WO2022078366A1 - 应用保护方法、装置、设备及介质 - Google Patents

应用保护方法、装置、设备及介质 Download PDF

Info

Publication number
WO2022078366A1
WO2022078366A1 PCT/CN2021/123460 CN2021123460W WO2022078366A1 WO 2022078366 A1 WO2022078366 A1 WO 2022078366A1 CN 2021123460 W CN2021123460 W CN 2021123460W WO 2022078366 A1 WO2022078366 A1 WO 2022078366A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
target
target application
state
preset
Prior art date
Application number
PCT/CN2021/123460
Other languages
English (en)
French (fr)
Inventor
黄琼
周爱平
曾令聪
Original Assignee
深圳市百富智能新技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市百富智能新技术有限公司 filed Critical 深圳市百富智能新技术有限公司
Publication of WO2022078366A1 publication Critical patent/WO2022078366A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services

Definitions

  • the present application belongs to the field of computer technology, and in particular, relates to an application protection method, apparatus, device and medium.
  • the program code of an application may be cracked by a malicious user and implanted with malicious code, resulting in damage to the interests of the user who installs the application with the malicious code implanted.
  • the embodiments of the present application provide an application protection method, apparatus, device, and medium, which aim to solve the problem that applications cannot be well protected in the related art.
  • an embodiment of the present application provides an application protection method, the method comprising:
  • the target state includes any one or more of the following:
  • the application signature information is inconsistent with the preset signature information
  • the target application is run in the state of the software emulating the device.
  • the application dynamic library information is used to indicate the dynamic library file that the target application depends on, and the application dynamic library information is obtained through the following steps:
  • the application dynamic library information is generated according to the name of each dynamic library file.
  • each dynamic library file generate preset dynamic library information, including:
  • the name of each dynamic library file is combined to obtain a string
  • the hash value of the obtained string is determined as the application dynamic library information.
  • the method also includes:
  • the method also includes:
  • preset dangerous conditions include any one or more of the following:
  • a disconnected network connection is detected
  • the target application was detected to be suspended.
  • the original password is deleted.
  • the installation package of the target application is obtained through the following steps:
  • the target installation package is obtained, and the target installation package is determined as the installation package of the target application.
  • an application protection device comprising:
  • a state detection unit used to detect the running state of the target application
  • the operation execution unit is configured to execute a protection operation matching the target state in response to the running state of the target application belonging to the target state.
  • an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the steps of the application protection method when executing the computer program.
  • an embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the application protection method are implemented.
  • an embodiment of the present application provides a computer program product that, when the computer program product runs on an electronic device, enables the electronic device to execute the application protection method according to any one of the foregoing first aspects.
  • the beneficial effects of the embodiments of the present application are: when the application is running, the running state of the application is detected in real time, and once it is found that the running state of the application belongs to the target state, the running of the application is terminated, and the danger of the application can be discovered in time. , so as to protect the application in time.
  • FIG. 1 is a schematic flowchart of an application protection method provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of an application protection method provided by another embodiment of the present application.
  • FIG. 3 is a schematic flowchart of an application protection method provided by another embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an application protection device provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the term “if” may be contextually interpreted as “when” or “once” or “in response to determining” or “in response to detecting “.
  • the phrases “if it is determined” or “if the [described condition or event] is detected” may be interpreted, depending on the context, to mean “once it is determined” or “in response to the determination” or “once the [described condition or event] is detected. ]” or “in response to detection of the [described condition or event]”.
  • references in this specification to "one embodiment” or “some embodiments” and the like mean that a particular feature, structure or characteristic described in connection with the embodiment is included in one or more embodiments of the present application.
  • appearances of the phrases “in one embodiment,” “in some embodiments,” “in other embodiments,” “in other embodiments,” etc. in various places in this specification are not necessarily All refer to the same embodiment, but mean “one or more but not all embodiments” unless specifically emphasized otherwise.
  • the terms “including”, “including”, “having” and their variants mean “including but not limited to” unless specifically emphasized otherwise.
  • an embodiment of the present application provides an application protection method, including:
  • Step 101 detecting the running state of the target application.
  • the above-mentioned target application is usually a preset application.
  • the execution body of the above application protection method may be a server.
  • the above servers are usually background servers that provide application protection.
  • the server may be hardware or software.
  • the server When the server is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or can be implemented as a single server.
  • the server When the server is software, it can be implemented as multiple software or software modules (for example, used to provide distributed services), or can be implemented as a single software or software module. There is no specific limitation here.
  • the above-mentioned execution body can detect the running state of the target application in various ways.
  • the above-mentioned execution body may detect the running state of the target application by querying the value of the preset parameter. For further example, the above-mentioned execution body can detect whether the target application is in a state of being run on a software simulation device by querying the value of the parameter TARGET_IPHONE_SIMULATOR. Specifically, if the value of the parameter TARGET_IPHONE_SIMULATOR is 1, the running state of the target application is: running on a software simulation device. If the value of the parameter TARGET_IPHONE_SIMULATOR is 0, the running state of the target application is: not in a state of being run on a software simulation device, that is, in a state of being run on a hardware device.
  • the above-mentioned execution body may detect the running state of the target application by comparing whether the current information of the target application is consistent with pre-stored corresponding information. For further example, the above-mentioned execution body may detect whether the target application is in a state in which the application signature information is inconsistent with the preset signature information by comparing whether the application signature information of the target application is consistent with the preset signature information. Specifically, if the application signature information is consistent with the preset signature information, the running state of the target application is a state in which the application signature information is consistent with the preset signature information. If the application signature information is inconsistent with the preset signature information, the running state of the target application is a state in which the application signature information is inconsistent with the preset signature information.
  • the application signature information is usually information used to sign the application program of the target application. In practice, application signature information is usually a string that is used to authenticate the application and cannot be forged by others.
  • Step 102 in response to the running state of the target application belonging to the target state, terminate the running of the target application, so as to realize the protection of the target application.
  • the above-mentioned target state is usually a preset state.
  • the above-mentioned target state may be a state in which the application signature information is inconsistent with the preset signature information.
  • the execution subject may terminate the running of the target application.
  • the above-mentioned execution body can remotely control the target application to terminate the operation through the network.
  • the method provided by this embodiment detects the running state of the application in real time when the application is running, and terminates the running of the application once it is found that the running state of the application belongs to the target state.
  • the above target state may include but is not limited to any one or more of the following:
  • the application signature information is inconsistent with the preset signature information.
  • a state in which the application signature information is inconsistent with the preset signature information may be referred to as the first state.
  • the application signature information is usually information used to sign the application program of the target application.
  • application signature information is usually a string that is used to authenticate the application and cannot be forged by others.
  • the above-mentioned preset signature information is usually pre-stored application signature information for the target application.
  • the background server can compare whether the received application signature information is consistent with the pre-stored application signature information. If they are consistent, it is considered that the target application is currently in a state where the application signature information is consistent with the preset signature information. On the contrary, if they are inconsistent, it is considered that the target application is currently in the first state.
  • the target application is currently in the first state, it is generally considered that the application program of the target application has been modified. At this point, the target application is not secure.
  • the application dynamic library information is inconsistent with the preset dynamic library information.
  • the application dynamic library information is used to indicate the dynamic library file that the target application depends on.
  • the state in which the application dynamic library information is inconsistent with the preset dynamic library information may be referred to as the second state.
  • the above dynamic library file is also called a dynamic link library (Dynamic Link Library, DLL) file.
  • DLL Dynamic Link Library
  • a dynamic library file is a non-executable binary program file that allows programs to share code and other resources necessary to perform special tasks. Dynamic library files contain many functions and resources. The program can open, enable, query, disable and close the driver according to the instructions in the dynamic library file.
  • the application dynamic library information is usually a combination of names of dynamic library files that the application depends on. For example, if the dynamic library files that the application depends on are file A, file B, and file C. Then the application dynamic library information can be "A-B-C".
  • the above-mentioned preset dynamic library information is usually pre-stored application dynamic library information for the above-mentioned target application.
  • the above-mentioned preset dynamic library information may be pre-stored in the background server.
  • the name of the dynamic library file that the application depends on can be queried by executing a preset query statement for querying the dynamic library file that the application depends on. Therefore, the application dynamic library information can be obtained by calculation based on the names of the dynamic library files.
  • the target application can send the application dynamic library information obtained by real-time calculation to the background server. In this way, the background server can compare whether the received application dynamic library information is consistent with the pre-stored application dynamic library information. If they are consistent, it is considered that the application dynamic library information of the target application is consistent with the preset dynamic library information. On the contrary, if they are inconsistent, it is considered that the target application is currently in the second state.
  • the target application is currently in the second state, it is generally considered that the application program of the target application has been modified. At this point, the target application is not secure.
  • the state in which the target application is being debugged may be denoted as the third state.
  • a debug flag (eg, P_TRACED) is set to the application process.
  • the above-mentioned execution body can detect whether the application process is being debugged by detecting the presence or absence of the debugging identifier. Specifically, if the debug flag is not detected, it is considered that the target application is not currently in a state in which the target application is being debugged. On the contrary, if the debug flag is detected, it is considered that the target application is currently in the third state.
  • the target application is currently in the third state, it is generally considered that the target application is currently being debugged. At this point, the target application is not secure.
  • the state in which the resource file of the target application is changed may be denoted as the fourth state.
  • the above-mentioned resource file is usually a file used to provide the application with required resources.
  • the types of the above resources can be pictures, audio, video, text, or other content that can be displayed in a computer.
  • the target application can obtain the resource file of the target application by executing a preset statement for obtaining the resource file. Then, calculate the hash value of the resource file.
  • the MD5 value of the resource file can be calculated.
  • the MD5 value is a widely used cryptographic hash function, which can generate a 128-bit hash value to ensure complete and consistent information transmission.
  • the backend server may obtain the calculated hash value of the resource file, and compare the calculated hash value of the calculated resource file with the pre-stored hash value of the resource file. For example, the calculated MD5 value of the resource file is compared with the pre-stored MD5 value of the resource file. If the two are consistent, it is considered that the resource file of the target application has not changed. On the contrary, if the two are inconsistent, it is considered that the target application is currently in the fourth state.
  • the target application is currently in the fourth state, it is generally considered that the application program of the target application has been modified. At this point, the target application is not secure.
  • the target application is run in the state of the software simulating the device.
  • the state in which the target application is run on the software simulation device may be referred to as the fifth state.
  • the above-mentioned software simulation device generally refers to a device that is simulated by software presentation.
  • the above-mentioned execution body can detect whether the target application is in a state of being run on a software simulated device by querying the value of a preset parameter (eg, TARGET_IPHONE_SIMULATOR) used to indicate the running device. For example, if the value of the parameter TARGET_IPHONE_SIMULATOR is 0, it is considered that the target application is not running on the software simulation device, that is, the target application is running on the hardware device. If the value of the parameter TARGET_IPHONE_SIMULATOR is 1, it is considered that the target application is currently in the fifth state.
  • a preset parameter eg, TARGET_IPHONE_SIMULATOR
  • the above-mentioned execution body when it is found that the value of the above parameter indicates that the target application is in the fifth state, the above-mentioned execution body usually continues to perform the operation of turning on Bluetooth to further determine whether the target application is in the fifth state. Due to software emulation devices usually do not have bluetooth. Therefore, if the Bluetooth can be turned on, it can be further determined that the target application is in the fifth state.
  • the application dynamic library information is used to indicate the dynamic library file that the target application depends on.
  • the application dynamic library information is obtained through the following steps:
  • the above-mentioned execution body can obtain the name of the dynamic library file that the target application depends on by executing a preset query statement for querying the dynamic library file that the application depends on.
  • the above-mentioned execution body may combine the names of each dynamic library to obtain the application dynamic library information.
  • the above-mentioned execution body may combine the names of the dynamic library files in a preset order to obtain a string, and then determine the hash value of the obtained string as the application dynamic library information.
  • the above-mentioned execution body may combine the names of each dynamic library file with the symbol "
  • the above-mentioned preset order may be an order according to the length of the names, or may be an order from A to Z according to the initials of the names.
  • the application dynamic library information is obtained by processing the names of each dynamic library file, the calculation complexity is low, the implementation is convenient, and the data processing efficiency is improved.
  • the installation package of the target application can be obtained through the following steps:
  • step 1 a source installation package is obtained, and a target folder in which the signature information is stored in the source installation package is obtained.
  • the source installation package usually includes a folder in which signature information is stored.
  • the above-mentioned target folder usually refers to a folder in which signature information is stored.
  • the above-mentioned execution body may directly obtain the source installation package stored locally, or may obtain the source installation package sent by other devices through the network.
  • the above source installation package is usually the ipa (iPhoneApplication) package generated by Xcode.
  • the above execution body can obtain the bundle folder in the ipa package by decompressing the ipa package.
  • the bundle folder is the target folder where the signature information is stored.
  • Xcode is an integrated development tool.
  • An ipa package is an installation package file for an iOS application. The ipa package can be installed and used by decompressing it, and if you uninstall it, you can just delete the program file.
  • step 2 the application signature information in the target folder is replaced with the preset signature information, and the name of the target folder is changed to the preset name.
  • the above-mentioned preset signature information may be preset information.
  • the above-mentioned preset signature information may be an Apple enterprise developer release certificate, or an enterprise certificate.
  • a corporate certificate usually includes a series of documents.
  • the above preset names may be preset names.
  • the above preset name can be embedded.mobileprovision.
  • the application signature information in the target folder can be replaced with the default signature information by the following operations: delete the _CodeSignature file that stores the signature information in the bundle folder, and replace the enterprise
  • the Provisioning Profile file in the certificate replaces the Provisioning Profile file in the bundle folder.
  • Step 3 Obtain the target installation package based on the changed target folder, and determine the target installation package as the installation package of the target application.
  • the above-mentioned executive body may use new signature information to sign the application program, and use an integrated development tool to integrate the signed application program to obtain a new installation package.
  • the obtained installation package of the target application is an installation package obtained through a secondary signature, which has better security and helps to further protect the security of the target application.
  • data obfuscation processing may also be performed on other codes not compiled in the C language, so that the application program is difficult to be decompiled, thereby protecting the security of the application.
  • some meaningless code may be added, such as adding some spaces, so that the application program is difficult to be decompiled, thereby further protecting the security of the application.
  • the application protection method in this embodiment includes:
  • Step 201 detecting the running state of the target application.
  • Step 202 in response to the running state of the target application belonging to the target state, terminate the running of the target application, so as to realize the protection of the target application.
  • steps 201 to 202 are basically the same as the operations of steps 101 to 102 in the embodiment shown in FIG. 1 , and details are not repeated here.
  • Step 203 in response to detecting that the system where the target application is located has applications in the preset application set installed, determine the locking level of the target application according to the risk level information associated with the installed applications, and lock the target application according to the determined locking level.
  • the applications in the preset application set are associated with risk level information.
  • the above-mentioned risk level information is generally information for describing the risk level of the application. As an example, the above risk level information may be "1" or "high” to describe that the risk of the application is relatively high.
  • the applications in the above-mentioned preset application set are usually preset applications that may cause damage to the function or authority of the target application.
  • the above system usually refers to an operating system, such as an iOS operating system.
  • the above-mentioned target application may call the application in the preset application set according to the name of each preset application in the preset application set stored in advance.
  • invoking an application if the invocation is successful, it is considered that the system where the target application is located has the application installed. On the contrary, if the call is unsuccessful, it is considered that the system where the target application is located has not installed the application.
  • the target application can determine whether the application in the preset application set is installed on the system where the target application is located by opening the URL Scheme of the application in the preset application set. For an application in the preset application set, if the target application can open the URL Scheme of the application, it is considered that the system where the target application is located has the application installed. On the contrary, if the target application cannot open the URL Scheme of the application, it is considered that the system where the target application is located has not installed the application.
  • the URL Scheme is a page jump protocol designed to facilitate mutual calls between applications, and the URL Scheme can uniquely identify an application.
  • the above-mentioned execution subject may determine the locking level of the target application according to the risk level information associated with the installed application.
  • the target application's level of lock-in usually corresponds to the risk level of the installed application. For example, if it is detected that the installed application is application X, the risk level information of application X is "high", indicating that the risk level of application X is high risk. At this time, it may be determined that the lock level of the target application is high.
  • the locking level of the target application when the locking level of the target application is high, all functions of the target application can be locked. In addition, if the locking level of the target application is low, some functions of the target application can be locked.
  • the locking method of the target application can be determined according to the risk level information of the installed application, so as to realize flexible and reasonable protection of the target.
  • the application protection method in this embodiment includes:
  • Step 301 detecting the running state of the target application.
  • Step 302 in response to the running state of the target application belonging to the target state, terminate the running of the target application, so as to realize the protection of the target application.
  • steps 301 to 302 are basically the same as the operations of steps 101 to 102 in the embodiment shown in FIG. 1 , and details are not repeated here.
  • Step 303 in response to detecting the password input operation and currently not meeting the preset dangerous condition, perform data obfuscation processing on the password input by the password input operation to obtain an obfuscated password.
  • Step 304 in response to detecting the password input operation and currently meeting the preset dangerous condition, delete the password input by the password input operation, and exit the password input interface.
  • the above-mentioned password input operation is usually an operation for inputting a password.
  • the above-mentioned password input operation may be an operation of inputting a password in a control for inputting a password in a password input interface.
  • the above-mentioned password input operation may also be an operation of inputting fingerprint information on a password input interface.
  • the above-mentioned password input interface is usually an interface for receiving a password input by a user.
  • the preset dangerous condition is usually a preset condition to indicate that the current situation is not suitable for inputting the password.
  • the above-mentioned execution body may detect whether the password input operation is detected by detecting whether the information input for the password input interface is received.
  • the above-mentioned execution subject may further determine whether the preset dangerous condition is currently satisfied. If the preset dangerous condition is not met, the password input by the password input operation is obtained, and the input password is subjected to data obfuscation processing to obtain obfuscated data. If the preset dangerous conditions are met, the password entered in the password input operation is deleted, and the password input interface is exited.
  • the password input in the password input operation is usually deleted by calling a preset data erasing function. In this way, quick password deletion can be achieved. Delete the password in time to protect the password from being leaked.
  • the above-mentioned preset data erasing function is usually a preset function for clearing data in the memory.
  • the data obfuscation processing generally refers to the operation of rewriting the data to generate new data that is unreadable by the user but does not affect the original logic of the data. Performing data obfuscation processing on the data can make the data not easy to be leaked and ensure the security of the data.
  • data obfuscation is usually performed on obfuscated data according to preset data obfuscation rules.
  • the data obfuscation rule is usually a rule for performing data obfuscation processing on data.
  • the above obfuscation processing rule may be a rule for adding a preset value to the data to be obfuscated.
  • the preset data obfuscation rule indicates that the character corresponding to 1 is 8, the character corresponding to 2 is 4, and the character corresponding to 3 is 0. Then, 840 can be obtained after data obfuscation is performed on the data to be obfuscated.
  • the password can be obtained and the data obfuscation of the password can be performed to protect the security of the password.
  • the current situation is unsafe, delete the entered password in time and exit the password input interface directly.
  • the password entered by the user can be properly protected. So as to realize the protection of the application.
  • the foregoing preset dangerous conditions include, but are not limited to, any one or more of the following: it is detected that the network connection is disconnected. It is detected that the current interface is screenshotted. The currently recorded screen is detected. The target application was detected to be suspended.
  • the above current interface usually refers to the password input interface.
  • the above-mentioned target application being suspended usually means that the target application is in a suspended state.
  • the suspended state usually refers to the state in which the application process is temporarily transferred out of memory by the operating system.
  • the above-mentioned execution body may obtain information that is used to represent that the target application is in the suspended state, so as to determine whether the target application is suspended through the information.
  • the target application can clear the entered password and exit the password input interface. If the entered password is used for payment, the current payment will be invalid.
  • the password input by the user can be properly protected, thereby realizing the protection of the application.
  • the following steps may be further included: first, in response to receiving a password acquisition request input by the user, perform data de-obfuscation processing on the obfuscated password , to get the original password. Then, in response to the original password being used, the original password is deleted.
  • the data de-obfuscation processing generally refers to the operation of restoring the obfuscated data to the data before the obfuscation. For example, after performing data obfuscation processing on the data 123, obfuscated data 840 is obtained. At this time, if data de-obfuscation processing is performed on the obfuscated data 840, the original data 123 can be obtained.
  • the above password acquisition request is usually a request for acquiring a password.
  • the obfuscated password is usually stored.
  • a password acquisition request can be input, for example, a fingerprint used to confirm the requested password can be input.
  • the target application can perform data de-obfuscation processing on the obfuscated password to obtain the original password. Once the original password is used, delete the original password in time to prevent the password from being leaked. In this way, further protection of the target application can be achieved.
  • FIG. 4 shows a structural block diagram of an application protection apparatus 400 provided by an embodiment of the present application. For convenience of description, only parts related to the embodiment of the present application are shown.
  • the device includes:
  • a state detection unit 401 configured to detect the running state of the target application
  • the operation execution unit 402 is configured to execute a protection operation matching the target state in response to the running state of the target application belonging to the target state.
  • the target state includes any one or more of the following:
  • the application signature information is inconsistent with the preset signature information
  • the target application is run in the state of the software emulating the device.
  • the application dynamic library information is used to indicate the dynamic library file that the target application depends on, and the application dynamic library information is obtained through the following steps:
  • the application dynamic library information is generated according to the name of each dynamic library file.
  • the preset dynamic library information is generated according to the name of each dynamic library file, including:
  • the name of each dynamic library file is combined to obtain a string
  • the hash value of the obtained string is determined as the application dynamic library information.
  • the apparatus further includes an application locking unit for:
  • the apparatus further includes a password input unit for:
  • the preset dangerous conditions include any one or more of the following:
  • a disconnected network connection is detected
  • the target application was detected to be suspended.
  • the method further includes:
  • the original password is deleted.
  • the installation package of the target application is obtained through the following steps:
  • the target installation package is obtained, and the target installation package is determined as the installation package of the target application.
  • the device provided in this embodiment detects the running state of the application in real time when the application is running, and terminates the running of the application once it is found that the running state of the application belongs to the target state, so that the danger of the application can be discovered in time, so that the application can be protected in time.
  • FIG. 5 is a schematic structural diagram of an electronic device 500 according to an embodiment of the present application.
  • the electronic device 500 of this embodiment includes: at least one processor 501 (only one processor is shown in FIG. 5 ), a memory 502 , and is stored in the memory 502 and can run on the at least one processor 501 503 of a computer program, such as an application protection program.
  • a computer program such as an application protection program.
  • the processor 501 executes the computer program 503 the steps in any of the foregoing method embodiments are implemented.
  • the processor 501 executes the computer program 503, the steps in the above embodiments of the respective application protection methods are implemented.
  • the processor 501 executes the computer program 503, the functions of the modules/units in the above-mentioned device embodiments are realized, for example, the functions of the units 401 to 402 shown in FIG. 4 .
  • the computer program 503 may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 502 and executed by the processor 501 to complete the present application.
  • One or more modules/units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program 503 in the electronic device 500 .
  • the computer program 503 can be divided into a state detection unit and an operation execution unit. The specific functions of each unit have been described in the above-mentioned embodiments, and will not be repeated here.
  • the electronic device 500 may be a computing device such as a server, a desktop computer, a tablet computer, a cloud server, and a mobile terminal.
  • the electronic device 500 may include, but is not limited to, a processor 501 and a memory 502 .
  • FIG. 5 is only an example of the electronic device 500, and does not constitute a limitation to the electronic device 500, and may include more or less components than the one shown, or combine some components, or different components
  • the electronic device may also include an input and output device, a network access device, a bus, and the like.
  • the so-called processor 501 may be a central processing unit (Central Processing Unit, CPU), and may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSP), application specific integrated circuits (Application Specific Integrated Circuits) Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory 502 may be an internal storage unit of the electronic device 500 , such as a hard disk or a memory of the electronic device 500 .
  • the memory 502 may also be an external storage device of the electronic device 500 , such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, a flash memory card (Flash card) equipped on the electronic device 500 . Card), etc.
  • the memory 502 may also include both an internal storage unit of the electronic device 500 and an external storage device.
  • the memory 502 is used to store computer programs and other programs and data required by the electronic device.
  • the memory 502 may also be used to temporarily store data that has been or will be output.
  • the disclosed apparatus/electronic device and method may be implemented in other manners.
  • the apparatus/electronic device embodiments described above are only illustrative, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components May be combined or may be integrated into another system, or some features may be omitted, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated modules if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium.
  • the present application realizes all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program is in When executed by the processor, the steps of the foregoing method embodiments can be implemented.
  • the computer program includes computer program code
  • the computer program code may be in the form of source code, object code, executable file or some intermediate forms, and the like.
  • Computer-readable media may include: any entity or device capable of carrying computer program code, recording media, USB flash drives, removable hard disks, magnetic disks, optical discs, computer memory, read-only memory (ROM, Read-Only Memory), random access Memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in computer-readable media may be appropriately increased or decreased in accordance with the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media does not include Electrical carrier signals and telecommunication signals.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Bioethics (AREA)
  • Virology (AREA)
  • Stored Programmes (AREA)

Abstract

一种应用保护方法，适用于计算机技术领域，包括：检测目标应用的运行状态（101）；响应于目标应用的运行状态属于目标状态，终止运行目标应用，以实现保护目标应用（102）。在应用运行时，实时检测应用的运行状态，一旦发现应用的运行状态属于目标状态，则终止应用的运行，可以及时发现应用存在的危险，从而及时对应用进行保护。

Description

应用保护方法、装置、设备及介质
本申请要求于2020年10月14日在中国专利局提交的、申请号为202011098062.2的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请属于计算机技术领域，尤其涉及一种应用保护方法、装置、设备及介质。
 背景技术
应用（Application，APP）的程序代码可能会被恶意用户破解并植入恶意代码，导致安装了被植入恶意代码的应用的用户的利益受到损害。
因此，相关技术中，需要对应用进行保护。
 技术问题
本申请实施例提供了应用保护方法、装置、设备及介质，旨在解决相关技术中不能较好地对应用进行保护的问题。
 技术解决方案
第一方面，本申请实施例提供了一种应用保护方法，该方法包括：
检测目标应用的运行状态；
响应于目标应用的运行状态属于目标状态，终止运行目标应用，以实现保护目标应用。
进一步地，目标状态包括以下任意一项或多项：
应用签名信息与预设签名信息不一致的状态；
应用动态库信息与预设动态库信息不一致的状态，其中，应用动态库信息用于指示目标应用所依赖的动态库文件；
目标应用被调试的状态；
目标应用的资源文件被改变的状态；
目标应用被运行于软件模拟设备的状态。
进一步地，应用动态库信息用于指示目标应用所依赖的动态库文件，应用动态库信息通过如下步骤得到：
提取目标应用所依赖的各动态库文件的名称；
根据各动态库文件的名称，生成应用动态库信息。
进一步地，根据各动态库文件的名称，生成预设动态库信息，包括：
按照预设顺序，将各动态库文件的名称组合得到字符串；
将所得到字符串的哈希值确定为应用动态库信息。
进一步地，方法还包括：
响应于检测到目标应用所在的系统安装有预设应用集中的应用，根据所安装应用关联的风险等级信息，确定目标应用的锁定等级，以及根据所确定的锁定等级锁定目标应用，其中，预设应用集中的应用关联有风险等级信息。
进一步地，方法还包括：
响应于检测到密码输入操作且当前不满足预设危险条件，对密码输入操作所输入的密码进行数据混淆处理，得到混淆后的密码；
响应于检测到密码输入操作且当前满足预设危险条件，删除密码输入操作所输入的密码，退出密码输入界面。
进一步地，预设危险条件，包括以下任意一项或多项：
检测到网络连接断开；
检测到当前界面被截图；
检测到当前被录屏；
检测到目标应用被挂起。
进一步地，在得到混淆后的密码之后，还包括：
响应于接收到用户输入的密码获取请求，对混淆后的密码进行数据逆混淆处理，得到原始密码；
响应于原始密码被使用，删除原始密码。
进一步地，目标应用的安装包通过如下步骤得到：
获取源安装包，得到源安装包中的存放有签名信息的目标文件夹；
将目标文件夹中的应用签名信息替换成预设签名信息，以及将目标文件夹的名称修改成预设名称；
基于变更后的目标文件夹，得到目标安装包，以及将目标安装包确定为目标应用的安装包。
第二方面，本申请实施例提供了一种应用保护装置，该装置包括：
状态检测单元，用于检测目标应用的运行状态；
操作执行单元，用于响应于目标应用的运行状态属于目标状态，执行与目标状态匹配的保护操作。
第三方面，本申请实施例提供了一种电子设备，包括存储器、处理器以及存储在存储器中并可在处理器上运行的计算机程序，处理器执行计算机程序时实现上述应用保护方法的步骤。
第四方面，本申请实施例提供了一种计算机可读存储介质，计算机可读存储介质存储有计算机程序，上述计算机程序被处理器执行时实现上述应用保护方法的步骤。
第五方面，本申请实施例提供了一种计算机程序产品，当计算机程序产品在电子设备上运行时，使得电子设备执行上述第一方面中任一项的应用保护方法。
 有益效果
本申请实施例与相关技术相比存在的有益效果是：在应用运行时，实时检测应用的运行状态，一旦发现应用的运行状态属于目标状态，则终止应用的运行，可以及时发现应用存在的危险，从而及时对应用进行保护。
可以理解的是，上述第二方面至第五方面的有益效果可以参见上述第一方面中的相关描述，在此不再赘述。
 附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例或相关技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一实施例提供的应用保护方法的流程示意图；
图2是本申请另一实施例提供的应用保护方法的流程示意图；
图3是本申请又一实施例提供的应用保护方法的流程示意图；
图4是本申请一实施例提供的应用保护装置的结构示意图；
图5是本申请一实施例提供的电子设备的结构示意图。
 本发明的实施方式
以下描述中，为了说明而不是为了限定，提出了诸如特定系统结构、技术之类的具体细节，以便透彻理解本申请实施例。然而，本领域的技术人员应当清楚，在没有这些具体细节的其它实施例中也可以实现本申请。在其它情况中，省略对众所周知的系统、装置、电路以及方法的详细说明，以免不必要的细节妨碍本申请的描述。
应当理解，当在本申请说明书和所附权利要求书中使用时，术语“包括”指示所描述特征、整体、步骤、操作、元素和/或组件的存在，但并不排除一个或多个其它特征、整体、步骤、操作、元素、组件和/或其集合的存在或添加。
还应当理解，在本申请说明书和所附权利要求书中使用的术语“和/或”是指相关联列出的项中的一个或多个的任何组合以及所有可能组合，并且包括这些组合。
如在本申请说明书和所附权利要求书中所使用的那样，术语“如果”可以依据上下文被解释为“当...时”或“一旦”或“响应于确定”或“响应于检测到”。类似地，短语“如果确定”或“如果检测到[所描述条件或事件]”可以依据上下文被解释为意指“一旦确定”或“响应于确定”或“一旦检测到[所描述条件或事件]”或“响应于检测到[所描述条件或事件]”。
另外，在本申请说明书和所附权利要求书的描述中，术语“第一”、“第二”、“第三”等仅用于区分描述，而不能理解为指示或暗示相对重要性。
在本申请说明书中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此，在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例，而是意味着“一个或多个但不是所有的实施例”，除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。
为了说明本申请的技术方案，下面通过以下实施例来进行说明。
实施例一
请参阅图1，本申请实施例提供一种应用保护方法，包括：
步骤101，检测目标应用的运行状态。
其中，上述目标应用通常是预先设定的应用。
在本实施例中，上述应用保护方法的执行主体可以为服务器。上述服务器通常是提供应用保护的后台服务器。需要说明的是，服务器可以是硬件，也可以是软件。当服务器为硬件时，可以实现成多个服务器组成的分布式服务器集群，也可以实现成单个服务器。当服务器为软件时，可以实现成多个软件或软件模块（例如用来提供分布式服务），也可以实现成单个软件或软件模块。在此不做具体限定。
在本实施例中，上述执行主体可以通过多种方式检测目标应用的运行状态。
作为一个示例，上述执行主体可以通过查询预设参数的取值，实现检测到目标应用的运行状态。进一步举例来说，上述执行主体可以通过查询参数TARGET_IPHONE_SIMULATOR的取值，来检测目标应用是否处于被运行于软件模拟设备的状态。具体地，若参数TARGET_IPHONE_SIMULATOR的取值为1，则目标应用的运行状态为：处于被运行于软件模拟设备的状态。若参数TARGET_IPHONE_SIMULATOR的取值为0，则目标应用的运行状态为：不处于被运行于软件模拟设备的状态，即，处于被运行于硬件设备的状态。
作为另一示例，上述执行主体可以通过比较目标应用的当前信息与预先存储的相应信息是否一致，实现检测到目标应用的运行状态。进一步举例来说，上述执行主体可以通过比较目标应用的应用签名信息与预设签名信息是否一致，来检测目标应用是否处于应用签名信息与预设签名信息不一致的状态。具体地，若应用签名信息与预设签名信息一致，则目标应用的运行状态为：应用签名信息与预设签名信息一致的状态。若应用签名信息与预设签名信息不一致，则目标应用的运行状态为：应用签名信息与预设签名信息不一致的状态。其中，应用签名信息通常是用于对目标应用的应用程序进行签名的信息。实践中，应用签名信息通常是用于鉴别应用并且别人无法伪造的字符串。
步骤102，响应于目标应用的运行状态属于目标状态，终止运行目标应用，以实现保护目标应用。
其中，上述目标状态通常是预先设定的状态。如，上述目标状态可以是应用签名信息与预设签名信息不一致的状态。
在本实施例中，若目标应用的运行状态属于目标状态，则上述执行主体可以终止运行目标应用。实践中，上述执行主体可以通过网络远程控制目标应用终止运行。
本实施例提供的方法，在应用运行时，实时检测应用的运行状态，一旦发现应用的运行状态属于目标状态，则终止应用的运行，可以及时发现应用存在的危险，从而及时对应用进行保护。
在本实施例的一些可选的实现方式中，上述目标状态可以包括但不限于以下任意一项或多项：
其一，应用签名信息与预设签名信息不一致的状态。
这里，为了便于描述，可以将应用签名信息与预设签名信息不一致的状态，记作第一状态。
其中，应用签名信息通常是用于对目标应用的应用程序进行签名的信息。实践中，应用签名信息通常是用于鉴别应用并且别人无法伪造的字符串。上述预设签名信息通常是预先存储的针对目标应用的应用签名信息。
实践中，目标应用每一次与后台服务器交互时，需要将应用的应用签名信息发送给后台服务器。这样，后台服务器可以比较所接收的应用签名信息与预先存储的应用签名信息是否一致。若一致，则认为目标应用当前处于应用签名信息与预设签名信息一致的状态。反之，若不一致，则认为目标应用当前处于第一状态。
需要指出的是，若目标应用当前处于第一状态，则通常认为目标应用的应用程序已被修改。此时，目标应用不安全。
其二，应用动态库信息与预设动态库信息不一致的状态。
其中，应用动态库信息用于指示目标应用所依赖的动态库文件。这里，为了便于描述，可以将应用动态库信息与预设动态库信息不一致的状态，记作第二状态。上述动态库文件，又称动态链接库（Dynamic Link Library，DLL）文件。动态库文件是一种不可执行的二进制程序文件，它允许程序共享执行特殊任务所必需的代码和其他资源。动态库文件中包含了许多函数和资源。程序可根据动态库文件中的指令打开、启用、查询、禁用和关闭驱动程序。
实际应用中，应用动态库信息通常是应用所依赖的动态库文件的名称的组合。举例来说，若应用所依赖的动态库文件有文件甲、文件乙和文件丙。则应用动态库信息可以为“甲-乙-丙”。上述预设动态库信息通常是预先存储的针对上述目标应用的应用动态库信息。
实践中，后台服务器中可以预先存储有上述预设动态库信息。目标应用在运行的过程中，可以通过执行预先设定的用于查询应用所依赖的动态库文件的查询语句，实现查询到应用所依赖的动态库文件的名称。从而可以基于各动态库文件的名称计算得到应用动态库信息。最后，目标应用可以将实时计算得到的应用动态库信息发送至后台服务器。这样，后台服务器可以比较所接收的应用动态库信息与预先存储的应用动态库信息是否一致。若一致，则认为目标应用的应用动态库信息与预设动态库信息一致。反之，若不一致，则认为目标应用当前处于第二状态。
需要指出的是，若目标应用当前处于第二状态，则通常认为目标应用的应用程序已被修改。此时，目标应用不安全。
其三，目标应用被调试的状态。
这里，为了便于描述，可以将目标应用被调试的状态，记作第三状态。
实践中，当一个应用被调试的时候，会给应用进程设置一个调试标识（如，P_TRACED）。上述执行主体可以通过检测调试标识的有无来检测应用进程是否正在被调试。具体地，若没有检测到调试标识，则认为目标应用当前没有处于目标应用被调试的状态。反之，若检测到调试标识，则认为目标应用当前处于第三状态。
需要指出的是，若目标应用当前处于第三状态，则通常认为目标应用当前正在被调试。此时，目标应用不安全。
其四，目标应用的资源文件被改变的状态。
这里，为了便于描述，可以将目标应用的资源文件被改变的状态，记作第四状态。
其中，上述资源文件，通常是用于给应用提供所需资源的文件。上述资源的类型可以是图片、音频、视频、文字，或者其他可以在计算机中展示的内容等。
实践中，目标应用可以通过执行预先设定的用于获取资源文件的语句，实现获取到目标应用的资源文件。然后，计算资源文件的哈希值。如，可以计算资源文件的MD5值。其中，MD5值是一种被广泛使用的密码散列函数，可以产生出一个128位的散列值，用于确保信息传输完整一致。最后，后台服务器可以获取到计算得到的资源文件的哈希值，以及将计算得到的计算资源文件的哈希值，与预先存储的资源文件的哈希值进行比较哈希值。如，将计算得到的资源文件的MD5值与预先存储的资源文件的MD5值进行比较。若二者一致，则认为目标应用的资源文件未改变。反之，若二者不一致，则认为目标应用当前处于第四状态。
需要指出的是，若目标应用当前处于第四状态，则通常认为目标应用的应用程序已被修改。此时，目标应用不安全。
其五，目标应用被运行于软件模拟设备的状态。
这里，为了便于描述，可以将目标应用被运行于软件模拟设备的状态，记作第五状态。
其中，上述软件模拟设备通常是指采用软件呈现模拟出的设备。
实践中，上述执行主体可以通过查询预先设定的用于指示运行设备的参数(如，TARGET_IPHONE_SIMULATOR)的取值，来检测目标应用是否处于被运行于软件模拟设备的状态。举例来说，若参数TARGET_IPHONE_SIMULATOR的取值为0，则认为目标应用未被运行于软件模拟设备，即，目标应用被运行于硬件设备。若参数TARGET_IPHONE_SIMULATOR的取值为1，则认为目标应用当前处于第五状态。实践中，在查询到上述参数的取值指示目标应用处于第五状态时，上述执行主体通常还会继续执行打开蓝牙的操作，以进一步确定目标应用是否处于第五状态。由于软件模拟设备通常不具有蓝牙。因此，若能够打开蓝牙，则可以进一步确定目标应用处于第五状态。
需要指出的是，由于应用被运行于软件模拟设备时，通常对一些信息不敏感。如，不能区分字符串的大小写。容易导致目标应用不安全。
本实现方式中，可以实现对多种可能造成应用不安全的情况进行排查，可以进一步保护应用的安全。
在本申请的各个实施例的可选的实现方式中，若应用动态库信息用于指示目标应用所依赖的动态库文件。此时，应用动态库信息通过如下步骤得到：
首先，提取目标应用所依赖的各动态库文件的名称。
实践中，上述执行主体可以通过执行预先设定的用于查询应用所依赖的动态库文件的查询语句，得到目标应用所依赖的动态库文件的名称。
然后，根据各动态库文件的名称，生成应用动态库信息。
这里，上述执行主体可以将各动态库的名称组合得到应用动态库信息。
可选地，上述执行主体可以按照预设顺序，将各动态库文件的名称组合得到字符串，然后，将所得到字符串的哈希值确定为应用动态库信息。这里，举例来说，上述执行主体可以将各动态库文件的名称以符号“|”为分隔符组合得到字符串。如，若动态库文件有文件A、文件B和文件C。则组合得到的字符串可以为“A|B|C”。
其中，上述预设顺序可以是按照名称长短的顺序，也可以是按照名称的首字母从A到Z的顺序。
本实现方式中，通过对各动态库文件的名称进行处理，得到应用动态库信息，计算复杂度低，便于实现，有助于提高数据处理效率。
在本申请的各个实施例的可选的实现方式中，目标应用的安装包可以通过如下步骤得到：
步骤一，获取源安装包，得到源安装包中的存放有签名信息的目标文件夹。
其中，源安装包中通常包括存放有签名信息的文件夹。上述目标文件夹通常是指存放有签名信息的文件夹。
在本实施例中，上述执行主体可以直接获取本地存储的源安装包，也可以通过网络获取其他设备发送的源安装包。
实践中，上述源安装包通常是通过Xcode生成的ipa（iPhoneApplication）包。上述执行主体可以通过对ipa包进行解压，得到ipa包中的bundle文件夹。这里，bundle文件夹为存放有签名信息的目标文件夹。其中，Xcode是集成开发工具。ipa包是iOS 应用的安装包文件。ipa包通过解压即可实现安装使用，卸载的话也只用删除程序文件即可。
步骤二，将目标文件夹中的应用签名信息替换成预设签名信息，以及将目标文件夹的名称修改成预设名称。
这里，上述预设签名信息可以是预先设定的信息。如，上述预设签名信息可以是苹果企业开发者发布证书，或称，企业证书。企业证书中通常包括一系列的文件。上述预设名称可以为预先设定的名称。如，上述预设名称可以为embedded.mobileprovision。
举例来说，若源安装包为ipa包时，可以通过如下操作实现将目标文件夹中的应用签名信息替换成预设签名信息：删除bundle文件夹中存放签名信息的_CodeSignature文件，以及将企业证书中的Provisioning Profile文件替代bundle文件夹中的Provisioning Profile文件。以及可以通过如下操作实现将目标文件夹的名称修改成预设名称：将企业证书改名为embedded.mobileprovision。
步骤三，基于变更后的目标文件夹，得到目标安装包，以及将目标安装包确定为目标应用的安装包。
这里，上述执行主体可以采用新的签名信息对应用程序进行签名，以及采用集成开发工具将签名后的应用程序集成得到新的安装包。
本实现方式中，所得到的目标应用的安装包是经过二次签名得到的安装包，安全性更好，有助于进一步保护目标应用的安全。
需要指出的是，为了提高目标应用的安全，在对目标应用的应用程序进行编译时，针对应用程序中的涉及敏感信息的逻辑部分，如涉及支付相关逻辑代码、涉及加密算法相关代码等，通常采用较难反编译的C语言进行编译。另外，在采用C语言对这部分代码进行编译时，通常将函数名隐藏在结构体中，以实现以指针成员的形式存储。这样，应用程序通过编译之后，仅有地址可见，而函数名和函数中的参数不可见。由于仅通过地址无法反推出函数名和函数中的参数，因此，可以保护应用程序不被反编译，从而保护应用的安全。
需要指出的是，在应用程序的代码编写阶段，还可以对不采用C语言编译的其它代码进行数据混淆处理，以使得应用程序难于被反编译，从而保护应用的安全。另外，在应用程序的代码编写阶段，还可以增加一些不具有意义的代码，如增加一些空格，以使得应用程序难于被反编译，从而进一步保护应用的安全。
实施例二
本申请实施例提供一种应用保护方法，本实施例是对实施例一的进一步说明，与实施例一相同或相似的地方，具体可参见实施例一的相关描述，此处不再赘述。请参阅图2，本实施例中的应用保护方法，包括：
步骤201，检测目标应用的运行状态。
步骤202，响应于目标应用的运行状态属于目标状态，终止运行目标应用，以实现保护目标应用。
在本实施例中，步骤201-202的具体操作与图1所示的实施例中步骤101-102的操作基本相同，在此不再赘述。
步骤203，响应于检测到目标应用所在的系统安装有预设应用集中的应用，根据所安装应用关联的风险等级信息，确定目标应用的锁定等级，以及根据所确定的锁定等级锁定目标应用。
其中，预设应用集中的应用关联有风险等级信息。上述风险等级信息通常是用于描述应用的风险等级的信息。作为示例，上述风险等级信息可以为“1”，也可以为“high”用于描述应用的风险较高。上述预设应用集中的应用通常是预先设定的可对目标应用功能或权限造成损害的应用。
其中，上述系统通常是指操作系统，如，iOS操作系统。
在本实施例中，上述目标应用可以按照预先存储的预设应用集中各预设应用的名称，调用预设应用集中的应用。在调用某一应用时，若能够调用成功，则认为目标应用所在的系统安装有该应用。反之，若调用不成功，则认为目标应用所在的系统未安装该应用。
实践中，目标应用可以通过打开预设应用集中应用的URL Scheme来确定目标应用所在的系统是否安装有预设应用集中的应用。针对预设应用集中某一应用，若目标应用可以打开该应用的URL Scheme，则认为目标应用所在的系统安装有该应用。反之，若目标应用不能打开该应用的URL Scheme，则认为目标应用所在的系统未安装该应用。其中，URL Scheme是为方便应用之间互相调用而设计的一种页面跳转协议，URL Scheme能够唯一标识一个应用。
在本实施例中，若检测到目标应用所在的系统安装有预设应用集中的应用，则上述执行主体可以根据所安装应用关联的风险等级信息，确定目标应用的锁定等级。
实践中，目标应用的锁定等级通常与所安装应用的风险等级相对应。如，若检测到所安装的应用为应用X，该应用X的风险等级信息为“high”，指示应用X的风险等级为高风险。此时，可以确定目标应用的锁定等级为高。
在本实施例中，在目标应用的锁定等级为高时，可以锁定目标应用的所有功能。另外，若目标应用的锁定等级为低时，可以锁定目标应用的部分功能。
本实现方式中，目标应用所在的系统安装有预设应用集中的应用时，可根据所安装应用的风险等级信息确定对目标应用的锁定方式，可以实现对目标应有进行灵活、合理的保护。
实施例三
本申请实施例提供一种应用保护方法，本实施例是对实施例一的进一步说明，与实施例一相同或相似的地方，具体可参见实施例一的相关描述，此处不再赘述。请参阅图3，本实施例中的应用保护方法，包括：
步骤301，检测目标应用的运行状态。
步骤302，响应于目标应用的运行状态属于目标状态，终止运行目标应用，以实现保护目标应用。
在本实施例中，步骤301-302的具体操作与图1所示的实施例中步骤101-102的操作基本相同，在此不再赘述。
步骤303，响应于检测到密码输入操作且当前不满足预设危险条件，对密码输入操作所输入的密码进行数据混淆处理，得到混淆后的密码。
步骤304，响应于检测到密码输入操作且当前满足预设危险条件，删除密码输入操作所输入的密码，退出密码输入界面。
其中，上述密码输入操作通常是用于输入密码的操作。作为示例，上述密码输入操作可以是在密码输入界面的用于输入密码的控件中输入密码的操作。作为另一示例，上述密码输入操作还可以是在密码输入界面输入指纹信息的操作。其中，上述密码输入界面通常是用于接收用户输入的密码的界面。
其中，预设危险条件通常是预先设定的用于指示当前情况不适合输入密码的条件。
实践中，上述执行主体可以通过检测是否接收到针对密码输入界面输入的信息，实现检测到密码输入操作。
在检测到密码输入操作时，上述执行主体可以进一步判断当前是否满足预设危险条件。若不满足预设危险条件，则获取密码输入操作所输入的密码，以及对所输入的密码进行数据混淆处理，以得到混淆后的数据。若满足预设危险条件，则删除密码输入操作所输入的密码，退出密码输入界面。实践中，为了保护密码的安全，通常通过调用预设数据擦除函数删除密码输入操作所输入的密码。这样，可以实现快速删除密码。及时删除密码，可以保护密码不被泄漏。上述预设数据擦除函数通常是预先设定的用于清空内存中数据的函数。
其中，数据混淆处理，通常是指对数据进行改写，生成用户不可读但不影响该数据的原有逻辑的新数据的操作。对数据进行数据混淆处理，可以使得数据不容易被泄漏，可以保障数据的安全。实践中，通常是按照预设数据混淆规则对待混淆数据进行数据混淆处理。数据混淆规则通常是用于对数据进行数据混淆处理的规则，作为示例，上述混淆处理规则可以是给待混淆数据加上预设数值的规则。进一步举例来说，若待混淆数据为123，预设数据混淆规则指示与1对应的字符为8，与2对应的字符为4，与3对应的字符为0。则对待混淆数据进行数据混淆处理后，可以得到840。
在本实施例中，在密码输入过程中，可以进一步检测当前是否满足预设危险条件。可以实现在当前情况安全时，获取密码以及对密码进行数据混淆处理，以保护密码的安全。在当前情况不安全时，及时删除所输入的密码，直接退出密码输入界面。可以实现对用户所输入密码的妥善保护。从而实现对应用进行保护。
本实施例的一些可选的实现方式中，上述预设危险条件，包括但不限于以下任意一项或多项：检测到网络连接断开。检测到当前界面被截图。检测到当前被录屏。检测到目标应用被挂起。
上述当前界面通常是指密码输入界面。上述目标应用被挂起通常是指目标应用处于挂起状态。挂起状态通常是指应用进程被操作系统暂时调离出内存的状态。在目标应用处于挂起状态时，上述执行主体可以获取到用于表征目标应用处于挂起状态的信息，从而通过该信息确定目标应用是否被挂起。
本实现方式中，在输入密码的过程中，若当前情况满足预设危险条件，则认为当前情况不安全，不适合输入密码。此时，目标应用可以清空已经输入的密码，以及退出密码输入界面。若所输入的密码用于支付，则当前支付失效。
本实现方式可以实现对用户所输入密码进行妥善保护，从而实现对应用进行保护。
在本实施例的一些可选的实现方式中，在得到混淆后的密码之后，还可以包括如下步骤：首先，响应于接收到用户输入的密码获取请求，对混淆后的密码进行数据逆混淆处理，得到原始密码。然后，响应于原始密码被使用，删除原始密码。其中，数据逆混淆处理通常是指将混淆后的数据恢复为混淆前的数据的操作。如，对数据123进行数据混淆处理后，得到混淆后的数据840。此时，若对混淆后的数据840进行数据逆混淆处理，则可以得到原始数据123。
其中，上述密码获取请求通常是用于获取密码的请求。实践中，在得到用户输入的密码后，为了便于下一次对密码的使用，通常会对混淆后的密码进行存储。在用户下一次需要用到该密码时，可以输入密码获取请求，如可以输入用于确认请求密码的指纹。这样，目标应用可以在接收到用于获取密码的请求后，对混淆后的密码进行数据逆混淆处理，得到原始密码。一旦该原始密码被使用，则及时删除该原始密码，以免密码被泄露。这样，可以实现进一步对目标应用进行保护。
实施例四
对应于上文实施例的应用保护方法，图4示出了本申请实施例提供的应用保护装置400的结构框图，为了便于说明，仅示出了与本申请实施例相关的部分。
参照图4，该装置包括：
状态检测单元401，用于检测目标应用的运行状态；
操作执行单元402，用于响应于目标应用的运行状态属于目标状态，执行与目标状态匹配的保护操作。
在一个实施例中，目标状态包括以下任意一项或多项：
应用签名信息与预设签名信息不一致的状态；
应用动态库信息与预设动态库信息不一致的状态，其中，应用动态库信息用于指示目标应用所依赖的动态库文件；
目标应用被调试的状态；
目标应用的资源文件被改变的状态；
目标应用被运行于软件模拟设备的状态。
在一个实施例中，应用动态库信息用于指示目标应用所依赖的动态库文件，应用动态库信息通过如下步骤得到：
提取目标应用所依赖的各动态库文件的名称；
根据各动态库文件的名称，生成应用动态库信息。
在一个实施例中，根据各动态库文件的名称，生成预设动态库信息，包括：
按照预设顺序，将各动态库文件的名称组合得到字符串；
将所得到字符串的哈希值确定为应用动态库信息。
在一个实施例中，装置还包括应用锁定单元，用于：
响应于检测到目标应用所在的系统安装有预设应用集中的应用，根据所安装应用关联的风险等级信息，确定目标应用的锁定等级，以及根据所确定的锁定等级锁定目标应用，其中，预设应用集中的应用关联有风险等级信息。
在一个实施例中，装置还包括密码输入单元，用于：
响应于检测到密码输入操作且当前不满足预设危险条件，对密码输入操作所输入的密码进行数据混淆处理，得到混淆后的密码；
响应于检测到密码输入操作且当前满足预设危险条件，删除密码输入操作所输入的密码，退出密码输入界面。
在一个实施例中，预设危险条件，包括以下任意一项或多项：
检测到网络连接断开；
检测到当前界面被截图；
检测到当前被录屏；
检测到目标应用被挂起。
在一个实施例中，在得到混淆后的密码之后，还包括：
响应于接收到用户输入的密码获取请求，对混淆后的密码进行数据逆混淆处理，得到原始密码；
响应于原始密码被使用，删除原始密码。
在一个实施例中，目标应用的安装包通过如下步骤得到：
获取源安装包，得到源安装包中的存放有签名信息的目标文件夹；
将目标文件夹中的应用签名信息替换成预设签名信息，以及将目标文件夹的名称修改成预设名称；
基于变更后的目标文件夹，得到目标安装包，以及将目标安装包确定为目标应用的安装包。
本实施例提供的装置，在应用运行时，实时检测应用的运行状态，一旦发现应用的运行状态属于目标状态，则终止应用的运行，可以及时发现应用存在的危险，从而及时对应用进行保护。
需要说明的是，上述装置/单元之间的信息交互、执行过程等内容，由于与本申请方法实施例基于同一构思，其具体功能及带来的技术效果，具体可参见方法实施例部分，此处不再赘述。
实施例五
图5为本申请一实施例提供的电子设备500的结构示意图。如图5所示，该实施例的电子设备500包括：至少一个处理器501（图5中仅示出一个处理器）、存储器502以及存储在存储器502中并可在至少一个处理器501上运行的计算机程序503，例如应用保护程序。处理器501执行计算机程序503时实现上述任意各个方法实施例中的步骤。处理器501执行计算机程序503时实现上述各个应用保护方法的实施例中的步骤。处理器501执行计算机程序503时实现上述各装置实施例中各模块/单元的功能，例如图4所示单元401至402的功能。
示例性的，计算机程序503可以被分割成一个或多个模块/单元，一个或者多个模块/单元被存储在存储器502中，并由处理器501执行，以完成本申请。一个或多个模块/单元可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述计算机程序503在电子设备500中的执行过程。例如，计算机程序503可以被分割成状态检测单元，操作执行单元，各单元具体功能在上述实施例中已有描述，此处不再赘述。
电子设备500可以是服务器、台式电脑、平板电脑、云端服务器和移动终端等计算设备。电子设备500可包括，但不仅限于，处理器501，存储器502。本领域技术人员可以理解，图5仅仅是电子设备500的示例，并不构成对电子设备500的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如电子设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器501可以是中央处理单元（Central Processing Unit，CPU），还可以是其他通用处理器、数字信号处理器（Digital Signal Processor，DSP）、专用集成电路（Application Specific Integrated Circuit，ASIC）、现场可编程门阵列（Field-Programmable Gate Array，FPGA）或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器502可以是电子设备500的内部存储单元，例如电子设备500的硬盘或内存。存储器502也可以是电子设备500的外部存储设备，例如电子设备500上配备的插接式硬盘，智能存储卡（Smart Media Card，SMC），安全数字（Secure Digital，SD）卡，闪存卡（Flash Card）等。进一步地，存储器502还可以既包括电子设备500的内部存储单元也包括外部存储设备。存储器502用于存储计算机程序以及电子设备所需的其他程序和数据。存储器502还可以用于暂时地存储已经输出或者将要输出的数据。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。上述系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请所提供的实施例中，应该理解到，所揭露的装置/电子设备和方法，可以通过其它的方式实现。例如，以上所描述的装置/电子设备实施例仅仅是示意性的，例如，模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通讯连接可以是通过一些接口，装置或单元的间接耦合或通讯连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的模块如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。其中，计算机程序包括计算机程序代码，计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。计算机可读介质可以包括：能够携带计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、电载波信号、电信信号以及软件分发介质等。需要说明的是，计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括电载波信号和电信信号。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围，均应包含在本申请的保护范围之内。

Claims (10)

  1. 一种应用保护方法，其特征在于，所述方法包括：
    检测目标应用的运行状态；
    响应于所述目标应用的运行状态属于目标状态，终止运行所述目标应用，以实现保护所述目标应用。
  2. 根据权利要求1所述的方法，其特征在于，所述目标状态包括以下任意一项或多项：
    应用签名信息与预设签名信息不一致的状态；
    应用动态库信息与预设动态库信息不一致的状态，其中，所述应用动态库信息用于指示所述目标应用所依赖的动态库文件；
    所述目标应用被调试的状态；
    所述目标应用的资源文件被改变的状态；
    所述目标应用被运行于软件模拟设备的状态。
  3. 根据权利要求1或2所述的方法，其特征在于，应用动态库信息用于指示所述目标应用所依赖的动态库文件，所述应用动态库信息通过如下步骤得到：
    提取所述目标应用所依赖的各动态库文件的名称；
    根据各动态库文件的名称，生成所述应用动态库信息。
  4. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    响应于检测到目标应用所在的系统安装有预设应用集中的应用，根据所安装应用关联的风险等级信息，确定所述目标应用的锁定等级，以及根据所确定的锁定等级锁定所述目标应用，其中，所述预设应用集中的应用关联有风险等级信息。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    响应于检测到密码输入操作且当前不满足预设危险条件，对所述密码输入操作所输入的密码进行数据混淆处理，得到混淆后的密码；
    响应于检测到密码输入操作且当前满足预设危险条件，删除所述密码输入操作所输入的密码，退出密码输入界面。
  6. 根据权利要求5所述的方法，其特征在于，所述预设危险条件，包括以下任意一项或多项：
    检测到网络连接断开；
    检测到当前界面被截图；
    检测到当前被录屏；
    检测到所述目标应用被挂起。
  7. 根据权利要求1所述的方法，其特征在于，所述目标应用的安装包通过如下步骤得到：
    获取源安装包，得到所述源安装包中的存放有签名信息的目标文件夹；
    将所述目标文件夹中的应用签名信息替换成预设签名信息，以及将所述目标文件夹的名称修改成预设名称；
    基于变更后的目标文件夹，得到目标安装包，以及将所述目标安装包确定为所述目标应用的安装包。
  8. 一种应用保护装置，其特征在于，所述装置包括：
    状态检测单元，用于检测目标应用的运行状态；
    操作执行单元，用于响应于所述目标应用的运行状态属于目标状态，执行与所述目标状态匹配的保护操作。
  9. 一种电子设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1至7任一项所述的方法。
  10. 一种计算机可读存储介质，所述存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至7任一项所述的方法。
PCT/CN2021/123460 2020-10-14 2021-10-13 应用保护方法、装置、设备及介质 WO2022078366A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011098062.2A CN112231702B (zh) 2020-10-14 2020-10-14 应用保护方法、装置、设备及介质
CN202011098062.2 2020-10-14

Publications (1)

Publication Number Publication Date
WO2022078366A1 true WO2022078366A1 (zh) 2022-04-21

Family

ID=74112915

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/123460 WO2022078366A1 (zh) 2020-10-14 2021-10-13 应用保护方法、装置、设备及介质

Country Status (2)

Country Link
CN (1) CN112231702B (zh)
WO (1) WO2022078366A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834850A (zh) * 2022-11-18 2023-03-21 河南中光学集团有限公司 设备监测方法、装置、电子设备及存储介质
CN117093351A (zh) * 2023-10-13 2023-11-21 亿咖通(湖北)技术有限公司 应用多开方法、装置、计算机设备以及存储介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112231702B (zh) * 2020-10-14 2024-06-21 深圳市百富智能新技术有限公司 应用保护方法、装置、设备及介质
CN114553514A (zh) * 2022-02-16 2022-05-27 中国建设银行股份有限公司 移动应用的静态注入风险检测方法及装置
CN117932594A (zh) * 2022-10-13 2024-04-26 中兴通讯股份有限公司 终端保护的方法、终端、计算机可读介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015167762A1 (en) * 2014-04-28 2015-11-05 Citrix Systems, Inc. Modifying an application for managed execution
CN107368326A (zh) * 2016-05-13 2017-11-21 腾讯科技（深圳）有限公司 进程控制方法和装置
CN109684795A (zh) * 2018-12-25 2019-04-26 成都卫士通信息产业股份有限公司 应用程序反调试的方法、装置及电子设备
CN110275832A (zh) * 2019-06-19 2019-09-24 北京字节跳动网络技术有限公司 应用程序的启动耗时测试方法、系统、设备及介质
CN112231702A (zh) * 2020-10-14 2021-01-15 深圳市百富智能新技术有限公司 应用保护方法、装置、设备及介质

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107592202B (zh) * 2017-09-20 2021-08-13 阿里巴巴（中国）有限公司 应用签名方法、装置、系统、计算设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015167762A1 (en) * 2014-04-28 2015-11-05 Citrix Systems, Inc. Modifying an application for managed execution
CN107368326A (zh) * 2016-05-13 2017-11-21 腾讯科技（深圳）有限公司 进程控制方法和装置
CN109684795A (zh) * 2018-12-25 2019-04-26 成都卫士通信息产业股份有限公司 应用程序反调试的方法、装置及电子设备
CN110275832A (zh) * 2019-06-19 2019-09-24 北京字节跳动网络技术有限公司 应用程序的启动耗时测试方法、系统、设备及介质
CN112231702A (zh) * 2020-10-14 2021-01-15 深圳市百富智能新技术有限公司 应用保护方法、装置、设备及介质

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834850A (zh) * 2022-11-18 2023-03-21 河南中光学集团有限公司 设备监测方法、装置、电子设备及存储介质
CN117093351A (zh) * 2023-10-13 2023-11-21 亿咖通(湖北)技术有限公司 应用多开方法、装置、计算机设备以及存储介质
CN117093351B (zh) * 2023-10-13 2024-02-02 亿咖通(湖北)技术有限公司 应用多开方法、装置、计算机设备以及存储介质

Also Published As

Publication number Publication date
CN112231702B (zh) 2024-06-21
CN112231702A (zh) 2021-01-15

Similar Documents

Publication Publication Date Title
US11645383B2 (en) Early runtime detection and prevention of ransomware
WO2022078366A1 (zh) 应用保护方法、装置、设备及介质
JP6166839B2 (ja) 実行時のアプリケーションメソッドを置き換えるためのシステム及び方法
US8122256B2 (en) Secure bytecode instrumentation facility
KR101503785B1 (ko) 동적 라이브러리를 보호하는 방법 및 장치
CN111143869B (zh) 应用程序包处理方法、装置、电子设备及存储介质
CN109992987B (zh) 基于Nginx的脚本文件保护方法、装置及终端设备
CN108259479B (zh) 业务数据处理方法、客户端与计算机可读存储介质
CN110555293A (zh) 用于保护数据的方法、装置、电子设备和计算机可读介质
US10296728B2 (en) Method and system for providing cloud-based application security service
EP3583536B1 (en) Securely defining operating system composition without multiple authoring
Velu Mobile Application Penetration Testing
CN111045722B (zh) 智能合约打包方法、装置、系统、计算机设备及存储介质
KR101557455B1 (ko) 응용 프로그램 코드 분석 장치 및 그것을 이용한 코드 분석 방법
Choi et al. Large‐Scale Analysis of Remote Code Injection Attacks in Android Apps
KR101436741B1 (ko) 프로그램 보안 솔루션 적용 방법 및 시스템
KR101604892B1 (ko) 안드로이드 기반 어플리케이션의 부정사용 방지 방법 및 장치
Niu et al. Clone analysis and detection in android applications
CN107391970B (zh) Flash应用程序中的函数访问控制方法及装置
US10503929B2 (en) Visually configurable privacy enforcement
KR20210133353A (ko) 프로그램 보안 적용방법
CN111984944B (zh) 一种源代码处理方法、相关装置及存储介质
Nurgaliyev et al. Analysis of reverse engineering
KR101440234B1 (ko) 프로그램 무결성 관리 방법, 시스템 및 그 방법을 컴퓨터 상에서 실행하는 프로그램을 기록한 기록매체
Kim et al. Self‐Controllable Mobile App Protection Scheme Based on Binary Code Splitting

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21879409

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 05/06/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21879409

Country of ref document: EP

Kind code of ref document: A1