Method and system for application security

Abstract

Methods and systems for application security. The methods and systems of the invention improve application security and can be used to protect host applications and operating systems from malicious fast applications. A request to access a resource of a computing device is received from an application adapter of a fast application operating within a host application on the computing device. In response to determining that the request is associated with a resource included in a permission list of the fast application, an operating system converts a unique user identifier (UID) of the application adapter to a UID of the host application, the operating system determines whether to allow the request based on the UID of the host application. Otherwise, the operating system determines whether to allow the request based on the UID of the application adapter.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to U.S. non-provisional application No. 17 / 127,793, entitled “METHOD AND SYSTEM FOR APPLICATION SECURITY,” filed December 18, 2020, the contents of which are incorporated herein by reference in the jurisdiction thereof. Technical Field

[0003] This invention relates to application security, and more specifically, to methods and systems for application security. Background Technology

[0004] Application security is a critical aspect of modern computing. Applications on computing devices face security risks such as hacking, viruses, and malware. Quick apps (also known as mini-apps, mini-programs, and web applications) are applications that can run on computing devices such as smartphones. Quick apps are typically lightweight, JavaScript-based applications designed to run within another application, known as the host application. The host application can be any suitable type of application, including social applications, messaging applications, web browsers, games, or launcher applications for the computing device's operating system. In addition to the native application ecosystem, quick apps also provide an alternative application ecosystem for host computing devices. An application ecosystem is a collection of applications that share application code. Applications within an application ecosystem typically have a hierarchical relationship based on inheritance or dependency between the shared application code and the host application and possibly other quick apps.

[0005] Quick apps offer the benefits of rapid development, rapid deployment, and ease of use, and have become increasingly popular in e-commerce, social media, and entertainment in recent years. Quick apps are commonly used as a means of mini-games, in-app purchases, and in-app digital rewards (often associated with in-app advertising). However, due to a lack of regulation and the persistently large attack surface in most JavaScript engines, quick apps pose critical security threats. Allowing malicious quick apps to operate freely on a user's computing device without restriction or inspection could result in significant losses for the user. For at least these reasons, methods and systems to improve app security are needed. Summary of the Invention

[0006] This invention provides methods and systems for application security. The methods and systems of this invention improve application security and can be used to protect host applications and operating systems from malicious fast applications. The methods and systems of this invention address at least two security problems associated with fast applications: weak boundaries and lack of prior checks.

[0007] The methods and systems of this invention aim to enhance the security of fast application runtime by introducing additional defensive measures to control untrusted fast application code, mitigate damage during attacks, and detect malicious fast applications before attacks occur. The proposed solutions utilize one or a combination of three features: user identifier (UID) isolation, low-privilege JavaScript engine sandbox isolation, and JavaScript integrity measurement agent (JIMA). UID isolation enforces operating system (OS) level separation between the fast application's JavaScript engine adapter and the host application. The low-privilege application sandbox further isolates the JavaScript engine. These features together create a stronger barrier to prevent malicious fast applications from gaining the same set of permissions as the host application. JIMA periodically measures the integrity of the fast application code to ensure it remains unchanged since installation and throughout execution.

[0008] Quick Apps are configured to operate within the host application and access resources accessible to the host application, such as user data, hardware, file systems, key configuration data, and cryptographic material. Access to resources on the host computing device is controlled by the JavaScript engine and role-based access control (RBAC) enforced by the underlying JavaScript engine adapter, which supports the platform-specific functionalities of the JavaScript engine. The JavaScript engine adapter is an application programming interface (API) that translates one interface (e.g., object properties and methods) into another, enabling real-time object communication within an object-centric API. Each Quick App has one corresponding JavaScript engine instance and one JavaScript engine adapter instance.

[0009] Now for reference Figure 1 , Figure 1This is a block diagram of existing software architecture to explain how a malicious fast application 62 can be used to attack a computing device 102 via a host application 60, according to existing technology. The host application 60 has a logical boundary, referred to as the application boundary 20, which is enforced by the operating system 150, which separates it from other applications 158 on the computing device 102. Within the application boundary 20 reside the host application 60, the JavaScript (JS) engine 54, the JavaScript (JS) engine adapter 56, and the fast application 62. Fast applications, such as the malicious fast application 62, typically operate within a weak logical boundary 30 within the application boundary 20 of the host application 60.

[0010] JavaScript engines have a large attack surface and are vulnerable to attacks, such as arbitrary RAM reads / writes, due to their design complexity. Therefore, JavaScript engines can control untrusted fast application code within weak boundaries. JavaScript engine adapters typically reside in the same process space as the JavaScript engine and the host application. Once malicious code (e.g., a malicious script) from a malicious fast application escapes the control of the JavaScript engine, the malicious script can manipulate the JavaScript engine adapter to bypass any checks it enforces (e.g., forging unauthorized user permissions) and gain the same permissions and permission set as the host application. The host application can be authorized with permissions and permissions to access various resources to support multiple fast applications. Therefore, there is a security risk that many permissions and permissions of the host application, as well as access to authorized resources of the host application, may be acquired by malicious scripts from malicious fast applications. One object of this invention is to mitigate damage in the event of an attack to prevent malicious code from reaching the host application.

[0011] Typically, quick apps launch and operate without any prior checks. JavaScript is easily tampered with because it is more readable than binary code, making it easier for attackers to modify. Furthermore, due to the flexibility of the JavaScript language, self-morphing code can be built that automatically changes parts of itself at runtime. This dynamic behavior cannot be detected by static analysis. Therefore, attackers can create self-morphing quick apps that may not be detected by malware analysis software deployed on quick app store servers, thus deceiving users into downloading them as legitimate apps. At runtime, attackers can remotely trigger app morphing, execute phishing attacks, or elevate their attacker devices via license escalation. One objective of this invention is to prevent such quick apps from operating further after code changes have been detected. This can be achieved, for example, by notifying users of the attack, allowing for the safe removal of malicious quick apps.

[0012] According to a first embodiment of a first aspect of the present invention, a method for enforcing application security on a computing device is provided. The method includes: receiving a request for access to resources of the computing device from an application adapter of a zip application operating within a host application on the computing device, by the operating system of the computing device. The host application and the application adapter are each associated with a unique user identifier (UID). In response to determining that the request is associated with a resource included in a licensed list of the zip application, the operating system translates the UID of the application adapter to the UID of the host application and determines whether to allow the request based on the UID of the host application. In response to determining that the request is associated with a resource not included in the licensed list of the zip application, the request is associated with a key management service, or the request is associated with a file system, the operating system does not translate the UID of the application adapter to the UID of the host application and determines whether to allow the request based on the UID of the application adapter.

[0013] In some or all examples of the first embodiment of the first aspect, the method further includes executing the request in response to determining the permission request.

[0014] In some or all of the examples of the first embodiment of the first aspect, the quick app and the script engine for executing the quick app operate within a low-privilege application sandbox, wherein access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter.

[0015] In some or all of the examples of the first embodiment of the first aspect, a low-privilege application sandbox provides a runtime environment in which access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter via a bidirectional channel.

[0016] In some or all of the examples of the first embodiment of the first aspect, the quick application is a JavaScript application, the script engine is a JavaScript engine, and the application adapter is a JavaScript engine adapter.

[0017] In some or all examples of the first embodiment of the first aspect, the method further includes: loading a reference fast application within a reference low-privilege application sandbox before operating the fast application, and obtaining the compiled bytecode of the reference fast application; using a cryptographic hash function to generate a cryptographic signature for each divisible portion of the bytecode in the compiled bytecode of the reference fast application; storing the cryptographic signature in a signature cache; and periodically during operation of the fast application: generating a cryptographic signature for each divisible portion of the bytecode of the runtime fast application; determining whether the cryptographic signature of the bytecode of the runtime fast application matches the cryptographic signature of the bytecode of the reference fast application stored in the signature cache; and performing a security action in response to determining that the cryptographic signature of the bytecode of the runtime fast application does not match the cryptographic signature of the bytecode of the reference fast application stored in the signature cache.

[0018] In some or all examples of the first embodiment of the first aspect, the security action includes: terminating the quick application.

[0019] In some or all examples of the first embodiment of the first aspect, the security action includes: generating a user notification.

[0020] In some or all of the examples of the first embodiment of the first aspect, the user notification is a screen notification displayed on the display of a computing device.

[0021] In some or all of the examples of the first embodiment of the first aspect, the on-screen notification is a portion of or overlay of the visual interface screen of the host application in which it operates.

[0022] In some or all of the examples of the first embodiment of the first aspect, each UID is associated with a set of licenses for accessing resources of the computing device, wherein the UID of the host application is granted more licenses than the UID of the application adapter.

[0023] According to a second embodiment of the first aspect of the present invention, a method for enforcing application security on a computing device is provided. Before operating a fast application that operates within a host application on the computing device, a reference fast application is loaded within a reference low-privilege application sandbox, and the compiled bytecode of the reference fast application is obtained; a cryptographic signature is generated for each divisible portion of the bytecode in the compiled bytecode of the reference fast application using a cryptographic hash function; and the cryptographic signature is stored in a signature cache. During operation of the fast application, periodically: a cryptographic signature is generated for each divisible portion of the bytecode of the runtime fast application; it is determined whether the cryptographic signature of the runtime fast application bytecode matches the cryptographic signature of the reference fast application bytecode stored in the signature cache; and in response to determining that the cryptographic signature of the runtime fast application bytecode does not match the cryptographic signature of the reference fast application bytecode stored in the signature cache, a security action is performed.

[0024] In some or all of the examples of the second embodiment of the first aspect, the quick app and the script engine for executing the quick app operate within a low-privilege application sandbox, wherein access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter.

[0025] In some or all examples of the second embodiment of the first aspect, the security action includes terminating the quick application.

[0026] In some or all examples of the second embodiment of the first aspect, the security action includes generating a user notification.

[0027] According to another aspect of the invention, a computing device including a processor and a memory is provided. The memory tangibly stores executable instructions for execution by the processor. In response to execution by the processor, the executable instructions cause the computing device to perform the methods described above and herein. In a first embodiment, the processor is configured to: receive a request for access to resources of the computing device from an application adapter of a hop operating within a host application on the computing device. The host application and the application adapter are each associated with a unique user identifier (UID). In response to determining that the request is associated with a resource included in the license list of the hop, the operating system converts the UID of the application adapter to the UID of the host application and determines whether to allow the request based on the UID of the host application. In response to determining that the request is associated with a resource not included in the license list of the hop, the request is associated with a key management service, or the request is associated with a file system, the operating system does not convert the UID of the application adapter to the UID of the host application and determines whether to allow the request based on the UID of the application adapter.

[0028] According to another aspect of the invention, a non-transitory machine-readable medium is provided having executable instructions tangibly stored thereon for execution by a processor of a computing device. In response to execution by the processor, the executable instructions cause the computing device to perform the methods described above and herein. In a first embodiment, in response to execution by the processor, the executable instructions cause the computing device to: receive, by the operating system of the computing device, a request for access to resources from a fast application operating within a host application on the computing device. The host application and the application adapter are each associated with a unique user identifier (UID). In response to determining that the request is associated with a resource included in the license list of the fast application, the operating system translates the UID of the application adapter to the UID of the host application and determines whether to allow the request based on the UID of the host application. In response to determining that the request is associated with a resource not included in the license list of the fast application, the request is associated with a key management service, or the request is associated with a file system, the operating system does not translate the UID of the application adapter to the UID of the host application and determines whether to allow the request based on the UID of the application adapter.

[0029] Other aspects and features of the invention will become clear to those skilled in the art after reviewing the following description of specific embodiments of the application in conjunction with the accompanying drawings. Attached Figure Description

[0030] Figure 1 It is a block diagram of software architecture based on existing technologies.

[0031] Figure 2 This is a block diagram of an exemplary computing device applicable to practicing the teachings of this invention.

[0032] Figure 3 This is a block diagram of the software architecture according to a first embodiment of the present invention.

[0033] Figure 4 This is a flowchart of a method for enforcing application security on a computing device according to a first embodiment of the present invention.

[0034] Figure 5 This is a block diagram of the software architecture according to a second embodiment of the present invention.

[0035] Figure 6 This is a block diagram of the software architecture according to a third embodiment of the present invention.

[0036] Figure 7 This is a flowchart of a method for enforcing application security on a computing device according to a third embodiment of the present invention. Detailed Implementation

[0037] This invention has been made with reference to the accompanying drawings, in which embodiments are illustrated. However, many different embodiments may be used, and therefore the description should not be construed as limiting it to the embodiments set forth herein. Rather, these embodiments are provided to make this application exhaustive and complete. Where possible, the same reference numerals are used in the drawings and the following description to refer to the same elements, and prime number notation is used in alternative embodiments to indicate similar elements, operations, or steps. The separate blocks or separations of functional elements of the illustrated systems and devices do not necessarily require physical separation of these functions, as communication between these elements can occur without any such physical separation via message passing, function calls, shared memory spaces, etc. Therefore, although functions are shown separately herein for ease of explanation, these functions do not need to be implemented in physically or logically separated platforms. Different devices may have different designs such that while some devices implement some functions in fixed-function hardware, others may implement these functions in a programmable processor with code available from a machine-readable medium. Finally, unless the context explicitly or inherently indicates otherwise, elements referred to in the singular may be plural, and vice versa.

[0038] First refer to Figure 1 , Figure 1 A computing device 102 suitable for practicing the teachings of this invention is shown. The computing device 102 can be a multi-purpose communication device, such as a wired or wireless communication device. Examples of the computing device 102 include, but are not limited to, smartphones, tablet computers, personal cameras or camera peripherals, personal computers such as desktop or laptop computers, smart glasses or other displays mounted on head-mounted devices, smart speakers or smart appliances, and other smart or Internet of Things (IoT) devices, as well as other possibilities. Alternatively, the computing device 102 can be a server, an access point (AP), or a computing system. Figure 1 A single instance of each component is shown. However, each component in computing device 102 can have multiple instances, and it can be implemented using a parallel and / or distributed architecture.

[0039] The computing device 102 includes a processing system comprising a processor 104 (e.g., a microprocessor or central processing unit (CPU)) that controls the overall operation of the computing device 102. The processing system may include one or more other types of processors coupled to the processor 104 for offloading certain computational tasks, such as a graphics processing unit (GPU), tensor processing unit (TPU), neural processing unit (NPU), application-specific integrated circuit (ASIC), or field-programmable gate array (FPGA). The processor 104 is coupled to multiple components via a communication bus (not shown), which provides communication paths between the components and the processor 104. The processor 104 is coupled to random access memory (RAM) 108, read-only memory (ROM) 110, and persistent (non-volatile) memory 112, such as flash memory, and a communication subsystem 130. The communication subsystem 130 includes one or more wireless transceivers for exchanging radio frequency signals with a wireless network. The communication subsystem 130 may also include a wired transceiver for wired communication with a wired network. The wireless transceiver may include one or a combination of the following: a Bluetooth transceiver or other short-range wireless transceiver; a Wi-Fi or other WLAN transceiver for communicating with a WLAN via a wireless local area network (WLAN) access point (AP); or a wireless wide area network (WWAN) transceiver such as a cellular transceiver for communicating with a wireless access network (e.g., a cellular network). The cellular transceiver may communicate with any of a plurality of fixed transceiver base stations of the cellular network within its geographical coverage area. The wireless transceiver may include a multi-band cellular transceiver supporting multiple radio frequency bands. Other types of short-range wireless communication include near-field communication (NFC), IEEE 802.15.3a (also known as Ultra-Wideband (UWB)), Z-Wave, ZigBee, ANT / ANT+, or infrared (e.g., infrared data association (IrDA) communication). Wireless transceivers may include satellite receivers for receiving satellite signals from a satellite network comprising multiple satellites as part of a global or regional satellite navigation system.

[0040] The computing device 102 may also include a microphone 132 and a speaker 134 coupled to the processor 104. The computing device 102 may also include a camera 136, a touchscreen 138, and a satellite receiver 140 for receiving satellite signals from a satellite network, depending on the type of computing device 102. The touchscreen 138 is typically a capacitive touchscreen. The computing device 102 may also include a plurality of sensors 120 coupled to the processor 104. The sensors 120 may include a biometric sensor 122 (e.g., a face scanner or fingerprint scanner), a motion sensor 124 (e.g., an accelerometer), an infrared (IR) sensor 126, and / or a proximity sensor 128. In possible embodiments, the sensors 120 may include other sensors (not shown), such as orientation sensors, electronic compasses, or altimeters. The computing device 102 may also include one or more other input devices 142, such as buttons, switches, dial pads, keyboards or keypads, or navigation tools, depending on the type of computing device 102.

[0041] Memory 112 stores software that can be executed by a processing system to provide operating system 150 (e.g., Android). TM This includes a low-privilege application sandbox 152, such as a JavaScript (JS) engine 154 (e.g., the V8 open-source JavaScript engine developed by the Chromium Project), and an application 158. The low-privilege application sandbox 152 is a special restricted process that executes with least privileges to isolate the sandbox contents from the rest of the system, as will be described in more detail below.

[0042] Operating system 150 provides a visual user interface (VUI) for user interaction with computing device 102 via touch input detected by touchscreen 138 and / or other input devices 142. Application 158 includes at least one host application 160, at least one quick application 162 executing within host application 160, and a scripting language integrity measurement agent, such as a JavaScript integrity measurement agent (JIMA) 164. Host application 160 provides a quick application framework that can launch one or more quick applications 162. An application adapter, such as a JavaScript (JS) engine adapter 156, is provided for each quick application 162. JS engine adapter 156 provides an application programming interface (API) that allows quick applications 162 to access various services of operating system 150, such as memory, camera, keystore, etc. JS engine adapter 156 can run as part of the host application process, and any requests from quick applications 162 to access operating system services must be routed to the host application process via IPC. Alternatively, Quick App 162 has its own JS engine adapter 156, which will interact with the operating system 150.

[0043] Examples of host application 160 include social media applications, messaging applications, web browsers, games, or launcher applications running operating system 110. Memory 112 stores the fast application 162 in bytecode for processing by JavaScript engine 154. Host application 160 can be written in various programming languages.

[0044] Operating system 150 controls inter-process communication (IPC) between processes (e.g., software components or applications 152) and various hardware components of computing device 102. Operating system 150 provides an IPC communication mechanism between the Fast Application framework and processes operating within a low-privilege application sandbox 152 (referred to as sandbox processes). Operating system 150 also grants and denies permissions for applications 152 (e.g., host application 160 and Fast Application 162) to access resources of computing device 102. As described above, Fast Application 162 is a lightweight JavaScript-based application designed to run within host application 160. Fast Application 162 is smaller and faster than host application 160 and resides within the host application boundary.

[0045] JIMA 164 is controlled by operating system 150. Alternatively, JIMA 164 may be part of operating system 150. JIMA 164 makes a copy of the bytecode of quick application 162 before its first launch. JIMA 164 uses a cryptographic hash function to compute a cryptographic signature for each bytecode segment and stores the cryptographic signature in memory 112. When quick application 162 runs, JIMA 164 periodically generates cryptographic signatures for the bytecode segments of a reference quick application running in an isolated sandbox and compares the generated cryptographic signatures with the stored cryptographic signatures to identify any mismatches. A mismatch means that the code of quick application 162 has changed since installation, indicating that quick application 162 may be malicious. In response to the detection of a mismatch, JIMA 164 may send a request to terminate the corresponding quick application 162 to operating system 150. The operation of JIMA 164 will be described in more detail below.

[0046] Memory 112 stores various types of data 170, including sensor data acquired by multiple sensors 120, including sensor data acquired by biometric sensor 122, sensor data acquired by motion sensor 124 (i.e., the accelerometer, gyroscope, or inertial measurement unit (IMU) of computing device 102), sensor data acquired by infrared sensor 126, and sensor data acquired by proximity sensor 128. Memory 112 also stores input data 172 acquired by touchscreen 138 and / or other input devices 142, including user preferences, settings, and possible user data regarding biometric data used for authentication and / or identification, download caches including data downloaded via wireless transceiver, and saved files. System software, software modules, specific device applications, or portions thereof may be temporarily loaded into RAM 108. Communication signals received by computing device 102 may also be stored in RAM 108. While specific functions of various types of memory have been described, this is merely one embodiment, and different functional allocations to memory types may be used in other embodiments.

[0047] The computing device 102 may also include a battery (not shown) as a power source, such as one or more rechargeable batteries that can be charged via a charging circuit coupled to a battery interface (e.g., a serial data port). The battery supplies power to at least some components of the computing device 102, and the battery interface (not shown) provides mechanical and electrical connections to the battery.

[0048] Figure 3This is a block diagram of a software architecture 300 according to an embodiment of the present invention. A host application 160 on a computing device 102 communicates with an operating system 150 to access resources such as user data, hardware, file systems, key configuration data, and cryptographic materials during execution. The host application 160 operates within a logical application boundary 20. The host application has at least one fast application 162. The fast application 162 has corresponding instances of a JavaScript engine 154 and a JavaScript engine adapter 156. The fast application 162 operates within a weak logical application boundary 30.

[0049] As part of the application installation process, operating system 150 assigns a user identifier (UID) to each application 158. For example, when authorizing access to resources of computing device 102, operating system 150 uses the user identifier to associate, evaluate, and execute instructions from each application 158. During the installation process of fast application 162, a unique UID, different from the UID of the host application 162, is assigned to the JavaScript engine adapter 156 of fast application 162. In the example shown, UID0 is assigned to the host application 160, and UID1 is assigned to the JavaScript engine adapter 156 of fast application 162. Normally, a UID cannot be assigned to the JavaScript engine adapter 156. Instead, the JavaScript engine adapter 156 will use the UID of the host application 160. Assigning a UID to the JavaScript engine adapter 156 of fast application 162 is called UID isolation. Figure 3 The logical boundary is indicated by reference numeral 301 in the attached figure. UID isolation aims to prevent the JavaScript engine adapter 156 from having the same permissions and license set as the host application 160, thus at least partially protecting the host application 160 in the event of a breach of the JavaScript engine adapter 156. On portable operating system interfaces (POSIX) and POSIX-like systems, UIDs are one of the primary tools for program isolation. POSIX and POSIX-like systems are operating systems that conform to the portable operating system interface standard. Applications such as host application 160 or quick application 162 can only access resources permitted by the operating system 150 for the application's UID.

[0050] Furthermore, on the mobile system, each UID is also associated with a user-authorized set of licenses that specifies which system services (e.g., hardware sensors) and cryptographic resources (e.g., encryption keys) the application can access. Since the host application 160 may need to support multiple quick applications 162 and act as the administrator of all quick applications 162, the host application 160 can obtain a richer set of licenses from the user and has access to critical configuration data associated with all installed quick applications 162. Because the JavaScript engine adapter 156 is allowed to have the same UID as the host application, there is a risk that these licenses could be granted after a malicious quick application 162 gains control of the JavaScript engine adapter 156.

[0051] JavaScript engine adapter 156 requests access to the file system via system inter-process communication (IPC) 304 or via system calls. System IPC 304 manages shared data of operating system 150. Assigning a unique UID to JavaScript engine adapter 156 changes how system services or the kernel perceive the identity of JavaScript engine adapter 156 when processing a request. This can lead to access denial because the identity associated with the request (e.g., the UID) may not possess the permissions required for the request. In most cases, this result is ideal because it isolates JavaScript engine adapter 156. However, in some cases, denial of service is undesirable. A UID converter 306 is provided to reduce or eliminate unnecessary denial of service. UID converter 306 is part of operating system 150. In some embodiments shown, UID converter 306 may be part of system IPC 304. UID converter 306 selectively converts (transforms) the UID of JavaScript engine adapter 156 to the UID of host application 160 to authorize permissions of host application 160 to JavaScript engine adapter 156 based on each request. UID converter 306 selectively converts the UID of JavaScript engine adapter 156 based on the license list of Quick App 162 (as part of configuration data available only to the administrator) and the requested destination. The license list identifies resources authorized for a specific Quick App 162, such as services of operating system 150. Licenses depend on operating system 150. For example, licenses may include the full set or a subset of operating system 150, such as Android. TM The full set or subset of the license. Examples of licenses include reading / writing device storage, accessing rough / precise location, accessing the camera, accessing the microphone, accessing the internet, reading / writing contacts, and reading / writing the calendar.

[0052] For the permitted services 308 that are allowed to be accessed by Quick App 162 based on the license list of Quick App 162, UID converter 306 converts the UID of JavaScript engine adapter 156 to the UID of host application 160, thereby making the request successful.

[0053] For a denied service 310 that does not allow access to Quick App 162 based on Quick App 162's license list, UID converter 306 does not convert the UID of JavaScript engine adapter 156 to the UID of host application 160, thus rejecting the request.

[0054] For the key management service (KMS) 312, the UID converter 306 does not convert the UID of the JavaScript engine adapter 156 to the UID of the host application 160, thus rejecting the request. In this case, the quick application 162 is identified as the only client of the KMS to prevent cross-client access to key configuration data and cryptographic materials stored in the KMS 312.

[0055] For file system access 314, UID converter 306 does not convert the UID of JavaScript engine adapter 156 back to the UID of host application 160, thus rejecting the request. In this case, the fast application can only access private files owned by the UID of JavaScript engine adapter 156.

[0056] Using the UID isolation described above, the malicious fast application 162 can detach itself from the JavaScript engine's control and manipulate the JavaScript engine adapter 156 to bypass any checks it enforces. However, the malicious fast application 162 will not be able to obtain the permissions and licenses of the host application 160 because the UID of the JavaScript engine adapter 156 is different from that of the host application 160. By separating the UID of the JavaScript engine adapter 156 from that of the host application 160, the compromised JavaScript engine adapter 156 will still be recognized by the operating system 150, but will be recognized as a different application from the host application 160, thereby preventing the malicious fast application 162 from accessing resources that the host application 160 has the right to access.

[0057] Figure 4 This is a flowchart of a method 400 for enforcing application security on a computing device according to a first embodiment of the present invention. At least a portion of method 400 is executed by software executed by a processor 104 of computing device 102. Computing device 102 has a plurality of applications 158 installed, including a host application 160 having a unique UID (UID0 in the illustrated example).

[0058] At operation 402, Quick App 162 is installed on Computing Device 102 along with its JavaScript Engine Adapter 156. During the installation process, a unique UID, different from the UID of the host application 160, is assigned to the JavaScript Engine Adapter 156 of Quick App 162. Quick App 162 can be installed by downloading from an external source.

[0059] At operation 404, launch, run, execute, or operate quick application 162 within host application 160.

[0060] At operation 406, Quick Application 162 requests access to resources of Computing Device 102 via JavaScript Engine Adapter 156. Resources may be user data, hardware, file systems, key configuration data, cryptographic materials, or other resources.

[0061] At operation 408, UID converter 306 determines whether to convert the UID of JavaScript engine adapter 156 to the UID of host application 160 based on the license list of quick application 162 and the destination requested as described above.

[0062] At operation 410, in response to determining that the request is associated with a resource included in the license list of the fast application, operating system 150 converts the UID of JavaScript engine adapter 156 to the UID of host application 160 via UID converter 306, and sends the request along with the converted UID (host application, UID0 in the example shown) to system IPC 304, which determines whether to allow the request based on the converted UID.

[0063] At operation 412, in response to determining that the request is associated with a resource not included in the Quick App's license list, the request is associated with a key management service, or the request is associated with a file system, the operating system 150 does not translate the UID of the JavaScript engine adapter 156 into the host application's UID, and sends the request and the UID of the JavaScript engine adapter 156 (UID1 in the illustrated example) to the system IPC, which determines whether to allow the request based on the UID of the JavaScript engine adapter 156.

[0064] At operation 414, system IPC determines whether to allow the request based on the UID of JavaScript engine adapter 156 or host application 160, as appropriate. At operation 416, system IPC 304 executes the request in response to determining that the request is allowed. At operation 418, system IPC 304 returns an error message or rejection message to quick application 162 in response to determining that the request is rejected. The error message or rejection message is a system IPC, but system messages can trigger on-screen messages sent to the user on computing device 102. Typically, the error message or rejection message is sent by host application 160 (e.g., Android). TM The host application 160 can handle java.lang.SecurityError by displaying an error dialog box or indicating an access denied error message.

[0065] Figure 5 This is a block diagram of a software architecture 320 according to a second embodiment of the present invention. The software architecture 320 is similar to... Figure 3 The software architecture 300 differs in that it also utilizes a low-privilege application sandbox 152, including low-privilege application sandbox isolation. The JavaScript engine 154 is isolated from the rest of the computing environment via the low-privilege application sandbox 152, which is generated by the JavaScript engine adapter 156 of the fast application 162. The implementation of the low-privilege application sandbox 152 is platform-dependent, but for each platform, the low-privilege application sandbox 152 provides a JavaScript runtime environment in which access to external resources is impossible. The low-privilege application sandbox 152 allows untrusted JavaScript code of the fast application 162 and the JavaScript engine 154 to be executed securely. The low-privilege application sandbox 152 implements an isolated JavaScript environment that can be used to manipulate any code without it escaping the low-privilege application sandbox 152. This low-privilege application sandbox 152, combined with UID isolation, provides complete isolation of untrusted code operating within the low-privilege application sandbox 152. The low-privilege application sandbox 152 can be implemented using the isolation services of the operating system 150, such as Android. TM The isolation service is executed using a special isolation process configured to prevent it from accessing any system services or resources and to communicate only with the host process that started the isolation service via the system IPC channel.

[0066] JavaScript engine adapter 156 generates a bidirectional channel for communicating with resources outside the low-privilege application sandbox 152. This bidirectional channel is the only way for the fast application 162 to access resources outside the low-privilege application sandbox 152. Any request to access resources outside the low-privilege application sandbox 152 is subject to permission checks enforced by JavaScript engine adapter 156. Optionally, when the permissions required to allow a request are insufficient, the user's authorization may be requested. For example, instead of denying an insufficiently authorized request, the user may be prompted to authorize one or more required permissions associated with the request. The low-privilege application sandbox 152 further prevents malicious fast applications from escalating permissions and permissions by taking over JavaScript engine adapter 156.

[0067] Figure 6 This is a block diagram of a software architecture 340 according to a third embodiment of the present invention. The software architecture 340 is similar to... Figure 5 The software architecture 320 differs in that it provides a scripting language integrity measurement agent, such as JIMA 164. JIMA 164 periodically monitors the integrity of runtime JavaScript code to detect tampering or self-destructive behavior. JIMA 164 is typically part of the operating system 150, but can be part of the host application 160.

[0068] JIMA 164 uses a reference version of Quick App 162 that operates within the JIMA Reference Low-Privilege Application Sandbox 152i, identified by Reference 162i. When Quick App 162 is about to launch, JIMA 164 loads JavaScript code into the JIMA Reference Low-Privilege Application Sandbox 152i without manipulating (executing) that JavaScript code. The JIMA Reference Low-Privilege Application Sandbox 152i is used to compile the code and generate reference hash signatures for the functions within it, as described herein. Reference Quick App 162i can be provided with UID isolation, as shown in... Figure 6 The logical boundary is identified by reference numeral 301i in the attached figure. Similar to Quick Application 162, Reference Quick Application 162i is loaded within a weak logical boundary 30i within the application boundary 20 of Host Application 160. Although not operated, Reference Quick Application 162i has associated instances of JavaScript Engine 154i and JavaScript Engine Adapter 156i. The cryptographic signature, as described below, may be stored in a signature cache 328 accessible to Host Application 160 or in part of Host Application 160.

[0069] Within the JIMA Reference Low-Privilege Application Sandbox 152i, the compiled bytecode of Reference Quick Application 162i is obtained from the JS JavaScript Engine 154i, and the cryptographic signature (also known as a hash) of the compiled bytecode is generated using a cryptographic hash function such as SHA-256 (Secure Hash Algorithm 256) on each bytecode segment. Instead of calculating a single cryptographic signature based on the entire bytecode of Reference Quick Application 162i, a cryptographic signature is generated for each divisible segment of the bytecode, ensuring that the cryptographic signature remains usable even if the order of the bytecode segments is later shuffled (which may depend on dynamic events occurring within the JavaScript engine). In some examples, each compiled JavaScript function is considered a divisible segment of the bytecode. By using JavaScript functions as the smallest divisible segment of the bytecode, the order in which functions are called does not affect the scheme. Therefore, a cryptographic signature (or hash) is generated for each divisible segment of the bytecode (e.g., each JavaScript function).

[0070] Cryptographic signatures are stored in a signature cache 328. When the fast application 162 runs, based on each divisible part of the bytecode, cryptographic signatures are periodically generated from the regular application low-privilege application sandbox 152, and compared with those in the signature cache to detect any changes in the bytecode. During the comparison, each cryptographic signature of the fast application 162 being operated on is compared with the cryptographic signatures stored in the signature cache 328 in the order of its appearance in the code of the fast application 162, until a match is found or all cryptographic signatures stored in the signature cache 328 have been tried without a match, in which case a mismatch is determined. A mismatch means that the fast application 162 has altered its source code and may be a malicious fast application 162. The interval or frequency of periodic checks can be adjusted to balance security and performance overhead. For example, the check can be performed once at the beginning, once each time the application is operated, once every few minutes, once per minute, or possibly several times per minute. In response to detecting a mismatch between the collected signatures and the cached signatures, JIMA 164 can send a request or instruction to terminate the fast application 162 to the operating system 150. As a supplement to or alternative to the instruction sent to the operating system 150 to terminate the fast application 162, JIMA 164 can also notify the user of a mismatch.

[0071] Because cryptographic signatures are generated at the bytecode level, JIMA 164 can detect any operations in the code of FastApp 162 that might be undetectable by simple static analysis based solely on source code. Another advantage over static analysis is that JIMA modules inspect runtime code. Therefore, it can detect tampering or self-modification behavior after FastApp 162 has been installed. Static analysis, on the other hand, performs only a one-time check.

[0072] Figure 7 This is a flowchart of a method 700 for enforcing application security on a computing device according to a third embodiment of the present invention. At least a portion of method 700 is executed by software executed by processor 104 of computing device 102. Method 700 is similar to method 400 in several respects, except that it includes additional operations of the aforementioned scripting language integrity measurement agent (e.g., JIMA 164).

[0073] At operation 402, Quick App 162 is installed on Computing Device 102 along with its JavaScript Engine Adapter 156. During the installation process, a unique UID, different from the UID of the host application 160, is assigned to the JavaScript Engine Adapter 156 of Quick App 162. Quick App 162 can be installed by downloading from an external source.

[0074] At operation 702, before the fast application 162 is started, run, executed, or operated within the host application 160, the reference fast application 162i is loaded into the JIMA reference low-privilege application sandbox 152i, but is not operated on (e.g., not run), and JIMA 164 obtains the compiled bytecode of the reference fast application 162i.

[0075] At operation 704, before Quick Application 162 is first launched, run, executed, or operated within Host Application 160, JIMA 164 uses a cryptographic hash function to generate a cryptographic signature for each divisible portion of the bytecode in the compiled bytecode of Reference Quick Application 162i. The cryptographic signature is stored in signature cache 328. Signature cache 328 may be generated during the installation of Quick Application 162. Alternatively, signature cache 328 may be generated upon first launch.

[0076] At operation 706, launch, run, execute, or operate quick application 162 within host application 160 in low-privilege application sandbox 152.

[0077] At operation 708, JIMA 164 generates a cryptographic signature of the bytecode for the runtime application 162.

[0078] At operation 710, JIMA 164 compares the cryptographic signature of the bytecode of the runtime Fast Application 162 with the cryptographic signature of the bytecode of the reference Fast Application 162i stored in the signature cache 328 and determines whether the corresponding cryptographic signatures match.

[0079] In response to a mismatch between the cryptographic signature of the bytecode of a running fast application and the cryptographic signature of the bytecode of a reference fast application stored in signature cache 328, a security action is performed. The nature of the security action can be chosen to balance security and performance overhead. In the example shown, at operation 712, in response to a mismatch between the cryptographic signature of the bytecode of a running fast application and the cryptographic signature of the bytecode of a reference fast application stored in signature cache 328, JIMA 164 may send a request or instruction to terminate fast application 162 to operating system 150. Operating system 150 may automatically terminate fast application 162 in response to receiving the request or instruction from JIMA 164. At operation 714, in response to a mismatch between the cryptographic signature of the bytecode of a running fast application and the cryptographic signature of the bytecode of a reference fast application stored in signature cache 328, JIMA 164 may notify the user of the mismatch. User notifications may be on-screen notifications displayed on the display of computing device 102, such as touchscreen 138, for example, as part of or covering the visual interface screen of host application 160 in which quick application 162 operates. Operation 714 may be performed as a supplement to or alternative to the instruction to terminate quick application 162 sent to operating system 150. For example, a prompt may be presented to the user on the display of computing device 102, providing options for continuing, namely terminating quick application 162 or continuing quick application 162.

[0080] Operations 708 through 714 can be executed in response to a timer to ensure that checks are performed periodically.

[0081] Then operations 406 to 418 from method 400 are executed. Alternatively, operations 406 to 418 may be executed before operations 708 to 714.

[0082] Although the above embodiments use a JavaScript engine, it should be understood that the teachings of this invention can be extended to other scripting languages, other scripting engines, and other application adapters with similar functionality.

[0083] Overview

[0084] The steps and / or operations in the flowcharts and figures described herein are for illustrative purposes only. These steps and / or operations can be varied in many ways without departing from the teachings of the invention. For example, steps may be performed in a different order, or steps may be added, deleted, or modified where appropriate.

[0085] In light of the present invention, the software code used to perform the described methods is within the scope of those skilled in the art. Machine-readable code that can be executed by one or more processors of one or more corresponding devices to perform the described methods can be stored in a machine-readable medium such as the memory of a data manager. The terms "software" and "firmware" are interchangeable in this invention and include any computer program stored in memory for execution by a processor, including random access memory (RAM), read-only memory (ROM), EPROM, electrically EPROM (EEPROM), and non-volatile RAM (NVRAM). The above memory types are merely examples and therefore do not limit the types of memory that can be used to store computer programs.

[0086] All values ​​and subranges within the scope of the disclosure are also disclosed. Furthermore, while the systems, devices, and processes disclosed and illustrated herein may include a specific number of elements, these systems, devices, and components may be modified to include more or fewer such elements. Although several exemplary embodiments are described herein, modifications, adjustments, and other implementations are possible. For example, elements shown in the figures may be replaced, added, or modified, and the exemplary methods described herein may be modified by replacing, reordering, or adding steps of the disclosed methods.

[0087] Features from one or more embodiments described above can be selected to create alternative embodiments consisting of sub-combinations of features that may not be explicitly described above. Furthermore, features from one or more embodiments described above can be selected and combined to create alternative embodiments consisting of combinations of features that may not be explicitly described above. The features applicable to such combinations and sub-combinations will be apparent to those skilled in the art when considering the invention as a whole.

[0088] Furthermore, numerous specific details have been set forth to provide a thorough understanding of the exemplary embodiments described herein. However, those skilled in the art will understand that the exemplary embodiments described herein can be practiced without these specific details. Moreover, well-known methods, processes, and elements have not been described in detail so as not to obscure the exemplary embodiments described herein. The subject matter described herein and in the stated claims is intended to cover and encompass all suitable variations of the art.

[0089] Although the invention has been described at least partially in terms of method, those skilled in the art will understand that the invention is also directed to various elements for performing at least some aspects and features of the method, whether by hardware, software, or a combination thereof. Therefore, the technical solutions of the invention can be embodied in a non-volatile or non-transitory machine-readable medium (e.g., optical disc, flash memory, etc.) on which executable instructions tangibly stored thereon, enabling a processing device to perform examples of the methods disclosed herein, are stored.

[0090] The term "processor" can include any programmable system, including those using microprocessors / controllers or nanoprocessors / controllers, central processing units (CPUs), neural processing units (NPUs), tensor processing units (TPUs), hardware accelerators, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), reduced instruction set circuits (RISCs), logic circuits, and any other circuits or processors capable of performing the functions described herein. The term "database" can refer to a data volume, a relational database management system (RDBMS), or both. As used herein, a database can include any dataset, including hierarchical databases, relational databases, flat file databases, object-relational databases, object-oriented databases, and any other structured records or datasets stored in a computer system. The examples above are merely illustrative and are not intended to limit the definition and / or meaning of the terms "processor" or "database" in any way.

[0091] This invention may be embodied in other specific forms without departing from the subject matter of the claims. The exemplary embodiments described are merely illustrative in all respects and not limiting. This invention is intended to cover and encompass all suitable technical modifications. The scope of this invention is therefore described by the appended claims rather than by the foregoing description. The scope of the claims should not be limited by the embodiments set forth in the examples, but should be given the broadest interpretation consistent with the entire description.

Claims

1. A method for enforcing application security on a computing device, characterized in that, include: The operating system of the computing device receives a request to access the resources of the computing device from the application adapter of a fast application running within a host application on the computing device, wherein the host application and the application adapter are each associated with a unique user identifier (UID). In response to determining that the request is associated with a resource included in the license list of the Quick App, the license list identifying resources that have been authorized to subscribe to the Quick App: The operating system converts the UID of the application adapter into the UID of the host application; The operating system determines whether to allow the request based on the UID of the host application; In response to determining that the request is associated with a resource not included in the license list of the Fast App, the request is associated with a key management service, or the request is associated with a file system: The operating system does not convert the UID of the application adapter to the UID of the host application; The operating system determines whether to allow the request based on the UID of the application adapter.

2. The method according to claim 1, characterized in that, Also includes: In response to determining that the request is permitted, the request is executed.

3. The method according to claim 1, characterized in that, The quick application and the script engine used to execute the quick application run within a low-privilege application sandbox, wherein access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter.

4. The method according to claim 3, characterized in that, The low-privilege application sandbox provides a runtime environment in which access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter through a bidirectional channel.

5. The method according to claim 3, characterized in that, The quick application is a JavaScript application, the script engine is a JavaScript engine, and the application adapter is a JavaScript engine adapter.

6. The method according to claim 3, characterized in that, Also includes: Before running the quick application: Load the reference fast application within the reference low-privilege application sandbox and obtain the compiled bytecode of the reference fast application; Use a cryptographic hash function to generate a cryptographic signature for each divisible portion of the bytecode in the compiled bytecode of the reference fast application; The cryptographic signature is stored in a signature cache; The following operations are performed periodically during the operation of the fast application: Generate a cryptographic signature for each divisible portion of the bytecode of the fast application at runtime; Determine whether the cryptographic signature of the bytecode of the fast application at runtime matches the cryptographic signature of the bytecode of the reference fast application stored in the signature cache; In response to the determination that the cryptographic signature of the bytecode of the fast application at runtime does not match the cryptographic signature of the bytecode of the reference fast application stored in the signature cache, a security action is performed.

7. The method according to claim 6, characterized in that, The security action includes terminating the quick application.

8. The method according to claim 6, characterized in that, The security actions include: generating user notifications.

9. The method according to claim 8, characterized in that, The user notification is a screen notification displayed on the monitor of the computing device.

10. The method according to claim 9, characterized in that, The on-screen notification is a portion of or covers the visual interface screen of the host application running the Quick app.

11. The method according to any one of claims 1 to 10, characterized in that, Each UID is associated with a set of permissions to access the resources of the computing device, wherein the UID of the host application is granted more permissions than the UID of the application adapter.

12. A computing device, characterized in that, include: Processor, used for: The operating system of the computing device receives a request to access resources from the application adapter of the fast application running within the host application on the computing device, wherein the host application and the application adapter are each associated with a unique user identifier (UID). In response to determining that the request is associated with a resource included in the license list of the Quick App, the license list identifying resources that have been authorized to subscribe to the Quick App: The operating system converts the UID of the application adapter into the UID of the host application; The operating system determines whether to allow the request based on the UID of the host application; In response to determining that the request is associated with a resource not included in the license list of the Fast App, the request is associated with a key management service, or the request is associated with a file system: The operating system does not convert the UID of the application adapter to the UID of the host application; The operating system determines whether to allow the request based on the UID of the application adapter.

13. The computing device according to claim 12, characterized in that, The processor is also configured to: In response to determining that the request is permitted, the request is executed.

14. The computing device according to any one of claims 12 to 13, characterized in that, The quick application and the script engine used to execute the quick application run within a low-privilege application sandbox, wherein access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter.

15. The computing device according to claim 14, characterized in that, The low-privilege application sandbox provides a runtime environment in which access to resources of the computing device outside the low-privilege application sandbox is controlled by the application adapter through a bidirectional channel.

16. The computing device according to claim 14, characterized in that, The quick application is a JavaScript application, the script engine is a JavaScript engine, and the application adapter is a JavaScript engine adapter.

17. The computing device according to claim 14, characterized in that, The processor is also configured to: Before running the quick application: Load the reference fast application within the reference low-privilege application sandbox and obtain the compiled bytecode of the reference fast application; Use a cryptographic hash function to generate a cryptographic signature for each divisible portion of the bytecode in the compiled bytecode of the reference fast application; The cryptographic signature is stored in a signature cache; The following operations are performed periodically during the operation of the fast application: Generate a cryptographic signature for each divisible portion of the bytecode of the fast application at runtime; Determine whether the cryptographic signature of the bytecode of the fast application at runtime matches the cryptographic signature of the bytecode of the reference fast application stored in the signature cache; In response to the determination that the cryptographic signature of the bytecode of the fast application at runtime does not match the cryptographic signature of the bytecode of the reference fast application stored in the signature cache, a security action is performed.

18. The computing device according to claim 17, characterized in that, The security action includes terminating the quick application.

19. The computing device according to claim 17, characterized in that, The security actions include: generating user notifications.

20. A non-transient machine-readable medium, characterized in that, The non-transitory machine-readable medium stores executable instructions for execution by a processor of a computing device, wherein, in response to execution by the processor, The operating system of the computing device receives a request to access resources from the application adapter of the fast application running within the host application on the computing device, wherein the host application and the application adapter are each associated with a unique user identifier (UID). In response to determining that the request is associated with a resource included in the license list of the Quick App, the license list identifying resources that have been authorized to subscribe to the Quick App: The operating system converts the UID of the application adapter into the UID of the host application; The operating system determines whether to allow the request based on the UID of the host application; In response to determining that the request is associated with a resource not included in the license list of the Fast App, the request is associated with a key management service, or the request is associated with a file system: The operating system does not convert the UID of the application adapter to the UID of the host application; The operating system determines whether to allow the request based on the UID of the application adapter.

Images