of the target application.

Optionally, the service judgment unit is specifically configured to:

Determine whether the target application has the authority to obtain the code segment;

If it is determined that the target application has the authority to acquire the code segment, the code segment of the target application is acquired through the current identification information.

Optionally, the service judgment unit is specifically configured to: in a rich execution environment, obtain a feedback data sample of the target application, and use the obtained feedback data sample of the target application as the obtained service request of the target application;

The service processing unit is specifically configured to: in a trusted execution environment, train a decision model for obtaining service decision results according to the feedback data of the target application based on the feedback data sample; and apply the obtained service decision result to the decision model As a result of processing.

Optionally, it further includes a decision-making unit, and the decision-making unit is specifically configured to:

In the rich execution environment, obtaining feedback data of the target application;

In the trusted execution environment, according to the feedback data of the target application and the decision model, the service decision result for the feedback data of the target application is obtained.

Optionally, the decision-making unit is specifically used for:

In the trusted execution environment, collecting feedback data of the target application into a database;

Determine whether the collection of the feedback data is completed, and if the result of the determination is yes, delete all the feedback data in the database;

According to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the decision-making unit further includes a decryption unit, and the decryption unit is specifically configured to:

Determine whether the feedback data is encrypted, and if so, decrypt the feedback data;

The decision-making unit is specifically used for:

According to the decrypted feedback data and the decision model, a service decision result for the feedback data of the target application is obtained.

Optionally, the service judgment unit is specifically configured to: in a rich execution environment, obtain feedback data of the target application, obtain candidate objects according to the feedback data; obtain the decision request of the target application; The decision request of the application serves as the acquired service request of the target application;

The service processing unit is specifically configured to: in a trusted execution environment, obtain a decision model for obtaining a decision result according to the candidate object according to the decision request of the target application, and obtain according to the candidate object and the decision model Decision-making result; taking the obtained decision-making result as the processing result.

Optionally, the service judgment unit is specifically configured to:

Obtaining a set of objects corresponding to the feedback data;

A filter condition for the feedback data is obtained, objects meeting the filter condition are selected from the object set, and the objects meeting the filter condition are used as candidate objects.

Optionally, the service processing unit is specifically configured to:

Acquiring the service identifier included in the decision request;

Obtain the decision model using the service identifier as an index.

Optionally, the service processing unit is specifically configured to:

Scoring each element of the candidate object according to the decision model to obtain a scoring result;

Sorting each element according to the scoring result to obtain a sorting result;

The scoring result and the ranking result are used as the decision result.

The application service method of this application can be applied to a terminal. Correspondingly, this application also provides a terminal. Please refer to FIG. 7, which is a schematic diagram of a terminal according to the seventh embodiment of the application, since the terminal embodiment is basically similar to The method embodiments 1 to 5 are therefore relatively simple to describe. For related parts, please refer to the part of the description of Embodiment 1 to Embodiment 5. The method embodiments described below are only illustrative.

The terminal provided by this application includes the following parts.

The service judging unit 701 is configured to judge whether the target application has a registered service in the rich execution environment in the terminal, if so, obtain the service request of the target application, and obtain the service request of the target application according to the service request. Current identification information, obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification information of the target application If the identification information is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment in the terminal whether the current signature information of the target application is consistent with the initial signature information when the target application is registered;

The service processing unit 702 is configured to perform processing according to the service request of the target application if the judgment result is yes.

The present application also provides a system for application services, as shown in FIG. 8, which is a schematic diagram of components of an embodiment of a system for application services in the eighth embodiment of this application. The system includes the following components: feedback data collector, service manager, end-side decision TA, feedback learner, decision maker, data and model manager.

The feedback data collector and service manager are located in the rich execution environment of the system. The feedback data collector is used to collect the feedback data of the target application according to the identification information at the permission layer higher than the target application, and the service manager is used to transmit the service request type to the trusted application according to the identification information at the permission layer higher than the target application Execution environment.

The end-side decision TA, feedback learner, decision maker, and data and model manager are all located in a trusted execution environment. The end-side decision TA is used to call the feedback learner, decision maker, data and model manager according to the request type of the service, and process the request type of the service. The feedback learner is used to train a decision model based on feedback data samples to obtain service decision results based on the feedback data of the target application. The decision maker is used to obtain the service decision result of the feedback data for the target application according to the feedback data and the decision model. The data and model manager is used to store feedback data and decision models.

In the system of this application, each component is allocated in different execution environments, which ensures the safety of applications using this system during data transmission, so as to prevent the services of the target application from being tampered with during data transmission.

Although this application is disclosed as above in preferred embodiments, it is not intended to limit the application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the application. Therefore, this application The scope of protection shall be subject to the scope defined by the claims of this application.

In a typical configuration, the computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory. The memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.

1. Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include non-transitory computer readable storage media, such as modulated data signals and carrier waves.

2. Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

Claims (28)

An application service method, characterized by comprising: In the rich execution environment, it is determined whether the target application has a registered service, if so, the service request of the target application is obtained, the current identification information of the target application is obtained according to the service request, and the current identification information is used to obtain all the services. The current signature information of the target application; judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; If the current identification information of the target application is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment whether the current signature information of the target application and the initial signature information when the target application is registered If they are consistent, the processing is performed according to the service request of the target application. The application service method according to claim 1, further comprising: In a rich execution environment, acquiring a service registration request of a target application, acquiring initial identification information of the target application according to the service registration request, and acquiring initial signature information of the target application through the initial identification information; In a trusted execution environment, based on the initial signature information and the initial identification information, a service identification that requires a service to be registered is generated, and the service identification is returned to the target application. The application service method according to claim 2, wherein the obtaining the initial identification information of the target application according to the service registration request comprises: Acquiring the identification information of the target application at a higher authority level than the target application; The identification information is used as the initial identification information of the target application. The application service method according to claim 2, wherein the obtaining the initial signature information of the target application through the initial identification information comprises: Acquiring the code segment and code segment location of the target application according to the initial identification information; Obtain the initial signature information of the target application according to the code segment and the location of the code segment. The application service method according to claim 4, wherein the obtaining the initial signature information of the target application according to the code segment and the location of the code segment comprises: Splicing the code segment with the position of the code segment to obtain spliced code information; Obtaining the signature information of the code segment according to the spliced code information; Use the signature information of the code segment as the initial signature information of the target application. The application service method according to claim 4, wherein the obtaining the code segment and the code segment location of the target application according to the initial identification information comprises: Determining the target application according to the initial identification information; At least one code segment is selected from the codes of the target application as the code segment of the target application. The application service method according to claim 4, further comprising: Determine whether the target application has the authority to obtain the code segment; The obtaining the code segment of the target application through the initial identification information includes: If it is determined that the target application has the authority to acquire the code segment, the code segment of the target application is acquired through the initial identification information. The application service method according to claim 2, characterized in that, in a trusted execution environment, according to the initial signature information and the initial identification information, generating a service identification that requires a registered service comprises: Storing the initial signature information and the initial identification information in the database of the trusted execution environment; In the trusted execution environment, a service identifier corresponding to the initial signature information and the initial identification information that requires a registered service is generated. The application service method according to claim 2, wherein the returning the service identifier to the target application comprises: In the rich execution environment, use the service identifier as an index to store the initial identification information and the initial signature information of the registered target application; store all the information stored in the rich execution environment The service identifier is returned to the target application. The application service method according to claim 2, wherein the service registration request includes at least one of the following information: The name information of the service that needs to be registered in the target application; Whether to enable data encryption for the service that needs to be registered; Data encryption algorithm information for the service that needs to be registered; Decrypt the public key information for the data of the service that needs to be registered. The application service method according to claim 2 or 3, wherein the initial identification information of the target application at least includes a unique identifier of the target application, and the unique identifier is that the target application is in the kernel authority layer The unique identifier. The application service method according to claim 2, wherein the judging whether the target application has a registered service comprises: Obtain information about all services of the target application; Determine whether all services of the target application have service identifiers. The application service method according to claim 1, wherein the judging whether the current identification information of the target application is consistent with the initial identification information when the target application is registered comprises: Acquiring the identification information of the target application at a higher authority level than the target application, and using the identification information as the current identification information of the target application; Acquiring initial identification information when the target application is registered; It is determined whether the current identification information of the target application is consistent with the initial identification information when the target application is registered. The application service method according to claim 13, wherein the determining whether the current signature information of the target application is consistent with the initial signature information when the target application is registered in a trusted execution environment comprises: Acquiring the current signature information of the target application according to the current identification information of the target application; Acquiring initial signature information when the target application is registered; It is determined whether the current signature information of the target application is consistent with the initial signature information when the target application is registered. The application service method according to claim 14, wherein the obtaining the current signature information of the target application according to the current identification information of the target application comprises: Acquiring the code segment and the code segment location of the target application according to the current identification information; Obtain the current signature information of the target application according to the code segment and the location of the code segment. The application service method according to claim 15, wherein the obtaining the current signature information of the target application according to the code segment and the location of the code segment comprises: Splicing the code segment with the position of the code segment to obtain spliced code information; Obtaining the signature information of the code segment according to the spliced code information; Use the signature information of the code segment as the current signature information of the target application. The application service method according to claim 15, wherein the obtaining the code segment and the code segment location of the target application according to the current identification information comprises: Determining the target application according to the current identification information; At least one code segment is selected from the codes of the target application as the code segment of the target application. The application service method of claim 15, further comprising: Determine whether the target application has the authority to obtain the code segment; The obtaining the code segment of the target application through the current identification information includes: If it is determined that the target application has the authority to obtain the code segment, the code segment of the target application is obtained through the current identification information. The application service method according to claim 1, wherein the obtaining the service request of the target application comprises: In a rich execution environment, obtain feedback data samples of the target application; use the obtained feedback data samples of the target application as the service request of the obtained target application; The processing according to the service request of the target application includes: in a trusted execution environment, training a decision model for obtaining service decision results according to the feedback data of the target application according to the feedback data sample; The decision model of the service decision result is taken as the processing result. The application service method according to claim 19, further comprising: In the rich execution environment, obtaining feedback data of the target application; In the trusted execution environment, a service decision result for the feedback data of the target application is obtained according to the feedback data of the target application and the decision model. The application service method of claim 20, further comprising: In the trusted execution environment, storing the feedback data of the target application in a database; Determine whether the collection of the feedback data is completed, and if the result of the determination is yes, delete all the feedback data in the database; According to the feedback data of the target application and the decision model, a service decision result for the feedback data of the target application is obtained. The application service method according to claim 21, further comprising: Determine whether the feedback data is encrypted, and if so, decrypt the feedback data; The obtaining a service decision result for the feedback data of the target application according to the feedback data of the target application and the decision model includes: According to the decrypted feedback data and the decision model, a service decision result for the feedback data of the target application is obtained. The application service method according to claim 1, wherein the obtaining the service request of the target application comprises: In a rich execution environment, the feedback data of the target application is obtained, candidate objects are obtained according to the feedback data, and the decision request of the target application is obtained; the decision request of obtaining the target application is taken as the obtained target application Request for service; The processing according to the service request of the target application includes: in a trusted execution environment, according to the decision request of the target application, obtaining a decision model for obtaining a decision result according to the candidate object, and according to the candidate object And the decision model to obtain a decision result; and use the obtained decision result as a processing result. The application service method according to claim 23, wherein the obtaining candidate objects according to the feedback data comprises: Obtaining a set of objects corresponding to the feedback data; A filter condition for the feedback data is obtained, objects meeting the filter condition are selected from the object set, and the objects meeting the filter condition are used as candidate objects. The application service method according to claim 23, wherein the obtaining a decision model used to obtain a decision result according to the candidate object according to a decision request of the target application comprises: Acquiring the service identifier included in the decision request; Obtain the decision model using the service identifier as an index. The application service method according to claim 23, wherein the obtaining a decision result according to the candidate object and the decision model comprises: Scoring each element of the candidate object according to the decision model to obtain a scoring result; Sorting each element according to the scoring result to obtain a sorting result; The scoring result and the ranking result are used as the decision result. An application service device, characterized by comprising: The service judging unit is used to judge whether the target application has a registered service in the rich execution environment, if so, obtain the service request of the target application, obtain the current identification information of the target application according to the service request, and pass all The current identification information acquires the current signature information of the target application; it is determined whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification information of the target application is consistent with the target application When the initial identification information when the application is registered is consistent, it is determined in the trusted execution environment whether the current signature information of the target application is consistent with the initial signature information when the target application is registered; The service processing unit is used for processing according to the service request of the target application if the judgment result is yes. A terminal, characterized in that it comprises: The service judgment unit is used to judge whether the target application has a registered service in the rich execution environment in the terminal, if so, obtain the service request of the target application, and obtain the current target application according to the service request Identification information, obtain the current signature information of the target application through the current identification information; determine whether the current identification information of the target application is consistent with the initial identification information when the target application is registered; if the current identification of the target application If the information is consistent with the initial identification information when the target application is registered, it is determined in the trusted execution environment in the terminal whether the current signature information of the target application is consistent with the initial signature information when the target application is registered; The service processing unit is used for processing according to the service request of the target application if the judgment result is yes.

Images