WO2022111391A1 - 管理不可信应用程序通信的方法及相关装置 - Google Patents

管理不可信应用程序通信的方法及相关装置 Download PDF

Info

Publication number
WO2022111391A1
WO2022111391A1 PCT/CN2021/131767 CN2021131767W WO2022111391A1 WO 2022111391 A1 WO2022111391 A1 WO 2022111391A1 CN 2021131767 W CN2021131767 W CN 2021131767W WO 2022111391 A1 WO2022111391 A1 WO 2022111391A1
Authority
WO
WIPO (PCT)
Prior art keywords
program
request
communication handle
communication
application
Prior art date
Application number
PCT/CN2021/131767
Other languages
English (en)
French (fr)
Inventor
周逸徉
权钲杰
汪洋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21896892.3A priority Critical patent/EP4242885A4/en
Publication of WO2022111391A1 publication Critical patent/WO2022111391A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/541—Interprogram communication via adapters, e.g. between incompatible applications
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/547—Remote procedure calls [RPC]; Web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115—Third party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications

Definitions

  • the embodiments of the present application relate to the field of computer technologies, and in particular, to a method and related apparatus for managing communication of an untrusted application.
  • Android (Android) operating system is one of the most popular mobile operating systems today, and many developers develop applications based on the Android operating system.
  • the Android operating system follows the open source protocol and is a kind of operating system that allows third-party manufacturers to develop customized operating systems based on source code, which reduces the security of the Android operating system to a certain extent.
  • the Android operating system allows users to install applications from third-party channels, which provides convenience for users, but for untested or untrusted applications, it will increase the risk of privacy data leakage and abnormal operation of the operating system. .
  • the embodiments of the present application provide a method and a related device for managing communication of an untrusted application, which can reduce risks such as leakage of privacy data and abnormal operation of the operating system when the untrusted application is running.
  • a first aspect of the embodiments of the present application provides a method for managing communication of an untrusted application, including: a first process obtaining a first request for a first program from a second process, where the first program may be an Android system program, or Can be a third-party application; the first request can be an access request to a third application, or a request to establish a communication connection with the first program, and carry at least one request parameter, and the first process runs a first management application a program in which an untrusted application runs in the second process; based on at least one request parameter including the first communication handle, the first process replaces the first communication handle in the at least one request parameter with the communication handle of the first management application; then The first process sends a second request for the first program to the target process, where the second request carries at least one request parameter including a communication handle of the first management application, and the target process runs the first program.
  • the first process obtains the first request, replaces the communication handle of the untrusted application program contained in the request parameter carried by the first request with the communication handle of the first management application program in the first process, and then sends the communication handle of the first management application program to the target process.
  • a second request for the communication handle of the management application in this way, the communication handle obtained by the target process is the communication handle of the first management application, not the communication handle of the untrusted application, so the target process can only pass the first management application.
  • the communication handle of the application program communicates with the first process, but cannot communicate with the second process through the communication handle of the untrusted application program, thereby preventing the target process from communicating directly with the second process and causing the first process to fail to play a management role. Thereby reducing the risk of private data leakage and abnormal operation of the operating system caused by the operation of untrusted applications.
  • the first request is included in the communication package, where the communication package can be regarded as a serialization method; after the first process obtains the first request for the first program from the second process, the Before the first process replaces the first communication handle in the at least one request parameter with the communication handle of the first management application based on the at least one request parameter including the first communication handle, the method further includes: the first process determines the first communication handle based on the storage identification bit The storage location information of the communication handle in the communication package, the storage identification bit is used to mark the starting position of the target storage area in the communication package, and the target storage area is used to store the first communication handle; the first process obtains the first communication based on the storage location information handle.
  • This implementation provides a feasible solution for obtaining the first communication handle by parsing the communication package, which is suitable for the scenario where the first request is included in the communication package.
  • the first program is a third-party application
  • the first request is used to request the communication handle of the first program
  • the second request is used to request the communication handle of the first program
  • the first communication handle is untrusted
  • a communication handle of the management application so that the second process sends the first request to the first process through the communication handle of the first management application, wherein, in the Android system, the application management service is used for inter-process management, when the second process When the process needs to send the first request to the target process, it needs to first send the first request to the application management service, and then the application management service forwards the first request to the target process where the first program is located.
  • the second process Since the first process replaces the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application, the second process will use the communication handle of the first management application as the communication handle of the application management service. communication handle; in this way, when the second process wants to send the first request to the target process where the first program is located, the second process will send the first request to the first process through the communication handle of the first management application; After receiving the first request, a second request for establishing a communication connection is sent to the target process to establish a communication connection between the first process and the target process, so that the first process can establish communication between the second process and the target process The management of the connection process; and, after the communication connection is established, the message transmitted between the second process and the target process needs to be forwarded by the first process, which realizes the management of the communication between the first process and the second process, reduces privacy data leakage, Risks such as abnormal operation of the operating system.
  • the method further includes: the first process communicates the communication handle of the untrusted application with the first management application handle association.
  • the first process can The communication handle determines the communication handle of the untrusted application, and then sends the message to the second process through the communication handle of the untrusted application, so as to realize the forwarding of the message and prevent the first process from passing through other programs except the untrusted application. Sending the message by the communication handle resulted in a message sending error.
  • the first program is a third-party application program
  • the first request is used to access the first program
  • the second request is used to access the first program
  • the communication handle is the communication handle of the first management application
  • the first process obtaining the first request for the first program from the second process includes: the first process receives the first request from the second process for the first program through the communication handle of the first management application Program's first request.
  • the second process Since the communication handle of the first program stored in the address space of the second process is the communication handle of the first management application, the second process sends a request to access the first program through the communication handle of the first management application, and the first process After receiving the first request, the proxy second process accesses the first program in the target process, so that the first process manages the process of accessing the third-party application program by the untrusted application program.
  • a communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application; the first process sends a message to the target process for The second request of the first program includes: the first process sends the second request to the target process through the communication handle of the first program associated with the communication handle of the first management application.
  • the host can determine the communication handle of the first program associated with the communication handle of the first management application, and pass the first management application in the second process.
  • the second request is sent through the communication handle of the first program associated with the communication handle of the first management application program, and the first process is prevented from passing through other programs except the first program. Sending the second request by the communication handle of the program results in an error in sending the second request.
  • the first program is a system program
  • the system program refers to an Android system program, which may specifically include a clipboard program, a mobile hotspot WIFI and other system programs.
  • the first request is used to access the first program
  • the second request is used to access the first program.
  • the request is used to access the first program; before the first process obtains the first request for the first program from the second process, the method further includes: the first process, in the service manager in the address space corresponding to the second process, adding The communication handle of the first management application and the identifier of the first program used to replace the communication handle of the first program, so that the second process sends a first request to the first process through the communication handle of the first management application, at least one
  • the request parameter also includes the identifier of the first program.
  • the second process Since the first process adds the communication handle of the first management application to replace the communication handle of the first program and the identifier of the first program in the service manager in the address space corresponding to the second process, the second process will The first request for accessing the first program is sent to the first process through the communication handle of the first management application, so that the first process can access the first program in the target process on behalf of the second process, so as to realize the first request for accessing the first program.
  • a process's management of untrusted applications accessing system programs.
  • the method further includes: A process inquires from the service manager in the address space corresponding to the first process, the communication handle of the first program corresponding to the identifier of the first program; sending the second request by the first process to the target process includes: The communication handle of the program sends the second request to the target process.
  • This implementation provides a specific solution for the first process to send the second request.
  • the method further includes: the first process receives a first response to the second request from the target process, where the first response carries at least one response parameter; based on at least one response parameter including the second communication handle, the first process replaces the second communication handle in the at least one response parameter with the communication handle of the first management application; the first process sends a request for the first request to the second process
  • the second response carries at least one response parameter including the communication handle of the first management application.
  • the first process obtains the second response from the target process, replaces the second communication handle in the response parameter carried by the second response with the communication handle of the first management application, and then sends the first management application to the second process.
  • the second process can only receive the communication handle of the first management application, but will not receive a second communication handle that is different from the communication handle of the first management application, so as to avoid the second process through the first management application.
  • the second communication handle communicates directly with other processes outside the first process, so that the first process cannot play a management role, thereby reducing risks such as leakage of privacy data and abnormal operation of the operating system caused by the running of untrusted applications.
  • the first program is a third-party application
  • the first request is used to request the communication handle of the first program
  • the second request is used to request the communication handle of the first program
  • the second communication handle is the first The communication handle of the program
  • the method further includes: the first process associates the communication handle of the first program with the communication handle of the first management application.
  • the first process can The communication handle determines the communication handle of the first program, and then sends the message to the second process through the communication handle of the first program, so as to realize the forwarding of the message and prevent the first process from sending the communication handle of other programs except the first program. This message resulted in a message sending error.
  • the method further includes: the first process receives a third request from the second process through the communication handle of the first management application, and the third request carries the identifier of the second program and the application of the second program The identifier of the interface API; the first process accesses the API of the second program based on the identifier of the second program in the third request and the identifier of the API of the second program, wherein the second program mainly means that the communication handle is not stored in the service manager System programs that cannot be directly accessed through the Binder mechanism, such as the alarm service AlarmManager, the audio manager AudioManager, etc.
  • the first process receives the third request for accessing the API of the second program, which is applicable to the scenario where the communication handle of the second program is not stored in the service manager and thus cannot be directly accessed through the Binder mechanism.
  • the method further includes: the first process sends the access result of the API of the second program to the second process through the communication handle of the untrusted application.
  • the first process acts as a proxy for the second process to access the API of the second program, so as to manage the process of accessing the API of the second program by the untrusted application.
  • a second aspect of an embodiment of the present application provides a method for managing communication of an untrusted application, including: a second process inquires a communication handle of the first program from a service manager in an address space corresponding to the second process, and obtains the first The communication handle of the management application and the identifier of the first program, the first program is a system program; the second process sends a first request to the first process through the communication handle of the first management application, and the first request is used to access the first request.
  • at least one request parameter further includes an identifier of the first program.
  • the second process Since the second process queries the communication handle of the first management application, not the communication handle of the first program, when the second process needs to access the first program, the second process will use the communication of the first management application.
  • the handle sends the first request to the first process, so as to realize the management of the first process for the untrusted application to access the system program whose communication handle is stored in the service manager.
  • the method further includes: the second process loads the custom class in the address space of the second process through the custom class loader, the identification of the custom class is the same as the identification of the second program, the custom class
  • the identifier of the application program interface API is the same as the identifier of the API of the second program
  • the API of the custom class is used to make the second process send a third request to the first process through the communication handle of the first management application, and the third request carries The identifier of the second program and the identifier of the API of the second program; when the second process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the second process accesses the API of the custom class;
  • the second process sends the third request to the first process through the communication handle of the first management application.
  • the identification of the custom class is the same as that of the second program, when the second process accesses the second program, the second process will access the custom class; and because the identification of the API of the custom class is the same as that of the API of the second program
  • the identifiers are the same, so when the second process accesses the API of the second program, the second process will access the API of the custom class; the access of the second process to the API of the custom class causes the second process to pass the communication handle of the first management application to the The first process sends the third request, so that the first process manages the process of accessing the API of the second program by the untrusted application.
  • a third aspect of the embodiments of the present application provides an apparatus for managing communication of an untrusted application, including:
  • a transceiver unit configured to obtain a first request from the second process for the first program, the first request carries at least one request parameter, the first process runs a first management application, and the second process runs an untrusted application program;
  • a processing unit configured to include the first communication handle proxy based on the at least one request parameter, and replace the first communication handle in the at least one request parameter with the communication handle of the first management application;
  • the transceiver unit is configured to send a second request to the target process, where the second request carries at least one request parameter including the communication handle of the first management application, and the target process runs the first program.
  • the first request is included in the communication package; the processing unit is further configured to determine the storage location information of the first communication handle in the communication package based on the storage identification bit, and the storage identification bit is used to mark the target storage area in the communication package The target storage area is used to store the first communication handle; the first communication handle is obtained based on the storage location information.
  • the first program is a third-party application program
  • the first request is used to request the communication handle of the first program
  • the second request is used to request the communication handle of the first program
  • the first communication handle is an untrusted application program communication handle.
  • the processing unit is further configured to replace the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application, so that the second process sends the communication handle to the first management application through the communication handle of the first management application.
  • a process sends the first request.
  • the processing unit is further configured to associate the communication handle of the untrusted application with the communication handle of the first management application.
  • the first program is a third-party application program
  • the first request is used to access the first program
  • the second request is used to access the first program
  • the communication handle of the first program stored in the address space of the second process Communication handle for the first management application.
  • the transceiver unit is further configured to receive the first request for the first program from the second process through the communication handle of the first management application program.
  • a communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application.
  • the transceiver unit is further configured to send the second request to the target process through the communication handle of the first program associated with the communication handle of the first management application program.
  • the first program is a system program
  • the first request is used to access the first program
  • the second request is used to access the first program
  • the processing unit is further configured to add, in the service manager in the address space corresponding to the second process, the communication handle of the first management application that is used to replace the communication handle of the first program and the identifier of the first program, so that the second process
  • the process sends the first request to the first process through the communication handle of the first management application, and at least one request parameter further includes the identifier of the first program.
  • the processing unit is further configured to query, from the service manager in the address space corresponding to the first process, the communication handle of the first program corresponding to the identifier of the first program;
  • the transceiver unit is further configured to send the second request to the target process through the communication handle of the first program.
  • the transceiver unit is further configured to receive a first response to the second request from the target process, where the first response carries at least one response parameter.
  • the processing unit is further configured to include the second communication handle based on the at least one response parameter, and replace the second communication handle in the at least one response parameter with the communication handle of the first management application.
  • the transceiver unit is further configured to send a second response to the first request to the second process, where the second response carries at least one response parameter including the communication handle of the first management application.
  • the first program is a third-party application program
  • the first request is used to request the communication handle of the first program
  • the second request is used to request the communication handle of the first program
  • the second communication handle is the communication handle of the first program.
  • processing unit is further configured for the first process to associate the communication handle of the first program with the communication handle of the first management application.
  • the transceiver unit is further configured for the first process to receive a third request from the second process through the communication handle of the first management application, where the third request carries the identifier of the second program and the application program interface of the second program The identifier of the API; based on the identifier of the second program in the third request and the identifier of the API of the second program, the API of the second program is accessed.
  • the transceiver unit is further configured to send the access result of the API of the second program to the second process through the communication handle of the untrusted application program.
  • a fourth aspect of the embodiments of the present application further provides an apparatus for managing communication of an untrusted application, including:
  • the processing unit is used to query the communication handle of the first program from the service manager in the address space corresponding to the second process, and obtain the communication handle of the first management application program and the identification of the first program, and the first program is a system program;
  • the transceiver unit is configured to send the first request to the first process through the communication handle of the first management application, and at least one request parameter further includes the identifier of the first program.
  • the processing unit is further configured to load a custom class in the address space of the second process through the custom class loader, where the identifier of the custom class is the same as that of the second program, and the application interface of the custom class is the same as that of the second program.
  • the identifier of the API is the same as the identifier of the API of the second program.
  • the API of the custom class is used to make the second process send a third request to the first process through the communication handle of the first management application, and the third request carries the second program's The identifier and the identifier of the API of the second program; when the second process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the API of the custom class is accessed.
  • the transceiver unit is further configured for the second process to send a third request to the first process through the communication handle of the first management application.
  • a fifth aspect of an embodiment of the present application provides a terminal device, including: one or more processors and a memory; wherein, the memory stores computer-readable instructions; the one or more processors read the Computer readable instructions to cause the computer device to implement the method according to any implementation of the first aspect.
  • a sixth aspect of an embodiment of the present application provides a terminal device, including: one or more processors and a memory; wherein, the memory stores computer-readable instructions; the one or more processors read the Computer readable instructions to cause the computer device to implement the method according to any implementation of the second aspect.
  • a seventh aspect of the embodiments of the present application provides a computer-readable storage medium, including computer-readable instructions, when the computer-readable instructions are executed on a computer, the computer is made to perform any of the first aspect or the second aspect. An implementation of the method described.
  • An eighth aspect of the embodiments of the present application provides a chip, including one or more processors. Part or all of the processor is used to read and execute the computer program stored in the memory, so as to execute the method in any possible implementation manner of the first aspect or the second aspect.
  • the chip includes a memory, and the memory and the processor are connected to the memory through a circuit or a wire. Further optionally, the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used for receiving data and/or information to be processed, the processor obtains the data and/or information from the communication interface, processes the data and/or information, and outputs the processing result through the communication interface.
  • the communication interface may be an input-output interface.
  • some of the one or more processors may also implement some steps in the above method by means of dedicated hardware, for example, the processing involving the neural network model may be performed by a dedicated neural network processor or graphics processor.
  • the methods provided in the embodiments of the present application may be implemented by one chip, or may be implemented collaboratively by multiple chips.
  • a ninth aspect of an embodiment of the present application provides a computer program product, where the computer program product includes computer software instructions, and the computer software instructions can be loaded by a processor to implement the method described in any one of the implementation manners of the first aspect above .
  • the embodiments of the present application have the following advantages:
  • the first process obtains the first request, replaces the communication handle of the untrusted application contained in the request parameter carried by the first request with the communication handle of the first management application in the first process, and then sends a message carrying the first request to the target process.
  • a second request for the communication handle of the management application in this way, the communication handle obtained by the target process is the communication handle of the first management application, not the communication handle of the untrusted application, so the target process can only pass the first management application.
  • the communication handle of the application program communicates with the first process, but cannot communicate with the second process through the communication handle of the untrusted application program, thereby preventing the target process from communicating directly with the second process and causing the first process to fail to play a management role. Thereby reducing the risk of private data leakage and abnormal operation of the operating system caused by the operation of untrusted applications.
  • FIG. 1 is a schematic diagram of a system architecture in an embodiment of the present application.
  • FIG. 2 is a schematic diagram of the Binder mechanism
  • FIG. 3 is a schematic diagram of a framework corresponding to the method in the embodiment of the present application.
  • FIG. 4 is a schematic diagram of an embodiment of a method for managing communication of an untrusted application in an embodiment of the present application
  • FIG. 5 is a schematic diagram of another embodiment of a method for managing communication of an untrusted application in an embodiment of the present application
  • FIG. 6 is a schematic diagram of a first application example in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a second application example in the embodiment of the present application.
  • FIG. 8 is a schematic diagram of an embodiment of an apparatus for managing communication of an untrusted application in an embodiment of the present application
  • FIG. 9 is a schematic diagram of another embodiment of an apparatus for managing communication of an untrusted application in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of an embodiment of a terminal device in an embodiment of the present application.
  • the embodiments of the present application may be applied to the system architecture shown in FIG. 1 .
  • the system is located in the Android Android environment, and specifically includes an isolated process, a host process, a third-party application program, and an Android system program.
  • a process is a running entity of a program.
  • a program is a description of instructions, data and its organization, and a process is the running entity of the program.
  • a process can have multiple threads concurrently, and each thread executes different tasks in parallel.
  • a thread may be the actual operation unit of a process, but the embodiments of the present application do not clearly distinguish between a thread and a process, and are replaced by processes in the description process.
  • the isolated process is a special process of "unauthorized" in the Android system.
  • the application running in the isolated process cannot directly communicate with the external environment (including the Android system program and third-party application shown in Figure 1). Communication, which can only communicate with the external environment through the host process, thus providing a sandbox environment for the application.
  • Sandbox Sandbox also known as sandbox, refers to a security mechanism that provides an isolated environment for running applications.
  • the host process Host Process is a regular process in the Android system, which is used to establish a connection with the isolated process, manage and proxy the communication behavior of the isolated process and the external environment.
  • Android system program refers to a system that controls and coordinates Android devices and external devices, supports the development and operation of application software, and is a collection of various programs that do not require user intervention.
  • the third-party application program corresponds to the system software. It is a collection of various programming languages that users can use, as well as a collection of programs compiled in various programming languages. It is divided into application software packages and user programs.
  • the untrusted applications can be run in the isolation process shown in FIG. Running in the host process shown in Figure 1.
  • the host process establishes a connection with the isolation process. After that, the host process receives all external access requests from the isolation process, and then performs security verification on the access requests.
  • the host process will proxy the untrusted application in the isolation process to complete the access according to the access request, and return the access result to the untrusted application in the isolation process; for the security verification If the verification result does not meet the required access request, the host process will terminate the access request. In this way, the host process can play the role of managing and proxying the communication between the isolated process and the external environment.
  • IPC can be implemented in a number of ways. For example, two processes can communicate through a communication handle, which can also be called a cross-process communication handle.
  • the communication handle can be Ibinder; when the communication handle is Ibinder, the two processes communicate through the Binder mechanism.
  • the program A may be an Android system program or a third-party application program; similarly, the program B may be an Android system program or a third-party application program.
  • Program A can apply to the Binder driver to create a Binder in the process where Program A is located, and the Binder can also be called a Binder entity or a local object; similarly, Program B can apply to the Binder driver to create a Binder in the process where Program B is located. Create a Binder in the process of the Binder, which can also be called a Binder entity or a local object.
  • Binder connection can be understood as: program A obtains the IBinder of program B, and program B obtains the IBinder of program A; among them, IBinder can also be called IBinder reference, remote object, Binder proxy proxy, for the convenience of description, Binder proxy is used below Instead of IBinder.
  • IBinder defines a basic interface of remotely callable objects, which describes the abstract protocol for interacting with remotely callable objects; Binder is the base class of remotely callable objects, and is the implementation class of IBinder, providing IBinder The standard native implementation of such objects.
  • program A When program A initiates access to program B, program A can initiate access to program B through the Binder proxy of program B.
  • the access process can be understood as: program A sends an access request to the binder driver through the binder proxy of program B, and the binder driver Process the access request and allocate two buffers Buffer, one of which is used to write the parameters in the access request, and program B can read the parameters of the access request from the buffer; the other buffer is used for writing Enter the parameters in the access response from program B, and program A can read the parameters of the access response from the buffer.
  • program B when program B initiates access to program A, program B can initiate access to program A through program A's Binder proxy.
  • the access process can be understood by referring to the above-mentioned process of program A accessing program B.
  • any two programs that can communicate through the Binder mechanism can directly communicate with each other through the Binder proxy after obtaining the Binder proxy of both parties.
  • the untrusted application can directly communicate with other programs through the Binder proxy. , which means that the host process cannot manage the communication behavior of the isolated process, which increases the risk caused by the operation of untrusted applications.
  • the embodiment of the present application provides a method, which enables the host process to obtain a request from the isolated process during the access process of the proxy isolated process, and replaces the Binder proxy in the request; the method also enables the host process to obtain the request from the isolated process.
  • the response sent to the isolated process, and the Binder proxy in the request is replaced to prevent the isolated process from obtaining the Binder proxy of other applications, thereby reducing the risk caused by the running of untrusted applications.
  • Parcel is a message container, and messages (including data and object references) packaged by the message container can be passed through the IBinder mechanism.
  • Hook technology is a series of computer programming techniques that alter or enhance the behavior of operating systems, applications or other software components by intercepting function calls or messages or events passed between software components.
  • Service Manager is an important class in the Android system. It is used to manage all Android system programs and maintain Binder communication between Android system programs and third-party applications.
  • ActivityManagerService also known as job management application, is the core service of Android system components, responsible for the startup, switching, scheduling and process management and scheduling of the four major components (Activity, Service, BroadcastReceiver, ContentProvider) in the system. Work.
  • PackageManagerService The core service of Android system components, responsible for all package-related work, such as application installation and uninstallation.
  • the method provided by the embodiments of the present application is described below by taking the Android system as an example, and the Binder mechanism is used as a mode of inter-process communication.
  • a Binder proxy is used instead of a communication handle.
  • the method provided by the embodiment of the present application is applied to the target process, the first process, and the second process, where the first process is a process for managing communication of an untrusted application, the second process is a process for running an untrusted application, and the target
  • the process is the process that runs the first program; for the convenience of description, the host process is used to replace the first process, and the isolated process is used to replace the second process.
  • FIG. 3 shows a schematic diagram of a framework corresponding to a method provided by an embodiment of the present application.
  • a client accesses an untrusted application, and the client may be a client corresponding to any third-party application.
  • the process of the client accessing the untrusted application may include the untrusted application loading process, the untrusted application life cycle management process and the untrusted application running process.
  • the untrusted application loading process is as follows.
  • the client pulls up the host process, and the host process runs the first management application; then, the host process pulls up the isolation process, and the isolation process loads the second management application; then the first management application communicates with the second management application through the Binder mechanism
  • the management application establishes a connection, that is, the first management application obtains the Binder proxy of the second management application, and the second management application obtains the Binder proxy of the first management application; then, the first management application passes through the second management application. application, which loads untrusted applications into isolated processes. Because when the client accesses the untrusted application, the loading of the untrusted application belongs to dynamic loading.
  • the process of loading the untrusted application into the isolated process may include: loading the untrusted application into the isolated process from the storage path of the untrusted application through a custom class loader, wherein the custom class loader may Override the loadClass method or the findClass method.
  • Loading the untrusted application in the above manner can solve the problem that the untrusted application in the isolation process cannot be managed and installed by the PackageManagerService of the Android system.
  • the client is unaware of whether the untrusted application is running in the sandbox environment provided by the isolated process.
  • the lifecycle management process for untrusted applications is as follows.
  • a service stub is created through the application management service, and the service stub can be regarded as an application program, and the function of the life cycle of the service stub has a corresponding relationship with the function of the life cycle of the untrusted application. In this way, the host process can manage the life cycle of the untrusted application program by managing the life cycle of the service pile.
  • an embodiment of the present application provides an embodiment of a method for managing communication of an untrusted application, including:
  • Step 101 the host process obtains a first request for the first program from the isolation process, the first request carries at least one request parameter, the host process runs a first management application, and the isolation process runs an untrusted application.
  • the first program is the request object of the first request, and the request object may be an Android system program or a third-party application program.
  • the kind of the first request is related to the first program.
  • the first request is usually an access request to the Android system program.
  • the first request may be an access request to the third application or a request to establish a Binder connection with the first program; when the first request is to establish a Binder connection with the first program When the request is made, the first request is used to request the Binder proxy of the first program.
  • the first request may be packaged to obtain a communication package containing the first request, so as to realize the transmission of the first request by transmitting the communication package, wherein the communication package may also be called a cross-process communication package, and may specifically be Parcel Object, Parcel object can be seen as a serialization method.
  • the first request obtained by the host process is contained in the Parcel object.
  • the types and quantities of request parameters in the first request are related to the types of the first request, and the embodiments of the present application do not specifically limit the types and quantities of request parameters in the first request.
  • Step 102 the host process determines the storage location information of the first Binder agent in the communication package based on the storage identification bit, the storage identification bit is used to mark the starting position of the target storage area in the communication package, and the target storage area is used to store the first Binder agent. .
  • steps 102 and 103 may be used to obtain the first Binder proxy from the first request.
  • the Binder agent it is usually stored in a fixed target storage area of the communication package, and the starting position of the target storage area is identified by a storage identification bit, and the storage identification bit can be stored in the Native layer. Therefore, the host process can determine the storage location information of the first Binder agent in the communication package according to the storage identifier.
  • the target storage area is traversed to find the storage position information of the first Binder agent in the communication package.
  • Step 103 the host process obtains the first Binder proxy based on the storage location information.
  • the host process can read the first Binder agent from the communication package based on the storage location information.
  • steps 102 and 103 are executed after step 101 and before step 104; and, only when the first request is included in the communication package, the first Binder proxy can be obtained through steps 102 and 103, Therefore steps 102 and 103 are optional.
  • Step 104 the host process replaces the first Binder proxy in at least one request parameter with the Binder proxy of the first management application.
  • the first binder agent is different from the binder agent of the first management application, so the replacement operation can be performed directly, but a judgment step can also be added before step 104, and when it is judged that the two are different, the replacement is performed.
  • the isolation process can directly communicate with other processes through the Binder agents of other programs;
  • the target process where a program is located has obtained the Binder proxy of the untrusted application, and the target process can also communicate directly with the isolated process through the Binder proxy of the untrusted application.
  • the host process replaces the first Binder proxy in the first request; specifically, the host process replaces the first Binder proxy with the binder proxy of the first management application, so that the first program is located
  • the target process can only obtain the Binder proxy of the first management application.
  • the process of replacing the first Binder proxy with the Binder proxy of the first management application by the host process may include: replacing the first Binder in the storage location indicated by the storage location information in step 103 The proxy is replaced with the Binder proxy of the first management application; since the communication package can be a Parcel object, as shown in FIG. 3 , this process can also be called Parcel object semantic replacement.
  • the first Binder agent may be the Binder agent of the untrusted application, or may be the Binder agent of other programs except the Binder agent of the untrusted application and the Binder agent of the first management application. This is not specifically limited in the application examples.
  • Step 105 the host process sends a second request for the first program to the target process, the second request carries at least one request parameter including the Binder proxy of the first management application, and the target process runs the first program.
  • the role of the host process is to proxy the isolated process to access the target process, so except for the Binder proxy, the parameters in the second request are the same as the parameters in the first request.
  • the host process obtains the first request, replaces the Binder proxy of the untrusted application program included in the request parameters carried by the first request with the Binder proxy of the first management application program in the host process, and then sends The target process sends a second request carrying the Binder proxy of the first management application; in this way, the Binder proxy obtained by the target process is the Binder proxy of the first management application, not the Binder proxy of the untrusted application, so the target process only It can communicate with the host process through the Binder agent of the first management application, but cannot communicate with the isolation process through the Binder agent of the untrusted application, so as to prevent the target process from communicating directly with the isolation process and the host process cannot play the role of management. , so as to reduce the risk of private data leakage and abnormal operation of the operating system caused by the operation of untrusted applications.
  • Step 106 the host process receives a first response to the second request from the target process, where the first response carries at least one response parameter.
  • step 105 the target process can send the first response corresponding to the second request to the host process, and accordingly, the host process will receive the response.
  • step 101 Based on the relevant description of step 101, it can be known that there can be various types of the first request, and the types of the first response correspond to the types of the first request, so there can also be various types of the first response. For details, please refer to the first request to understand the relevant instructions.
  • the response parameter is related to the request parameter in the first request. Similar to the request parameter, the embodiment of the present application does not specifically limit the type and quantity of the response parameter.
  • Step 107 the host process replaces the second Binder proxy in at least one response parameter with the Binder proxy of the first management application.
  • the request parameters in the first request may include a first Binder proxy that is different from the Binder proxy of the first management application.
  • the response parameters may also include a different Binder proxy than the first management application.
  • the second Binder agent of the Binder agent when the response parameter contains a second Binder agent that is different from the Binder agent of the first management application, the host process will replace the second Binder agent with the Binder agent of the first management application.
  • the second Binder agent may be the Binder agent of the first program, or may be the Binder agent of other programs except the Binder agent of the first program and the Binder agent of the host process, which is not specifically limited in this embodiment of the present application.
  • the first program is program C
  • the second Binder agent can be the Binder agent of program C or the Binder agent of program D, that is, the response parameter can instruct the isolated process to access the process where program D is located through the Binder agent of program D .
  • Step 108 The host process sends a second response to the first request to the isolation process, where the second response carries at least one response parameter that includes the Binder proxy of the first management application.
  • the relationship between the second response and the first response is similar to the relationship between the second request and the first request, and can be understood with reference to the foregoing descriptions of the second request and the first request.
  • the target process may not send the first response to the host process, and accordingly, the host process will not send the second response to the isolated process; for example, if the first request uses To request the first program to play audio, similarly, the second request is also used to request the first program to play audio, then after the target process receives the second request, it will perform the operation of playing the audio, and will not send it to the host process. first response.
  • steps 106 to 108 are optional, and are applicable to the scenario where the target process sends the second response to the host process.
  • the host process obtains the second response from the target process, replaces the second Binder proxy in the response parameter carried by the second response with the binder proxy of the first management application, and then sends a message containing the Binder proxy to the isolation process.
  • the Binder proxy of the first management application in this way, the isolation process can only receive the Binder proxy of the first management application, and will not receive a second Binder proxy that is different from the Binder proxy of the first management application to avoid isolation
  • the process directly communicates with other processes outside the host process through the second Binder agent, so that the host process cannot play the role of management, thereby reducing the risk of private data leakage and abnormal operation of the operating system caused by the running of untrusted applications.
  • the first scenario in which the host process obtains the first request the isolation process sends the first request to request to establish a binder connection with the target process.
  • the first program is a third-party application
  • the first request is used to request the Binder proxy of the first program
  • the second request is used to request the Binder proxy of the first program
  • the first Binder proxy is the Binder proxy of the untrusted application .
  • the application management service is used for inter-process management, so when the isolated process needs to communicate with other processes, it needs to communicate with other processes through the application management service; that is, when the isolated process needs to send the first When requesting, the first request needs to be sent to the application management service, and then the application management service forwards the first request to the target process where the first program is located.
  • the method may further include:
  • the host process replaces the binder proxy of the application management service in the address space corresponding to the isolation process with the binder proxy of the first management application, so that the isolation process sends the first request to the host process through the binder proxy of the first management application.
  • Step 101 may specifically include: the host process receives the first request from the isolation process through the Binder proxy of the first management application.
  • the request parameter in the first request will carry the Binder proxy of the untrusted application, so that the target process can obtain the Binder of the untrusted application.
  • Proxy; the Binder proxy of the first program is also carried in the second response, so that the isolated process can obtain the Binder proxy of the first program, thereby realizing the Binder connection between the isolated process and the target process.
  • the second request sent by the host process to the target process carries the Binder proxy of the host process
  • the second response sent by the host process to the isolation process also carries the binder proxy of the host process. What is established is the Binder connection between the isolated process and the host process, and the Binder connection between the host process and the target process. After that, communication between the target process and the isolated process depends on the host process.
  • the host process can have multiple binder agents, and the host process can also establish binder connections with other processes other than the target process and the isolated process. Therefore, when the target process sends an access request to the untrusted application to the host process through the Binder proxy of the host process, the host process needs to first determine the binder proxy of the untrusted application according to the binder proxy used by the target process, and then can pass the untrusted application. The Binder proxy of the letter application forwards the access request to the isolated process.
  • the method may further include: the host process associates the Binder proxy of the untrusted application with the Binder proxy of the first management application.
  • the host process can determine the binder proxy of the untrusted application to be accessed by the access request based on the association relationship between the binder proxy of the untrusted application and the binder proxy of the first management application.
  • the isolation process sends an access request to the first program to the host process through the Binder agent of the host process
  • the host process needs to determine the Binder agent of the first program according to the Binder agent used by the target process, and then can pass the first program.
  • the Binder proxy of the program forwards the access request to the target process.
  • step 106 the method further includes:
  • the host process associates the Binder proxy of the first program with the Binder proxy of the first management application.
  • the host process can determine the binder proxy of the first program to be accessed by the access request based on the association relationship between the binder proxy of the first program and the binder proxy of the first management application.
  • the host process has Binder proxy 1 and Binder proxy 2.
  • the host process replaces both the Binder proxy of the untrusted application and the Binder proxy of the first program with Binder proxy 1, that is, the second The request carries Binder proxy 1, and the second response also carries Binder proxy 1. Therefore, the host process establishes Binder connections with the target process and the isolated process through Binder proxy 1, respectively. In addition, the host process also establishes a Binder connection with another third-party application through the Binder proxy 2.
  • the isolation process sends an access request for the first program to the host process through Binder agent 1
  • the host process can determine to forward the access request through the Binder agent of the first program through the association relationship between Binder agent 1 and the Binder agent of the first program
  • the access request is not forwarded through the Binder proxy of another third-party application.
  • the host process can determine the untrusted application through the association relationship between Binder proxy 1 and the Binder proxy of the untrusted application.
  • the Binder proxy of the program forwards the access request instead of forwarding the access request through the Binder proxy of another third-party application.
  • the first request that should be sent to the application management service is transferred to the host process, and then the host process completes the IPC transfer.
  • the IPC transfer can be understood as the host process to The third-party application sends the second request.
  • the host process replaces the Binder proxy of the application management service in the address space corresponding to the isolation process with the binder proxy of the first management application, so the host process will receive a Binder connection from the isolation process for establishing a Binder connection.
  • the first request after that, the host process sends a second request for establishing a Binder connection to the target process, finally establishing a Binder connection between the isolated process and the host process, and also establishing a Binder connection between the host process and the target process,
  • the host process can manage the process of establishing a Binder connection between the isolated process and the target process.
  • the second scenario in which the host process obtains the first request the isolated process sends the first request to request access to a third-party application.
  • the first program is a third-party application program
  • the first request is used to access the first program
  • the second request is used to access the first program
  • the Binder proxy of the first program stored in the address space of the isolated process is the first management The application's Binder proxy.
  • the second scenario means that the host process and the isolation process establish a binder connection, and after the host process and the target process establish a binder connection, the isolation process sends a first request to access the first program.
  • the isolation process obtains is the Binder proxy of the first management application, that is, the Binder proxy of the first management application is stored in the address space of the isolation process, and the isolation process will store the Binder proxy of the first management application.
  • the Binder proxy of the application acts as the Binder proxy of the first program.
  • the isolation process when the isolation process needs to send the first request to the first program through the binder mechanism, the isolation process will send the first request through the binder proxy of the first management application.
  • obtaining the first request for the first program from the isolated process by the host process may include:
  • the host process receives the first request for the first program from the isolation process through the Binder proxy of the first management application.
  • the target process obtains the Binder proxy of the first management application, and based on the relevant description of the first scenario, it can be known that the host process will associate the Binder proxy of the first program with the Binder proxy of the first management application. Agent association.
  • the Binder proxy of the first program is stored in the address space of the host process, and the Binder proxy of the first program is associated with the Binder proxy of the first management application.
  • sending the second request for the first program by the host process to the target process includes:
  • the host process sends the second request to the target process through the Binder proxy of the first program associated with the Binder proxy of the first management application.
  • the host process determines the Binder agent of the first program associated with the Binder agent of the first management application according to the association relationship between the Binder agent of the first program and the Binder agent of the first management application, and then determines the Binder agent of the first program associated with the Binder agent of the first management application, and then A Binder proxy of the first program associated with the Binder proxy of the management application sends the second request.
  • the first request that should be sent to the application management service is transferred to the host process, and then the host process completes the IPC transfer.
  • the IPC transfer can be understood as the host process to The third-party application sends the second request.
  • the Binder proxy of the first program stored in the address space of the isolation process is the Binder proxy of the first management application, and the isolation process sends a request to access the first program through the Binder proxy of the first management application, After the host process receives the first request, the proxy isolation process accesses the first program in the target process, so that the host process manages the process of accessing the third-party application program by the untrusted application program.
  • the third scenario in which the host process obtains the first request the isolated process sends the first request to request access to the Android system program.
  • the first program is a system program
  • the system program refers to an Android system program, which may specifically include system programs such as clipboard programs, mobile hotspot WIFI, etc.; the first request is used to access the first program, and the second request is used to access the first program. a program.
  • the first program is a system program, that is, the isolated process sends a first request to access the system program.
  • the service manager is used to manage all the Android system programs, and maintains the Binder communication between the Android system program and the third-party application, wherein each process may have its own service manager.
  • the service manager stores the Binder agent of the Android system program, and both third-party applications and untrusted applications can query the Binder agent of each Android system program from the service manager.
  • the untrusted application when the untrusted application queries the Binder agent of the system program from the service manager, it can communicate directly with the system program through the Binder agent of the system program.
  • the method further includes:
  • the host process adds the Binder agent of the first management application and the identifier of the first program for replacing the Binder agent of the first program, so that the isolation process can pass the first management application.
  • the Binder proxy of the application sends the first request to the host process, and at least one request parameter further includes the identifier of the first program.
  • the isolation process is a special process with "no permission"
  • the Binder agent in the address space corresponding to the isolation process Binder proxies for any system programs are usually not stored in the service manager.
  • the host process adds the Binder agent of the first management application and the first-degree identifier to the service manager in the address space corresponding to the isolation process, so that the isolation process uses the Binder of the first management application
  • the agent acts as the Binder agent of the first program.
  • the Binder agent of the first management application and the identifier of the first program can be regarded as the Binder agent of the packaged first management application, that is, the Binder agent of the packaged first management application is used to replace the Binder agent of the first program. Binder proxy.
  • the host process can add multiple Binder proxies of the packaged first management application to the service manager to replace the Binder proxies of all Android system programs, so as to use the Binder proxies of the packaged first management application
  • the purpose of replacing the Binder agent of the first program it should be noted that since the identifiers of each Android system program are different, in the Binder agent of the packaged first management application corresponding to different Android system programs, the The logo is different.
  • the host process usually adds the Binder agent of the first management application and the identifier of the first program in the process of starting the isolation process (which can be understood as initialization of the isolation process).
  • the isolation process queries the Binder agent of the first program from the service manager in the address space corresponding to the isolation process, and obtains the Binder agent of the first management application and the Binder agent of the first program.
  • identification the first program is a system program
  • the isolation process sends a first request to the host process through the Binder proxy of the first management application, and at least one request parameter further includes an identifier of the first program.
  • step 101 includes: the host process receives a first request for the first program from the isolation process through the Binder proxy of the host process, and the request parameter in the first request includes the identifier of the first program.
  • the host process can query the Binder proxy of the first program from the service manager, and then send the second request through the Binder proxy of the first program.
  • the method further includes:
  • the host process inquires from the service manager in the address space corresponding to the host process, the Binder proxy of the first program corresponding to the identifier of the first program.
  • sending the second request by the host process to the target process includes:
  • the host process sends the second request to the target process through the Binder proxy of the first program.
  • the first request that should be sent to the target process is transferred to the host process, and then the host process completes the IPC transfer.
  • the IPC transfer can be understood as the host process to Android
  • the system program sends the second request.
  • the host process adds the Binder agent of the first management application and the identifier of the first program, which is used to replace the Binder agent of the first program, in the service manager in the address space corresponding to the isolation process, so as to Make the isolation process send the first request to the host process through the Binder proxy of the first management application, so that the host process can proxy the isolation process to access the first program in the target process, so that the host process can access the untrusted application Management of system programs; wherein, when the first program is a system program, the way that the host process proxy isolated process accesses the first program can also be called a stub proxy.
  • the host process manages the process of the isolated process communicating with the first process through the Binder mechanism. Based on the foregoing description, the isolated process can also communicate with the first process by directly accessing the API. Therefore, the following describes how the host process manages the process in which the isolated process communicates with the first process by accessing the API.
  • the embodiment of the present application also provides another embodiment of a method for managing communication of an untrusted application. As shown in FIG. 5 , the embodiment includes:
  • Step 201 the isolated process loads a custom class in the address space of the isolated process through a custom class loader, the identifier of the custom class is the same as that of the second program, and the identifier of the API of the custom class is the same as that of the API of the second program.
  • the identifiers are the same, and the API of the custom class is used to make the isolated process send a third request to the host process through the Binder proxy of the first management application, and the third request carries the identifier of the second program and the identifier of the API of the second program.
  • the custom class can be regarded as a class object.
  • any functional component such as the application management service and the service manager is also a class object.
  • the isolated process since the identifier of the custom class is the same as the identifier of the second program, when the isolated process accesses the second program, the isolated process will access the custom class; and because the identifier of the API of the custom class is the same as the identifier of the API of the second program , so when the isolated process accesses the API of the second program, the isolated process will access the API of the custom class.
  • the user can set the API of the custom class to make the isolated process send the third request to the host process through the Binder proxy of the first management application.
  • Step 202 when the isolated process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the isolated process accesses the API of the custom class.
  • step 201 Based on the relevant description of step 201, it can be known that when the isolated process accesses the API of the second program, the isolated process will access the API of the custom class.
  • Step 203 the isolation process sends a third request to the host process through the Binder proxy of the first management application.
  • step 201 Based on the relevant description of step 201, it can be seen that since the API of the custom class enables the isolated process to send a third request to the host process through the Binder proxy of the first management application, the isolated process accessing the API of the custom class will prompt the isolated process to pass the third request. A Binder proxy of the management application sends the third request.
  • the host process receives the third request from the isolation process through the Binder proxy of the first management application, and the third request carries the identifier of the second program and the identifier of the API of the second program.
  • Step 204 the host process accesses the API of the second program based on the identifier of the second program in the third request and the identifier of the API of the second program.
  • the host process after receiving the third request, the host process will access the API of the second program based on the identifier of the second program and the API of the second program, that is, the host process proxy isolation process accesses the API of the second program. .
  • Step 205 the host process sends the access result of the API of the second program to the isolation process through the Binder proxy of the untrusted application.
  • the host process After the host process obtains the access result of the API of the second program, the host process can send the access result of the API of the second program to the isolated process by using the Binder mechanism.
  • the system program represented by the second program is different from the system program represented by the first program in the third scenario in the foregoing embodiment.
  • the second program mainly refers to the system program that the Binder agent is not stored in the service manager, and the system program represented by the first program in the third scenario refers to the system program that the Binder agent stores in the service manager; specifically, the third
  • the binder proxy of the system program represented by the first program will be stored in the service manager, and the system program represented by the second program can also have a binder proxy, but the binder proxy will not be stored in the service manager, so
  • the Binder proxy of the system program represented by the second program cannot be queried through the service manager, and the second program can only be accessed through the API of the second program.
  • the system program represented by the second program may be an alarm clock service AlarmManager, an audio manager AudioManager, and the like.
  • the first application example is as follows.
  • the client needs to use the context awareness service Awareness Kit to register the time fence DuringTimePeriod.
  • the status of the time fence is True.
  • the client pulls up the host process
  • the host process pulls up the isolation process
  • the isolation process loads the context-aware service (ie, an untrusted application)
  • the host process establishes a service stub bound to the context-aware service.
  • the context-aware service When the context-aware service performs the logical processing of the time fence, it needs to access the AlarmManager in the system program; at this time, the isolation process loads a custom class with the same ID as the AlarmManager, so when the isolation process accesses the AlarmManager API, it will The host process sends a request to access the API of the AlarmManager, specifically referring to the relevant description of the embodiment shown in Figure 5; after the host process receives the request of the API of the AlarmManager, it will access the API of the AlarmManager and send the access result to the isolation process, That is, the IPC transposition is completed.
  • the context-aware service in the isolation process returns the response result of the time fence to the client through the host process.
  • the second application example is as follows.
  • the client needs to use the activity recognition snapshot GetBehaviorStatus function of the context awareness service Awareness Kit, which is used to query the current motion status information of the device, such as walking, running, etc.
  • the client pulls up the host process
  • the host process pulls up the isolation process
  • the isolation process loads the context-aware service (ie, an untrusted application)
  • the host process establishes a service stub bound to the context-aware service.
  • the context-aware service needs to access the MSDP service when performing the logical processing of the activity recognition snapshot; at this time, the isolation process will first establish a Binder connection with the process where the MSDP service is located through the host process.
  • the isolated process can access the MSDP service through the host process and send the access result to the isolated process, that is, complete the IPC transfer.
  • the context awareness service in the isolation process returns the running status information of the device queried by the active recognition snapshot to the client through the host process.
  • the embodiments of the present application do not need to obtain the root authority of the Android system, do not need to modify the application framework layer of the Android system and the source code of the untrusted application, construct a permission-controlled operating environment for the untrusted application, and realize all communication with the untrusted application. Effective management of behavior; and, after a large number of tests, the response time of the untrusted application running in the isolated process is not much different from the response time of not running in the isolated process, so the embodiment of the present application can ensure that the untrusted application program. operation with high performance efficiency.
  • an embodiment of the present application further provides an embodiment of an apparatus for managing communication of an untrusted application, including:
  • the transceiver unit 301 is configured to obtain a first request for a first program from a second process, the first request carries at least one request parameter, a first management application program is running in the first process, and an untrusted program is running in the second process application;
  • a processing unit 302 configured to replace the first communication handle in the at least one request parameter with the communication handle of the first management application
  • the transceiver unit 301 is configured to send a second request to a target process, where the second request carries at least one request parameter including a communication handle of a first management application, and the target process runs the first program.
  • the processing unit 302 is further configured to determine the storage location information of the first communication handle in the communication package based on the storage identification bit, and the storage identification bit is used to mark the target storage in the communication package The starting position of the area, and the target storage area is used to store the first communication handle; the first communication handle is obtained based on the storage location information.
  • the first program is a third-party application program
  • the first request is used to request the communication handle of the first program
  • the second request is used to request the communication handle of the first program
  • the first communication handle is an untrusted application program communication handle.
  • the processing unit 302 is further configured to replace the communication handle of the job application management service in the address space corresponding to the second process with the communication handle of the first management application, so that the second process passes the communication handle of the first management application.
  • a first request is sent to the first process.
  • the processing unit 302 is further configured to associate the communication handle of the untrusted application with the communication handle of the first management application.
  • the first program is a third-party application program
  • the first request is used to access the first program
  • the second request is used to access the first program
  • the communication handle of the first program stored in the address space of the second process Communication handle for the first management application.
  • the transceiver unit 301 is further configured to receive the first request for the first program from the second process through the communication handle of the first management application program.
  • a communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application.
  • the transceiver unit 301 is further configured to send the second request to the target process through the communication handle of the first program associated with the communication handle of the first management application program.
  • the first program is a system program
  • the first request is used to access the first program
  • the second request is used to access the first program
  • the processing unit 302 is further configured to add, in the service manager in the address space corresponding to the second process, the communication handle of the first management application and the identifier of the first program, which are used to replace the communication handle of the first program, so that the The second process sends a first request to the first process through the communication handle of the first management application, and at least one request parameter further includes an identifier of the first program.
  • the processing unit 302 is further configured to query, from the service manager in the address space corresponding to the first process, the communication handle of the first program corresponding to the identifier of the first program;
  • the transceiver unit 301 is further configured to send a second request to the target process through the communication handle of the first program.
  • the transceiver unit 301 is further configured to receive a first response to the second request from the target process, where the first response carries at least one response parameter.
  • the processing unit 302 is further configured to replace the second communication handle in the at least one response parameter with the communication handle of the first management application.
  • the transceiver unit 301 is further configured to send a second response to the first request to the second process, where the second response carries at least one response parameter including the communication handle of the first management application.
  • the first program is a third-party application program
  • the first request is used to request the communication handle of the first program
  • the second request is used to request the communication handle of the first program
  • the second communication handle is the communication handle of the first program.
  • processing unit 302 is further configured for the first process to associate the communication handle of the first program with the communication handle of the first management application.
  • the transceiver unit 301 is further configured for the first process to receive a third request from the second process through the communication handle of the first management application, where the third request carries the identifier of the second program and the application of the second program The identifier of the interface API; based on the identifier of the second program in the third request and the identifier of the API of the second program, the API of the second program is accessed.
  • the transceiver unit 301 is further configured to send the access result of the API of the second program to the second process through the communication handle of the untrusted application program.
  • an embodiment of the present application further provides an embodiment of an apparatus for managing communication of an untrusted application, including:
  • the processing unit 401 is used to query the communication handle of the first program from the service manager in the address space corresponding to the second process, and obtain the communication handle of the first management application program and the identifier of the first program, and the first program is a system program ;
  • the transceiver unit 402 is configured to send a first request to the first process through the communication handle of the first management application, and at least one request parameter further includes an identifier of the first program.
  • the processing unit 401 is further configured to load a custom class in the address space of the second process through a custom class loader, where the identifier of the custom class is the same as that of the second program, and the application program of the custom class is the same as that of the second program.
  • the identifier of the interface API is the same as the identifier of the API of the second program, and the API of the custom class is used to make the second process send a third request to the first process through the communication handle of the first management application, and the third request carries the second program
  • the identifier of the second program and the identifier of the API of the second program when the second process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, it accesses the API of the custom class.
  • the transceiver unit 402 is further configured for the second process to send a third request to the first process through the communication handle of the first management application.
  • the terminal can be any terminal device including mobile phone, tablet computer, personal digital assistant (full name in English: Personal Digital Assistant, English abbreviation: PDA), sales terminal (full name in English: Point of Sales, English abbreviation: POS), vehicle-mounted computer, etc. Take the terminal as a mobile phone as an example:
  • FIG. 10 is a block diagram showing a partial structure of a mobile phone related to a terminal provided by an embodiment of the present application.
  • the mobile phone includes: a radio frequency (full name in English: Radio Frequency, English abbreviation: RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (full name in English: wireless fidelity) , English abbreviation: WiFi) module 1070, central processing unit CPU1080, power supply and other components.
  • RF radio frequency
  • the RF circuit 1010 can be used for receiving and sending signals during sending and receiving of information or during a call. In particular, after receiving the downlink information of the base station, it is processed by the CPU 1080; in addition, it sends the designed uplink data to the base station.
  • the RF circuit 1010 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (full name in English: Low Noise Amplifier, English abbreviation: LNA), a duplexer, and the like.
  • the RF circuit 1010 can also communicate with networks and other devices via wireless communication.
  • the above wireless communication can use any communication standard or protocol, including but not limited to Global System for Mobile Communication (English full name: Global System of Mobile communication, English abbreviation: GSM), General Packet Radio Service (English full name: General Packet Radio Service, GPRS ), Code Division Multiple Access (English full name: Code Division Multiple Access, English abbreviation: CDMA), Wideband Code Division Multiple Access (English full name: Wideband Code Division Multiple Access, English abbreviation: WCDMA), Long Term Evolution (English full name: Long Term Evolution, English abbreviation: LTE), e-mail, short message service (full name in English: Short Messaging Service, SMS) and so on.
  • GSM Global System for Mobile Communication
  • GSM Global System of Mobile communication
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • SMS short message service
  • the memory 1020 can be used to store software programs and modules, and the CPU 1080 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 1020 .
  • the memory 1020 may mainly include a stored program area and a stored data area, wherein the stored program area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; Data created by the use of the mobile phone (such as audio data, phone book, etc.), etc. Additionally, memory 1020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 1030 can be used for receiving inputted number or character information, and generating key signal input related to user setting and function control of the mobile phone.
  • the input unit 1030 may include a touch panel 1031 and other input devices 1032 .
  • the touch panel 1031 also referred to as a touch screen, can collect the user's touch operations on or near it (such as the user's finger, stylus, etc., any suitable object or accessory on or near the touch panel 1031). operation), and drive the corresponding connection device according to the preset program.
  • the touch panel 1031 may include two parts, a touch detection device and a touch controller.
  • the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the touch controller.
  • the touch panel 1031 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 1030 may also include other input devices 1032 .
  • other input devices 1032 may include, but are not limited to, one or more of physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 1040 may be used to display information input by the user or information provided to the user and various menus of the mobile phone.
  • the display unit 1040 may include a display panel 1041.
  • a liquid crystal display (English full name: Liquid Crystal Display, English abbreviation: LCD), an organic light-emitting diode (English full name: Organic Light-Emitting Diode, English abbreviation: OLED), etc. form to configure the display panel 1041.
  • the touch panel 1031 can cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it transmits it to the CPU 1080 to determine the type of the touch event, and then the CPU 1080 displays the touch event on the display panel according to the type of the touch event.
  • the corresponding visual output is provided on 1041.
  • the touch panel 1031 and the display panel 1041 are used as two independent components to realize the input and input functions of the mobile phone, in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to form Realize the input and output functions of the mobile phone.
  • the cell phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1041 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1041 and/or when the mobile phone is moved to the ear. or backlight.
  • the accelerometer sensor can detect the magnitude of acceleration in all directions (usually three axes), and can detect the magnitude and direction of gravity when it is stationary. games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors such as gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc. Repeat.
  • the audio circuit 1060, the speaker 1061, and the microphone 1062 can provide an audio interface between the user and the mobile phone.
  • the audio circuit 1060 can convert the received audio data into an electrical signal, and transmit it to the speaker 1061, and the speaker 1061 converts it into a sound signal and outputs it; After receiving, it is converted into audio data, and then the audio data is output to the CPU 1080 for processing, and then sent to, for example, another mobile phone via the RF circuit 1010, or the audio data is output to the memory 1020 for further processing.
  • WiFi is a short-distance wireless transmission technology.
  • the mobile phone can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 1070, which provides users with wireless broadband Internet access.
  • FIG. 10 shows the WiFi module 1070, it can be understood that it is not a necessary component of the mobile phone, and can be completely omitted as required within the scope of not changing the essence of the invention.
  • the CPU 1080 is the control center of the mobile phone, and uses various interfaces and lines to connect various parts of the entire mobile phone. Various functions and processing data for overall monitoring of the mobile phone.
  • the CPU 1080 may include one or more processing units; preferably, the CPU 1080 may integrate an application processor and a modulation and demodulation processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc.
  • the processor mainly handles wireless communication. It can be understood that, the above-mentioned modulation and demodulation processor may not be integrated into the CPU 1080.
  • the mobile phone also includes a power source (such as a battery) for supplying power to various components.
  • a power source such as a battery
  • the power source can be logically connected to the CPU 1080 through a power management system, so as to manage charging, discharging, and power consumption management functions through the power management system.
  • the mobile phone may also include a camera, a Bluetooth module, and the like, which will not be repeated here.
  • the CPU 1080 included in the terminal may run the host process and the isolation process in the foregoing embodiment.
  • Embodiments of the present application further provide a chip including one or more processors. Part or all of the processor is used to read and execute the computer program stored in the memory, so as to execute the method of each embodiment corresponding to FIG. 4 and FIG. 5 .
  • the chip includes a memory, and the memory and the processor are connected to the memory through a circuit or a wire. Further optionally, the chip further includes a communication interface, and the processor is connected to the communication interface.
  • the communication interface is used for receiving data and/or information to be processed, the processor obtains the data and/or information from the communication interface, processes the data and/or information, and outputs the processing result through the communication interface.
  • the communication interface may be an input-output interface.
  • some of the one or more processors may also implement some steps in the above method by means of dedicated hardware, for example, the processing involving the neural network model may be performed by a dedicated neural network processor or graphics processor.
  • the methods provided in the embodiments of the present application may be implemented by one chip, or may be implemented collaboratively by multiple chips.
  • Embodiments of the present application also provide a computer storage medium, where the computer storage medium is used for storing computer software instructions used by the above-mentioned computer device, which includes a program for executing a program designed for the computer device.
  • the computer equipment may include the means for managing communication of untrusted applications as described above with respect to FIGS. 8 and 9 .
  • Embodiments of the present application also provide a computer program product, where the computer program product includes computer software instructions that can be loaded by a processor to implement the flow in the method shown in FIG. 4 or FIG. 5 .
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Stored Programmes (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种管理不可信应用程序通信的方法及相关装置，该方法包括：宿主进程获取来自不可信应用程序对于第一程序的访问请求，将该访问请求中携带的通信句柄替换为第一管理应用程序的通信句柄。因此第一程序仅能通过第一管理应用程序的通信句柄与不可信应用程序进行通信，而无法通过不可信应用程序的通信句柄直接与不可信应用程序通信，避免直接通信导致宿主进程无法起到管理的作用，降低不可信应用程序的运行而导致的隐私数据泄露、操作系统运行异常等风险。

Description

管理不可信应用程序通信的方法及相关装置
本申请要求于2020年11月27日提交的、中国申请号为202011365125.6、发明名称为“管理不可信应用程序通信的方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及计算机技术领域，尤其涉及一种管理不可信应用程序通信的方法及相关装置。
背景技术
安卓(Android)操作系统是当今最流行的移动操作系统之一，许许多多的开发者都基于Android操作系统进行应用程序开发。Android操作系统遵循开源协议，是一种允许第三方厂商基于源代码开发定制化的操作系统，这在一定程度上降低了Android操作系统的安全性。另外，Android操作系统允许用户从第三方渠道安装应用程序，这虽然为用户使用提供了方便，但对于未经测试或不受信任的应用程序，这会增加隐私数据泄露、操作系统运行异常等风险。
因此需要对未经测试或不受信任的应用程序的通信行为进行管理，以降低隐私数据泄露、操作系统运行异常等风险。
发明内容
本申请实施例提供了一种管理不可信应用程序通信的方法及相关装置，能够不可信应用程序运行时降低隐私数据泄露、操作系统运行异常等风险。
本申请实施例第一方面提供了一种管理不可信应用程序通信的方法，包括：第一进程获取来自第二进程对于第一程序的第一请求，该第一程序可以是Android系统程序，也可以第三方应用程序；第一请求可以是对第三应用程序的访问请求，也可以是与第一程序建立通信连接的请求，且携带至少一个请求参数，第一进程中运行有第一管理应用程序，第二进程中运行有不可信应用程序；基于至少一个请求参数包含第一通信句柄，第一进程将至少一个请求参数中的第一通信句柄替换为第一管理应用程序的通信句柄；然后第一进程向目标进程发送对于第一程序的第二请求，第二请求中携带包含第一管理应用程序的通信句柄的至少一个请求参数，目标进程中运行有第一程序。
第一进程获取第一请求，并将第一请求携带的请求参数中包含的不可信应用程序的通信句柄，替换位第一进程中第一管理应用程序的通信句柄，然后向目标进程发送携带第一管理应用程序的通信句柄的第二请求；这样，目标进程获取到的通信句柄为第一管理应用程序的通信句柄，而不是不可信应用程序的通信句柄，所以目标进程仅能通过第一管理应用程序的通信句柄与第一进程进行通信，而无法通过不可信应用程序的通信句柄与第二进程通信，从而防止目标进程与第二进程直接通信而导致第一进程无法起到管理的作用，从 而降低不可信应用程序的运行导致隐私数据泄露、操作系统运行异常等风险。
作为一种可实现的方式，第一请求包含于通信包裹中，其中，通信包裹可以看成一种序列化的方式；在第一进程获取来自第二进程对于第一程序的第一请求之后，在基于至少一个请求参数包含第一通信句柄第一进程将至少一个请求参数中的第一通信句柄替换为第一管理应用程序的通信句柄之前，方法还包括：第一进程基于存储标识位确定第一通信句柄在通信包裹中的存储位置信息，存储标识位用于标记通信包裹中目标存储区域的起始位置，目标存储区域用于存储第一通信句柄；第一进程基于存储位置信息获取第一通信句柄。
在该实现方式提供了从通信包裹中解析得到第一通信句柄的一种可行方案，适用于第一请求包含于通信包裹的场景。
作为一种可实现的方式，第一程序为第三方应用程序，第一请求用于请求第一程序的通信句柄，第二请求用于请求第一程序的通信句柄，第一通信句柄为不可信应用程序的通信句柄；在第一进程获取来自第二进程对于第一程序的第一请求之前，方法还包括：第一进程将第二进程对应的地址空间中应用管理服务的通信句柄替换为第一管理应用程序的通信句柄，以使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求，其中，在Android系统中，应用管理服务用于进程间管理，当第二进程需要向目标进程发送第一请求时，需要先向应用管理服务发送该第一请求，然后由应用管理服务将第一请求转发至第一程序所在的目标进程。
由于第一进程将第二进程对应的地址空间中应用管理服务的通信句柄替换为第一管理应用程序的通信句柄，所以第二进程便会将第一管理应用程序的通信句柄作为应用管理服务的通信句柄；这样，当第二进程要向第一程序所在的目标进程发送第一请求时，第二进程会通过第一管理应用程序的通信句柄向第一进程发送第一请求；第一进程在接收到第一请求后，会向目标进程发送用于建立通信连接的第二请求，以建立第一进程与目标进程之间的通信连接，从而实现第一进程对第二进程与目标进程建立通信连接的过程的管理；并且，在通信连接建立后，第二进程与目标进程之间传递的消息需要经过第一进程转发，实现了第一进程对第二进程通信的管理，降低隐私数据泄露、操作系统运行异常等风险。
作为一种可实现的方式，在第一进程获取来自第二进程对于第一程序的第一请求之后，方法还包括：第一进程将不可信应用程序的通信句柄与第一管理应用程序的通信句柄关联。
由于不可信应用程序的通信句柄与第一管理应用程序的通信句柄关联，所以目标进程在通过第一管理应用程序的通信句柄第一进程发送消息后，第一进程可以根据第一管理应用程序的通信句柄确定不可信应用程序的通信句柄，然后通过不可信应用程序的通信句柄向第二进程发送该消息，从而实现消息的转发，且避免第一进程通过除不可信应用程序外的其他程序的通信句柄发送该消息导致消息发送错误。
作为一种可实现的方式，第一程序为第三方应用程序，第一请求用于访问第一程序，第二请求用于访问第一程序；第二进程的地址空间中存储的第一程序的通信句柄为第一管理应用程序的通信句柄；第一进程获取来自第二进程对于第一程序的第一请求包括：第一进程通过第一管理应用程序的通信句柄接收来自第二进程对于第一程序的第一请求。
由于第二进程的地址空间中存储的第一程序的通信句柄为第一管理应用程序的通信句 柄，所以第二进程通过第一管理应用程序的通信句柄发送访问第一程序的请求，第一进程在接收到第一请求后，代理第二进程对目标进程中的第一程序进行访问，从而实现了第一进程对不可信应用程序访问第三方应用程序的过程进行管理。
作为一种可实现的方式，第一进程的地址空间中存储有第一程序的通信句柄，且第一程序的通信句柄与第一管理应用程序的通信句柄关联；第一进程向目标进程发送对于第一程序的第二请求包括：第一进程通过与第一管理应用程序的通信句柄关联的第一程序的通信句柄，向目标进程发送第二请求。
基于第一程序的通信句柄与第一管理应用程序的通信句柄的关联关系，宿主可以确定与第一管理应用程序的通信句柄关联的第一程序的通信句柄，并在第二进程通过第一管理应用程序的通信句柄向第一进程发送一请求后，通过与第一管理应用程序的通信句柄关联的第一程序的通信句柄发送第二请求，且避免第一进程通过除第一程序外的其他程序的通信句柄发送该第二请求导致第二请求发送错误。
作为一种可实现的方式，第一程序为系统程序，该系统程序是指Android系统程序，具体可以包括剪贴板程序、行动热点WIFI等系统程序，第一请求用于访问第一程序，第二请求用于访问第一程序；在第一进程获取来自第二进程对于第一程序的第一请求之前，方法还包括：第一进程在第二进程对应的地址空间中的服务管理器中，添加用于代替第一程序的通信句柄的第一管理应用程序的通信句柄和第一程序的标识，以使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
由于第一进程在第二进程对应的地址空间中的服务管理器中，添加用于代替第一程序的通信句柄的第一管理应用程序的通信句柄和第一程序的标识，所以第二进程会通过第一管理应用程序的通信句柄向第一进程发送用于访问第一程序的第一请求，这样，第一进程便可以代理第二进程对目标进程中的第一程序进行访问，从而实现第一进程对不可信应用程序访问系统程序的管理。
作为一种可实现的方式，在第一进程获取来自第二进程对于第一程序的第一请求之后，在第一进程向目标进程发送对于第一程序的第二请求之前，方法还包括：第一进程从第一进程对应的地址空间中的服务管理器中查询，第一程序的标识对应的第一程序的通信句柄；第一进程向目标进程发送第二请求包括：第一进程通过第一程序的通信句柄向目标进程发送第二请求。
该实现方式提供了第一进程发送第二请求的一种具体方案。
作为一种可实现的方式，在第一进程向目标进程发送第二请求之后，方法还包括：第一进程接收来自目标进程的对于第二请求的第一响应，第一响应中携带至少一个响应参数；基于至少一个响应参数包含第二通信句柄，第一进程将至少一个响应参数中的第二通信句柄替换为第一管理应用程序的通信句柄；第一进程向第二进程发送对于第一请求的第二响应，第二响应中携带包含第一管理应用程序的通信句柄的至少一个响应参数。
第一进程获取来自目标进程的第二响应，并将第二响应携带的响应参数中的第二通信句柄替换为第一管理应用程序的通信句柄，然后向第二进程发送携带第一管理应用程序的 通信句柄；这样，第二进程只能接收到第一管理应用程序的通信句柄，而不会接收到不同于第一管理应用程序的通信句柄的第二通信句柄，以避免第二进程通过第二通信句柄与第一进程外的其他进程直接通信而导致第一进程无法起到管理的作用，从而降低不可信应用程序的运行导致隐私数据泄露、操作系统运行异常等风险。
作为一种可实现的方式，第一程序为第三方应用程序，第一请求用于请求第一程序的通信句柄，第二请求用于请求第一程序的通信句柄，第二通信句柄为第一程序的通信句柄；在第一进程接收来自目标进程的对于第二请求的第一响应之后，方法还包括：第一进程将第一程序的通信句柄与第一管理应用程序的通信句柄关联。
由于第一程序的通信句柄与第一管理应用程序的通信句柄关联，所以第二进程在通过第一管理应用程序的通信句柄第一进程发送消息后，第一进程可以根据第一管理应用程序的通信句柄确定第一程序的通信句柄，然后通过第一程序的通信句柄向第二进程发送该消息，从而实现消息的转发，且避免第一进程通过除第一程序外的其他程序的通信句柄发送该消息导致消息发送错误。
作为一种可实现的方式，方法还包括：第一进程通过第一管理应用程序的通信句柄接收来自第二进程的第三请求，第三请求携带第二程序的标识和第二程序的应用程序接口API的标识；第一进程基于第三请求中第二程序的标识和第二程序的API的标识，访问第二程序的API，其中，第二程序主要是指通信句柄未存储于服务管理器中而导致无法通过Binder机制直接访问的系统程序，例如可以是闹钟服务AlarmManager、音频管理器AudioManager等。
在该实现方式中，第一进程接收用于访问第二程序的API的第三请求，适用于第二程序的通信句柄未存储于服务管理器中而导致无法通过Binder机制直接访问的场景。
作为一种可实现的方式，方法还包括：第一进程通过不可信应用程序的通信句柄向第二进程发送，第二程序的API的访问结果。
在该实现方式中，第一进程代理第二进程访问第二程序的API，从而实现对不可信应用程序访问第二程序的API的过程的管理。
本申请实施例第二方面提供了一种管理不可信应用程序通信的方法，包括：第二进程从第二进程对应的地址空间中的服务管理器中查询第一程序的通信句柄，得到第一管理应用程序的通信句柄和第一程序的标识，第一程序为系统程序；第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求，第一请求用于访问所述第一程序，至少一个请求参数中还包含第一程序的标识。
由于第二进程查询到的是第一管理应用程序的通信句柄，而不是第一程序的通信句柄，所以当第二进程需要访问第一程序时，第二进程会通过第一管理应用程序的通信句柄向第一进程发送第一请求，从而实现第一进程对不可信应用程序访问通信句柄存储于服务管理器中的系统程序的管理。
作为一种可实现的方式，方法还包括：第二进程通过自定义类加载器在第二进程的地址空间中加载自定义类，自定义类的标识与第二程序的标识相同，自定义类的应用程序接口API的标识与第二程序的API的标识相同，自定义类的API用于使得第二进程通过第一 管理应用程序的通信句柄向第一进程发送第三请求，第三请求携带第二程序的标识和第二程序的API的标识；当第二进程基于第二程序的标识以及第二程序的API的标识访问第二程序的API时，第二进程访问自定义类的API；第二进程通过第一管理应用程序的通信句柄向第一进程发送第三请求。
由于自定义类的标识与第二程序的标识相同，所以第二进程在访问第二程序时，第二进程会访问自定义类；又由于自定义类的API的标识与第二程序的API的标识相同，所以当第二进程访问第二程序的API时，第二进程会访问自定义类的API；第二进程访问自定义类的API导致第二进程通过第一管理应用程序的通信句柄向第一进程发送第三请求，从而实现第一进程对不可信应用程序访问第二程序的API的过程进行管理。
本申请实施例第三方面提供了一种管理不可信应用程序通信的装置，包括：
收发单元，用于获取来自第二进程对于第一程序的第一请求，第一请求中携带至少一个请求参数，第一进程中运行有第一管理应用程序，第二进程中运行有不可信应用程序；
处理单元，用于基于至少一个请求参数包含第一通信句柄proxy，将至少一个请求参数中的第一通信句柄替换为第一管理应用程序的通信句柄；
收发单元，用于向目标进程发送第二请求，第二请求中携带包含第一管理应用程序的通信句柄的至少一个请求参数，目标进程中运行有第一程序。
作为一种实现方式，第一请求包含于通信包裹中；处理单元还用于基于存储标识位确定第一通信句柄在通信包裹中的存储位置信息，存储标识位用于标记通信包裹中目标存储区域的起始位置，目标存储区域用于存储第一通信句柄；基于存储位置信息获取第一通信句柄。
作为一种实现方式，第一程序为第三方应用程序，第一请求用于请求第一程序的通信句柄，第二请求用于请求第一程序的通信句柄，第一通信句柄为不可信应用程序的通信句柄。
相应地，处理单元还用于将第二进程对应的地址空间中应用管理服务的通信句柄替换为第一管理应用程序的通信句柄，以使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求。
作为一种实现方式，处理单元还用于将不可信应用程序的通信句柄与第一管理应用程序的通信句柄关联。
作为一种实现方式，第一程序为第三方应用程序，第一请求用于访问第一程序，第二请求用于访问第一程序；第二进程的地址空间中存储的第一程序的通信句柄为第一管理应用程序的通信句柄。
相应地，收发单元还用于通过第一管理应用程序的通信句柄接收来自第二进程对于第一程序的第一请求。
作为一种实现方式，第一进程的地址空间中存储有第一程序的通信句柄，且第一程序的通信句柄与第一管理应用程序的通信句柄关联。
相应地，收发单元还用于通过与第一管理应用程序的通信句柄关联的第一程序的通信句柄，向目标进程发送第二请求。
作为一种实现方式，第一程序为系统程序，第一请求用于访问第一程序，第二请求用于访问第一程序；
处理单元还用于在第二进程对应的地址空间中的服务管理器中，添加用于代替第一程序的通信句柄的第一管理应用程序的通信句柄和第一程序的标识，以使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
作为一种实现方式，处理单元还用于从第一进程对应的地址空间中的服务管理器中查询，第一程序的标识对应的第一程序的通信句柄；
收发单元还用于通过第一程序的通信句柄向目标进程发送第二请求。
作为一种实现方式，收发单元还用于接收来自目标进程的对于第二请求的第一响应，第一响应中携带至少一个响应参数。
处理单元还用于基于至少一个响应参数包含第二通信句柄，将至少一个响应参数中的第二通信句柄替换为第一管理应用程序的通信句柄。
收发单元还用于向第二进程发送对于第一请求的第二响应，第二响应中携带包含第一管理应用程序的通信句柄的至少一个响应参数。
作为一种实现方式，第一程序为第三方应用程序，第一请求用于请求第一程序的通信句柄，第二请求用于请求第一程序的通信句柄，第二通信句柄为第一程序的通信句柄。
相应地，处理单元还用于第一进程将第一程序的通信句柄与第一管理应用程序的通信句柄关联。
作为一种实现方式，收发单元还用于第一进程通过第一管理应用程序的通信句柄接收来自第二进程的第三请求，第三请求携带第二程序的标识和第二程序的应用程序接口API的标识；基于第三请求中第二程序的标识和第二程序的API的标识，访问第二程序的API。
作为一种实现方式，收发单元还用于通过不可信应用程序的通信句柄向第二进程发送，第二程序的API的访问结果。
其中，以上各单元的具体实现、相关说明以及技术效果请参考本申请实施例第一方面的描述。
本申请实施例第四方面还提供了一种管理不可信应用程序通信的装置，包括：
处理单元，用于从第二进程对应的地址空间中的服务管理器中查询第一程序的通信句柄，得到第一管理应用程序的通信句柄和第一程序的标识，第一程序为系统程序；
收发单元，用于通过第一管理应用程序的通信句柄向第一进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
作为一种实现方式，处理单元还用于通过自定义类加载器在第二进程的地址空间中加载自定义类，自定义类的标识与第二程序的标识相同，自定义类的应用程序接口API的标识与第二程序的API的标识相同，自定义类的API用于使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第三请求，第三请求携带第二程序的标识和第二程序的API的标识；当第二进程基于第二程序的标识以及第二程序的API的标识访问第二程序的API时，访问自定义类的API。
收发单元还用于第二进程通过第一管理应用程序的通信句柄向第一进程发送第三请求。
其中，以上各单元的具体实现、相关说明以及技术效果请参考本申请实施例第二方面的描述。
本申请实施例第五方面提供了一种终端设备，包括：一个或多个处理器和存储器；其中，所述存储器中存储有计算机可读指令；所述一个或多个处理器读取所述计算机可读指令，以使所述计算机设备实现如第一方面任一实现方式所述的方法。
本申请实施例第六方面提供了一种终端设备，包括：一个或多个处理器和存储器；其中，所述存储器中存储有计算机可读指令；所述一个或多个处理器读取所述计算机可读指令，以使所述计算机设备实现如第二方面任一实现方式所述的方法。
本申请实施例第七方面提供了一种计算机可读存储介质，包括计算机可读指令，当所述计算机可读指令在计算机上运行时，使得所述计算机执行如第一方面或第二方面任一实现方式所述的方法。
本申请实施例第八方面提供了一种芯片，包括一个或多个处理器。所述处理器中的部分或全部用于读取并执行存储器中存储的计算机程序，以执行上述第一方面或第二方面任意可能的实现方式中的方法。
可选地，该芯片该包括存储器，该存储器与该处理器通过电路或电线与存储器连接。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理，并通过该通信接口输出处理结果。该通信接口可以是输入输出接口。
在一些实现方式中，所述一个或多个处理器中还可以有部分处理器是通过专用硬件的方式来实现以上方法中的部分步骤，例如涉及神经网络模型的处理可以由专用神经网络处理器或图形处理器来实现。
本申请实施例提供的方法可以由一个芯片实现，也可以由多个芯片协同实现。
本申请实施例第九方面提供了一种计算机程序产品，该计算机程序产品包括计算机软件指令，该计算机软件指令可通过处理器进行加载来实现上述第一方面中任意一种实现方式所述的方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
第一进程获取第一请求，并将第一请求携带的请求参数中包含的不可信应用程序的通信句柄，替换为第一进程中第一管理应用程序的通信句柄，然后向目标进程发送携带第一管理应用程序的通信句柄的第二请求；这样，目标进程获取到的通信句柄为第一管理应用程序的通信句柄，而不是不可信应用程序的通信句柄，所以目标进程仅能通过第一管理应用程序的通信句柄与第一进程进行通信，而无法通过不可信应用程序的通信句柄与第二进程通信，从而防止目标进程与第二进程直接通信而导致第一进程无法起到管理的作用，从而降低不可信应用程序的运行导致隐私数据泄露、操作系统运行异常等风险。
附图说明
图1为本申请实施例中的系统架构示意图；
图2为Binder机制的示意图；
图3为本申请实施例中方法所对应的框架示意图；
图4为本申请实施例中管理不可信应用程序通信的方法的一个实施例示意图；
图5为本申请实施例中管理不可信应用程序通信的方法的另一个实施例示意图；
图6为本申请实施例中第一应用例的示意图；
图7为本申请实施例中第二应用例的示意图；
图8为本申请实施例中管理不可信应用程序通信的装置的一个实施例示意图；
图9为本申请实施例中管理不可信应用程序通信的装置的另一个实施例示意图；
图10为本申请实施例中终端设备的实施例示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间或逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。
本申请实施例可以应用于图1所示的系统架构中。如图1所示，该系统位于安卓Android环境中，具体包括隔离进程、宿主进程、第三方应用程序和Android系统程序。
进程是指程序的运行实体。程序是指令、数据及其组织形式的描述，进程是程序的运行实体。一个进程中可以并发多个线程，每条线程并行执行不同的任务。线程可以是进程的实际运作单位，但本申请实施例不对线程和进程进行明确区分，描述过程中都用进程代替。
隔离进程Isolated Process是Android系统中的一种“无权限”的特殊进程，运行在隔离进程中的应用程序，无法与外界环境(包括图1所示的Android系统程序和第三方应用程序)进行直接通信，仅能通过宿主进程与外界环境进行通信，从而为应用程序提供了一个沙箱环境。沙箱Sandbox也称为沙盒，是指一种安全机制，为运行中的应用程序提供隔离环境。
宿主进程Host Process是Android系统中的常规进程，用于与隔离进程建立连接，管 理和代理隔离进程与外界环境的通信行为。
Android系统程序是指控制和协调Android设备及外部设备，支持应用软件开发和运行的系统，是无需用户干预的各种程序的集合。
第三方应用程序是和系统软件相对应的，是用户可以使用的各种程序设计语言，以及用各种程序设计语言编制的程序的集合，分为应用软件包和用户程序。
为了降低未经测试或不受信任的应用程序(下文称为不可信应用程序)运行所导致的风险，可以将不可信应用程序运行在图1所示的隔离进程中，将第一管理应用程序运行在图1所示的宿主进程中。宿主进程与隔离进程建立连接，此后，宿主进程会接收隔离进程对外的所有访问请求，然后对该访问请求进行安全性校验。
对于安全性校验结果满足要求的访问请求，宿主进程将根据该访问请求代理隔离进程中不可信应用程序完成访问，并将访问结果回传给隔离进程中的不可信应用程序；对于安全性校验结果不满足要求的访问请求，宿主进程将终止该访问请求。这样，宿主进程便可以起到管理和代理隔离进程与外界环境通信的作用。
应理解，无论是Android系统程序，还是第三方应用程序，都运行在相应的进程中。因此，不可信应用程序与外界环境的通信过程属于进程间通信(Inter-Process Communication，IPC)。
IPC可以通过多种方式实现。例如，两个进程之间可以通过通信句柄进行通信，该通信句柄也可以称为跨进程通信句柄。
在Android系统中，该通信句柄可以为Ibinder；当通信句柄为Ibinder时，则两个进程之间通过Binder机制实现通信。下面以程序A和程序B为例，对Binder机制进行介绍。其中，程序A可以是Android系统程序，也可以是第三方应用程序；同样地，程序B可以是Android系统程序，也可以是第三方应用程序。
如图2所示，程序A可以向Binder驱动申请在程序A所在的进程中创建一个Binder，该Binder又可以称为Binder实体、本地对象；同样地，程序B可以向Binder驱动申请在程序B所在的进程中创建一个Binder，该Binder又可以称为Binder实体、本地对象。
若程序A与程序B要通过Binder机制进行通信，则程序A和程序B首先要建立Binder连接。建立Binder连接可以理解为：程序A获取到程序B的IBinder，程序B获取到程序A的IBinder；其中，IBinder又可以称为IBinder引用、远程对象、Binder代理proxy，为了便于描述，下文用Binder代理代替IBinder。
其中，IBinder定义了一种可远程调用对象的基本接口，该基本接口描述了与可远程调用对象进行交互的抽象协议；Binder是可远程调用对象的基类，是IBinder的实现类，提供了IBinder这类对象的标准本地实现。
当程序A发起对程序B的访问时，则程序A可以通过程序B的Binder代理对程序B发起访问，访问过程可以理解为：程序A通过程序B的Binder代理向Binder驱动发送访问请求，Binder驱动处理该访问请求，并分配两个缓冲区Buffer，其中一个缓冲区用于写入访问请求中的参数，且程序B可以从该缓冲区内读取访问请求的参数；另一个缓冲区用于写入来自程序B的访问响应中的参数，且程序A可以从该缓冲区内读取访问响应的参数。
同样地，当程序B发起对程序A的访问时，则程序B可以通过程序A的Binder代理对程序A发起访问，访问过程可参照上述程序A访问程序B的过程进行理解。
基于上述说明可知，任意两个能够通过Binder机制通信的程序，在获取到双方的Binder代理后，便可以直接通过Binder代理与对方通信。
那么，对于不可信应用程序来说，若不可信应用程序获取到除宿主进程中第一管理应用程序外的其他程序的Binder代理，则不可信应用程序可以直接通过Binder代理与其他程序直接进行通信，这意味着宿主进程则无法对隔离进程的通信行为进行管理，从而会增加不可信应用程序运行所导致的风险。
为此，本申请实施例提供了一种方法，该方法使得宿主进程在代理隔离进程访问的过程中，获取来自隔离进程的请求，并替换该请求中的Binder代理；该方法还使得宿主进程获取向隔离进程发送的响应，并替换该请求中的Binder代理，以防止隔离进程获取到其他应用程序的Binder代理，从而降低不可信应用程序运行所导致的风险。
在介绍本申请实施例提供的方法前，先对本申请实施例中涉及的其他专业术语进行说明。
Parcel是一种消息容器，经过该消息容器打包的消息(包括数据和对象引用)可通过IBinder机制进行传递。
钩子Hook技术是一系列计算机编程技术，这一系列的技术通过截获在软件组件之间传递的函数调用或消息或事件，来更改或增强操作系统、应用程序或其他软件组件的行为。
服务管理器(ServiceManager)是Android系统中一个重要的类，用于管理所有的Android系统程序，维护着Android系统程序和第三方应用程序的Binder通信。
应用管理服务(ActivityManagerService)又可以称为作业管理应用程序，是Android系统组件的核心服务，负责了系统中四大组件(Activity、Service、BroadcastReceiver、ContentProvider)的启动、切换、调度以及进程管理和调度工作。
PackageManagerService：Android系统组件的核心服务，负责所有跟Package相关的工作，比如应用安装、卸载等。
下面对本申请实施例提供的方法进行介绍。
为了便于理解，下文以Android系统为例对本申请实施例提供的方法进行说明，并将Binder机制作为进程间通信的方式，相应地，采用Binder代理代替通信句柄。
需要说明的是，本申请实施例提供的方法所应用的系统不限于Android系统。
另外，本申请实施例提供的方法应用于目标进程、第一进程和第二进程，其中，第一进程为用于管理不可信应用通信的进程，第二进程为运行不可信应用的进程，目标进程为运行第一程序的进程；为了便于说明，下文采用宿主进程代替第一进程，采用隔离进程代替第二进程。
请参阅图3，图3示出了本申请实施例提供的方法所对应的框架示意图。
如图3所示，在Android系统环境中，客户端对不可信应用程序进行访问，该客户端可以为任一第三方应用程序对应的客户端。
客户端访问不可信应用程序的过程可以包括不可信应用程序加载过程、不可信应用程 序的生命周期管理过程以及不可信应用程序的运行过程。
不可信应用程序加载过程如下。
首先，客户端拉起宿主进程，宿主进程中运行有第一管理应用程序；然后，宿主进程拉起隔离进程，隔离进程加载第二管理应用程序；接着第一管理应用程序通过Binder机制与第二管理应用程序建立连接，即第一管理应用程序获取到第二管理应用程序的Binder代理，第二管理应用程序获取到第一管理应用程序的Binder代理；接着，第一管理应用程序通过第二管理应用程序，将不可信应用程序加载到隔离进程中。由于当客户端访问不可信应用程序时，所以不可信应用程序的加载属于动态加载。
将不可信应用程序加载到隔离进程中的过程可以包括：通过自定义类加载器从不可信应用程序的存储路径下将该不可信应用程序加载到隔离进程中，其中，自定义类加载器可以采用覆写loadClass的方法或findClass的方法。
通过上述方式加载不可信应用程序，能够解决隔离进程中的不可信应用程序无法被Android系统的PackageManagerService管理和安装的问题。
需要说明的是，客户端对于不可信应用程序是否运行在隔离进程提供的沙箱环境中是无感知的。
不可信应用程序的生命周期管理过程如下。
考虑到不可信应用程序未注册在Android系统的应用管理服务中,所以宿主进程不能直接对不可信应用程序的生命周期进行管理。因此，在本申请实施例中，通过应用管理服务创建一个服务桩，该服务桩可以看成一个应用程序，该服务桩的生命周期的函数与不可信应用程序的生命周期的函数存在对应关系。这样，宿主进程便可以通过对服务桩的生命周期的管理实现对不可信应用程序的生命周期的管理。
上述两个过程完成后，不可信应用程序便可以运行，在不可信应用运行过程中，则可以使用本申请实施例提供的方法对不可信应用程序的通信行为进行管理。具体地，请参阅图4，本申请实施例提供了一种管理不可信应用程序通信的方法的一个实施例，包括：
步骤101，宿主进程获取来自隔离进程对于第一程序的第一请求，第一请求中携带至少一个请求参数，宿主进程中运行有第一管理应用程序，隔离进程中运行有不可信应用程序。
第一程序作为第一请求的请求对象，该请求对象可以是Android系统程序，也可以第三方应用程序。
第一请求的种类与第一程序相关。
具体地，当第一程序为Android系统程序时，第一请求通常为对Android系统程序的访问请求。
当第一程序为第三方应用程序时，第一请求可以是对第三应用程序的访问请求，也可以是与第一程序建立Binder连接的请求；当第一请求是与第一程序建立Binder连接的请求时，第一请求用于请求第一程序的Binder代理。
第一请求的传输形式也可以有多种，本申请实施例对此不做具体限定。例如，可以对第一请求进行打包，得到包含第一请求的通信包裹，从而通过传输通信包裹实现对第一请 求的传输，其中，该通信包裹又可以称为跨进程通信包裹，具体可以为Parcel对象，Parcel对象可以看成一种序列化的方式。相应地，宿主进程获取到的第一请求则包含于Parcel对象中。
第一请求中的请求参数的种类和数量都与第一请求的种类相关，本申请实施例对的第一请求中请求参数的种类和数量均不做具体限定。
基于上述说明可知，第一程序的种类可以有多种，第一请求的种类也可以有多种，而宿主进程获取第一请求的场景与第一程序的种类和第一请求的种类相关，所以宿主进程获取第一请求的场景也可以有多种，下文会对宿主进程获取第一请求的场景进行具体介绍。
步骤102，宿主进程基于存储标识位确定第一Binder代理在通信包裹中的存储位置信息，存储标识位用于标记通信包裹中目标存储区域的起始位置，目标存储区域用于存储第一Binder代理。
基于步骤101的相关说明可知，第一请求可以包含于通信包裹中，此时，则可以通过步骤102和103从第一请求中获取第一Binder代理。
应理解，对于Binder代理来说，通常存储于通信包裹的某一固定的目标存储区域中，该目标存储区域的起始位置是用存储标识位标识的，该存储标识位可以存储于Native层。所以，宿主进程可以根据该存储标识位确定第一Binder代理在通信包裹中的存储位置信息。
具体地，从存储标识位所标识的位置开始，以四字节位为间隔，遍历目标存储区域以查找第一Binder代理在通信包裹中的存储位置信息。
步骤103，宿主进程基于存储位置信息获取第一Binder代理。
在查找第一Binder代理在通信包裹中的存储位置信息后，宿主进程便可以基于该存储位置信息从通信包裹中读取第一Binder代理。
需要说明的是，步骤102和步骤103是在步骤101之后，在步骤104之前执行的；并且，只有当第一请求包含于通信包裹中，才能够通过步骤102和步骤103获取第一Binder代理，因此步骤102和步骤103是可选的。
步骤104，宿主进程将至少一个请求参数中的第一Binder代理替换为第一管理应用程序的Binder代理。
实际实现中，第一binder代理与第一管理应用程序的binder代理是不同的，所以可以直接执行替换操作，但也可以在步骤104之前增加判断步骤，当判断二者不同时，再执行替换。
基于Binder机制的相关说明可知，若隔离进程获取到除第一管理应用程序之外其他程序的Binder代理，则隔离进程可以直接通过其他程序的Binder代理与其他进程直接进行通信；同样地，若第一程序所在的目标进程获取到了不可信应用程序的Binder代理，则目标进程也可以通过不可信应用程序的Binder代理与隔离进程直接进行通信。
因此，在本申请实施例中，宿主进程对第一请求中的第一Binder代理进行替换；具体地，宿主进程将第一Binder代理替换为第一管理应用程序的Binder代理，使得第一程序所在的目标进程仅能获取到第一管理应用程序的Binder代理。
当第一请求包含于通信包裹中，宿主进程将第一Binder代理替换为第一管理应用程序的Binder代理的过程可以包括：将步骤103中的存储位置信息所指示的存储位置中的第一Binder代理，替换为第一管理应用程序的Binder代理；由于通信包裹又可以为Parcel对象，所以如图3所示，该过程又可以称为Parcel对象语义替换。
需要说明的是，第一Binder代理可以是不可信应用程序的Binder代理，也可以是除不可信应用程序的Binder代理以及第一管理应用程序的Binder代理之外的，其他程序的Binder代理，本申请实施例对此不做具体限定。
步骤105，宿主进程向目标进程发送对于第一程序的第二请求，第二请求中携带包含第一管理应用程序的Binder代理的至少一个请求参数，目标进程中运行有第一程序。
可以理解的是，宿主进程的作用是代理隔离进程对目标进程进行访问，所以除Binder代理之外，第二请求中的参数与第一请求中的参数相同。
在本申请实施例中，宿主进程获取第一请求，并将第一请求携带的请求参数中包含的不可信应用程序的Binder代理，替换位宿主进程中第一管理应用程序的Binder代理，然后向目标进程发送携带第一管理应用程序的Binder代理的第二请求；这样，目标进程获取到的Binder代理为第一管理应用程序的Binder代理，而不是不可信应用程序的Binder代理，所以目标进程仅能通过第一管理应用程序的Binder代理与宿主进程进行通信，而无法通过不可信应用程序的Binder代理与隔离进程通信，从而防止目标进程与隔离进程直接通信而导致宿主进程无法起到管理的作用，从而降低不可信应用程序的运行导致隐私数据泄露、操作系统运行异常等风险。
步骤106，宿主进程接收来自目标进程的对于第二请求的第一响应，第一响应中携带至少一个响应参数。
可以理解的是，在执行步骤105后，目标进程可以向宿主进程发送与第二请求对应的第一响应，相应地，宿主进程则会接收到该响应。
基于步骤101的相关说明可知，第一请求的种类可以由多种，而第一响应的种类与第一请求的种类对应，所以第一响应的种类也可以有多种，具体请参阅第一请求的相关说明进行理解。
响应参数与第一请求中的请求参数相关，与请求参数类似，本申请实施例对响应参数的种类和数量也不做具体限定。
步骤107，宿主进程将至少一个响应参数中的第二Binder代理替换为第一管理应用程序的Binder代理。
基于步骤104的相关说明可知，第一请求中的请求参数可能包含不同于第一管理应用程序的Binder代理的第一Binder代理，同理，响应参数中也可能包含不同于第一管理应用程序的Binder代理的第二Binder代理；当响应参数中包含不同于第一管理应用程序的Binder代理的第二Binder代理时，宿主进程会将第二Binder代理替换为第一管理应用程序的Binder代理。
其中，第二Binder代理可以为第一程序的Binder代理，也可以为除第一程序的Binder代理以及宿主进程的Binder代理外的其他程序的Binder代理，本申请实施例对此不做具 体限定。
例如，第一程序为程序C，第二Binder代理可以为程序C的Binder代理，也可以是程序D的Binder代理，即响应参数可以指示隔离进程通过程序D的Binder代理，访问程序D所在的进程。
步骤108，宿主进程向隔离进程发送对于第一请求的第二响应，第二响应中携带包含第一管理应用程序的Binder代理的至少一个响应参数。
第二响应与第一响应之间的关系，类似于第二请求与第一请求之间的关系，具体可参照前述第二请求和第一请求的相关说明进行理解。
需要说明的是，对于某种类型的第二请求，目标进程可能不会向宿主进程发送第一响应，相应地，宿主进程也不会向隔离进程发送第二响应；例如，若第一请求用于请求第一程序播放音频，同样地，第二请求也用于请求第一程序播放音频，那么目标进程在接收到第二请求后，则会执行播放音频的操作，并不会向宿主进程发送第一响应。
因此，步骤106至步骤108是可选的，适用于目标进程向宿主进程发送第二响应的场景。
在本申请实施例中，宿主进程获取来自目标进程的第二响应，并将第二响应携带的响应参数中的第二Binder代理替换为第一管理应用程序的Binder代理，然后向隔离进程发送携带第一管理应用程序的Binder代理；这样，隔离进程只能接收到第一管理应用程序的Binder代理，而不会接收到不同于第一管理应用程序的Binder代理的第二Binder代理，以避免隔离进程通过第二Binder代理与宿主进程外的其他进程直接通信而导致宿主进程无法起到管理的作用，从而降低不可信应用程序的运行导致隐私数据泄露、操作系统运行异常等风险。
基于前述说明可知，宿主进程获取第一请求的场景可以有多种，下面介绍宿主进程获取第一请求的三种场景。
宿主进程获取第一请求的第一种场景：隔离进程发送第一请求，以请求建立与目标进程之间的Binder连接。
相应地，第一程序为第三方应用程序，第一请求用于请求第一程序的Binder代理，第二请求用于请求第一程序的Binder代理，第一Binder代理为不可信应用程序的Binder代理。
应理解，在Android系统中，应用管理服务用于进程间管理，所以当隔离进程需要与其他进程通信时，需要经过应用管理服务与其他进程进行通信；即当隔离进程需要向目标进程发送第一请求时，需要先向应用管理服务发送该第一请求，然后由应用管理服务将第一请求转发至第一程序所在的目标进程。
而在本申请实施例中，为了实现宿主进程对隔离进程通信的管理，在步骤101之前，方法还可以包括：
宿主进程将隔离进程对应的地址空间中应用管理服务的Binder代理替换为第一管理应用程序的Binder代理，以使得隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第一请求。
在本申请实施例中，由于宿主进程将隔离进程对应的地址空间中应用管理服务的Binder代理替换为第一管理应用程序的Binder代理，所以隔离进程便会将第一管理应用程序的Binder代理作为应用管理服务的Binder代理；这样，当隔离进程要向第一程序所在的目标进程发送第一请求时，隔离进程会通过第一管理应用程序的Binder代理向宿主进程发送第一请求，相应地，步骤101则具体可以包括：宿主进程通过第一管理应用程序的Binder代理接收来自隔离进程的第一请求。
应理解，由于第一请求用于请求建立与目标进程之间的Binder连接，所以第一请求中的请求参数会携带不可信应用程序的Binder代理，以使得目标进程获取到不可信应用程序的Binder代理；在第二响应中也会携带第一程序的Binder代理，以使得隔离进程获取到第一程序的Binder代理，从而实现隔离进程与目标进程之间的Binder连接。
而在本申请实施例中，宿主进程向目标进程发送的第二请求中携带的是宿主进程的Binder代理，宿主进程向隔离进程发送的第二响应中携带的也是宿主进程的Binder代理，所以实际建立的是隔离进程与宿主进程之间的Binder连接，以及宿主进程与目标进程之间的Binder连接。此后，目标进程和隔离进程之间的通信都需依赖宿主进程。
然而，对于宿主进程来说，宿主进程可以具有多个Binder代理，并且，宿主进程还可以与除目标进程、隔离进程之外的其他进程建立Binder连接。所以，当目标进程通过宿主进程的Binder代理向宿主进程发送对不可信应用程序的访问请求后，宿主进程需要先根据目标进程所使用的Binder代理确定不可信应用程序的Binder代理，然后才能通过不可信应用程序的Binder代理向隔离进程转发该访问请求。
因此，在步骤101之后，方法还可以包括：宿主进程将不可信应用程序的Binder代理与第一管理应用程序的Binder代理关联。
这样，宿主进程便可以基于不可信应用程序的Binder代理与第一管理应用程序的Binder代理的关联关系，确定访问请求所需访问的不可信应用程序的Binder代理。
同样地，当隔离进程通过宿主进程的Binder代理向宿主进程发送对第一程序的访问请求后，宿主进程需要先根据目标进程所使用的Binder代理确定第一程序的Binder代理，然后才能通过第一程序的Binder代理向目标进程转发该访问请求。
因此，在步骤106之后，方法还包括：
宿主进程将第一程序的Binder代理与第一管理应用程序的Binder代理关联。
这样，宿主进程便可以基于第一程序的Binder代理与第一管理应用程序的Binder代理的关联关系，确定访问请求所需访问的第一程序的Binder代理。
下面以具体的示例对上述过程进行说明。
示例性地，宿主进程具有Binder代理1和Binder代理2，在建立Binder连接的过程中，宿主进程将不可信应用程序的Binder代理和第一程序的Binder代理均替换为Binder代理1，即第二请求中携带Binder代理1，第二响应中也携带Binder代理1。因此，宿主进程通过Binder代理1与目标进程、隔离进程分别建立了Binder连接。此外，宿主进程还通过Binder代理2与另一第三方应用程序建立Binder连接。
当隔离进程通过Binder代理1向宿主进程发送对于第一程序的访问请求时，宿主进程 可以通过Binder代理1与第一程序的Binder代理之间的关联关系，确定通过第一程序的Binder代理转发该访问请求，而不是通过另一第三方应用程序的Binder代理转发该访问请求。
同样地，当目标进程通过Binder代理1向宿主进程发送对于不可信应用程序的访问请求时，宿主进程可以通过Binder代理1与不可信应用程序的Binder代理之间的关联关系，确定通过不可信应用程序的Binder代理转发该访问请求，而不是通过另一第三方应用程序的Binder代理转发该访问请求。
在第一种场景中，如图3所示，通过请求转调，将应该发送至应用管理服务的第一请求转调到宿主进程，然后由宿主进程完成IPC转调，该IPC转调可以理解为宿主进程向第三方应用程序发送第二请求。
在本申请实施例中，宿主进程将隔离进程对应的地址空间中应用管理服务的Binder代理替换为第一管理应用程序的Binder代理，所以宿主进程会接收到来自隔离进程的用于建立Binder连接的第一请求；此后，宿主进程向目标进程发送用于建立Binder连接的第二请求，最终建立了隔离进程与宿主进程之间的Binder连接，也建立了宿主进程与目标进程之间的Binder连接，从而实现宿主进程对隔离进程与目标进程建立Binder连接的过程的管理。
宿主进程获取第一请求的第二种场景：隔离进程发送第一请求，以请求访问第三方应用程序。
相应地，第一程序为第三方应用程序，第一请求用于访问第一程序，第二请求用于访问第一程序，隔离进程的地址空间中存储的第一程序的Binder代理为第一管理应用程序的Binder代理。
第二种场景是指宿主进程与隔离进程建立Binder连接，且宿主进程与目标进程建立Binder连接后，隔离进程发送访问第一程序的第一请求。
因此，在第二种场景中，隔离进程获取到的是第一管理应用程序的Binder代理，即隔离进程的地址空间中存储的是第一管理应用程序的Binder代理，隔离进程会将第一管理应用程序的Binder代理作为第一程序的Binder代理。
基于此，当隔离进程需要通过Binder机制向第一程序发送第一请求时，隔离进程会通过第一管理应用程序的Binder代理发送第一请求。
相应地，宿主进程获取来自隔离进程对于第一程序的第一请求可以包括：
宿主进程通过第一管理应用程序的Binder代理接收来自隔离进程对于第一程序的第一请求。
在第二场景中，目标进程获取到的是第一管理应用程序的Binder代理，并且基于第一种场景的相关说明可知，宿主进程会将第一程序的Binder代理与第一管理应用程序的Binder代理关联。
因此，作为一种实现方式，宿主进程的地址空间中存储有第一程序的Binder代理，且第一程序的Binder代理与第一管理应用程序的Binder代理关联。
相应地，宿主进程向目标进程发送对于第一程序的第二请求包括：
宿主进程通过与第一管理应用程序的Binder代理关联的第一程序的Binder代理，向目标进程发送第二请求。
可以理解的是，宿主进程根据第一程序的Binder代理与第一管理应用程序的Binder代理的关联关系，确定与第一管理应用程序的Binder代理关联的第一程序的Binder代理，然后通过与第一管理应用程序的Binder代理关联的第一程序的Binder代理发送第二请求。
在第二种场景中，如图3所示，通过请求转调，将应该发送至应用管理服务的第一请求转调到宿主进程，然后由宿主进程完成IPC转调，该IPC转调可以理解为宿主进程向第三方应用程序发送第二请求。
在本申请实施例中，隔离进程的地址空间中存储的第一程序的Binder代理为第一管理应用程序的Binder代理，隔离进程通过第一管理应用程序的Binder代理发送访问第一程序的请求，宿主进程在接收到第一请求后，代理隔离进程对目标进程中的第一程序进行访问，从而实现了宿主进程对不可信应用程序访问第三方应用程序的过程进行管理。
宿主进程获取第一请求的第三种场景：隔离进程发送第一请求，以请求访问Android系统程序。
相应地，第一程序为系统程序，该系统程序是指Android系统程序，具体可以包括剪贴板程序、行动热点WIFI等系统程序；第一请求用于访问第一程序，第二请求用于访问第一程序。
与第一种场景和第二种场景不同，在第三种场景中，第一程序为系统程序，即隔离进程发送访问系统程序的第一请求。
基于前述说明可知，在Android系统中，服务管理器用于管理所有的Android系统程序，维护着Android系统程序和第三方应用程序的Binder通信，其中，每个进程可以具有各自的服务管理器。具体地，服务管理器中存储有Android系统程序的Binder代理，第三方应用程序和不可信应用程序都可以从服务管理器中查询各个Android系统程序的Binder代理。
以不可信应用程序为例，当不可信应用程序从服务管理器中查询到系统程序的Binder代理后，便可以通过系统程序的Binder代理与系统程序直接通信。
而在本申请实施例中，为了实现宿主进程对隔离进程通信的管理，在步骤101之前，方法还包括：
宿主进程在隔离进程对应的地址空间中的服务管理器中，添加用于代替第一程序的Binder代理的第一管理应用程序的Binder代理和第一程序的标识，以使得隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
可以理解的是，由于隔离进程属于“无权限”的特殊进程，为了防止不可信应用程序从隔离进程对应的地址空间中的服务管理器获取系统程序的Binder代理，隔离进程对应的地址空间中的服务管理器中通常不会存储任何系统程序的Binder代理。而在本申请实施例中，宿主进程在隔离进程对应的地址空间中的服务管理器中添加第一管理应用程序的Binder代理和第一程度的标识，使得隔离进程将第一管理应用程序的Binder代理作为第 一程序的Binder代理。
其中，第一管理应用程序的Binder代理和第一程序的标识可以看成是包装后的第一管理应用程序的Binder代理，即采用包装后的第一管理应用程序的Binder代理代替第一程序的Binder代理。
具体地，宿主进程可以向服务管理器中添加多个包装后的第一管理应用程序的Binder代理，以代替所有Android系统程序的Binder代理，从而达到使用包装后的第一管理应用程序的Binder代理代替第一程序的Binder代理的目的；需要说明的是，由于每个Android系统程序的标识不同，所以在不同Android系统程序对应的包装后的第一管理应用程序的Binder代理中，Android系统程序的标识不同。
由于第一程序为Android系统程序，所以宿主进程通常在拉起隔离进程的过程(可以理解为隔离进程初始化)中，添加第一管理应用程序的Binder代理和第一程序的标识。
基于此，当隔离进程需要访问第一程序时，隔离进程从隔离进程对应的地址空间中的服务管理器中查询第一程序的Binder代理，得到第一管理应用程序的Binder代理和第一程序的标识，第一程序为系统程序；
隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
相应地，步骤101包括：宿主进程通过宿主进程的Binder代理接收来自隔离进程对于第一程序的第一请求，第一请求中的请求参数包括第一程序的标识。
可以理解的是，宿主进程在获取到第一程序的标识后，便可以从服务管理器中查询第一程序的Binder代理，然后通过第一程序的Binder代理发送第二请求。
作为一种实现方式，在步骤101之后，在步骤102之前，方法还包括：
宿主进程从宿主进程对应的地址空间中的服务管理器中查询，第一程序的标识对应的第一程序的Binder代理。
相应地，宿主进程向目标进程发送第二请求包括：
宿主进程通过第一程序的Binder代理向目标进程发送第二请求。
在第三种场景中，如图3所示，通过请求转调，将应该发送至目标进程的第一请求转调到宿主进程，然后由宿主进程完成IPC转调，该IPC转调可以理解为宿主进程向Android系统程序发送第二请求。
在本申请实施例中，宿主进程在隔离进程对应的地址空间中的服务管理器中，添加用于代替第一程序的Binder代理的第一管理应用程序的Binder代理和第一程序的标识，以使得隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第一请求，这样，宿主进程便可以代理隔离进程对目标进程中的第一程序进行访问，从而实现宿主进程对不可信应用程序访问系统程序的管理；其中，当第一程序为系统程序时，宿主进程代理隔离进程访问第一程序的方式又可以称为桩代理。
在上述各个实施例中，宿主进程是对隔离进程通过Binder机制与第一进程通信的过程进行管理，基于前述说明可知，隔离进程还可以通过直接访问API的方式与第一进程通信。因此，下面介绍宿主进程对隔离进程通过访问API与第一进程通信的过程进行管理。
基于上述各个实施例，本申请实施例还提供了管理不可信应用程序通信的方法的另一个实施例，如图5所示，该实施例包括：
步骤201，隔离进程通过自定义类加载器在隔离进程的地址空间中加载自定义类，自定义类的标识与第二程序的标识相同，自定义类的API的标识与第二程序的API的标识相同，自定义类的API用于使得隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第三请求，第三请求携带第二程序的标识和第二程序的API的标识。
其中，自定义类可以看成一个类对象，在Android系统中，应用管理服务、服务管理器等任意一个功能组件也都是一个类对象。
由于自定义类的标识与第二程序的标识相同，所以隔离进程在访问第二程序时，隔离进程会访问自定义类；又由于自定义类的API的标识与第二程序的API的标识相同，所以当隔离进程访问第二程序的API时，隔离进程会访问自定义类的API。
由于自定义类是由用户根据需求自定义的，所以用户可以将自定义类的API设置为，使得隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第三请求。
步骤202，当隔离进程基于第二程序的标识以及第二程序的API的标识访问第二程序的API时，隔离进程访问自定义类的API。
基于步骤201的相关说明可知，当隔离进程访问第二程序的API时，隔离进程会访问自定义类的API。
步骤203，隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第三请求。
基于步骤201的相关说明可知，由于自定义类的API使得隔离进程通过第一管理应用程序的Binder代理向宿主进程发送第三请求，所以隔离进程访问自定义类的API，会促使隔离进程通过第一管理应用程序的Binder代理发送第三请求。
相应地，宿主进程通过第一管理应用程序的Binder代理接收来自隔离进程的第三请求，第三请求携带第二程序的标识和第二程序的API的标识。
步骤204，宿主进程基于第三请求中第二程序的标识和第二程序的API的标识，访问第二程序的API。
可以理解的是，宿主进程在接收到第三请求后，会基于第二程序的标识和第二程序的API的标识，访问第二程序的API，即宿主进程代理隔离进程访问第二程序的API。
步骤205，宿主进程通过不可信应用程序的Binder代理向隔离进程发送，第二程序的API的访问结果。
在宿主进程获取到第二程序的API的访问结果后，宿主进程可以利用Binder机制向隔离进程发送第二程序的API的访问结果。
在本申请实施例中，第二程序所表示的系统程序与前述实施例中，第三场景下第一程序所表示的系统程序不同。第二程序主要是指Binder代理未存储于服务管理器中的系统程序，第三场景下第一程序所表示的系统程序是指Binder代理存储于服务管理器中的系统程序；具体地，第三场景下第一程序所表示的系统程序的Binder代理会存储于服务管理器中，而第二程序所表示的系统程序也可以具有Binder代理，但该Binder代理不会存储于服务管理器中，因此无法通过服务管理器查询第二程序所表示的系统程序的Binder代理，只能 通过第二程序的API对第二程序进行访问。
其中，第二程序所表示的系统程序可以是闹钟服务AlarmManager、音频管理器AudioManager等。
为了更好地理解本申请实施例提供的方法，下面还提供了2个具体的应用例。
第一应用例如下。
如图6所示，客户端需要使用情景感知服务Awareness Kit注册时间围栏DuringTimePeriod，当设备处于预设时间段内，该时间围栏的状态为真True。
具体地，客户端拉起宿主进程，宿主进程拉起隔离进程，隔离进程加载情景感知服务(即不可信应用程序)，并且宿主进程会建立与载情景感知服务绑定的服务桩。
情景感知服务在进行时间围栏的逻辑处理时，需要访问系统程序中的AlarmManager；此时，基于隔离进程中加载了与AlarmManager标识相同的自定义类，所以隔离进程在访问AlarmManager的API时，会向宿主进程发送访问AlarmManager的API的请求，具体可参阅图5所示的实施例的相关说明；宿主进程在接收到AlarmManager的API的请求后，会访问AlarmManager的API并将访问结果发送给隔离进程，即完成IPC转调。
最终，隔离进程中的情景感知服务将时间围栏的响应结果通过宿主进程返回给客户端。
第二应用例如下。
如图7所示，客户端需要使用情景感知服务Awareness Kit的活动识别快照GetBehaviorStatus功能，该功能用于查询设备当前所处的运动状态信息，比如步行、跑步等。
具体地，客户端拉起宿主进程，宿主进程拉起隔离进程，隔离进程加载情景感知服务(即不可信应用程序)，并且宿主进程会建立与载情景感知服务绑定的服务桩。
情景感知服务在进行活动识别快照的逻辑处理时，需要访问MSDP服务；此时，隔离进程会先通过宿主进程与MSDP服务所在的进程建立Binder连接，建立Binder连接的过程可参阅前述实施例中第一种场景的相关说明；在建立Binder连接后，隔离进程则可以通过宿主进程访问MSDP服务并将访问结果发送给隔离进程，即完成IPC转调。
最终，隔离进程中的情景感知服务将活动识别快照所查询到的设备的运行状态信息，通过宿主进程返回给客户端。
本申请实施例无需获取安卓系统的root权限、无需修改安卓系统应用框架层和不可信应用程序源代码，为不可信应用程序构造了权限受控的运行环境，实现了对不可信应用程序所有通信行为的有效管理；并且，经过大量测试，不可信应用程序运行在隔离进程中的响应耗时与不在隔离进程中运行的响应耗时差别不大，所以本申请实施例可以保证这不可信应用程序的运行具有较高的性能效率。
如图8所示，本申请实施例还提供了一种管理不可信应用程序通信的装置的一个实施例，包括：
收发单元301，用于获取来自第二进程对于第一程序的第一请求，第一请求中携带至少一个请求参数，第一进程中运行有第一管理应用程序，第二进程中运行有不可信应用程序；
处理单元302，用于将至少一个请求参数中的第一通信句柄替换为第一管理应用程序的通信句柄；
收发单元301，用于向目标进程发送第二请求，第二请求中携带包含第一管理应用程序的通信句柄的至少一个请求参数，目标进程中运行有第一程序。
作为一种实现方式，第一请求包含于通信包裹中；处理单元302还用于基于存储标识位确定第一通信句柄在通信包裹中的存储位置信息，存储标识位用于标记通信包裹中目标存储区域的起始位置，目标存储区域用于存储第一通信句柄；基于存储位置信息获取第一通信句柄。
作为一种实现方式，第一程序为第三方应用程序，第一请求用于请求第一程序的通信句柄，第二请求用于请求第一程序的通信句柄，第一通信句柄为不可信应用程序的通信句柄。
相应地，处理单元302还用于将第二进程对应的地址空间中作业应用管理服务的通信句柄替换为第一管理应用程序的通信句柄，以使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求。
作为一种实现方式，处理单元302还用于将不可信应用程序的通信句柄与第一管理应用程序的通信句柄关联。
作为一种实现方式，第一程序为第三方应用程序，第一请求用于访问第一程序，第二请求用于访问第一程序；第二进程的地址空间中存储的第一程序的通信句柄为第一管理应用程序的通信句柄。
相应地，收发单元301还用于通过第一管理应用程序的通信句柄接收来自第二进程对于第一程序的第一请求。
作为一种实现方式，第一进程的地址空间中存储有第一程序的通信句柄，且第一程序的通信句柄与第一管理应用程序的通信句柄关联。
相应地，收发单元301还用于通过与第一管理应用程序的通信句柄关联的第一程序的通信句柄，向目标进程发送第二请求。
作为一种实现方式，第一程序为系统程序，第一请求用于访问第一程序，第二请求用于访问第一程序；
处理单元302还用于在第二进程对应的地址空间中的服务管理器中，添加用于代替第一程序的通信句柄的第一管理应用程序的通信句柄和第一程序的标识，以使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
作为一种实现方式，处理单元302还用于从第一进程对应的地址空间中的服务管理器中查询，第一程序的标识对应的第一程序的通信句柄；
收发单元301还用于通过第一程序的通信句柄向目标进程发送第二请求。
作为一种实现方式，收发单元301还用于接收来自目标进程的对于第二请求的第一响应，第一响应中携带至少一个响应参数。
处理单元302还用于将至少一个响应参数中的第二通信句柄替换为第一管理应用程序 的通信句柄。
收发单元301还用于向第二进程发送对于第一请求的第二响应，第二响应中携带包含第一管理应用程序的通信句柄的至少一个响应参数。
作为一种实现方式，第一程序为第三方应用程序，第一请求用于请求第一程序的通信句柄，第二请求用于请求第一程序的通信句柄，第二通信句柄为第一程序的通信句柄。
相应地，处理单元302还用于第一进程将第一程序的通信句柄与第一管理应用程序的通信句柄关联。
作为一种实现方式，收发单元301还用于第一进程通过第一管理应用程序的通信句柄接收来自第二进程的第三请求，第三请求携带第二程序的标识和第二程序的应用程序接口API的标识；基于第三请求中第二程序的标识和第二程序的API的标识，访问第二程序的API。
作为一种实现方式，收发单元301还用于通过不可信应用程序的通信句柄向第二进程发送，第二程序的API的访问结果。
其中，以上各单元的具体实现、相关说明以及技术效果请参考本申请实施例第一方面的描述。
如图9所示，本申请实施例还提供了一种管理不可信应用程序通信的装置的一个实施例，包括：
处理单元401，用于从第二进程对应的地址空间中的服务管理器中查询第一程序的通信句柄，得到第一管理应用程序的通信句柄和第一程序的标识，第一程序为系统程序；
收发单元402，用于通过第一管理应用程序的通信句柄向第一进程发送第一请求，至少一个请求参数中还包含第一程序的标识。
作为一种实现方式，处理单元401还用于通过自定义类加载器在第二进程的地址空间中加载自定义类，自定义类的标识与第二程序的标识相同，自定义类的应用程序接口API的标识与第二程序的API的标识相同，自定义类的API用于使得第二进程通过第一管理应用程序的通信句柄向第一进程发送第三请求，第三请求携带第二程序的标识和第二程序的API的标识；当第二进程基于第二程序的标识以及第二程序的API的标识访问第二程序的API时，访问自定义类的API。
收发单元402还用于第二进程通过第一管理应用程序的通信句柄向第一进程发送第三请求。
其中，以上各单元的具体实现、相关说明以及技术效果请参考本申请实施例第二方面的描述。
本申请实施例还提供了另一种终端设备，如图10所示，为了便于说明，仅示出了与本申请实施例相关的部分，具体技术细节未揭示的，请参照本申请实施例方法部分。该终端可以为包括手机、平板电脑、个人数字助理(英文全称：Personal Digital Assistant，英文缩写：PDA)、销售终端(英文全称：Point of Sales，英文缩写：POS)、车载电脑等任意终端设备，以终端为手机为例：
图10示出的是与本申请实施例提供的终端相关的手机的部分结构的框图。参考图10， 手机包括：射频(英文全称：Radio Frequency，英文缩写：RF)电路1010、存储器1020、输入单元1030、显示单元1040、传感器1050、音频电路1060、无线保真(英文全称：wireless fidelity，英文缩写：WiFi)模块1070、中央处理器CPU1080以及电源等部件。本领域技术人员可以理解，图10中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图10对手机的各个构成部件进行具体的介绍：
RF电路1010可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给CPU1080处理；另外，将设计上行的数据发送给基站。通常，RF电路1010包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(英文全称：Low Noise Amplifier，英文缩写：LNA)、双工器等。此外，RF电路1010还可以通过无线通信与网络和其他设备通信。上述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(英文全称：Global System of Mobile communication，英文缩写：GSM)、通用分组无线服务(英文全称：General Packet Radio Service，GPRS)、码分多址(英文全称：Code Division Multiple Access，英文缩写：CDMA)、宽带码分多址(英文全称：Wideband Code Division Multiple Access,英文缩写：WCDMA)、长期演进(英文全称：Long Term Evolution，英文缩写：LTE)、电子邮件、短消息服务(英文全称：Short Messaging Service，SMS)等。
存储器1020可用于存储软件程序以及模块，CPU1080通过运行存储在存储器1020的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器1020可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器1020可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元1030可用于接收输入的数字或字符信息，以及产生与手机的用户设置以及功能控制有关的键信号输入。具体地，输入单元1030可包括触控面板1031以及其他输入设备1032。触控面板1031，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板1031上或在触控面板1031附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板1031可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给CPU1080，并能接收CPU1080发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板1031。除了触控面板1031，输入单元1030还可以包括其他输入设备1032。具体地，其他输入设备1032可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元1040可用于显示由用户输入的信息或提供给用户的信息以及手机的各种菜 单。显示单元1040可包括显示面板1041，可选的，可以采用液晶显示器(英文全称：Liquid Crystal Display，英文缩写：LCD)、有机发光二极管(英文全称：Organic Light-Emitting Diode，英文缩写：OLED)等形式来配置显示面板1041。进一步的，触控面板1031可覆盖显示面板1041，当触控面板1031检测到在其上或附近的触摸操作后，传送给CPU1080以确定触摸事件的类型，随后CPU1080根据触摸事件的类型在显示面板1041上提供相应的视觉输出。虽然在图10中，触控面板1031与显示面板1041是作为两个独立的部件来实现手机的输入和输入功能，但是在某些实施例中，可以将触控面板1031与显示面板1041集成而实现手机的输入和输出功能。
手机还可包括至少一种传感器1050，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板1041的亮度，接近传感器可在手机移动到耳边时，关闭显示面板1041和/或背光。作为运动传感器的一种，加速计传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于手机还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路1060、扬声器1061，传声器1062可提供用户与手机之间的音频接口。音频电路1060可将接收到的音频数据转换后的电信号，传输到扬声器1061，由扬声器1061转换为声音信号输出；另一方面，传声器1062将收集的声音信号转换为电信号，由音频电路1060接收后转换为音频数据，再将音频数据输出CPU1080处理后，经RF电路1010以发送给比如另一手机，或者将音频数据输出至存储器1020以便进一步处理。
WiFi属于短距离无线传输技术，手机通过WiFi模块1070可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图10示出了WiFi模块1070，但是可以理解的是，其并不属于手机的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
CPU1080是手机的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器1020内的软件程序和/或模块，以及调用存储在存储器1020内的数据，执行手机的各种功能和处理数据，从而对手机进行整体监控。可选的，CPU1080可包括一个或多个处理单元；优选的，CPU1080可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到CPU1080中。
手机还包括给各个部件供电的电源(比如电池)，优选的，电源可以通过电源管理系统与CPU1080逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
尽管未示出，手机还可以包括摄像头、蓝牙模块等，在此不再赘述。
在本申请实施例中，该终端所包括的CPU1080中可以运行前述实施例中宿主进程和隔离进程。
本申请实施例还提供一种芯片，包括一个或多个处理器。所述处理器中的部分或全部 用于读取并执行存储器中存储的计算机程序，以执行图4和图5对应的各实施例的方法。
可选地，该芯片该包括存储器，该存储器与该处理器通过电路或电线与存储器连接。进一步可选地，该芯片还包括通信接口，处理器与该通信接口连接。通信接口用于接收需要处理的数据和/或信息，处理器从该通信接口获取该数据和/或信息，并对该数据和/或信息进行处理，并通过该通信接口输出处理结果。该通信接口可以是输入输出接口。
在一些实现方式中，所述一个或多个处理器中还可以有部分处理器是通过专用硬件的方式来实现以上方法中的部分步骤，例如涉及神经网络模型的处理可以由专用神经网络处理器或图形处理器来实现。
本申请实施例提供的方法可以由一个芯片实现，也可以由多个芯片协同实现。
本申请实施例还提供了一种计算机存储介质，该计算机存储介质用于储存为上述计算机设备所用的计算机软件指令，其包括用于执行为计算机设备所设计的程序。
该计算机设备可以包括前述图8和图9所描述的管理不可信应用程序通信的装置。
本申请实施例还提供了一种计算机程序产品，该计算机程序产品包括计算机软件指令，该计算机软件指令可通过处理器进行加载来实现前述图4或图5所示的方法中的流程。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (19)

  1. 一种管理不可信应用程序通信的方法，其特征在于，包括：
    第一进程获取来自第二进程对于第一程序的第一请求，所述第一请求中携带至少一个请求参数，所述第一进程中运行有第一管理应用程序，所述第二进程中运行有所述不可信应用程序；
    所述第一进程将所述至少一个请求参数中的第一通信句柄替换为所述第一管理应用程序的通信句柄；
    所述第一进程向目标进程发送对于所述第一程序的第二请求，所述第二请求中携带包含所述第一管理应用程序的通信句柄的所述至少一个请求参数，所述目标进程中运行有所述第一程序。
  2. 根据权利要求1所述的方法，其特征在于，所述第一请求包含于通信包裹中；
    在所述第一进程获取来自所述第二进程对于第一程序的第一请求之后，在所述第一进程将所述至少一个请求参数中的第一通信句柄替换为所述第一管理应用程序的通信句柄之前，所述方法还包括：
    所述第一进程基于存储标识位确定所述第一通信句柄在所述通信包裹中的存储位置信息，所述存储标识位用于标记所述通信包裹中目标存储区域的起始位置，所述目标存储区域用于存储所述第一通信句柄；
    所述第一进程基于所述存储位置信息获取所述第一通信句柄。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一程序为第三方应用程序，所述第一请求用于请求所述第一程序的通信句柄，所述第二请求用于请求所述第一程序的通信句柄，所述第一通信句柄为所述不可信应用程序的通信句柄；
    在所述第一进程获取来自所述第二进程对于第一程序的第一请求之前，所述方法还包括：
    所述第一进程将所述第二进程对应的地址空间中应用管理服务的通信句柄替换为所述第一管理应用程序的通信句柄，以使得所述第二进程通过所述第一管理应用程序的通信句柄向所述第一进程发送所述第一请求。
  4. 根据权利要求3所述的方法，其特征在于，在所述第一进程获取来自所述第二进程对于第一程序的第一请求之后，所述方法还包括：
    所述第一进程将所述不可信应用程序的通信句柄与所述第一管理应用程序的通信句柄关联。
  5. 根据权利要求1或2所述的方法，其特征在于，所述第一程序为第三方应用程序，所述第一请求用于访问所述第一程序，所述第二请求用于访问所述第一程序；
    所述第二进程的地址空间中存储的所述第一程序的通信句柄为所述第一管理应用程序 的通信句柄；
    所述第一进程获取来自所述第二进程对于第一程序的第一请求包括：
    所述第一进程通过所述第一管理应用程序的通信句柄接收来自所述第二进程对于第一程序的第一请求。
  6. 根据权利要求5所述的方法，其特征在于，所述第一进程的地址空间中存储有所述第一程序的通信句柄，且所述第一程序的通信句柄与所述第一管理应用程序的通信句柄关联；
    所述第一进程向所述目标进程发送对于所述第一程序的第二请求包括：
    所述第一进程通过与所述第一管理应用程序的通信句柄关联的所述第一程序的通信句柄，向所述目标进程发送所述第二请求。
  7. 根据权利要求1或2所述的方法，其特征在于，所述第一程序为系统程序，所述第一请求用于访问所述第一程序，所述第二请求用于访问所述第一程序；
    在所述第一进程获取来自所述第二进程对于第一程序的第一请求之前，所述方法还包括：
    所述第一进程在所述第二进程对应的地址空间中的服务管理器中，添加用于代替所述第一程序的通信句柄的所述第一管理应用程序的通信句柄和所述第一程序的标识，以使得所述第二进程通过所述第一管理应用程序的通信句柄向所述第一进程发送所述第一请求，所述至少一个请求参数中还包含所述第一程序的标识。
  8. 根据权利要求7所述的方法，其特征在于，在所述第一进程获取来自所述第二进程对于第一程序的第一请求之后，在所述第一进程向所述目标进程发送对于所述第一程序的第二请求之前，所述方法还包括：
    所述第一进程从所述第一进程对应的地址空间中的服务管理器中查询，所述第一程序的标识对应的所述第一程序的通信句柄；
    所述第一进程向所述目标进程发送第二请求包括：
    所述第一进程通过所述第一程序的通信句柄向所述目标进程发送所述第二请求。
  9. 根据权利要求1至8中任意一项所述的方法，其特征在于，在所述第一进程向所述目标进程发送第二请求之后，所述方法还包括：
    所述第一进程接收来自所述目标进程的对于所述第二请求的第一响应，所述第一响应中携带至少一个响应参数；
    所述第一进程将所述至少一个响应参数中的所述第二通信句柄替换为所述第一管理应用程序的通信句柄；
    所述第一进程向所述第二进程发送对于所述第一请求的第二响应，所述第二响应中携带包含所述第一管理应用程序的通信句柄的所述至少一个响应参数。
  10. 根据权利要求9所述的方法，其特征在于，所述第一程序为第三方应用程序，所述第一请求用于请求所述第一程序的通信句柄，所述第二请求用于请求所述第一程序的通信句柄，所述第二通信句柄为所述第一程序的通信句柄；
    在所述第一进程接收来自所述目标进程的对于所述第二请求的第一响应之后，所述方法还包括：
    所述第一进程将所述第一程序的通信句柄与所述第一管理应用程序的通信句柄关联。
  11. 根据权利要求1至10中任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一进程通过所述第一管理应用程序的通信句柄接收来自所述第二进程的所述第三请求，所述第三请求携带第二程序的标识和所述第二程序的应用程序接口的标识；
    所述第一进程基于所述第三请求中所述第二程序的标识和所述第二程序的应用程序接口的标识，访问所述第二程序的应用程序接口。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    所述第一进程通过所述不可信应用程序的通信句柄向所述第二进程发送，所述第二程序的应用程序接口的访问结果。
  13. 一种管理不可信应用程序通信的方法，其特征在于，包括：
    第二进程从所述第二进程对应的地址空间中的服务管理器中查询第一程序的通信句柄，得到所述第一管理应用程序的通信句柄和所述第一程序的标识，所述第二进程中运行有所述不可信应用程序，所述第一程序为系统程序；
    所述第二进程通过所述第一管理应用程序的通信句柄向第一进程发送所述第一请求，所述第一请求用于访问所述第一程序，所述至少一个请求参数中还包含所述第一程序的标识，所述第一进程中运行有第一管理应用程序。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述第二进程通过自定义类加载器在所述第二进程的地址空间中加载自定义类，所述自定义类的标识与第二程序的标识相同，所述自定义类的应用程序接口的标识与所述第二程序的应用程序接口的标识相同，所述自定义类的应用程序接口用于使得所述第二进程通过所述第一管理应用程序的通信句柄向所述第一进程发送所述第三请求，所述第三请求携带第二程序的标识和所述第二程序的应用程序接口的标识；
    当所述第二进程基于所述第二程序的标识以及所述第二程序的应用程序接口的标识访问所述第二程序的应用程序接口时，所述第二进程访问所述自定义类的应用程序接口；
    所述第二进程通过所述第一管理应用程序的通信句柄向所述第一进程发送所述第三请求。
  15. 一种管理不可信应用程序通信的装置，其特征在于，包括：
    收发单元，用于获取来自所述第二进程对于第一程序的第一请求，所述第一请求中携带至少一个请求参数，所述第一进程中运行有第一管理应用程序，所述第二进程中运行有所述不可信应用程序；
    处理单元，用于将所述至少一个请求参数中的所述第一通信句柄替换为所述第一管理应用程序的通信句柄；
    收发单元，用于向所述目标进程发送第二请求，所述第二请求中携带包含所述第一管理应用程序的通信句柄的所述至少一个请求参数，所述目标进程中运行有所述第一程序。
  16. 一种管理不可信应用程序通信的装置，其特征在于，包括：
    处理单元，用于从所述第二进程对应的地址空间中的服务管理器中查询第一程序的通信句柄，得到所述第一管理应用程序的通信句柄和所述第一程序的标识，所述第二进程中运行有所述不可信应用程序，所述第一程序为系统程序；
    收发单元，用于通过所述第一管理应用程序的通信句柄向第一进程发送所述第一请求，所述至少一个请求参数中还包含所述第一程序的标识，所述第一进程中运行有第一管理应用程序。
  17. 一种终端设备，其特征在于，包括：一个或多个处理器和存储器；其中，所述存储器中存储有计算机可读指令；
    所述一个或多个处理器读取所述计算机可读指令，以使所述计算机设备实现如权利要求1至14中任一项所述的方法。
  18. 一种计算机可读存储介质，其特征在于，包括计算机可读指令，当所述计算机可读指令在计算机上运行时，使得所述计算机执行如权利要求1至14中任一项所述的方法。
  19. 一种计算机程序产品，其特征在于，包括计算机可读指令，当所述计算机可读指令在计算机上运行时，使得所述计算机执行如权利要求1至14中任一项所述的方法。
PCT/CN2021/131767 2020-11-27 2021-11-19 管理不可信应用程序通信的方法及相关装置 WO2022111391A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21896892.3A EP4242885A4 (en) 2020-11-27 2021-11-19 METHOD FOR MANAGING THE COMMUNICATIONS OF AN UNSECURE APPLICATION PROGRAM AND ASSOCIATED DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011365125.6A CN114564700A (zh) 2020-11-27 2020-11-27 管理不可信应用程序通信的方法及相关装置
CN202011365125.6 2020-11-27

Publications (1)

Publication Number Publication Date
WO2022111391A1 true WO2022111391A1 (zh) 2022-06-02

Family

ID=81711948

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/131767 WO2022111391A1 (zh) 2020-11-27 2021-11-19 管理不可信应用程序通信的方法及相关装置

Country Status (3)

Country Link
EP (1) EP4242885A4 (zh)
CN (1) CN114564700A (zh)
WO (1) WO2022111391A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117056173A (zh) * 2023-10-12 2023-11-14 麒麟软件有限公司 在Web操作系统上监控安卓应用生命周期的方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160306963A1 (en) * 2015-04-14 2016-10-20 Avecto Limited Computer device and method for controlling untrusted access to a peripheral device
CN106897611A (zh) * 2017-03-03 2017-06-27 金光 无需root权限的安全虚拟移动应用程序运行环境系统及方法与应用
CN108509802A (zh) * 2018-02-28 2018-09-07 郑州信大捷安信息技术股份有限公司 一种应用程序数据防泄密方法和装置
US20190097977A1 (en) * 2017-09-28 2019-03-28 L3 Technologies, Inc. Browser switching system and methods
CN110807191A (zh) * 2019-09-30 2020-02-18 奇安信科技集团股份有限公司 一种应用程序的安全运行方法及装置
CN111880987A (zh) * 2020-07-09 2020-11-03 青岛海尔科技有限公司 应用程序的动态监测方法、装置、存储介质以及电子装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106384045B (zh) * 2016-09-12 2020-10-27 电子科技大学 基于应用程序虚拟化的安卓存储应用沙箱及通信方法
US10983849B2 (en) * 2019-02-28 2021-04-20 Crowdstrike, Inc. Container application for android-based devices

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160306963A1 (en) * 2015-04-14 2016-10-20 Avecto Limited Computer device and method for controlling untrusted access to a peripheral device
CN106897611A (zh) * 2017-03-03 2017-06-27 金光 无需root权限的安全虚拟移动应用程序运行环境系统及方法与应用
US20190097977A1 (en) * 2017-09-28 2019-03-28 L3 Technologies, Inc. Browser switching system and methods
CN108509802A (zh) * 2018-02-28 2018-09-07 郑州信大捷安信息技术股份有限公司 一种应用程序数据防泄密方法和装置
CN110807191A (zh) * 2019-09-30 2020-02-18 奇安信科技集团股份有限公司 一种应用程序的安全运行方法及装置
CN111880987A (zh) * 2020-07-09 2020-11-03 青岛海尔科技有限公司 应用程序的动态监测方法、装置、存储介质以及电子装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4242885A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117056173A (zh) * 2023-10-12 2023-11-14 麒麟软件有限公司 在Web操作系统上监控安卓应用生命周期的方法
CN117056173B (zh) * 2023-10-12 2024-01-30 麒麟软件有限公司 在Web操作系统上监控安卓应用生命周期的方法

Also Published As

Publication number Publication date
EP4242885A4 (en) 2024-04-10
EP4242885A1 (en) 2023-09-13
CN114564700A (zh) 2022-05-31

Similar Documents

Publication Publication Date Title
US20200036772A1 (en) Image Distribution Method and Apparatus, and Image Obtaining Method and Apparatus
KR102481065B1 (ko) 애플리케이션 기능 구현 방법 및 전자 디바이스
CN106598584B (zh) 一种处理资源文件的方法、装置和系统
WO2021036706A1 (zh) 可信应用的运行方法、信息处理和内存分配方法及装置
WO2019057155A1 (zh) 一种动态管理内核节点的方法和设备
WO2015090250A1 (zh) 一种进程间通讯的方法及装置
WO2015035947A1 (zh) 一种实现无卡手机的方法、手机和服务器
CN111095199B (zh) 一种加载应用的方法及终端设备
WO2019128588A1 (zh) 进程处理方法和装置、电子设备、计算机可读存储介质
WO2019128571A1 (zh) 资源管理方法、装置、移动终端及计算机可读存储介质
WO2022111391A1 (zh) 管理不可信应用程序通信的方法及相关装置
CN106933636B (zh) 启动插件服务的方法、装置和终端设备
WO2015062234A1 (zh) 移动终端资源处理方法、装置和设备
CN111414265A (zh) 一种调用系统资源的服务框架及方法
CN114218560A (zh) 资源访问方法、装置、电子设备及存储介质
CN109145598B (zh) 脚本文件的病毒检测方法、装置、终端及存储介质
WO2017211260A1 (zh) 一种访问数据的方法及相关设备
JP2006277204A (ja) 携帯通信端末装置
WO2017166093A1 (zh) 前置系统
JP6685538B2 (ja) アプリケーション加速方法およびデバイス
WO2018049896A1 (zh) 数据传输方法及设备
CN111078233B (zh) 一种应用推广的实现方法、装置、设备及存储介质
US20180210770A1 (en) Enabling wpd devices to be managed at the capability level
WO2018045549A1 (zh) 一种射频系统、信号处理系统及终端
TW201523321A (zh) 防止應用程式操作中遠程代碼被執行的方法、裝置及系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21896892

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021896892

Country of ref document: EP

Effective date: 20230605

NENP Non-entry into the national phase

Ref country code: DE