WO2021114614A1 - 应用程序安全启动方法、装置、计算机设备和存储介质 - Google Patents

应用程序安全启动方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2021114614A1
WO2021114614A1 PCT/CN2020/098856 CN2020098856W WO2021114614A1 WO 2021114614 A1 WO2021114614 A1 WO 2021114614A1 CN 2020098856 W CN2020098856 W CN 2020098856W WO 2021114614 A1 WO2021114614 A1 WO 2021114614A1
Authority
WO
WIPO (PCT)
Prior art keywords
check code
download
file
resource file
decompressed
Prior art date
Application number
PCT/CN2020/098856
Other languages
English (en)
French (fr)
Inventor
何兵
吴春海
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2021114614A1 publication Critical patent/WO2021114614A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • This application relates to a method, device, computer equipment, and storage medium for securely starting an application program.
  • the inventor realizes that in the traditional technology, the application file is downloaded from the network according to the obtained download address, but the security of the obtained application file cannot be guaranteed.
  • the applet resources are decompressed into the host sandbox, but there is no guarantee that the applet resources will not be tampered with in the host sandbox, making the file security lower.
  • a method, device, computer device, and storage medium for securely starting an application program are provided.
  • a method for safely starting an application program includes:
  • the download and decompression check code is a check code downloaded from a server in advance and used to identify the decompressed resource file
  • a device for safely starting an application program includes:
  • the request receiving module is used to receive an application start request, and the application start request carries an application identifier
  • the query module is used to query whether the application corresponding to the application identifier is running for the first time
  • the decompressed file obtaining module is used to obtain the decompressed resource file corresponding to the application program identifier when the application program is not running for the first time;
  • the actual decompression check code calculation module is used to calculate the actual decompression check code of the decompressed resource file
  • the download decompression check code acquisition module is used to obtain the download decompression check code of the decompressed resource file, the download decompression check code is a check code downloaded from the server in advance for identifying the decompressed resource file;
  • the judgment module is used to judge whether the actual decompression check code is consistent with the download decompression check code
  • the startup module is used to start the application when the actual decompression check code is consistent with the downloaded decompression check code.
  • a computer device including a memory and one or more processors, the memory stores computer readable instructions, and when the computer readable instructions are executed by the processor, the one or more processors execute The following steps:
  • the download and decompression check code is a check code downloaded from a server in advance and used to identify the decompressed resource file
  • One or more computer-readable storage media storing computer-readable instructions.
  • the one or more processors perform the following steps:
  • the download and decompression check code is a check code downloaded from a server in advance and used to identify the decompressed resource file
  • Computer readable instructions computer readable instructions computer readable instructions computer readable instructions computer readable instructions computer readable instructions
  • Fig. 1 is a diagram of an application environment according to a method for starting an application in one or more embodiments.
  • Fig. 2 is a schematic flowchart of a method for starting an application according to one or more embodiments.
  • Fig. 3 is a schematic flowchart of a method for starting an application according to another or more embodiments.
  • Fig. 4 is a sequence diagram of a method for starting an application according to another or more embodiments.
  • Fig. 5 is a structural block diagram of an application starting device according to one or more embodiments.
  • Fig. 6 is a block diagram of a terminal device according to one or more embodiments.
  • the method for securely starting an application program provided in this application can be applied to the application environment as shown in FIG. 1.
  • the terminal 102 communicates with the server 104 through the network.
  • the terminal 102 receives the application start request, the application start request carries the application identifier; queries whether the application corresponding to the application identifier is running for the first time; when the application is not running for the first time, obtains the decompressed resource file corresponding to the application identifier; calculates The actual decompression check code of the decompressed resource file; the download decompression check code of the decompressed resource file is obtained, and the download decompression check code is the check code downloaded from the server 104 in advance to identify the decompressed resource file; determine the actual decompression check code Whether it is consistent with the download decompression check code; when the actual decompression check code is consistent with the download decompression check code, start the application.
  • the terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable
  • a method for securely starting an application program is provided. Taking the method applied to the terminal in FIG. 1 as an example for description, the method includes the following steps:
  • Step 210 Receive an application start request, where the application start request carries an application identifier.
  • the user can trigger an application on the terminal to generate an application startup request.
  • the terminal receives the application startup request sent by the user, it extracts the application identifier carried in the application startup request to locate the application based on the application identifier.
  • the application program identifier is used to uniquely identify an application program, such as the program name or application program number of the application program, etc., which is not limited here.
  • the application program may be a program such as a small program, which is not limited here.
  • the application startup request can also be automatically generated in the terminal.
  • it can be adapted to operation services such as regular verification of the application or regular security check.
  • the application startup can be preset When the preset startup time is reached, the application startup request is automatically triggered to ensure that the startup business of the application is executed regularly to complete the regular security check of the application.
  • Step 220 Query whether the application corresponding to the application identifier is running for the first time.
  • the first run may refer to the first run of the application in the terminal, or it may mean that although the application is not run for the first time in the terminal, there is no relevant historical data about the application in the terminal.
  • the terminal may search for corresponding historical data in the terminal according to the obtained application identifier, and when the historical data corresponding to the application identifier is found, it is determined that the application is not running for the first time, and when the terminal does not find the corresponding historical data
  • the historical data corresponding to the program identifier determines that the application program is run for the first time.
  • the terminal downloads the applet resource file corresponding to the applet from the server via the network, and then decompresses the downloaded applet resource file into the host sandbox to execute the applet in the host sandbox Running.
  • the terminal receives the start request for the applet, it searches the host sandbox for the existence of historical download data about the applet. When the historical download data is found, it is determined that the applet is not running for the first time. It is determined that the applet has been run for the first time when the historical data is downloaded.
  • the resource files downloaded from the server may also be stored in a database corresponding to the terminal, such as a local database or a cloud database, which is not limited here.
  • Step 230 When the application program is not running for the first time, obtain the decompressed resource file corresponding to the application program identifier.
  • the decompressed resource file can be a data resource corresponding to running the application. Specifically, when the terminal finds the historical download data corresponding to the application identifier in the database corresponding to the terminal according to the application identifier, the terminal determines that the application is not running for the first time, and then obtains the corresponding application identifier from the database corresponding to the terminal.
  • the decompressed resource file after decompression.
  • the terminal database can be the host sandbox in the terminal. The host sandbox stores the resource files for running the applet, which can include compressed resource files and decompressed resource files obtained by decompressing the compressed resource files .
  • the host sandbox of the terminal can store compressed resource files or decompressed resource files about the applet, so there is no need to download the application from the server through the network again.
  • the compressed resource file corresponding to the program can directly find the corresponding compressed resource file from the host sandbox, and then the terminal can decompress the compressed resource file to obtain the decompressed resource file after decompression, or directly find the corresponding compressed resource file from the host sandbox Unzip the resource file.
  • the terminal when the terminal determines that the application is not running for the first time after receiving the application start request, it can start the corresponding application first, or obtain the decompressed resource file corresponding to the application while starting the application, and decompress the resource file. Perform security verification. When the verification is passed, continue to start the application. When the verification fails, it means that the resource file is not a secure file. You can send a security warning to the terminal or directly prohibit the terminal from continuing to start the corresponding application.
  • Step 240 Calculate the actual decompression check code of the decompressed resource file.
  • the check code can be used to uniquely identify a resource file.
  • the check code can be an MD5 check code.
  • MD5 is a 32-bit string that can be used as the unique feature value of the resource file to determine the uniqueness of the resource file. Therefore, the MD5 check code can be used to judge the security of the resource file, such as judging whether the resource file has been modified.
  • the terminal can use the preset verification algorithm to obtain the actual decompression check code corresponding to the decompressed resource file.
  • the preset MD5 verification can be used The algorithm obtains the actual decompression check code corresponding to the decompressed resource file locally.
  • the feature recognition technology in the field of artificial intelligence may also be used to calculate the actual decompression check code of the decompressed resource file.
  • Step 250 Obtain the download and decompression check code of the decompressed resource file, where the download and decompression check code is a check code downloaded from the server in advance for identifying the decompressed resource file.
  • a check code about the decompressed resource file is pre-stored in the server, and the check code is marked as a download decompression check code, so as to uniquely identify the decompressed resource file by using the download decompression check code.
  • the terminal obtains the corresponding decompressed resource file in the local host sandbox, and then calculates the actual decompression check code corresponding to the decompressed resource file locally, and then the terminal obtains the download decompression check of the decompressed resource file from the server Then you can compare the actual decompression check code with the download decompression check code to verify whether the decompressed resource file in the server and the locally stored decompressed resource file obtained by the terminal from the host sandbox are the same decompressed resource file.
  • the server performs MD5 once for the decompressed resource file to be uploaded to obtain the downloaded and compressed MD5 value to uniquely identify the resource file to be uploaded, and then the server returns the downloaded and decompressed MD5 value to the terminal, so that the terminal downloads the decompressed resource file from the server If the string is the same, it means that the decompressed resource file obtained by the terminal is correct. If the string is not the same, then the server will return the downloaded and decompressed MD5 to match the actual decompressed MD5 generated locally. This indicates that the decompressed resource file is modified, and the decompressed resource file obtained by the terminal is not safe.
  • Step 260 Determine whether the actual decompression check code is consistent with the downloaded decompression check code.
  • the terminal compares the actual decompression check code with the characters in the download decompression check code one by one. When all the characters are the same, it determines that the actual decompression check code is consistent with the download decompression check code. When any one of the characters in the decompression check code and the download decompression check code is inconsistent, it is determined that the actual decompression check code is inconsistent with the download decompression check code.
  • the actual decompression check code can be compared with the characters in the downloaded decompression check code in a certain order. When any one of the characters is inconsistent, a conclusion of inconsistency can be drawn directly without having to change all the characters. After the characters are compared, inconsistent conclusions are reached.
  • Step 270 When the actual decompression check code is consistent with the downloaded decompression check code, the application is started.
  • the actual decompression check code is the same as the download decompression check code, it means that the decompressed resource file obtained by the terminal is consistent with the decompressed resource file uploaded by the server, that is, the decompressed resource file obtained by the terminal is uploaded by the server in advance. Decompress the resource file, and unzip the resource file that has not been tampered with. At this time, you can perform the steps to start the application.
  • the decompressed resource file obtained by the terminal and the decompressed resource file pre-uploaded by the server are not the same file, that is to say, the data transmission between the server and the terminal If the decompressed resource file is tampered with or lost, or the decompressed resource file is tampered with in the host sandbox, a warning message should be issued to remind the terminal that the application is at risk or the terminal is directly prohibited from starting the corresponding application.
  • security verification is performed on the decompressed resource file after decompression to ensure the security of the decompressed resource file.
  • the corresponding application is run to ensure the security of the data.
  • the security of the data after decompression corresponding to the application program is ensured, man-in-the-middle attacks or data tampering are prevented, and hackers are improved The cost and difficulty of malicious attacks.
  • the application is not running for the first time, it directly obtains the decompressed resource file corresponding to the application. There is no need to download the compressed resource file from the server multiple times and then decompress it, which improves the opening speed of applications such as applets and saves the network of the terminal. Resources.
  • the decompressed resource file includes a plurality of decompressed sub-files
  • calculating the actual decompression check code of the decompressed resource file includes: obtaining the sub-file identifier and the sub-file check code corresponding to each decompressed sub-file; Combine each sub-file identifier and each sub-file check code according to preset rules to obtain the actual decompression check code corresponding to the decompressed resource file.
  • the decompressed resource file is a data file corresponding to running the corresponding application.
  • the decompressed resource file can be a folder, and the folder can also contain multiple subfolders and multiple decompressed subfiles.
  • the identifier is combined with the sub-file check code to obtain the actual decompressed check code corresponding to the decompressed resource file.
  • the preset algorithm can be to count all the individual files in the folder, sort the names of these files in ascending order, and then sort them with "File 1 name: MD5 of file 1, File 2 name: MD5 of file 2 ," is spliced into a string to obtain the MD5 corresponding to the decompressed resource file, and then MD5 is performed on this string of strings.
  • the preset algorithm is pre-appointed by the terminal and the server, that is, the download and decompression check code of the decompressed resource file is generated in the server according to the preset algorithm in advance, and then when the terminal obtains the decompressed resource file, the resource is decompressed locally Get the actual decompressed resource file from MD5, and then perform the consistency check between the actual decompressed check code and the downloaded decompressed check code.
  • the preset algorithm can also be other pre-appointed algorithms, which are not limited here.
  • the decompressed resource file will contain multiple files after decompression, and each file will have a corresponding file check code
  • it is generated by a preset algorithm
  • the check codes corresponding to multiple files, and the preset algorithm is pre-appointed by the terminal and the server, in various forms, preventing theft, and further ensuring the security of decompressing resource files.
  • the security of the decompressed resource file it can be known whether the internal files of the decompressed folder have been modified.
  • a schematic flow diagram of another application startup method including: after querying whether the application corresponding to the application identifier is running for the first time, it also includes:
  • Step 310 When the application program is running for the first time, obtain a compressed resource file corresponding to the application program identifier.
  • an application startup request is received, the application startup request carries an application identifier, and it is queried whether the application corresponding to the application identifier is running for the first time, and when the application is running for the first time, the compressed resource file corresponding to the application identifier is obtained .
  • the terminal when the terminal does not find historical download data corresponding to the application identifier from the corresponding host sandbox or other database, it determines that the application is running for the first time, and then the terminal downloads the compressed resource file corresponding to the application identifier from the server . For example, the terminal can locate the resource to be downloaded according to the downloaded download address, and download the resource to be downloaded to obtain the compressed resource file.
  • Step 320 Calculate the actual compression check code of the compressed resource file.
  • the terminal can use the preset check algorithm to obtain the actual compression check code corresponding to the compressed resource file.
  • the preset MD5 check code can be used to verify The algorithm obtains the actual compression check code corresponding to the compressed resource file locally.
  • the compressed resource file can be a file with the suffix zip, which corresponds to a file, which can be directly verified by MD5.
  • Step 330 Obtain the download compression check code of the compressed resource file corresponding to the application program downloaded from the server in advance.
  • the server prestores a check code about the compressed resource file, and marks the check code as a download compression check code to uniquely identify the compressed resource file by using the download compression check code. Specifically, after downloading the corresponding compressed resource file in the terminal server, the actual compression check code corresponding to the compressed resource file is calculated locally, and then the terminal obtains the download compression check code for the compressed resource file from the server, and then it can The actual compression check code is compared with the downloaded compression check code to verify whether the compressed resource file in the server and the compressed resource file obtained by the terminal are the same compressed resource file.
  • the server performs MD5 once for the compressed resource file to be uploaded to obtain the downloaded compressed MD5 value, to uniquely identify the resource file to be uploaded, and then the server returns the downloaded compressed MD5 value to the terminal, so that the terminal downloads the compressed resource file from the server If the string is the same, it means that the compressed resource file obtained by the terminal is correct. If the string is not the same, then the server will return the downloaded compressed MD5 to match the actual compressed MD5 generated locally. It indicates that the compressed resource file is modified, and the compressed resource file obtained by the terminal is not safe.
  • Step 340 Determine whether the actual compression check code is consistent with the downloaded compression check code.
  • the terminal compares the actual compression check code with the characters in the downloaded compression check code one by one. When all the characters are the same, it determines that the actual compression check code is consistent with the downloaded compression check code. When any one of the characters in the compression check code and the download compression check code is inconsistent, it is determined that the actual compression check code is inconsistent with the download compression check code.
  • the actual compression check code can be compared with the characters in the downloaded compression check code in a certain order. When any one of the characters is inconsistent, a conclusion of inconsistency can be drawn directly without having to change all the characters. After the characters are compared, inconsistent conclusions are reached.
  • Step 350 When the actual compression check code is consistent with the download compression check code, it is determined that the compressed resource file is a safe compressed file.
  • the actual compression check code is consistent with the download compression check code, it means that the compressed resource file obtained by the terminal is the same as the compressed resource file uploaded by the server, that is, the compressed resource file obtained by the terminal is uploaded by the server in advance.
  • the compressed resource file of, the compressed resource file that has not been tampered with, the steps of starting the application can be executed at this time.
  • the actual compression check code is inconsistent with the download compression check code, it means that the compressed resource file obtained by the terminal and the compressed resource file pre-uploaded by the server are not the same file, that is, the data transmission between the server and the terminal If the compressed resource file has been tampered with or lost, a warning message should be issued to remind the terminal that the application is at risk or the terminal should be directly prohibited from starting the corresponding application.
  • Step 360 When the compressed resource file is a secure compressed file, decompress the secure compressed file to obtain the decompressed resource file, and start the application program according to the decompressed compressed file.
  • the terminal determines that the compressed resource file is a secure compressed file, it decompresses the secure compressed file to obtain the decompressed resource file, and then performs a security check on the decompressed resource file.
  • the decompressed resource file is also a secure decompressed file, Enable the application.
  • the terminal downloads the compressed resource file corresponding to the application program for the first time, it performs security verification on the compressed resource file. For example, MD5 verification is performed. When the security verification is passed, the compressed resource file is decompressed and the compressed resource file is decompressed. Resource file. If the security verification of the compressed resource file fails, it means that the compressed resource file has been modified. If error handling is performed, the user terminal can be refused to start the application program, which ensures the security of the data.
  • security verification For example, MD5 verification is performed.
  • the security verification of the compressed resource file fails, it means that the compressed resource file has been modified. If error handling is performed, the user terminal can be refused to start the application program, which ensures the security of the data.
  • the actual compression check code after judging whether the actual compression check code is consistent with the download compression check code, it further includes: when the actual compression check code is inconsistent with the download compression check code, judging that the compressed resource file is unsafely compressed Resource files; generate warning messages for unsafe compressed resource files.
  • the actual decompression check code after judging whether the actual decompression check code is consistent with the download decompression check code, it further includes: when the actual decompression check code is inconsistent with the download decompression check code, determining that the decompressed resource file is unsafe for decompression Resource files; generate warning messages for unsafe decompressed resource files.
  • obtaining the compressed resource file corresponding to the application identifier includes: when the application is running for the first time, generating an encrypted symmetric key, and sending the symmetric key to For the server, the symmetric secret key is used to instruct the server to encrypt the download address of the application program, the download decompression check code, and the download compression check code to generate an encrypted service file.
  • the terminal determines that the application program is running for the first time, it needs to obtain the compressed resource file for starting the application program from the server through the network. Specifically, the terminal needs to provide the download address of the compressed resource file and the compressed resource file from the server. Download the compression check code and the decompression resource check code. The download address is used to download the corresponding compressed resource file, the download compression check code is used to verify the security of the downloaded compressed resource file, and the download decompression check code is used to verify the decompressed resource generated after decompressing the compressed resource file File security, such as verifying whether the decompressed resource file has been modified in the host sandbox.
  • the terminal communicates with the server through the network, and when the server sends the download address and check code to the terminal, the security of the network data transmission process needs to be ensured, that is, to ensure that the transmitted data is not tampered with.
  • the terminal may generate a symmetric secret key according to a preset rule, and send the symmetric secret key to the server, so that the server can use the received symmetric secret key to determine the download address, download decompression check code, and download compression check code of the application program. Encryption is performed to generate encrypted business files. By encrypting the business files, the encrypted business files are sent to the terminal, which improves the security of the data transmission process.
  • the characteristic of symmetric encryption is that the keys for encryption and decryption are the same, which makes the efficiency of encryption and decryption very high without affecting the efficiency of data transmission. It should be noted that in other embodiments, the terminal may also use other encryption algorithms, such as an asymmetric encryption algorithm, to generate encrypted service files, which is not limited in this embodiment.
  • the algorithm for generating the symmetric key may be the AES encryption algorithm.
  • the symmetric key may be dynamically and randomly generated.
  • the step of generating the symmetric key may include: first randomly generating a string abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, and then using a round-robin algorithm such as It can be a code algorithm that loops 16 times. Each time a letter in the string is randomly selected, and the letters are spliced together to generate a string, which is used as a randomly generated 16-bit symmetric key.
  • the terminal sends the symmetric key to the server to instruct the server to use the symmetric key to encrypt the service data to generate an encrypted service file, and then the terminal decrypts the encrypted service data according to the symmetric key to generate the service data, and then uses the service data Perform the steps to start the application.
  • the symmetric key for encryption, the encrypted file is sent to the terminal to ensure the security of data transmission, and the symmetric key algorithm is simple and will not affect the efficiency of data transmission.
  • the symmetric key can also include re-encrypting the symmetric key.
  • RSA encryption technology can be used to encrypt the symmetric key for transmission.
  • RSA encryption technology is a kind of asymmetric encryption. , That is, the keys corresponding to encryption and decryption are not the same.
  • RSA has two keys, a public key and a private key. The public key is used for encryption and the private key is used for decryption.
  • sending the symmetric secret key to the server includes: encrypting the symmetric secret key with the public key of the asymmetric secret key and sending it to the server, so that the server passes the public key corresponding to the asymmetric secret key The private key is decrypted to obtain the symmetric secret key.
  • the public key of the asymmetric secret key is stored in the terminal code. Since the public key is only used for encryption and is stored in the terminal code or transmitted over the network, even if the hacker obtains it, it can only be used for encryption, not for decryption. So there is no need to worry about illegal personnel decompiling to obtain it, the private key of the asymmetric key is on the background server.
  • the terminal encrypts a symmetric secret key such as an AES key with the public key of the asymmetric secret key, sends the encrypted data to the backend server, and the backend server decrypts the result by using the private key corresponding to the public key of the asymmetric secret key.
  • the symmetric key corresponding to AES completes the transmission of the AES key between the terminal and the background server.
  • Data transmission is performed after AES is encrypted by RSA, only a small amount of data such as a key symmetric key is encrypted, and the efficiency of data transmission is not affected.
  • the method for obtaining the download decompression check code and the download compression check code includes: extracting the download decompression check code and the download compression check code from the service file obtained by decrypting the encrypted service file by the symmetric secret key ,
  • the download decompression check code and the download compression check code are stored in a blockchain.
  • obtaining the download decompression check code of the decompressed resource file corresponding to the application program downloaded from the server in advance includes: obtaining the download decompression check code corresponding to the application program from the decompressed business file; and obtaining the application downloaded from the server in advance
  • the download compression check code of the compressed resource file corresponding to the program includes: obtaining the download compression check code corresponding to the application program from the decompressed business file.
  • the download address returned by the background server is http://fcloud.paic.com.cn/f/ios_app.zip
  • the downloaded MD5 returned is 6ea84e6330f55248cbb5b06fbcf95d59.
  • the terminal After the terminal receives the download address and MD5 data, it first uses the download address to download the compressed resource file to the terminal such as a mobile phone, and then performs MD5 verification on the downloaded compressed resource file to obtain the corresponding actual compressed MD5.
  • the actual compressed MD5 can be 6ea84e6330f55248cbb5b06fbcf95d59, then compare the actual compressed MD5 with the downloaded compressed MD5 returned by the background server. If the comparison results are consistent, it means that the downloaded compressed resource file has not been modified and can be used. If the MD5 value does not match, it means the download package and the expected result If it does not match, the local process is terminated.
  • the download decompression check code and the download compression check code can also be stored in a node of a blockchain.
  • the download decompression check code and the download compression check code can also be stored in a node of a blockchain.
  • a sequence diagram of an application startup method includes:
  • the terminal such as the mobile phone, randomly generates the AES key and the result is A, and then the terminal uses the RSA public key to encrypt the secret key A to obtain the decryption result B.
  • the terminal sends B to the backend server, the backend server uses the RSA private key to decrypt B to obtain the result A, the backend server uses A to encrypt the business data to be sent to obtain C, sends C to the terminal, and the terminal uses A to perform C
  • the decrypted service data is obtained by decryption, and at the same time, the service data to be sent is encrypted using A to obtain the encrypted service data and sent to the background server.
  • the resource files of the small program package are generally downloaded through the network and decompressed into the host sandbox. Because there are many hosts, it is not excluded that the host developer will modify the small program resources or because of the host code. Cause the resource to be modified. In order to ensure the correctness of resources, the general approach is to perform MD5 verification after downloading, but it cannot prevent MD5 from being modified in the interface, and it cannot prevent the modification of resources after decompression, which will lead to insecure small package resources.
  • the security check is performed on the compressed resource file and the decompressed resource file by using the check code to ensure the security of the file, thereby ensuring the security of the data.
  • data encryption is performed during data transmission between the terminal and the server to further ensure the security of data transmission and improve the security of applet resources.
  • a structural block diagram of a device for secure startup of an application program including: a request receiving module 510, a query module 520, a decompressed file acquisition module 530, and an actual decompression check code calculation module 540. Download and decompress check code acquisition module 550, judgment module 560, and start module 570, where:
  • the request receiving module 510 is configured to receive an application start request, and the application start request carries an application identifier.
  • the query module 520 is used to query whether the application corresponding to the application identifier is running for the first time.
  • the decompressed file obtaining module 530 is configured to obtain the decompressed resource file corresponding to the application program identifier when the application program is not running for the first time.
  • the actual decompression check code calculation module 540 is used to calculate the actual decompression check code of the decompressed resource file.
  • the download and decompression check code acquisition module 550 is used to obtain the download and decompression check code of the decompressed resource file.
  • the download decompression check code is a check code downloaded from the server in advance for identifying the decompressed resource file.
  • the judgment module 560 is used to judge whether the actual decompression check code is consistent with the download decompression check code.
  • the first activation module 570 is configured to activate the application when the actual decompression check code is consistent with the downloaded decompression check code.
  • the actual decompression check code calculation module 540 includes:
  • the file verification acquiring unit is used to acquire the sub-file identification and the sub-file verification code corresponding to each decompressed sub-file.
  • the actual decompression check code calculation unit is used to combine the identification of each sub file and the check code of each sub file according to preset rules to obtain the actual decompression check code corresponding to the decompressed resource file.
  • the device for safely launching an application program further includes:
  • the compressed resource file acquisition module is used to acquire the compressed resource file corresponding to the application program identifier when the application program is run for the first time.
  • the module for calculating the actual compression check code is used to calculate the actual compression check code of the compressed resource file.
  • the download compression check code obtaining module is used to obtain the download compression check code of the compressed resource file corresponding to the application program downloaded in advance from the server.
  • the compressed file judgment module is used to judge whether the actual compression check code is consistent with the downloaded compression check code.
  • the compressed file judging module is used for judging that the compressed resource file is a safe compressed file when the actual compression check code is consistent with the downloaded compression check code.
  • the second starting module is used to decompress the secure compressed file to obtain the decompressed resource file when the compressed resource file is a secure compressed file, and start the application program according to the decompressed compressed file.
  • the compressed resource file acquisition module includes:
  • Encrypted business file generating unit used to generate encrypted symmetric secret key when the application is running for the first time, and send the symmetric secret key to the server.
  • the symmetric secret key is used to instruct the server to download the application program and verify the download decompression. Code and download the compressed check code to encrypt and generate encrypted business files.
  • the encrypted service file receiving unit is used to receive the encrypted service file returned by the server.
  • the business file obtaining unit is used to decrypt the encrypted business file by using the symmetric secret key to obtain the business file.
  • the download address obtaining unit is used to obtain the download address corresponding to the application program from the business file.
  • the compressed file download unit is used for downloading according to the download address to obtain the compressed resource file.
  • the device for safely launching an application program includes:
  • the verification code extraction module is used to extract the download decompression check code and the download compression check code from the service file obtained by decrypting the encrypted service file by the symmetric secret key, the download decompression check code and the download compression check code Stored in the blockchain.
  • the encrypted service file generating unit includes:
  • the symmetric secret key acquisition subunit is used to encrypt the symmetric secret key with the public key of the asymmetric secret key and send it to the server, so that the server can obtain the symmetric secret key by decrypting the private key corresponding to the public key of the asymmetric secret key .
  • the device for safely launching an application program further includes:
  • the first warning module is used to determine that the compressed resource file is an unsafe compressed resource file when the actual compression check code is inconsistent with the downloaded compression check code; and generate warning information for the unsafe compressed resource file.
  • the second warning module is used to determine that the decompressed resource file is an unsafe decompressed resource file when the actual decompression check code is inconsistent with the download decompression check code; and generate warning information for the unsafe decompressed resource file.
  • Each module in the above-mentioned application program safe startup device can be implemented in whole or in part by software, hardware, and a combination thereof.
  • the above-mentioned modules may be embedded in the form of hardware or independent of the processor in the computer equipment, or may be stored in the memory of the computer equipment in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned modules.
  • the blockchain referred to in the present invention is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • Blockchain essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information for verification. The validity of the information (anti-counterfeiting) and the generation of the next block.
  • the blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.
  • a computer device is provided.
  • the computer device may be a terminal, and its internal structure diagram may be as shown in FIG. 6.
  • the computer equipment includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus.
  • the processor of the computer device is used to provide calculation and control capabilities.
  • the memory of the computer device includes a non-volatile or volatile storage medium and internal memory.
  • the non-volatile or volatile storage medium stores an operating system and computer readable instructions.
  • the internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile or volatile storage medium.
  • the communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, an operator's network, NFC (near field communication) or other technologies.
  • WIFI wireless fidelity
  • NFC near field communication
  • the computer-readable instructions are executed by the processor, a method for safely starting an application program is realized.
  • the display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen
  • the input device of the computer equipment can be a touch layer covered on the display screen, or it can be a button, a trackball or a touchpad set on the housing of the computer equipment , It can also be an external keyboard, touchpad, or mouse.
  • FIG. 6 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied.
  • the specific computer device may Including more or fewer parts than shown in the figure, or combining some parts, or having a different arrangement of parts.
  • a computer device including a memory and one or more processors, and computer readable instructions are stored in the memory.
  • the application start request carries the application identifier; query whether the application corresponding to the application identifier is running for the first time; when the application is not running for the first time, obtain the decompressed resource file corresponding to the application identifier; calculate the actual decompression correction of the decompressed resource file Verification code; obtain the download and decompression check code of the decompressed resource file, the download decompression check code is the check code downloaded from the server in advance to identify the decompressed resource file; determine whether the actual decompression check code is consistent with the download decompression check code ; And when the actual decompression check code is consistent with the downloaded decompression check code, start the application.
  • the decompressed resource file includes multiple decompression sub-files
  • the step of calculating the actual decompression check code of the decompressed resource file is also used to: obtain each decompression sub-file.
  • the sub-file identifier and sub-file check code corresponding to the file; and the sub-file identifier and each sub-file check code are combined according to preset rules to obtain the actual decompression check code corresponding to the decompressed resource file.
  • the processor when the processor executes the computer-readable instruction to query whether the application program corresponding to the application program identifier is a step after the first run, it is also used to: when the application program is run for the first time, obtain the corresponding application program identifier Calculate the actual compression check code of the compressed resource file; obtain the download compression check code of the compressed resource file corresponding to the application downloaded from the server in advance; determine whether the actual compression check code is consistent with the download compression check code ; When the actual compression check code is consistent with the download compression check code, the compressed resource file is determined to be a secure compressed file; and when the compressed resource file is a secure compressed file, the secure compressed file is decompressed to obtain the decompressed resource file, and the decompression The compressed file starts the application.
  • the step of obtaining the compressed resource file corresponding to the application program identifier is also used to: when the application program is run for the first time, generate The encrypted symmetric secret key is sent to the server.
  • the symmetric secret key is used to instruct the server to encrypt the application download address, download decompression check code, and download compression check code to generate encrypted service files; the receiving server returns Encrypted business files; decrypt the encrypted business files by the symmetric secret key to obtain the business files; obtain the download address corresponding to the application from the business file; and download the compressed resource file according to the download address.
  • the steps of downloading the decompression check code and downloading the compressed check code are also used to: and decrypt the encrypted service file through the symmetric secret key.
  • the download decompression check code and the download compression check code are extracted from the business file, and the download decompression check code and the download compression check code are stored in the blockchain.
  • the processor when the processor executes the computer-readable instruction to realize the step of sending the symmetric secret key to the server, it is also used to: encrypt the symmetric secret key with the public key of the asymmetric secret key and then send it to the server.
  • the server decrypts to obtain the symmetric secret key through the private key corresponding to the public key of the asymmetric secret key.
  • the processor when the processor executes the computer-readable instructions, it is also used to determine whether the actual compression check code is consistent with the download compression check code when the processor executes the following steps: when the actual compression check code is the same as the download compression check code When they are inconsistent, determine that the compressed resource file is an unsafe compressed resource file; and generate a warning message for the unsafe compressed resource file;
  • the processor executes computer-readable instructions, it is also used to determine whether the actual decompression check code is consistent with the download decompression check code when it is the next step: when the actual decompression check code is inconsistent with the download decompression check code, determine the decompression resource file Decompress resource files for unsafe; and generate warning messages for unsafe uncompressed resource files.
  • one or more computer-readable storage media are stored, and when the computer-readable instructions are executed by one or more processors, the one or more processors perform the following steps: receiving an application start request, The application start request carries the application identifier; queries whether the application corresponding to the application identifier is running for the first time; when the application is not running for the first time, obtains the decompressed resource file corresponding to the application identifier; calculates the actual decompression check of the decompressed resource file Code; Get the download decompression check code of the decompressed resource file, the download decompression check code is the check code downloaded from the server in advance to identify the decompressed resource file; judge whether the actual decompression check code is consistent with the download decompression check code; And when the actual decompression check code is consistent with the downloaded decompression check code, the application is started.
  • the computer-readable storage medium may be non-volatile or volatile.
  • the decompressed resource file includes a plurality of decompressed sub-files
  • the step of calculating the actual decompression check code of the decompressed resource file is also used to: obtain each decompression Sub-file identification and sub-file verification code corresponding to the sub-file; and combining each sub-file identification and sub-file verification code according to preset rules to obtain the actual decompression verification code corresponding to the decompressed resource file.
  • the computer-readable instruction when executed by the processor to query whether the application program corresponding to the application program identifier is a step after the first run, it is also used to: when the application program is run for the first time, obtain the application program identifier Corresponding compressed resource file; calculate the actual compression check code of the compressed resource file; obtain the download compression check code of the compressed resource file corresponding to the application downloaded from the server in advance; determine whether the actual compression check code and the download compression check code are Consistent; when the actual compression check code is consistent with the download compression check code, the compressed resource file is judged to be a safe compressed file; and when the compressed resource file is a safe compressed file, the safe compressed file is decompressed to obtain the decompressed resource file, and according to Unzip the compressed file to start the application.
  • the step of obtaining the compressed resource file corresponding to the application program identifier when the application program is run for the first time is also used to: when the application program is run for the first time, Generate encrypted symmetric secret key, send the symmetric secret key to the server, the symmetric secret key is used to instruct the server to encrypt the application download address, download decompression check code, and download compression check code to generate encrypted service files; receiving server The returned encrypted service file; decrypt the encrypted service file with the symmetric secret key to obtain the service file; obtain the download address corresponding to the application program from the service file; and download according to the download address to obtain the compressed resource file.
  • the steps of obtaining the downloading decompression check code and downloading the compressed check code are also used to: decrypt the encrypted service file by the symmetric secret key.
  • the download decompression check code and the download compression check code are extracted from the business file, and the download decompression check code and the download compression check code are stored in the blockchain.
  • the computer-readable instruction when executed by the processor to realize the step of sending the symmetric key to the server, it is also used to: encrypt the symmetric key with the public key of the asymmetric key and send it to the server, In this way, the server obtains the symmetric secret key by decrypting the private key corresponding to the public key of the asymmetric secret key.
  • the computer-readable instruction when executed by the processor, it is also used in the following step of determining whether the actual compression check code is consistent with the download compression check code: when the actual compression check code is the same as the download compression check When the codes are inconsistent, determine that the compressed resource file is an unsafe compressed resource file; generate warning information for the unsafe compressed resource file.
  • the computer-readable instruction when executed by the processor, it is used to determine whether the actual decompression check code is consistent with the download decompression check code. It is also used to determine the decompression resource when the actual decompression check code is inconsistent with the download decompression check code.
  • the file is an unsafe decompressed resource file; and a warning message for the unsafe decompressed resource file is generated.
  • Non-volatile memory may include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, or optical storage.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM may be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

一种应用程序安全启动方法，涉及数据安全技术领域。方法包括：接收应用程序启动请求，应用程序启动请求携带有应用程序标识；查询应用程序标识对应的应用程序是否为首次运行；当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；计算解压资源文件的实际解压校验码；获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器下载的用于标识解压资源文件的校验码；判断实际解压校验码与下载解压校验码是否一致；当实际解压校验码与下载解压校验码一致时，启动应用程序。隐私信息如下载解压校验码可存储于区块链中。

Description

应用程序安全启动方法、装置、计算机设备和存储介质
相关申请的交叉引用
本申请要求于2020年05月14日提交中国专利局，申请号为2020104057146，申请名称为“应用程序安全启动方法、装置、计算机设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及一种应用程序安全启动方法、装置、计算机设备和存储介质。
背景技术
随着计算机技术的发展，在网络上下载文件的需求越来越多，故而如何保证从网络上下载文件的安全性变得越来越重要。
然而，发明人意识到，传统技术中，根据获取到的下载地址从网络中下载应用程序文件，但是不能保证获取到的应用程序文件的安全性，如当从网络中下载小程序资源时，需要将小程序资源解压到宿主沙盒中，但是不能保证小程序资源在宿主沙盒中不被篡改，使得文件的安全性较低。
发明内容
根据本申请公开的各种实施例，提供一种应用程序安全启动方法、装置、计算机设备和存储介质。
一种应用程序安全启动方法包括：
接收应用程序启动请求，应用程序启动请求携带有应用程序标识；
查询应用程序标识对应的应用程序是否为首次运行；
当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；
计算解压资源文件的实际解压校验码；
获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
判断实际解压校验码与下载解压校验码是否一致；及
当实际解压校验码与下载解压校验码一致时，启动应用程序。
一种应用程序安全启动装置包括：
请求接收模块，用于接收应用程序启动请求，应用程序启动请求携带有应用程序标识；
查询模块，用于查询应用程序标识对应的应用程序是否为首次运行；
解压文件获取模块，用于当应用程序不是首次运行时，获取应用程序标识对应的解压资 源文件；
实际解压校验码计算模块，用于计算解压资源文件的实际解压校验码；
下载解压校验码获取模块，用于获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器下载的用于标识解压资源文件的校验码；
判断模块，用于判断实际解压校验码与下载解压校验码是否一致；
启动模块，用于当实际解压校验码与下载解压校验码一致时，启动应用程序。
一种计算机设备，包括存储器和一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述一个或多个处理器执行以下步骤：
接收应用程序启动请求，应用程序启动请求携带有应用程序标识；
查询应用程序标识对应的应用程序是否为首次运行；
当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；
计算解压资源文件的实际解压校验码；
获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
判断实际解压校验码与下载解压校验码是否一致；及
当实际解压校验码与下载解压校验码一致时，启动应用程序。
一个或多个存储有计算机可读指令的计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：
接收应用程序启动请求，应用程序启动请求携带有应用程序标识；
查询应用程序标识对应的应用程序是否为首次运行；
当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；
计算解压资源文件的实际解压校验码；
获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
判断实际解压校验码与下载解压校验码是否一致；及
当实际解压校验码与下载解压校验码一致时，启动应用程序。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
计算机可读指令计算机可读指令计算机可读指令计算机可读指令
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为根据一个或多个实施例中应用程序启动方法的应用环境图。
图2为根据一个或多个实施例中应用程序启动方法的流程示意图。
图3为根据另一个或多个实施例中应用程序启动方法的流程示意图。
图4为根据另一个或多个实施例中应用程序启动方法的时序图。
图5为根据一个或多个实施例中应用程序启动装置的结构框图。
图6为根据一个或多个实施例中终端设备的框图。
具体实施方式
为了使本申请的技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的应用程序安全启动方法，可以应用于如图1所示的应用环境中。终端102通过网络与服务器104进行通信。终端102接收应用程序启动请求，应用程序启动请求携带有应用程序标识；查询应用程序标识对应的应用程序是否为首次运行；当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；计算解压资源文件的实际解压校验码；获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器104下载的用于标识解压资源文件的校验码；判断实际解压校验码与下载解压校验码是否一致；当实际解压校验码与下载解压校验码一致时，启动应用程序。终端102可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器104可以用独立的服务器或者是多个服务器组成的服务器集群来实现。
在其中一个实施例中，如图2所示，提供了一种应用程序安全启动方法，以该方法应用于图1中的终端为例进行说明，包括以下步骤：
步骤210，接收应用程序启动请求，应用程序启动请求携带有应用程序标识。
具体地，用户可以对终端上的应用程序进行触发操作生成应用程序启动请求，终端接收用户发送的应用程序启动请求后，提取应用程序启动请求中携带的应用程序标识，以根据应用程序标识定位到对应的应用程序。应用程序标识用于唯一标识一个应用程序，如可以为应用程序的程序名称或者应用程序编号等，在此不作限制。在其中一个实施例中，应用程序可以为小程序等程序，在此不作限制。
在另一个实施例中，也可以在终端中自动生成应用程序启动请求，如可以适应于对应用程序的定期校验或者定期安全性检查等操作业务中，具体地，可以预先设定应用程序启动的预设启动时间，当到达预设启动时间时自动触发应用程序启动请求，以保证定期执行应用程序的启动业务完成应用程序的定期安全性检查。
步骤220，查询应用程序标识对应的应用程序是否为首次运行。
首次运行可以是指在终端中第一次运行该应用程序，也可以是指虽然不是在终端中第一次运行该应用程序但是该终端中不存在关于该应用程序的相关历史数据。具体地，终端可以根据获取到的应用程序标识在终端中查找对应的历史数据，当查找到与该应用程序标识对应的历史数据时判定该应用程序不是首次运行，当终端未查找到与该应用程序标识对应的历史数据时判定该应用程序是首次运行。
当应用程序为小程序时，终端通过网络从服务器中下载小程序对应的小程序资源文件，然后将下载到的小程序资源文件解压缩到宿主沙盒里，以在宿主沙盒里执行小程序的运行。具体地，终端接收到关于小程序的启动请求时，在宿主沙盒里查找是否存在关于该小程序的历史下载数据，当查找到历史下载数据时，判定小程序不是首次运行，当未能查找到历史下载数据时判定该小程序为首次运行。在其他实施例中也可以将从服务器中下载的资源文件存储至终端对应的数据库中，如可以是本地数据库也可以是云端数据库，在此不做限定。
步骤230，当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件。
解压资源文件可以为运行该应用程序对应的数据资源。具体地，当终端根据应用程序标识在终端对应的数据库中查找到该应用程序标识对应的历史下载数据后，终端判定该应用程序不是首次运行，然后从终端对应的数据库中获取该应用程序标识对应的解压后的解压资源文件。当应用程序对应小程序时，终端数据库可以为终端中的宿主沙盒，宿主沙盒里存储了运行该小程序的资源文件，可包含压缩资源文件以及对压缩资源文件进行解压得到的解压资源文件。
具体地，当该小程序不是首次在终端运行时，终端的宿主沙盒里可以存储有关于该小程序的压缩资源文件或者解压后的解压资源文件，故而不需要再次通过网络从服务器中下载应用程序对应的压缩资源文件，可以直接从宿主沙盒中查找到对应的压缩资源文件然后终端可以对压缩资源文件进行解压缩得到解压后的解压资源文件，或者直接从宿主沙盒里查找到对应的解压资源文件。
需要说明的是，当终端接收到应用程序启动请求后判定应用程序不是首次运行时，可以先启动对应的应用程序，或者在启动应用程序的同时获取应用程序对应的解压资源文件，对解压资源文件进行安全性校验，当校验通过时继续启动应用程序，当校验失败时，说明解压资源文件的不是安全文件，可以向终端发送安全性警示提示或者直接禁止终端继续启动对应的应用程序。
步骤240，计算解压资源文件的实际解压校验码。
具体地，校验码可用于唯一标识一个资源文件，如校验码可以为MD5校验码，MD5是一个32位的字符串，可以用来作为资源文件的唯一特征值，确定资源文件的唯一性，故而可以利用MD5校验码判断资源文件的安全性如判断资源文件是否被修改。具体地，终端获取到解压资源文件后，可以利用预设的校验算法获取解压资源文件对应的实际解压校验码，如当校验码对应MD5校验码时，可以利用预设的MD5验证算法在本地获取解压资源文件对应的实际解压校验码。在其他实施例中还可以利用人工智能领域的特征识别技术计算解压资源文件的实际解压校验码。
步骤250，获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器下载的用于标识解压资源文件的校验码。
服务器中预先存储了关于该解压资源文件的校验码，将该校验码标记为下载解压校验码，以利用下载解压校验码对该解压资源文件进行唯一标识。具体地，终端在本地的宿主沙盒里获取对应的解压资源文件，然后在本地计算该解压资源文件对应的实际解压校验码，然后终 端从服务器中获取关于该解压资源文件的下载解压校验码，然后可以将实际解压校验码与下载解压校验码进行比对，以验证服务器中的解压资源文件与终端从宿主沙盒中获取到的本地存储的解压资源文件是否为同一个解压资源文件。
具体地，服务器对待上传的解压资源文件进行一次MD5得到下载压缩MD5值，以对待上传的资源文件进行唯一标识，然后服务器将下载解压MD5值返回给终端，使得终端从服务器中下载到解压资源文件时，在本地进行一次MD5，然后将服务器返回下载解压MD5的和本地生成的实际解压MD5进行匹配，如果字符串一样，就说明终端获取到的解压资源文件是正确的，如果字符串不一样，说明解压资源文件被修改，终端获取到的解压资源文件是不安全的。
步骤260，判断实际解压校验码与下载解压校验码是否一致。
具体地，终端将实际解压校验码与下载解压校验码中的字符一一比对，当所有的字符均相同时，判定实际解压校验码与下载解压校验码是一致的，当实际解压校验码与下载解压校验码中的字符存在任意一个字符不一致时，判定实际解压校验码与下载解压校验码不一致。在具体实施中，可以按照一定的顺序依次对实际解压校验码与下载解压校验码中的字符进行比对，当存在任意一个字符不一致时，直接得出不一致的结论而不需要将所有的字符均进行比对之后才得出不一致的结论。
步骤270，当实际解压校验码与下载解压校验码一致时，启动应用程序。
具体地，当实际解压校验码与下载解压校验码一致时，说明终端获取到的解压资源文件与服务器上传的解压资源文件是一致的，即终端获取到的解压资源文件正是服务器事先上传的解压资源文件，未被篡改过的解压资源文件，此时可以执行启动应用程序的步骤。反之，当实际解压校验码与下载解压校验码不一致时，说明终端获取到的解压资源文件与服务器预先上传的解压资源文件不是同一个文件，也就是说在服务器与终端之间的数据传输中发生了解压资源文件被篡改或者丢失的情况，或者解压资源文件在宿主沙盒中被篡改，此时应该发出警示信息提示终端该应用程序存在风险或者直接禁止终端启动对应的应用程序。
在本实施例中，对解压后的解压资源文件进行安全性校验，确保解压资源文件的安全性，当确定解压资源是安全的数据时再运行对应的应用程序，保证了数据的安全性。进一步地，通过将终端得到的实际压缩校验码与从服务器下载到的下载压缩校验码进行比对，保证了应用程序对应的解压之后数据的安全性，防止中间人攻击或者篡改数据，提高黑客恶意攻击的成本和难度。并且当应用程序不是首次运行时，直接获取应用程序对应的解压资源文件，无需多次从服务器中下载压缩资源文件然后再进行解压，提高了应用程序如小程序的开启速度并节约了终端的网络资源。
在其中一个实施例中，解压资源文件中包含多个解压子文件，计算解压资源文件的实际解压校验码，包括：所述获取各解压子文件对应的子文件标识以及子文件校验码；按照预设的规则将各子文件标识以及各子文件校验码进行组合，得到解压资源文件对应的实际解压校验码。
解压资源文件是运行对应的应用程序对应的数据文件，具体地，解压之后的资源文件可 以是一个文件夹，并且文件夹里还可以包含多个子文件夹以及多个解压子文件。对多个文件进行安全性校验时，可以获取各个解压子文件对应的子文件标识，如文件名，以及获取各个解压子文件对应的子文件校验码，然后利用预设算法将各个子文件标识与子文件校验码进行组合得到解压资源文件对应的实际解压校验码。如预设算法可以为将文件夹中的所有单个的文件统计出来，对这些文件的名称进行升序排序，排好序之后以“文件1名称：文件1的MD5，文件2名称：文件2的MD5，…”的形式拼接成字符串，得到解压资源文件对应的MD5，然后对这串字符串进行MD5。需要说明的是，预设算法是终端与服务器预先约定的，即在服务器中预先根据预设算法生成解压资源文件的下载解压校验码，然后当终端获取到解压资源文件时在本地进行解压资源的MD5得到实际解压资源文件，然后执行实际解压校验码与下载解压校验码的一致性校验。并且，预设算法还可以为预先约定的其他算法在此不做限定。
在本实施例中，考虑到解压后解压资源文件中会包含多个文件，并且每个文件都会有对应的文件校验码，为了实现对多个文件的安全性校验，通过预设算法生成多个文件对应的校验码，并且预设算法是终端与服务器预先约定的，形式多种多样，防止了被窃取，进一步地保证了解压资源文件的安全性。并且通过对解压资源文件的安全性进行校验可以得知解压后的文件夹内部文件是否被修改。
如图3所示，提供了另一种应用程序启动的方法流程示意图，包括：查询应用程序标识对应的应用程序是否为首次运行之后，还包括：
步骤310，当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件。
具体地，接收应用程序启动请求，应用程序启动请求携带有应用程序标识，查询应用程序标识对应的应用程序是否为首次运行，当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件。
具体地，终端从对应的宿主沙盒或者其他数据库中未查找到关于应用程序标识对应的历史下载数据时，判断该应用程序为首次运行，然后终端从服务器中下载应用程序标识对应的压缩资源文件。如终端可以根据获取到的下载地址，根据下载地址定位到待下载资源，对待下载资源进行文件下载得到压缩资源文件。
步骤320，计算压缩资源文件的实际压缩校验码。
具体地，终端获取到压缩资源文件后，可以利用预设的校验算法获取压缩资源文件对应的实际压缩校验码，如当校验码对应MD5校验码时，可以利用预设的MD5验证算法在本地获取压缩资源文件对应的实际压缩校验码。需要说明的是，压缩资源文件可以为后缀名为zip的文件，对应为一个文件，可以直接进行MD5校验。
步骤330，获取预先从服务器下载的应用程序对应的压缩资源文件的下载压缩校验码。
服务器中预先存储了关于该压缩资源文件的校验码，将该校验码标记为下载压缩校验码，以利用下载压缩校验码对该压缩资源文件进行唯一标识。具体地，终端服务器中下载到对应的压缩资源文件后，在本地计算该压缩资源文件对应的实际压缩校验码，然后终端从服务器中获取关于该压缩资源文件的下载压缩校验码，然后可以将实际压缩校验码与下载压缩校验码进行比对，以验证服务器中的压缩资源文件与终端获取到的压缩资源文件是否为同一个压 缩资源文件。
具体地，服务器对待上传的压缩资源文件进行一次MD5得到下载压缩MD5值，以对待上传的资源文件进行唯一标识，然后服务器将下载压缩MD5值返回给终端，使得终端从服务器中下载到压缩资源文件时，在本地进行一次MD5，然后将服务器返回下载压缩MD5的和本地生成的实际压缩MD5进行匹配，如果字符串一样，就说明终端获取到的压缩资源文件是正确的，如果字符串不一样，说明压缩资源文件被修改，终端获取到的压缩资源文件是不安全的。
步骤340，判断实际压缩校验码与下载压缩校验码是否一致。
具体地，终端将实际压缩校验码与下载压缩校验码中的字符一一比对，当所有的字符均相同时，判定实际压缩校验码与下载压缩校验码是一致的，当实际压缩校验码与下载压缩校验码中的字符存在任意一个字符不一致时，判定实际压缩校验码与下载压缩校验码不一致。在具体实施中，可以按照一定的顺序依次对实际压缩校验码与下载压缩校验码中的字符进行比对，当存在任意一个字符不一致时，直接得出不一致的结论而不需要将所有的字符均进行比对之后才得出不一致的结论。
步骤350，当实际压缩校验码与下载压缩校验码一致时，判定压缩资源文件为安全压缩文件。
具体地，当实际压缩校验码与下载压缩校验码一致时，说明终端获取到的压缩资源文件与服务器上传的压缩资源文件是一致的，即终端获取到的压缩资源文件正是服务器事先上传的压缩资源文件，未被篡改过的压缩资源文件，此时可以执行启动应用程序的步骤。反之，当实际压缩校验码与下载压缩校验码不一致时，说明终端获取到的压缩资源文件与服务器预先上传的压缩资源文件不是同一个文件，也就是说在服务器与终端之间的数据传输中发生了压缩资源文件被篡改或者丢失的情况，此时应该发出警示信息提示终端该应用程序存在风险或者直接禁止终端启动对应的应用程序。
步骤360，当压缩资源文件为安全压缩文件时，对安全压缩文件进行解压得到解压资源文件，并根据解压压缩文件启动应用程序。
具体地，当终端判定压缩资源文件为安全压缩文件时，对安全压缩文件进行解压得到解压资源文件，然后再执行对解压资源文件的安全性校验，当解压资源文件也为安全解压文件时，启用应用程序。
在本实施例中，当终端首次下载应用程序对应的压缩资源文件后，对压缩资源文件进行安全性校验如进行MD5验证，当安全性验证通过时，则对压缩资源文件进行解压运行得到解压资源文件，如果压缩资源文件的安全性验证未通过时，则说明压缩资源文件被修改，做错误处理如可以拒绝用户终端启动应用程序，保证了数据的安全性。
在其中一个实施例中，判断实际压缩校验码与下载压缩校验码是否一致之后，还包括：当实际压缩校验码与下载压缩校验码不一致时，判定压缩资源文件为不安全的压缩资源文件；生成针对不安全的压缩资源文件的警示信息。
在其中一个实施例中，判断实际解压校验码与下载解压校验码是否一致之后，还包括： 当实际解压校验码与下载解压校验码不一致时，判定解压资源文件为不安全的解压资源文件；生成针对不安全的解压资源文件的警示信息。
在其中一个实施例中，当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件，包括：当应用程序是首次运行时，生成加密后的对称秘钥，将对称秘钥发送至服务器，对称秘钥用于指示服务器对应用程序的下载地址、下载解压校验码以及下载压缩校验码进行加密生成加密业务文件。接收服务器返回的加密业务文件；通过对称秘钥对加密业务文件进行解密得到业务文件；从业务文件中获取应用程序对应的下载地址；根据下载地址进行下载得到压缩资源文件。
具体地，终端在判定应用程序是首次运行时，需要通过网络从服务器中获取关于启动该应用程序的压缩资源文件，具体地，终端需从服务器提供下载压缩资源文件的下载地址、压缩资源文件的下载压缩校验码以及解压资源校验码。下载地址用于下载对应的压缩资源文件，下载压缩校验码用于校验下载到的压缩资源文件的安全性，下载解压校验码用于校验对压缩资源文件进行解压后生成的解压资源文件的安全性，如验证解压资源文件在宿主沙盒中是否被修改。
进一步地，终端通过网络与服务器通信，在服务器向终端发送下载地址以及校验码的过程中，需要保证网络数据传输过程的安全性，即保证传输的数据不被篡改。具体地，终端可以按照预设规则生成对称秘钥，将对称秘钥发送至服务器，以使得服务器根据接收到的对称秘钥对应用程序的下载地址、下载解压校验码以及下载压缩校验码进行加密生成加密业务文件，通过对业务文件进行加密，将加密后的业务文件发送至终端，提高了数据传输过程的安全性。对称加密的特点是加密和解密的密钥是一样的，使得加密和解密的效率很高，不会影响数据传输的效率。需要说明的是，在其他实施例中，终端也可以利用其他加密算法如非对称加密算法生成加密业务文件，在本实施例中不做限制。
具体地，生成对称秘钥的算法可以为AES加密算法，具体地，对称秘钥可以是动态随机生成的，生成对称秘钥的步骤可包括：首先随机生成一个字符串abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789，然后利用循环算法如可以是一个循环16次的代码算法，每次随机取这个字符串中的某个字母，并将取出的字母拼接起来，生成一个字符串，将该字符串作为随机生成的16位对称密钥。然后终端将该对称密钥发送到服务器，以指示服务器利用该对称秘钥对业务数据进行加密生成加密业务文件，然后终端再根据对称秘钥对加密业务数据进行解密生成业务数据，然后利用业务数据执行应用程序启动的步骤。通过利用对称秘钥进行加密，将加密后的文件发送至终端保证数据传输的安全性，并且对称秘钥算法简单，不会影响数据传输的效率。
为了进一步地保证对称秘钥在网络传输过程中不被篡改，还可以包括对对称秘钥进行再次加密，如可以利用RSA加密技术对对称秘钥进行加密传输，RSA加密技术是一种非对称加密，即加密和解密对应的密钥是不一样的，具体地RSA有两个密钥公钥和私钥，利用公钥进行加密，利用私钥进行解密。
在其中一个实施例中，将对称秘钥发送至服务器，包括：通过非对称秘钥的公钥对对称 秘钥进行加密后发送至服务器，以使得服务器通过与非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
具体地，终端代码里面保存了非对称秘钥的公钥，由于公钥只用来加密，保存在终端代码里面或者通过网络传输，即使黑客拿到了也只能用于加密，无法用于解密，所以无需担心有不法人员反编译去获取它，非对称秘钥的私钥在后台服务器。具体地，终端用非对称秘钥的公钥将对称秘钥如AES密钥进行加密，将加密后的数据发送到后台服务器，后台服务器利用非对称秘钥的公钥对应的私钥进行解密得到AES对应的对称密钥，进而完成终端和后台服务器的AES密钥的传递。通过RSA对AES进行加密后再执行数据传输，只对较小的数据量如关键的对称秘钥进行加密，不影响数据传输的效率。
在其中一个实施例中，下载解压校验码和下载压缩校验码的获取方式包括：通过对称秘钥对加密业务文件进行解密得到的业务文件中提取下载解压校验码和下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
具体地，获取预先从服务器下载的应用程序对应的解压资源文件的下载解压校验码，包括：从解压后的业务文件中获取应用程序对应的下载解压校验码；获取预先从服务器下载的应用程序对应的压缩资源文件的下载压缩校验码，包括：从解压后的业务文件中获取应用程序对应的下载压缩校验码。
如后台服务器返回的下载地址为http://fcloud.paic.com.cn/f/ios_app.zip，返回的下载压缩MD5为6ea84e6330f55248cbb5b06fbcf95d59。终端接收到下载地址以及MD5数据之后，先使用下载地址将压缩资源文件下载到终端如手机，然后对下载到的压缩资源文件及进行MD5验证，得到对应的实际压缩MD5，如实际压缩MD5可为6ea84e6330f55248cbb5b06fbcf95d59，然后将实际压缩MD5与后台服务器返回的下载压缩MD5进行比对，若比对结果一致，说明下载压缩资源文件没被修改可以使用，如果MD5的值对不上，说明下载包和预期结果不符，本地流程终止。
需要强调的是，为进一步保证上述下载解压校验码和下载压缩校验码的私密和安全性，上述下载解压校验码和下载压缩校验码还可以存储于一区块链的节点中，当需要利用下载解压校验码和下载压缩校验码进行应用程序的安全性校验时，直接从对应的区块链节点中获取下载解压校验码和下载压缩校验码，以保证获取到的信息的安全性。
如图4所示，提供了一种应用程序启动方法的时序图。具体地，包括：
终端如手机端随机生成AES密钥结果为A，然后终端使用RSA公钥对秘钥A进行加密得到解密结果B。终端将B发送到后台服务器，后台服务器使用RSA的私钥对B进行解密得到结果A，后台服务器使用A将待发送的业务数据进行加密得到C，将C发送到终端，终端使用A对C进行解密得到解密后的业务数据，同时也将待发送的业务数据使用A进行加密得到加密后的业务数据发送到后台服务器。
当应用程序对应小程序时，小程序包的资源文件一般是通过网络下载，解压到宿主沙盒里面的，因为宿主较多，不排除宿主开发者去修改小程序资源，或者因为宿主代码的原因导致资源被修改。为了保证资源的正确性，一般的做法是下载之后进行MD5验证，但是无法防 止接口中MD5也被修改，更无法防止解压后的资源修改，这就会导致小程序包资源的不安全。本实施例中通过校验码对压缩资源文件以及解压资源文件进行安全性校验，确保文件的安全性，进而保证了数据的安全性。并且在终端与服务器之间数据传输的过程中进行数据加密进一步地保证了数据传输的安全性，提高了小程序资源的安全性。
应该理解的是，虽然图2-4的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图2-4中的至少一部分步骤可以包括多个步骤或者多个阶段，这些步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤中的步骤或者阶段的至少一部分轮流或者交替地执行。
在其中一个实施例中，如图5所示，提供了一种应用程序安全启动装置的结构框图，包括：请求接收模块510、查询模块520、解压文件获取模块530、实际解压校验码计算模块540、下载解压校验码获取模块550、判断模块560和启动模块570，其中：
请求接收模块510，用于接收应用程序启动请求，应用程序启动请求携带有应用程序标识。
查询模块520，用于查询应用程序标识对应的应用程序是否为首次运行。
解压文件获取模块530，用于当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件。
实际解压校验码计算模块540，用于计算解压资源文件的实际解压校验码。
下载解压校验码获取模块550，用于获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器下载的用于标识解压资源文件的校验码。
判断模块560，用于判断实际解压校验码与下载解压校验码是否一致；及
第一启动模块570，用于当实际解压校验码与下载解压校验码一致时，启动应用程序。
在其中一个实施例中，实际解压校验码计算模块540，包括：
文件校验获取单元，用于获取各解压子文件对应的子文件标识以及子文件校验码。及
实际解压校验码计算单元，用于按照预设的规则将各子文件标识以及各子文件校验码进行组合，得到解压资源文件对应的实际解压校验码。
在其中一个实施例中，应用程序安全启动装置，还包括：
压缩资源文件获取模块，用于当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件。
计算实际压缩校验码模块，用于计算压缩资源文件的实际压缩校验码。
下载压缩校验码获取模块，用于获取预先从服务器下载的应用程序对应的压缩资源文件的下载压缩校验码。
压缩文件判断模块，用于判断实际压缩校验码与下载压缩校验码是否一致。
压缩文件判定模块，用于当实际压缩校验码与下载压缩校验码一致时，判定压缩资源文件为安全压缩文件。及
第二启动模块，用于当压缩资源文件为安全压缩文件时，对安全压缩文件进行解压得到解压资源文件，并根据解压压缩文件启动应用程序。
在其中一个实施例中，压缩资源文件获取模块，包括：
加密业务文件生成单元，用于当应用程序是首次运行时，生成加密后的对称秘钥，将对称秘钥发送至服务器，对称秘钥用于指示服务器对应用程序的下载地址、下载解压校验码以及下载压缩校验码进行加密生成加密业务文件。
加密业务文件接收单元，用于接收服务器返回的加密业务文件。
业务文件获取单元，用于通过对称秘钥对加密业务文件进行解密得到业务文件。
下载地址获取单元，用于从业务文件中获取应用程序对应的下载地址。及
压缩文件下载单元，用于根据下载地址进行下载得到压缩资源文件。
在其中一个实施例中，应用程序安全启动装置，包括：
验证码提取模块，用于通过对称秘钥对加密业务文件进行解密得到的业务文件中提取下载解压校验码和下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
在其中一个实施例中，加密业务文件生成单元，包括：
对称秘钥获取子单元，用于通过非对称秘钥的公钥对对称秘钥进行加密后发送至服务器，以使得服务器通过与非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
在其中一个实施例中，应用程序安全启动装置，还包括：
第一警示模块，用于当实际压缩校验码与下载压缩校验码不一致时，判定压缩资源文件为不安全的压缩资源文件；生成针对不安全的压缩资源文件的警示信息。及
第二警示模块，用于当实际解压校验码与下载解压校验码不一致时，判定解压资源文件为不安全的解压资源文件；生成针对不安全的解压资源文件的警示信息。
关于应用程序安全启动装置的具体限定可以参见上文中对于应用程序安全启动方法的限定，在此不再赘述。上述应用程序安全启动装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
本发明所指区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。区块链(Blockchain)，本质上是一个去中心化的数据库，是一串使用密码学方法相关联产生的数据块，每一个数据块中包含了一批次网络交易的信息，用于验证其信息的有效性(防伪)和生成下一个区块。区块链可以包括区块链底层平台、平台产品服务层以及应用服务层等。
在其中一个实施例中，提供了一种计算机设备，该计算机设备可以是终端，其内部结构 图可以如图6所示。该计算机设备包括通过系统总线连接的处理器、存储器、通信接口、显示屏和输入装置。该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失或易失性性存储介质、内存储器。该非易失性或易失性存储介质存储有操作系统和计算机可读指令。该内存储器为非易失性或易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的通信接口用于与外部的终端进行有线或无线方式的通信，无线方式可通过WIFI、运营商网络、NFC(近场通信)或其他技术实现。该计算机可读指令被处理器执行时以实现一种应用程序安全启动方法。该计算机设备的显示屏可以是液晶显示屏或者电子墨水显示屏，该计算机设备的输入装置可以是显示屏上覆盖的触摸层，也可以是计算机设备外壳上设置的按键、轨迹球或触控板，还可以是外接的键盘、触控板或鼠标等。
本领域技术人员可以理解，图6中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和一个或多个处理器，存储器中储存有计算机可读指令，计算机可读指令被处理器执行时，使得一个或多个处理器执行以下步骤：接收应用程序启动请求，应用程序启动请求携带有应用程序标识；查询应用程序标识对应的应用程序是否为首次运行；当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；计算解压资源文件的实际解压校验码；获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器下载的用于标识解压资源文件的校验码；判断实际解压校验码与下载解压校验码是否一致；及当实际解压校验码与下载解压校验码一致时，启动应用程序。
在其中一个实施例中，所述解压资源文件中包含多个解压子文件，处理器执行计算机可读指令时实现计算解压资源文件的实际解压校验码的步骤时还用于：获取各解压子文件对应的子文件标识以及子文件校验码；及按照预设的规则将各子文件标识以及各子文件校验码进行组合，得到解压资源文件对应的实际解压校验码。
在其中一个实施例中，处理器执行计算机可读指令时实现查询应用程序标识对应的应用程序是否为首次运行之后的步骤时还用于：当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件；计算压缩资源文件的实际压缩校验码；获取预先从服务器下载的应用程序对应的压缩资源文件的下载压缩校验码；判断实际压缩校验码与下载压缩校验码是否一致；当实际压缩校验码与下载压缩校验码一致时，判定压缩资源文件为安全压缩文件；及当压缩资源文件为安全压缩文件时，对安全压缩文件进行解压得到解压资源文件，并根据解压压缩文件启动应用程序。
在其中一个实施例中，处理器执行计算机可读指令时实现当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件的步骤时还用于：当应用程序是首次运行时，生成加密后的对称秘钥，将对称秘钥发送至服务器，对称秘钥用于指示服务器对应用程序的下载地址、下载解压校验码以及下载压缩校验码进行加密生成加密业务文件；接收服务器返回的加密业务文件；通过对称秘钥对加密业务文件进行解密得到业务文件；从业务文件中获取应用程序对应的下载地址；及根据下载地址进行下载得到压缩资源文件。
在其中一个实施例中，处理器执行计算机可读指令时实现下载解压校验码和下载压缩校验码的获取方式的步骤时还用于：及通过对称秘钥对加密业务文件进行解密得到的业务文件中提取下载解压校验码和下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
在其中一个实施例中，处理器执行计算机可读指令时实现将对称秘钥发送至服务器的步骤时还用于：通过非对称秘钥的公钥对对称秘钥进行加密后发送至服务器，以使得服务器通过与非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
在其中一个实施例中，处理器执行计算机可读指令时实现判断实际压缩校验码与下载压缩校验码是否一致之后的步骤时还用于：当实际压缩校验码与下载压缩校验码不一致时，判定压缩资源文件为不安全的压缩资源文件；及生成针对不安全的压缩资源文件的警示信息；
处理器执行计算机可读指令时实现判断实际解压校验码与下载解压校验码是否一致之后的步骤时还用于：当实际解压校验码与下载解压校验码不一致时，判定解压资源文件为不安全的解压资源文件；及生成针对不安全的解压资源文件的警示信息。
在其中一个实施例中，一个或多个存储有计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：接收应用程序启动请求，应用程序启动请求携带有应用程序标识；查询应用程序标识对应的应用程序是否为首次运行；当应用程序不是首次运行时，获取应用程序标识对应的解压资源文件；计算解压资源文件的实际解压校验码；获取解压资源文件的下载解压校验码，下载解压校验码为预先从服务器下载的用于标识解压资源文件的校验码；判断实际解压校验码与下载解压校验码是否一致；及当实际解压校验码与下载解压校验码一致时，启动应用程序。
其中，该计算机可读存储介质可以是非易失性，也可以是易失性的。
在其中一个实施例中，所述解压资源文件中包含多个解压子文件，计算机可读指令被处理器执行时实现计算解压资源文件的实际解压校验码的步骤时还用于：获取各解压子文件对应的子文件标识以及子文件校验码；及按照预设的规则将各子文件标识以及各子文件校验码进行组合，得到解压资源文件对应的实际解压校验码。
在其中一个实施例中，计算机可读指令被处理器执行时实现查询应用程序标识对应的应用程序是否为首次运行之后的步骤时还用于：当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件；计算压缩资源文件的实际压缩校验码；获取预先从服务器下载的应用程序对应的压缩资源文件的下载压缩校验码；判断实际压缩校验码与下载压缩校验码是否一致；当实际压缩校验码与下载压缩校验码一致时，判定压缩资源文件为安全压缩文件；及当压缩资源文件为安全压缩文件时，对安全压缩文件进行解压得到解压资源文件，并根据解压压缩文件启动应用程序。
在其中一个实施例中，计算机可读指令被处理器执行时实现当应用程序是首次运行时，获取与应用程序标识对应的压缩资源文件的步骤时还用于：当应用程序是首次运行时，生成加密后的对称秘钥，将对称秘钥发送至服务器，对称秘钥用于指示服务器对应用程序的下载地址、下载解压校验码以及下载压缩校验码进行加密生成加密业务文件；接收服务器返回的 加密业务文件；通过对称秘钥对加密业务文件进行解密得到业务文件；从业务文件中获取应用程序对应的下载地址；及根据下载地址进行下载得到压缩资源文件。
在其中一个实施例中，计算机可读指令被处理器执行时实现下载解压校验码和下载压缩校验码的获取方式的步骤时还用于：通过对称秘钥对加密业务文件进行解密得到的业务文件中提取下载解压校验码和下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
在其中一个实施例中，计算机可读指令被处理器执行时实现将对称秘钥发送至服务器的步骤时还用于：通过非对称秘钥的公钥对对称秘钥进行加密后发送至服务器，以使得服务器通过与非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
在其中一个实施例中，计算机可读指令被处理器执行时实现判断实际压缩校验码与下载压缩校验码是否一致之后的步骤时还用于：当实际压缩校验码与下载压缩校验码不一致时，判定压缩资源文件为不安全的压缩资源文件；生成针对不安全的压缩资源文件的警示信息。计算机可读指令被处理器执行时实现判断实际解压校验码与下载解压校验码是否一致之后的步骤时还用于：当实际解压校验码与下载解压校验码不一致时，判定解压资源文件为不安全的解压资源文件；及生成针对不安全的解压资源文件的警示信息。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机可读指令来指令相关的硬件来完成，的计算机可读指令可存储于一非易失性或易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和易失性存储器中的至少一种。非易失性存储器可包括只读存储器(Read-Only Memory，ROM)、磁带、软盘、闪存或光存储器等。易失性存储器可包括随机存取存储器(Random Access Memory，RAM)或外部高速缓冲存储器。作为说明而非局限，RAM可以是多种形式，比如静态随机存取存储器(Static Random Access Memory，SRAM)或动态随机存取存储器(Dynamic Random Access Memory，DRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种应用程序安全启动方法，包括：
    接收应用程序启动请求，所述应用程序启动请求携带有应用程序标识；
    查询所述应用程序标识对应的应用程序是否为首次运行；
    当所述应用程序不是首次运行时，获取所述应用程序标识对应的解压资源文件；
    计算所述解压资源文件的实际解压校验码；
    获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
    判断所述实际解压校验码与所述下载解压校验码是否一致；及
    当所述实际解压校验码与所述下载解压校验码一致时，启动所述应用程序。
  2. 根据权利要求1所述的方法，其中，所述解压资源文件中包含多个解压子文件；所述计算所述解压资源文件的实际解压校验码，包括：
    获取各所述解压子文件对应的子文件标识以及子文件校验码；及
    按照预设的规则将各所述子文件标识以及各所述子文件校验码进行组合，得到所述解压资源文件对应的实际解压校验码。
  3. 根据权利要求1所述的方法，其中，所述查询所述应用程序标识对应的应用程序是否为首次运行之后，所述方法还包括：
    当所述应用程序是首次运行时，获取与所述应用程序标识对应的压缩资源文件；
    计算所述压缩资源文件的实际压缩校验码；
    获取预先从服务器下载的所述应用程序对应的压缩资源文件的下载压缩校验码；
    判断所述实际压缩校验码与所述下载压缩校验码是否一致；
    当所述实际压缩校验码与所述下载压缩校验码一致时，判定所述压缩资源文件为安全压缩文件；及
    当所述压缩资源文件为安全压缩文件时，对所述安全压缩文件进行解压得到解压资源文件，并根据所述解压压缩文件启动应用程序。
  4. 根据权利要求1至3任意一项所述的方法，其中，所述当所述应用程序是首次运行时，获取与所述应用程序标识对应的压缩资源文件，包括：
    当所述应用程序是首次运行时，生成加密后的对称秘钥，将所述对称秘钥发送至服务器，所述对称秘钥用于指示服务器对所述应用程序的下载地址、所述下载解压校验码以及所述下载压缩校验码进行加密生成加密业务文件；
    接收服务器返回的所述加密业务文件；
    通过所述对称秘钥对所述加密业务文件进行解密得到业务文件；
    从所述业务文件中获取所述应用程序对应的下载地址；及
    根据所述下载地址进行下载得到压缩资源文件。
  5. 根据权利要求4所述的方法，其中，所述下载解压校验码和所述下载压缩校验码的获取方式包括：
    通过对称秘钥对所述加密业务文件进行解密得到的业务文件中提取下载解压校验码和所述下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
  6. 根据权利要求4所述的方法，其中，所述将所述对称秘钥发送至服务器，包括：
    通过非对称秘钥的公钥对对称秘钥进行加密后发送至服务器，以使得服务器通过与所述非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
  7. 根据权利要求3所述的方法，其中，所述判断所述实际压缩校验码与所述下载压缩校验码是否一致之后，所述方法还包括：
    当所述实际压缩校验码与所述下载压缩校验码不一致时，判定所述压缩资源文件为不安全的压缩资源文件；
    生成针对所述不安全的压缩资源文件的警示信息；
    所述判断所述实际解压校验码与所述下载解压校验码是否一致之后，还包括：
    当所述实际解压校验码与所述下载解压校验码不一致时，判定所述解压资源文件为不安全的解压资源文件；及
    生成针对所述不安全的解压资源文件的警示信息。
  8. 一种应用程序安全启动装置，包括：
    请求接收模块，用于接收应用程序启动请求，所述应用程序启动请求携带有应用程序标识；
    查询模块，用于查询所述应用程序标识对应的应用程序是否为首次运行；
    解压文件获取模块，用于当所述应用程序不是首次运行时，获取所述应用程序标识对应的解压资源文件；
    实际解压校验码计算模块，用于计算所述解压资源文件的实际解压校验码；
    下载解压校验码获取模块，用于获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
    判断模块，用于判断所述实际解压校验码与所述下载解压校验码是否一致；及
    启动模块，用于当所述实际解压校验码与所述下载解压校验码一致时，启动所述应用程序。
  9. 一种计算机设备，包括存储器及一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    接收应用程序启动请求，所述应用程序启动请求携带有应用程序标识；
    查询所述应用程序标识对应的应用程序是否为首次运行；
    当所述应用程序不是首次运行时，获取所述应用程序标识对应的解压资源文件；
    计算所述解压资源文件的实际解压校验码；
    获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
    判断所述实际解压校验码与所述下载解压校验码是否一致；及
    当所述实际解压校验码与所述下载解压校验码一致时，启动所述应用程序。
  10. 根据权利要求9所述的计算机设备，其中，所述解压资源文件中包含多个解压子文件；所述处理器执行所述计算机可读指令时所实现的所述计算所述解压资源文件的实际解压校验码，包括：
    获取各所述解压子文件对应的子文件标识以及子文件校验码；及
    按照预设的规则将各所述子文件标识以及各所述子文件校验码进行组合，得到所述解压资源文件对应的实际解压校验码。
  11. 根据权利要求9所述的计算机设备，其中，所述处理器执行所述计算机可读指令时所实现的所述查询所述应用程序标识对应的应用程序是否为首次运行之后，还包括：
    当所述应用程序是首次运行时，获取与所述应用程序标识对应的压缩资源文件；
    计算所述压缩资源文件的实际压缩校验码；
    获取预先从服务器下载的所述应用程序对应的压缩资源文件的下载压缩校验码；
    判断所述实际压缩校验码与所述下载压缩校验码是否一致；
    当所述实际压缩校验码与所述下载压缩校验码一致时，判定所述压缩资源文件为安全压缩文件；及
    当所述压缩资源文件为安全压缩文件时，对所述安全压缩文件进行解压得到解压资源文件，并根据所述解压压缩文件启动应用程序。
  12. 根据权利要求9至11任意一项所述的计算机设备，其中，所述处理器执行所述计算机可读指令时所实现的所述当所述应用程序是首次运行时，获取与所述应用程序标识对应的压缩资源文件，还包括：
    当所述应用程序是首次运行时，生成加密后的对称秘钥，将所述对称秘钥发送至服务器，所述对称秘钥用于指示服务器对所述应用程序的下载地址、所述下载解压校验码以及所述下载压缩校验码进行加密生成加密业务文件；
    接收服务器返回的所述加密业务文件；
    通过所述对称秘钥对所述加密业务文件进行解密得到业务文件；
    从所述业务文件中获取所述应用程序对应的下载地址；及
    根据所述下载地址进行下载得到压缩资源文件。
  13. 根据权利要求12所述的计算机设备，其中，所述处理器执行所述计算机可读指令时所实现的所述下载解压校验码和所述下载压缩校验码的获取方式，包括：
    通过对称秘钥对所述加密业务文件进行解密得到的业务文件中提取下载解压校验码和所述下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
  14. 根据权利要求12所述的计算机设备，其中，所述处理器执行所述计算机可读指令时所实现的所述将所述对称秘钥发送至服务器，包括：
    通过非对称秘钥的公钥对对称秘钥进行加密后发送至服务器，以使得服务器通过与所述非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
  15. 一个或多个存储有计算机可读指令的计算机可读存储介质，所述计算机可读指令被 一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    接收应用程序启动请求，所述应用程序启动请求携带有应用程序标识；
    查询所述应用程序标识对应的应用程序是否为首次运行；
    当所述应用程序不是首次运行时，获取所述应用程序标识对应的解压资源文件；
    计算所述解压资源文件的实际解压校验码；
    获取所述解压资源文件的下载解压校验码，所述下载解压校验码为预先从服务器下载的用于标识所述解压资源文件的校验码；
    判断所述实际解压校验码与所述下载解压校验码是否一致；及
    当所述实际解压校验码与所述下载解压校验码一致时，启动所述应用程序。
  16. 根据权利要求15所述的存储介质，其中，所述解压资源文件中包含多个解压子文件；所述计算机可读指令被所述处理器执行时所实现的所述计算所述解压资源文件的实际解压校验码，包括：
    获取各所述解压子文件对应的子文件标识以及子文件校验码；及
    按照预设的规则将各所述子文件标识以及各所述子文件校验码进行组合，得到所述解压资源文件对应的实际解压校验码。
  17. 根据权利要求15所述的存储介质，其中，所述计算机可读指令被所述处理器执行时所实现的所述查询所述应用程序标识对应的应用程序是否为首次运行之后，还包括：
    当所述应用程序是首次运行时，获取与所述应用程序标识对应的压缩资源文件；
    计算所述压缩资源文件的实际压缩校验码；
    获取预先从服务器下载的所述应用程序对应的压缩资源文件的下载压缩校验码；
    判断所述实际压缩校验码与所述下载压缩校验码是否一致；
    当所述实际压缩校验码与所述下载压缩校验码一致时，判定所述压缩资源文件为安全压缩文件；及
    当所述压缩资源文件为安全压缩文件时，对所述安全压缩文件进行解压得到解压资源文件，并根据所述解压压缩文件启动应用程序。
  18. 根据权利要求15至17任意一项所述的存储介质，其中，所述计算机可读指令被所述处理器执行时所实现的所述当所述应用程序是首次运行时，获取与所述应用程序标识对应的压缩资源文件，还包括：
    当所述应用程序是首次运行时，生成加密后的对称秘钥，将所述对称秘钥发送至服务器，所述对称秘钥用于指示服务器对所述应用程序的下载地址、所述下载解压校验码以及所述下载压缩校验码进行加密生成加密业务文件；
    接收服务器返回的所述加密业务文件；
    通过所述对称秘钥对所述加密业务文件进行解密得到业务文件；
    从所述业务文件中获取所述应用程序对应的下载地址；及
    根据所述下载地址进行下载得到压缩资源文件。
  19. 根据权利要求18所述的存储介质，其中，所述计算机可读指令被所述处理器执行时 所实现的所述下载解压校验码和所述下载压缩校验码的获取方式，包括：
    通过对称秘钥对所述加密业务文件进行解密得到的业务文件中提取下载解压校验码和所述下载压缩校验码，所述下载解压校验码以及所述下载压缩校验码存储于区块链中。
  20. 根据权利要求18所述的存储介质，其中，所述计算机可读指令被所述处理器执行时所实现的所述将所述对称秘钥发送至服务器，包括：
    通过非对称秘钥的公钥对对称秘钥进行加密后发送至服务器，以使得服务器通过与所述非对称秘钥的公钥对应的私钥进行解密得到对称秘钥。
PCT/CN2020/098856 2020-05-14 2020-06-29 应用程序安全启动方法、装置、计算机设备和存储介质 WO2021114614A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010405714.6 2020-05-14
CN202010405714.6A CN111666564B (zh) 2020-05-14 2020-05-14 应用程序安全启动方法、装置、计算机设备和存储介质

Publications (1)

Publication Number Publication Date
WO2021114614A1 true WO2021114614A1 (zh) 2021-06-17

Family

ID=72382589

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/098856 WO2021114614A1 (zh) 2020-05-14 2020-06-29 应用程序安全启动方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN111666564B (zh)
WO (1) WO2021114614A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112182584A (zh) * 2020-09-28 2021-01-05 广东小天才科技有限公司 安全校验方法及装置、电子设备、存储介质
CN112163412B (zh) * 2020-09-30 2024-02-09 善恒展创(深圳)发展合伙企业(有限合伙) 数据校验方法、装置、电子设备及存储介质
CN112379905B (zh) * 2020-11-20 2024-06-28 惠州Tcl移动通信有限公司 一种内核升级方法、装置、终端及存储介质
CN112732365B (zh) * 2021-01-28 2024-07-12 北京字跳网络技术有限公司 预装应用程序启动方法、装置、电子设备及存储介质
CN112597485B (zh) * 2021-03-01 2021-06-08 腾讯科技（深圳）有限公司 基于区块链的信息校验方法、装置和设备及存储介质
CN115022091B (zh) * 2022-08-04 2022-12-16 亿次网联(杭州)科技有限公司 一种基于数字证书的自主授权方法和系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104778060A (zh) * 2015-04-07 2015-07-15 珠海全志科技股份有限公司 一种嵌入式Linux系统快速安全启动方法
CN106778099A (zh) * 2016-11-29 2017-05-31 北京奇虎科技有限公司 防篡改apk的生成方法和装置、安装及运行方法和装置
CN106815135A (zh) * 2015-11-30 2017-06-09 阿里巴巴集团控股有限公司 漏洞检测方法及装置
CN107273172A (zh) * 2017-07-14 2017-10-20 银联商务有限公司 一种基于业务包的数据处理系统、方法及装置
US20180247082A1 (en) * 2016-08-11 2018-08-30 Intel Corporation Secure Public Cloud with Protected Guest-Verified Host Control
CN110162964A (zh) * 2019-05-29 2019-08-23 中国银行股份有限公司 一种文件篡改的检查方法、装置及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6711709B1 (en) * 1998-06-24 2004-03-23 Unisys Corporation Integrated block checking system for rapid file transfer of compressed data
US9055093B2 (en) * 2005-10-21 2015-06-09 Kevin R. Borders Method, system and computer program product for detecting at least one of security threats and undesirable computer files
CN108647041A (zh) * 2018-04-02 2018-10-12 金证财富南京科技有限公司 一种混合型APP本地Web资源热更新机制
CN108810894B (zh) * 2018-05-31 2023-08-25 康键信息技术（深圳）有限公司 终端授权方法、装置、计算机设备和存储介质
CN110308924A (zh) * 2019-05-24 2019-10-08 平安银行股份有限公司 应用程序更新方法、装置、电子设备及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104778060A (zh) * 2015-04-07 2015-07-15 珠海全志科技股份有限公司 一种嵌入式Linux系统快速安全启动方法
CN106815135A (zh) * 2015-11-30 2017-06-09 阿里巴巴集团控股有限公司 漏洞检测方法及装置
US20180247082A1 (en) * 2016-08-11 2018-08-30 Intel Corporation Secure Public Cloud with Protected Guest-Verified Host Control
CN106778099A (zh) * 2016-11-29 2017-05-31 北京奇虎科技有限公司 防篡改apk的生成方法和装置、安装及运行方法和装置
CN107273172A (zh) * 2017-07-14 2017-10-20 银联商务有限公司 一种基于业务包的数据处理系统、方法及装置
CN110162964A (zh) * 2019-05-29 2019-08-23 中国银行股份有限公司 一种文件篡改的检查方法、装置及系统

Also Published As

Publication number Publication date
CN111666564B (zh) 2024-02-02
CN111666564A (zh) 2020-09-15

Similar Documents

Publication Publication Date Title
WO2021114614A1 (zh) 应用程序安全启动方法、装置、计算机设备和存储介质
CN109075976B (zh) 取决于密钥认证的证书发布
CN108369622B (zh) 软件容器注册表服务
CN107689869B (zh) 用户口令管理的方法和服务器
US11539690B2 (en) Authentication system, authentication method, and application providing method
US9430211B2 (en) System and method for sharing information in a private ecosystem
WO2016058487A1 (zh) 一种信息处理方法及装置
CN110799941A (zh) 防盗和防篡改的数据保护
CN109462602B (zh) 登录信息存储方法、登录验证方法、装置、设备及介质
EP2657871A2 (en) Secure configuration of mobile application
WO2021219086A1 (zh) 基于区块链的数据传输方法和系统
WO2016019790A1 (zh) 一种安装包的校验方法、客户端、服务器及系统
CN112559993B (zh) 身份认证方法、装置、系统及电子设备
WO2016053729A1 (en) Method and system for secure management of computer applications
CN112257086B (zh) 一种用户隐私数据保护方法及电子设备
JP6967449B2 (ja) セキュリティチェックのための方法、デバイス、端末およびサーバ
US10630722B2 (en) System and method for sharing information in a private ecosystem
CN107040520B (zh) 一种云计算数据共享系统及方法
US20160330030A1 (en) User Terminal For Detecting Forgery Of Application Program Based On Hash Value And Method Of Detecting Forgery Of Application Program Using The Same
EP3697053B1 (en) Accessing encrypted user data at a multi-tenant hosted cloud service
US20140047236A1 (en) Authenticated file handles for network file systems
CN115062291A (zh) 用于管理容器的方法、系统和计算机可读介质
CN111224826B (zh) 基于分布式系统的配置更新方法、设备、系统及介质
US9245097B2 (en) Systems and methods for locking an application to device without storing device information on server
CN112769565B (zh) 密码加密算法的升级方法、装置、计算设备和介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20899118

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 12/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20899118

Country of ref document: EP

Kind code of ref document: A1