Application protection method and device and electronic equipment

Abstract

The embodiment of the invention provides an application protection method and device and electronic equipment, the method can be applied to the electronic equipment, the electronic equipment comprises a first file system and a second file system, and the method comprises the steps that in the starting process of a first application, a code file of the first application is loaded; determining whether the code file of the first application is an encrypted file; when the first application is an encrypted file, reading a code file of the first application through a first file system; and when the file is not the encrypted file, the second file system reads the code file of the first application. According to the method, the device and the electronic equipment, the virtual file system or the encrypted file system is introduced, the encrypted code file and the non-encrypted code file are subjected to shunt processing so as to realize self-adaptive encryption and decryption processing of the code file, the essential logic of application program operation is not changed in the process, the influence on the performance of system hardware is small, and the security of the system is improved. And application double opening, application sharing and rapid application hot repair are supported.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of application protection, and more specifically, to a method, device, and electronic device for application protection. Background Art

[0002] For application security considerations, application developers have a demand for protecting application code. Currently, there are two ways to achieve the protection of application code. One is to use the methods of code obfuscation and code shelling, which are implemented through a virtual machine engine and cannot enjoy the performance optimization of the operating system for the virtual machine, and will increase the workload of the virtual machine engine; the other is to use the methods of code obfuscation and application encryption. The current application encryption method is implemented by the file system, and there are problems such as a decrease in hot start performance and a cumbersome process. Summary of the Invention

[0003] The present application provides a method, device, and electronic device for application protection. Through this method, device, and electronic device, a virtual file system or an encrypted file system is introduced to separate and process encrypted code files and non-encrypted code files, so as to achieve adaptive encryption and decryption processing of code files. This process does not change the essential logic of the application program running, has little impact on the performance of the system hardware, and supports dual-opening of applications, application sharing, and rapid hot-fix of applications.

[0004] In a first aspect, a method for application protection is provided. This method is applied to an electronic device, and the electronic device includes a first file system and a second file system. The method includes: during the startup process of a first application, loading the code file of the first application; determining whether the code file of the first application is an encrypted file; when the code file of the first application is an encrypted file, reading the code file of the first application through the first file system; when the code file of the first application is not an encrypted file, reading the code file of the first application through the second file system.

[0005] In some embodiments, the method can also be described as: during the startup process of a first application, loading the code file of the first application; determining whether the code file of the first application is an encrypted file; determining whether to read the code file of the first application through the first file system or through the second file system according to whether the code file of the first application is an encrypted file.

[0006] In embodiments of the present application, a second file system is introduced to separate and process encrypted code files and non-encrypted code files, so as to achieve adaptive encryption and decryption processing of code files. This process does not change the essential logic of the application program running, has little impact on the performance of the system hardware, and supports dual-opening of applications, application sharing, and rapid hot-fix of applications.

[0007] In combination with the first aspect, in a possible implementation, the first file system is a virtual file system, and the second file system is a real file system. Reading the code file of the first application through the first file system includes: the first file system decrypting the code file of the first application; the second file system reading the decrypted code file of the first application.

[0008] Wherein, the virtual file system can obtain the key for decrypting the code file of the first application, and then decrypt the code file of the first application according to the key in combination with the content and format information of the code file of the first application. It can also be understood that the virtual file system has a decryption function.

[0009] In the embodiments of the present application, during the running of the application program on the device, when the code file of the application program is an encrypted file, it is decrypted by the virtual file system and then read and written by the real file system; when the code file of the application program is not an encrypted file, it is directly read and written by the real file system. This method can realize the adaptive encryption and decryption processing of the code file of the application program by the system, and will not change the essential running logic of the application program, has a small coupling relationship with the original memory management and file management, and can also support scenarios such as dual-opening of applications, sharing of applications, and rapid hot-fix of applications.

[0010] In combination with the first aspect, in a possible implementation, the method further includes: the first file system caching the decrypted code file of the first application.

[0011] In the embodiments of the present application, after the encrypted file is decrypted, the virtual file system caches the decrypted code file. In this way, when the application runs again, there is no need to perform the decryption operation of the code file. That is to say, if the code file of the application program is an encrypted file, it only needs to be decrypted during the first running process, and there is no need to perform the decryption operation during subsequent running processes, which can reduce the performance loss during the hot start of the application program.

[0012] In combination with the first aspect, in a possible implementation, the first file system is a real file system, and the second file system is a real file system. Reading the code file of the first application through the first file system includes: the first file system calling the decryption module to decrypt the code file of the first application; the first file system reading the decrypted code file of the first application.

[0013] In the embodiments of the present application, the read and write operations of the applied code files are distinguished based on real physical storage, that is, the code files of the application are divided into encrypted files and non-encrypted files. The encrypted files are read and written by the encrypted file system, and the non-encrypted files are read and written by the original file system. This method can also achieve the adaptive encryption and decryption processing of the code files of the application program by the system, and will not change the essential running logic of the application program, and can also support scenarios such as dual-opening of applications, sharing of applications, and rapid hot-fix of applications.

[0014] In combination with the first aspect, in a possible implementation manner, the method further includes: obtaining a first key, where the first key is used to decrypt the code file of the first application.

[0015] In a second aspect, an apparatus for application protection is provided. The apparatus includes: a memory management module, configured to load the code file of the first application during the startup process of the first application; a determination module, configured to determine whether the code file of the first application is an encrypted file; a first file system, configured to participate in reading the code file of the first application when the code file of the first application is an encrypted file; and a second file system, configured to read the code file of the first application when the code file of the first application is not an encrypted file.

[0016] In the embodiments of the present application, a second file system is introduced to separate and process encrypted code files and non-encrypted code files to achieve the adaptive encryption and decryption processing of code files. This process does not change the essential logic of the application program running, has little impact on the performance of the system hardware, and supports dual-opening of applications, sharing of applications, and rapid hot-fix of applications.

[0017] In combination with the second aspect, in a possible implementation manner, the first file system is a virtual file system, and the second file system is a real file system. The first file system is specifically configured to: decrypt the code file of the first application; and the second file system is further configured to: read the decrypted code file of the first application.

[0018] In the embodiments of the present application, during the running process of the application program on the device, when the code file of the application program is an encrypted file, it is decrypted by the virtual file system and then read and written by the real file system; when the code file of the application program is not an encrypted file, it is directly read and written by the real file system. This method can achieve the adaptive encryption and decryption processing of the code files of the application program by the system, and will not change the essential running logic of the application program, has a small coupling relationship with the original memory management and file management, and can also support scenarios such as dual-opening of applications, sharing of applications, and rapid hot-fix of applications.

[0019] In combination with the second aspect, in a possible implementation manner, the first file system is further configured to: cache the decrypted code file of the first application.

[0020] In the embodiment of the present application, after the encrypted file is decrypted, the virtual file system caches the decrypted code file. In this way, when the application runs again, there is no need to perform the decryption operation on the code file anymore. That is to say, if the code file of the application is an encrypted file, it only needs to be decrypted during the first run, and there is no need to perform the decryption operation during subsequent runs, which can reduce the performance loss during the warm start of the application.

[0021] In combination with the second aspect, in a possible implementation manner, the first file system is a real file system, the second file system is a real file system, and the first file system is specifically used for: calling the decryption module to decrypt the code file of the first application; reading the decrypted code file of the first application.

[0022] In the embodiment of the present application, the read and write operations of the code file of the application are distinguished based on the real physical storage, that is, the code file of the application is divided into an encrypted file and a non-encrypted file. The encrypted file is read and written by the encrypted file system, and the non-encrypted file is read and written by the original file system. This method can also implement the adaptive encryption and decryption processing of the code file of the application by the system, and will not change the essential running logic of the application, and can also support scenarios such as dual-opening of applications, sharing of applications, and quick hot-fix of applications.

[0023] In combination with the second aspect, in a possible implementation manner, the device further includes: an acquisition module, configured to acquire a first key, and the first key is used to decrypt the code file of the first application.

[0024] In a third aspect, an electronic device is provided, which includes a memory and a processor. Among them, the memory is used to store computer program code, and the processor is used to execute the computer program code stored in the memory to implement the method in the first aspect or any possible implementation manner in the first aspect.

[0025] In a fourth aspect, a computer-readable storage medium is provided, in which computer programs or instructions are stored. When the computer programs or instructions are executed, the method in the first aspect or any possible implementation manner in the first aspect is implemented.

[0026] In a fifth aspect, a chip is provided, in which instructions are stored. When it runs on a device, the chip executes the method in the first aspect or any possible implementation manner in the first aspect. Description of the Drawings

[0027] Figure 1 is a schematic structural diagram of the electronic device provided by the embodiment of the present application;

[0028] Figure 2 It is a software structure block diagram of an electronic device provided by an embodiment of the present application;

[0029] Figure 3 It is a schematic flowchart of a method for application protection;

[0030] Figure 4 It is a schematic flowchart of another method for application protection;

[0031] Figure 5 It is an application protection scenario diagram provided by an embodiment of the present application;

[0032] Figure 6 It is a system architecture diagram corresponding to application protection provided by an embodiment of the present application;

[0033] Figure 7 It is a schematic flowchart of a method for application protection provided by an embodiment of the present application;

[0034] Figure 8 It is a schematic flowchart of yet another method for application protection provided by an embodiment of the present application;

[0035] Figure 9 It is a schematic diagram of the execution process of application protection provided by an embodiment of the present application;

[0036] Figure 10 It is an interactive comparison diagram corresponding to an existing solution and the solution of the present application provided by an embodiment of the present application;

[0037] Figure 11 It is yet another system architecture diagram corresponding to application protection provided by an embodiment of the present application;

[0038] Figure 12 It is a schematic flowchart of yet another method for application protection provided by an embodiment of the present application;

[0039] Figure 13 It shows a schematic diagram of the execution process of yet another application protection provided by an embodiment of the present application. Detailed implementation manners

[0040] Next, the technical solutions in the present application will be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments.

[0041] The following will describe the technical solutions in the embodiments of the present application in conjunction with the accompanying drawings in the embodiments of the present application. Among them, in the description of the embodiments of the present application, unless otherwise specified, " / " means "or". For example, A / B may mean A or B. The "and / or" herein is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of the present application, "a plurality of" or "multiple" means two or more than two.

[0042] Hereinafter, the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of this embodiment, unless otherwise specified, the meaning of "a plurality of" is two or more than two.

[0043] The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and claims of the present application, the singular forms "a", "an", "the", "above-mentioned", "said", and "this" are also intended to include the form of "one or more", unless the context clearly indicates otherwise. It should also be understood that in the following embodiments of the present application, "at least one" and "one or more" mean one, two, or more than two. The term "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist; for example, A and / or B may mean: A exists alone, A and B exist simultaneously, and B exists alone, where A and B may be singular or plural. The character " / " generally means that the associated objects before and after are in an "or" relationship.

[0044] The reference to "one embodiment" or "some embodiments" etc. described in this specification means that a specific feature, structure, or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, statements such as "one embodiment", "some embodiments", "another embodiment", "some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "include", "comprise", "have" and their variants all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0045] The method provided by the embodiments of the present application can be applied to electronic devices with a time display function or a time recognition function. For example, it can be applied to mobile phones, tablet computers, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), smart home devices, and other electronic devices. The embodiments of the present application do not impose any restrictions on the specific types of electronic devices.

[0046] Exemplarily, Figure 1 FIG. shows a schematic structural diagram of an electronic device 100. The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0047] It can be understood that the structure schematically shown in the embodiments of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or have different component arrangements. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0048] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0049] Among them, the controller may be the nerve center and command center of the electronic device 100. The controller may generate operation control signals according to the instruction operation code and timing signals to complete the control of fetching and executing instructions.

[0050] A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory may save the instructions or data that the processor 110 has just used or recycled. If the processor 110 needs to use the instruction or data again, it can directly call it from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0051] In some embodiments, the processor 110 may include one or more interfaces. The interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0052] The USB interface 130 is an interface that complies with the USB standard specification. Specifically, it can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and peripheral devices. It can also be used to connect headphones to play audio. This interface can also be used to connect other electronic devices, such as AR devices, etc.

[0053] It can be understood that the interface connection relationship between the modules illustrated in the embodiments of the present application is only for illustrative purposes and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 can also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0054] The charging management module 140 is used to receive a charging input from a charger. Among them, the charger can be a wireless charger or a wired charger. In some embodiments of wired charging, the charging management module 140 can receive the charging input of the wired charger through the USB interface 130. In some embodiments of wireless charging, the charging management module 140 can receive the wireless charging input through the wireless charging coil of the electronic device 100. While charging the battery 142, the charging management module 140 can also supply power to the electronic device through the power management module 141.

[0055] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives the input from the battery 142 and / or the charging management module 140 and supplies power to the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, the wireless communication module 160, etc. The power management module 141 can also be used to monitor parameters such as the battery capacity, the number of battery cycles, and the battery health status (leakage, impedance). In some other embodiments, the power management module 141 can also be provided in the processor 110. In some other embodiments, the power management module 141 and the charging management module 140 can also be provided in the same device.

[0056] The wireless communication function of the electronic device 100 can be implemented through antenna 1, antenna 2, the mobile communication module 150, the wireless communication module 160, the modulation and demodulation processor, and the baseband processor, etc.

[0057] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be multiplexed to improve the utilization rate of the antennas. For example: Antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0058] The mobile communication module 150 may provide a solution for wireless communication including 2G / 3G / 4G / 5G, etc. applied to the electronic device 100. The mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 150 may receive electromagnetic waves through the antenna 1, filter, amplify, etc. the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 may also amplify the signal modulated by the modulation and demodulation processor and convert it into electromagnetic waves through the antenna 1 for radiation. In some embodiments, at least some functional modules of the mobile communication module 150 may be disposed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 150 and at least some modules of the processor 110 may be disposed in the same device.

[0059] The modulation and demodulation processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. Subsequently, the demodulator transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After being processed by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs a sound signal through an audio device (not limited to the speaker 170A, receiver 170B, etc.), or displays an image or video through the display screen 194. In some embodiments, the modulation and demodulation processor may be an independent device. In other embodiments, the modulation and demodulation processor may be independent of the processor 110 and disposed in the same device as the mobile communication module 150 or other functional modules.

[0060] The wireless communication module 160 may provide solutions for wireless communications applied to the electronic device 100, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite systems (GNSSs), frequency modulation (FM), near field communication (NFC), infrared (IR), etc. The wireless communication module 160 may be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, performs frequency modulation and filtering processing on the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 may also receive signals to be sent from the processor 110, perform frequency modulation and amplification on them, and convert them into electromagnetic waves through the antenna 2 for radiation.

[0061] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, enabling electronic device 100 to communicate with a network and other devices via wireless communication technologies. The wireless communication technologies may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time-Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology, etc. The GNSS may include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS), and / or Satellite Based Augmentation Systems (SBAS).

[0062] Electronic device 100 implements a display function via a GPU, display screen 194, and an application processor, etc. The GPU is a microprocessor for image processing, connected to display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0063] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a Miniled, a MicroLed, a Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include one or N display screens 194, where N is a positive integer greater than 1.

[0064] The electronic device 100 can implement the shooting function through the ISP, the camera 193, the video codec, the GPU, the display screen 194, and the application processor, etc.

[0065] The ISP is used to process the data fed back by the camera 193. For example, when taking a photo, the shutter is opened, and light passes through the lens and is transmitted to the camera sensor. The light signal is converted into an electrical signal, and the camera sensor transmits the electrical signal to the ISP for processing and converts it into an image visible to the naked eye. The ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. The ISP can also optimize parameters such as the exposure and color temperature of the shooting scene. In some embodiments, the ISP can be set in the camera 193.

[0066] The camera 193 is used to capture static images or videos. An object generates an optical image through the lens and projects it onto the sensor. The sensor can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The sensor converts the light signal into an electrical signal, and then transmits the electrical signal to the ISP to convert it into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard format such as RGB or YUV. In some embodiments, the electronic device 100 may include one or N cameras 193, where N is a positive integer greater than 1.

[0067] The digital signal processor is used to process digital signals. In addition to processing digital image signals, it can also process other digital signals. For example, when the electronic device 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy, etc.

[0068] The video codec is used to compress or decompress digital videos. The electronic device 100 can support one or more video codecs. In this way, the electronic device 100 can play or record videos in multiple coding formats, such as: Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0069] The NPU is a neural-network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission pattern between human brain neurons, it can quickly process input information and can also continuously self-learn. Through the NPU, applications such as intelligent cognition of the electronic device 100 can be realized, such as: image recognition, face recognition, speech recognition, text understanding, etc.

[0070] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement the data storage function. For example, files such as music and videos are saved in the external memory card.

[0071] The internal memory 121 can be used to store computer-executable program code, and the executable program code includes instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 can include a program storage area and a data storage area. Among them, the program storage area can store the operating system, apps required for at least one function (such as the sound playback function, the image playback function, etc.). The data storage area can store data created during the use of the electronic device 100 (such as audio data, phone book, etc.). In addition, the internal memory 121 can include high-speed random access memory and can also include non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0072] The electronic device 100 can implement audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor, etc. For example, music playback, recording, etc.

[0073] The audio module 170 is used to convert digital audio information into an analog audio signal for output, and is also used to convert an analog audio input into a digital audio signal. The audio module 170 can also be used for encoding and decoding audio signals. In some embodiments, the audio module 170 can be disposed in the processor 110, or some functional modules of the audio module 170 can be disposed in the processor 110.

[0074] The speaker 170A, also known as a "loudspeaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or hands-free calls through the speaker 170A.

[0075] The receiver 170B, also known as an "earpiece", is used to convert an audio electrical signal into a sound signal. When the electronic device 100 answers a call or a voice message, the voice can be listened to by placing the receiver 170B close to the ear.

[0076] The microphone 170C, also known as a "microphone" or "transmitter", is used to convert a sound signal into an electrical signal. When making a call or sending a voice message, the user can speak close to the microphone 170C, and input the sound signal into the microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In some other embodiments, the electronic device 100 can be provided with two microphones 170C, which can not only collect sound signals but also implement a noise reduction function. In some other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C, which can collect sound signals, reduce noise, identify the sound source, and implement functions such as directional recording.

[0077] The headphone jack 170D is used to connect a wired headphone. The headphone jack 170D can be a USB interface 130, or a 3.5 mm open mobile terminal platform (OMTP) standard interface, or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0078] The keys 190 include a power-on key, volume keys, etc. The keys 190 can be mechanical keys or touch keys. The electronic device 100 can receive key inputs and generate key signal inputs related to the user settings and function controls of the electronic device 100.

[0079] The motor 191 can generate vibration prompts. The motor 191 can be used for incoming call vibration prompts and also for touch vibration feedback. For example, touch operations on different applications (such as taking pictures, audio playing, etc.) can correspond to different vibration feedback effects. For touch operations on different areas of the display screen 194, the motor 191 can also correspond to different vibration feedback effects. Different application scenarios (such as time reminder, receiving messages, alarm clock, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0080] The indicator 192 can be an indicator light and can be used to indicate the charging state, power change, and can also be used to indicate messages, missed calls, notifications, etc.

[0081] The SIM card interface 195 is used to connect the SIM card. The SIM card can be in contact with and separated from the electronic device 100 by being inserted into or pulled out of the SIM card interface 195. The electronic device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The electronic device 100 interacts with the network through the SIM card to implement functions such as calls and data communication. In some embodiments, the electronic device 100 uses an embedded SIM (eSIM) card, that is, an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0082] It should be understood that the phone cards in the embodiments of the present application include but are not limited to SIM cards, eSIM cards, universal subscriber identity module (USIM), universal integrated circuit card (UICC), and so on.

[0083] The software system of the electronic device 100 can adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservices architecture, or a cloud architecture. In the embodiments of the present application, the Android system with a layered architecture is taken as an example to exemplarily illustrate the software structure of the electronic device 100.

[0084] Figure 2It is a software structure block diagram of the electronic device 100 according to an embodiment of the present application. The layered architecture divides the software into several layers, and each layer has a clear role and division of labor. Communication between layers is carried out through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom are the application layer, the application framework layer, the Android runtime and the system libraries, and the kernel layer. The application layer may include a series of application packages.

[0085] As Figure 2 shown, the application packages may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.

[0086] The application framework layer provides application programming interfaces (APIs) and programming frameworks for the applications in the application layer. The application framework layer includes some predefined functions.

[0087] As Figure 2 shown, the application framework layer may include a window manager, a content provider, a view system, a telephone manager, a resource manager, a notification manager, etc.

[0088] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0089] The content provider is used to store and obtain data, and make this data accessible to applications. The data may include video, image, audio, dialed and answered calls, browsing history and bookmarks, phone book, etc.

[0090] The view system includes visible controls, such as controls for displaying text, controls for displaying pictures, etc. The view system can be used to build applications. The display interface can be composed of one or more views. For example, a display interface including a short message notification icon may include a view for displaying text and a view for displaying pictures.

[0091] The telephone manager is used to provide the communication function of the electronic device 100. For example, the management of call states (including connection, disconnection, etc.).

[0092] The resource manager provides various resources for applications, such as localized strings, icons, pictures, layout files, video files, and so on.

[0093] The notification manager enables an application to display notification information in the status bar. It can be used to convey messages of the notification type, and can automatically disappear after a short stay without user interaction. For example, the notification manager is used to inform that a download is completed, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as a notification of a background-running application, or a notification that appears on the screen in the form of a dialogue window. For example, it prompts text information in the status bar, emits a prompt tone, the electronic device vibrates, the indicator light flashes, etc.

[0094] The Android Runtime includes core libraries and a virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.

[0095] The core libraries consist of two parts: one part is the functional functions that the Java language needs to call, and the other part is the core libraries of Android.

[0096] The application layer and the application framework layer run in the virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as the management of object life cycles, stack management, thread management, security and exception management, and garbage collection.

[0097] The system libraries can include multiple functional modules. For example: surface manager, media libraries, 3D graphics processing libraries (such as: OpenGL ES), 2D graphics engines (such as: SGL), etc.

[0098] The surface manager is used to manage the display subsystem and provides the fusion of 2D and 3D layers for multiple applications.

[0099] The media libraries support the playback and recording of multiple common audio and video formats, as well as static image files, etc. The media libraries can support multiple audio and video coding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0100] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, synthesis, and layer processing, etc.

[0101] The 2D graphics engine is the graphics engine for 2D drawing.

[0102] The kernel layer is the layer between the hardware and the software. The kernel layer at least includes a display driver, a camera driver, an audio driver, and a sensor driver.

[0103] It should be understood that the technical solutions in the embodiments of the present application can be used in systems such as Android, IOS, HarmonyOS, etc.

[0104] The technical solution of the embodiment of the present application can be applied to the application development process and also to the running process of the application. Specifically, it can be applied to the application protection scenario in the application development or running process.

[0105] Among them, the application can be installed on an electronic device, which can be a television, a desktop computer, a laptop computer, or a portable electronic device, such as a mobile phone, a folding screen, a tablet computer, a camera, a video camera, a video recorder, or a smart home device, such as a refrigerator, a washing machine, a floor sweeper, etc., or an electronic device in a 5G network or an electronic device in a future evolved public land mobile network (PLMN).

[0106] For application security considerations, application developers have a need to protect application code. Currently, there are two ways to achieve the protection of application code. One is to use code obfuscation and code shelling methods, which are implemented through a virtual machine engine and cannot enjoy the performance optimization of the operating system for the virtual machine, and will increase the workload of the virtual machine engine; the other is to use code obfuscation and application encryption methods. The current application encryption method is implemented by the file system, and there are problems such as a decrease in hot start performance and a cumbersome process.

[0107] Hereinafter, in combination with Figure 3 and Figure 4 , the existing two methods for protecting application code will be introduced respectively.

[0108] Exemplarily, Figure 3 shows a schematic flowchart of a method 300 for application protection. As Figure 3 shown, the method 300 includes:

[0109] S301: Extract partial code from the application code and transform the partial code into intermediate code.

[0110] S302: During the running process of the application, the virtual machine engine interprets the intermediate code.

[0111] This method is based on the typical VMP shelling principle. The VMP shelling principle is an encryption shell used to protect critical code segments, mainly achieved through code obfuscation and virtual machine technology. The specific principle can be explained as follows: Extract local code from the application code and transform it into intermediate code. During the running process of the application, the virtual machine engine interprets this intermediate code, replacing the step of the CPU interpreting and executing the code, and then jumps back to the source address. In this method, every time the application runs, the virtual machine engine needs to interpret the intermediate code once. Moreover, since the execution entity of this method is the virtual machine engine, the operating system cannot optimize the performance of the virtual machine during the running process of the application. Additionally, the virtual machine engine itself needs to execute operations such as parsing a custom instruction set, making conversions, and cross-function calls. In this method, the virtual machine engine also needs to interpret the intermediate code every time the process runs, increasing its workload and resulting in a decline in the performance of the virtual machine engine.

[0112] Exemplarily, Figure 4 FIG. shows a schematic flowchart of another method 400 for protecting an application. As Figure 4 shown, the method 400 includes:

[0113] S401: When the application is put on the shelf, encrypt the internal execution file.

[0114] S402: During the running process of the application, read the internal execution file through the file system and the encryption and decryption interface.

[0115] In this method, directly performing the decryption operation of the application code by the file system will lead to a decline in the hot start performance and cannot support fast hot start. Moreover, since the encryption and decryption operations need to be performed every time a call is made (i.e., every time the application runs), it cannot support scenarios such as dual-opening and sharing of applications, nor can it support scenarios such as fast hot fix of applications.

[0116] In summary, the existing application protection methods have a greater impact on the performance of system hardware; and they cannot support scenarios such as dual-opening of applications, sharing of applications, and fast hot fix of applications.

[0117] In view of this, the embodiments of the present application provide a method, device, and electronic device for protecting an application. In this method, a virtual file system or an encrypted file system is introduced, and the encrypted code file and the non-encrypted code file are separated and processed through the virtual file system or the encrypted file system, enabling adaptive encryption and decryption processing of the application execution code. Moreover, this method does not change the essential logic of the application running process, has a small impact on the performance of system hardware, and can support scenarios such as dual-opening of applications, sharing of applications, and fast hot fix of applications.

[0118] Exemplarily, Figure 5 FIG. shows a scenario diagram for protecting an application provided by the embodiments of the present application. As Figure 5As shown in the figure, the application protection scenario may include the application development stage, the application listing stage, and the application installation and running stage. Among them, in the application development stage, the application developer develops an encrypted APP; in the application listing stage, the developed application is listed on the application market, and the encrypted operation is also performed on the listed application in this application listing stage; in the application installation and running stage, the encrypted application is decrypted, specifically, it can be decrypted when the application runs. In addition, the encrypted application can also be stored on the terminal side.

[0119] It should be understood that the embodiments provided in this application are mainly carried out in the application installation and running stage.

[0120] Exemplarily, Figure 6 The figure shows a system architecture diagram corresponding to the application protection provided by the embodiments of this application. As Figure 6 shown in the figure, the system architecture includes a user space and a kernel space. Among them, the user space includes one or more application programs; the kernel space includes a system call module, a memory management module, a virtual file system, and a file system. Among them, the virtual file system can implement page cache, directory entry cache, and inode cache.

[0121] Specifically, during the startup process of the application program, the memory management module loads the code file of the application program. When the code file is an encrypted file, the encrypted file is decrypted through the virtual file system, and the decrypted code file is further read and written by the file system; when the code file is a non-encrypted file, the code file is directly read and written by the file system.

[0122] Exemplarily, Figure 7 The figure shows a schematic flowchart of a method 700 for application protection provided by the embodiments of this application. As Figure 7 shown in the figure, the method 700 includes:

[0123] S701: During the application startup process, the memory management module loads the code file of the application program.

[0124] S702: Determine whether the code file is an encrypted file. If so, execute S703; if not, execute S705.

[0125] In one implementation, the memory management module determines whether the code file is an encrypted file.

[0126] In another implementation, the file system determines whether the code file is an encrypted file.

[0127] In another implementation, a separate determination module determines whether the code file is an encrypted file.

[0128] S703: The virtual file system decrypts the code file and further executes S704 and S705.

[0129] In some embodiments, during the download and installation of an application, the device on which the application is installed and the application market obtain the key of the encrypted file of the application through key negotiation, and the virtual file system decrypts the code file with this key.

[0130] S704: The virtual file system caches the decrypted code file.

[0131] Among them, after the encrypted file is decrypted, the virtual file system caches the decrypted code file. In this way, when the application runs again, there is no need to perform the decryption operation of the code file again. That is to say, if the code file of the application is an encrypted file, it only needs to be decrypted during the first run, and there is no need to perform the decryption operation during subsequent runs, which can reduce the performance loss during the warm start of the application.

[0132] S705: Read and write the code file through the file system, or read and write the decrypted code file through the file system.

[0133] In the embodiments of the present application, after the application program is encrypted, during the running process of the application program on the device, the operating system of the device can automatically identify whether the code file of the application program is an encrypted file. When it is an encrypted file, it is decrypted by the virtual file system and then read and written by the file system; when it is not an encrypted file, it is directly read and written by the file system. This method can realize the adaptive encryption and decryption processing of the code file of the application program by the system, and does not change the essential running logic of the application program, has a small coupling relationship with the original memory management and file management, and can also support scenarios such as dual-opening of applications, sharing of applications, and fast hot-fix of applications.

[0134] Exemplarily, Figure 8 shows a schematic flowchart of another application protection method 800 provided by the embodiments of the present application. As Figure 8 shown, the method 800 includes:

[0135] S801: When the application is put on the application market, encrypt the internal execution file of the application to obtain an encrypted file and save the key well.

[0136] S802: When the application is downloaded and installed, the encrypted file is installed on the device side together with the installation package, and at the same time, the key is sent to the device through key negotiation.

[0137] In some embodiments, the user downloads and installs an application through the application market on the device side; the user can also download and install the application through a browser; the user can also download and install the application through the received installation package; in addition, the user can also download and install the application through other means, which is not limited in this application.

[0138] S803: When the application starts, the kernel obtains the key information corresponding to the encrypted file.

[0139] In some embodiments, the kernel obtains the key information corresponding to the encrypted file through the upper-layer decryption service.

[0140] S804: During the application startup process, the memory management module loads the code file corresponding to the application.

[0141] In some embodiments, the memory management module loads the code file corresponding to the application from the file system.

[0142] S805: Determine whether the code file is an encrypted file. If so, execute S806; if not, execute S808.

[0143] S806: The virtual file system decrypts the code file according to the key and further executes S807 and S808.

[0144] S807: The virtual file system caches the decrypted code file.

[0145] S808: Read and write the code file through the file system, or read and write the decrypted code file through the file system.

[0146] Among them, the explanations for S804 to S808 are the same as those for S701 to S705 in the Figure 7 illustrated embodiment. For the sake of brevity, they will not be elaborated here.

[0147] Exemplarily, Figure 9 shows a schematic diagram of the execution process of an application protection provided by an embodiment of the present application.

[0148] As Figure 9As shown, during the application development stage, the source code is transformed into bytecode format by a compiler. After the application development is completed, the application is put on the shelves. When the application is put on the shelves, the internal execution code (original code) of the application is encrypted to achieve the encryption of the application. After the application is downloaded and installed on the device side, when the application runs, the code file of the protected application process (i.e., the application process with application encryption) flows to the file system. After the application process applies for memory from the memory management module, the memory management module loads the code file of the application process from the file system. When the loaded code file is an unencrypted file, the code file is directly read and written by the file system. When the loaded code file is an encrypted file, the virtual file system decrypts the code file, and then the file system reads and writes the decrypted file.

[0149] Exemplarily, Figure 10 Fig. shows an interaction comparison diagram corresponding to an existing solution provided by an embodiment of the present application and the solution of the present application.

[0150] As Figure 10 shown in (a) of, in the existing solution currently, the application program applies for memory from the memory management module, and loads memory pages through the file system. After the memory management module loads the code file, the file system reads and writes it.

[0151] As Figure 10 shown in (b) of, in the solution of the present application, the application program applies for memory from the memory management module, and loads memory pages through the virtual file system and the file system. When the memory management module loads the code file, if the code file is an encrypted file, the virtual file system obtains the encrypted file handle, and further replaces the encrypted file handle, and the virtual file system decrypts the encrypted file to obtain a plaintext page and caches the plaintext page.

[0152] Exemplarily, Figure 11 Fig. shows another system architecture diagram corresponding to application protection provided by an embodiment of the present application. As Figure 11 shown, the system architecture includes a user space and a kernel space. Among them, the user space includes one or more application programs; the kernel space includes a system call module, a memory management module, an encrypted file system, a decryption module, and a file system.

[0153] Specifically, during the startup process of the application program, the memory management module loads the code file of the application program. When the code file is an encrypted file, the encrypted file is decrypted and read and written through the encrypted file system and the decryption module. When the code file is an unencrypted file, the code file is directly read and written through the file system.

[0154] Exemplarily, Figure 12 Fig. shows a schematic flowchart of another application protection method 1200 provided by an embodiment of the present application.Figure 12 As shown in , the method 1200 includes:

[0155] S1201: During the application startup process, the memory management module loads the code file corresponding to the application.

[0156] S1202: Determine whether the code file is an encrypted file. If so, execute S1203; if not, execute S1204.

[0157] Among them, the explanation of this step is the same as the explanation of S702 in the Figure 7 illustrated embodiment. For the sake of brevity, it will not be elaborated here.

[0158] S1203: Decrypt the code file through the encrypted file system and read and write the decrypted code file.

[0159] In some embodiments, after receiving the encrypted file, the encrypted file system stores the encrypted file in the encrypted file system, first decrypts the stored encrypted file through the decryption module, and after the decryption is completed, the encrypted file system reads and writes the decrypted code file.

[0160] It should be understood that the functions of the encrypted file system combined with the decryption module are not limited to the decryption and reading and writing operations of the code file.

[0161] Among them, the encrypted file system is a real file system, not a virtual file system.

[0162] S1204: Read and write the code file through the file system.

[0163] In the embodiments of the present application, the reading and writing operations of the application file are distinguished based on the real physical storage, that is, the code file of the application is divided into an encrypted file and a non-encrypted file. The encrypted file is read and written by the encrypted file system, and the non-encrypted file is read and written by the file system. This method can also implement the adaptive encryption and decryption processing of the code file of the application program by the system, and will not change the essential running logic of the application program, and can also support scenarios such as dual-opening of applications, application sharing, and rapid hot-fix of applications.

[0164] Exemplarily, Figure 13 shows another execution flow diagram of application protection provided by the embodiments of the present application.

[0165] As Figure 13As shown, during the application development stage, the source code is transformed into bytecode format by a compiler. After the application development is completed, the application is put on the shelves. When the application is put on the shelves, the internal execution code (original code) of the application is encrypted to achieve the encryption of the application. After the application is downloaded and installed on the device side, when the application runs, the code file of the protected application process (i.e., the application process with application encryption) flows to the file system. After the application process applies for memory from the internal management module, the memory management module loads the code file of the application process from the file system. When the loaded code file is an unencrypted file, the code file is directly read and written by the file system. When the loaded code file is an encrypted file, the encrypted file system stores the code file, and the decryption module decrypts the code file. The decrypted code file is read and written by the encrypted file system.

[0166] One or more of the modules or units described in this article can be implemented in software, hardware, or a combination of both. When any of the above modules or units is implemented in software, the software exists in the form of computer program instructions and is stored in the memory. The processor can be used to execute the program instructions and implement the above method flow. The processor can include, but is not limited to, at least one of the following: central processing unit (CPU), microprocessor, digital signal processor (DSP), microcontroller unit (MCU), or artificial intelligence processor and other types of computing devices that run software. Each computing device can include one or more cores for executing software instructions for arithmetic or processing. The processor can be built into a system on a chip (SoC) or an application-specific integrated circuit (ASIC), or it can be an independent semiconductor chip. In addition to the cores in the processor for executing software instructions for arithmetic or processing, it can further include necessary hardware accelerators, such as field programmable gate array (FPGA), programmable logic device (PLD), or logic circuits for implementing dedicated logic operations.

[0167] When the modules or units described in this article are implemented in hardware, the hardware can be any one or any combination of CPU, microprocessor, DSP, MCU, artificial intelligence processor, ASIC, SoC, FPGA, PLD, dedicated digital circuit, hardware accelerator, or non-integrated discrete devices, which can run the necessary software or execute the above method flow without relying on software.

[0168] When the modules or units described in this specification are implemented in software, they can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of this application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (such as coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more integrated available media. The available medium can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0169] Those of ordinary skill in the art will appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans can use different methods for each specific application to implement the described functions, but such implementation should not be considered to exceed the scope of this application.

[0170] Those skilled in the art can clearly understand that for the sake of convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0171] In several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there can be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings, direct couplings, or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of devices or units can be in electrical, mechanical, or other forms.

[0172] The unit described as a separation component may or may not be physically separated. The component shown as a unit may or may not be a physical unit, that is, it may be located in one place or may be distributed across multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0173] In addition, each functional unit in various embodiments of the present application can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit.

[0174] If the above-mentioned function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0175] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for application protection, characterized in that, the method is applied to an electronic device, the electronic device includes a first file system and a second file system, and the method includes: During the startup process of the first application, load the code file of the first application; Determine whether the code file of the first application is an encrypted file; When the code file of the first application is an encrypted file, read the code file of the first application through the first file system; When the code file of the first application is not an encrypted file, the second file system reads the code file of the first application.

2. The method according to claim 1, characterized in that, the first file system is a virtual file system, the second file system is a real file system, and the reading of the code file of the first application through the first file system includes: The first file system decrypts the code file of the first application; The second file system reads the decrypted code file of the first application.

3. The method according to claim 2, characterized in that, the method further includes: The first file system caches the decrypted code file of the first application.

4. The method according to claim 1, characterized in that, the first file system is a real file system, the second file system is a real file system, and the reading of the code file of the first application through the first file system includes: The first file system calls a decryption module to decrypt the code file of the first application; The first file system reads the decrypted code file of the first application.

5. The method according to any one of claims 1 to 4, characterized in that, the method further includes: Obtain a first key, which is used to decrypt the code file of the first application.

6. An apparatus for application protection, characterized in that, the apparatus includes: A memory management module, configured to load the code file of the first application during the startup process of the first application; A determination module, configured to determine whether the code file of the first application is an encrypted file; A first file system, configured to participate in reading the code file of the first application when the code file of the first application is an encrypted file; A second file system, configured to read the code file of the first application when the code file of the first application is not an encrypted file.

7. The apparatus according to claim 6, characterized in that, the first file system is a virtual file system, the second file system is a real file system, and the first file system is specifically configured to: Decrypt the code file of the first application; The second file system is further configured to: Read the decrypted code file of the first application.

8. The apparatus according to claim 7, characterized in that, the first file system is further configured to: Cache the decrypted code file of the first application.

9. The apparatus according to claim 6, characterized in that, the first file system is a real file system, the second file system is a real file system, and the first file system is specifically configured to: Call the decryption module to decrypt the code file of the first application; Read the decrypted code file of the first application.

10. The apparatus according to any one of claims 6 to 9, wherein, the apparatus further comprises: an acquisition module, configured to acquire a first key, where the first key is used to decrypt the code file of the first application.

11. An electronic device, wherein, comprising: one or more processors; one or more memories; and one or more computer programs, wherein the one or more computer programs are stored in the one or more memories, and the one or more computer programs include instructions that, when executed by the one or more processors, cause the electronic device to execute the method according to any one of claims 1 to 5.

12. A computer-readable storage medium, wherein, the storage medium stores a program or instructions that, when run, implement the method according to any one of claims 1 to 5.

13. A chip, wherein, the chip stores instructions that, when run, implement the method according to any one of claims 1 to 5.

Images