Data protection method, apparatus, device, and medium

Abstract

The application discloses a data protection method and device, equipment and a storage medium, and belongs to the field of data security. The method comprises the following steps: in response to a data processing instruction for first data, a target process is called, the data processing instruction carries device information of a target device, and the target process is used for data processing of the first data; the authority of the target device is identified through the device information; in response to the fact that the target device does not have data processing authority, the target process is modified from pointing to the first data to pointing to second data, and the second data is sent to the target device through the modified process. That is to say, the first data of the application program can be stored locally and does not need to be stored on the server separately. When the first data of the application program is stolen by a criminal, the authority of a target device used by the criminal can be identified. When it is identified that the target device does not have data processing authority, the second data can be sent to the target device, so that the security of the first data is improved.

Description

Technical Field

[0001] This application relates to the field of data security, and in particular to a data protection method, apparatus, device, and storage medium. Background Technology

[0002] With the development of internet technology, developers design various applications to provide users with different functions. For example, developers design shopping applications to provide users with shopping functions, and news applications to provide users with news browsing functions. The implementation of application functions depends on the code data written by developers, and some code data embodies the hard work of developers and has great commercial value. Some criminals will steal the application's code data through reverse engineering.

[0003] In related technologies, developers store application code data in a backend server so that even if the application is successfully reverse engineered, the application code data will not be stolen.

[0004] However, this means that the application needs to retrieve code data from the server in real time to perform its normal functions. When the user is in a poor network environment, retrieving code data from the server may take a long time, and the application's functions may not work properly, resulting in low human-computer interaction efficiency. Summary of the Invention

[0005] This application provides a data protection method, apparatus, device, and storage medium, which can improve the security of primary data while ensuring the normal operation of application functions. The technical solution is as follows: On the one hand, a data protection method is provided, the method comprising: In response to a data processing instruction for the first data, a target process is invoked, wherein the data processing instruction carries device information of the target device, and the target process is used to process the first data. The permissions of the target device are identified using the device information; In response to the target device not having data processing permissions, the target process is modified from pointing to the first data to pointing to the second data. The modified process then sends the second data to the target device. The second data is data that does not have any data processing function.

[0006] On the one hand, a data protection device is provided, the device comprising: The calling module is used to call the target process in response to a data processing instruction for the first data. The data processing instruction carries device information of the target device, and the target process is used to process the first data. The permission identification module is used to identify the permissions of the target device based on the device information; The sending module is configured to, in response to the target device not having data processing permissions, modify the target process from pointing to the first data to pointing to the second data, and send the second data to the target device through the modified process. The second data is data that does not have any data processing functions.

[0007] In one possible implementation, the instruction determination module is configured to compare the data processing instruction with an instruction template, and in response to the data processing instruction matching any instruction template, determine the data processing operation corresponding to any instruction template.

[0008] In one possible implementation, the device further includes: An enhancement module is used to increase the weight of any instruction template, wherein the weight is used to indicate the selection priority of the instruction template when comparing the data processing instruction with the instruction template.

[0009] In one possible implementation, the device further includes: The parsing module is used to perform semantic parsing on the data processing instruction in response to the data processing instruction not matching any instruction template, so as to obtain the field name and field value carried by the data processing instruction.

[0010] In one possible implementation, the device further includes: An extraction module is used to extract field names and corresponding field values ​​from the data processing instructions, and determine the execution position of the data processing operation in the first data based on the field names and field values. The processing module is used to perform the data processing operation at the execution location to process the first data.

[0011] In one possible implementation, the device further includes: An execution module is used to execute a target script and obtain configuration data for a first application, wherein the target script is used to generate a target application; A generation module is used to generate the target application based on the configuration data and the user interface data of the target application carried by the target script. The target application shares the application data storage space with the first application. The display module is used to execute the target application and, in response to a change in the data stored in the application data storage space of the first application, display the change in the data on the user interface of the target application.

[0012] On one hand, a computer device is provided, the computer device including one or more processors and one or more memories, the one or more memories storing at least one instruction, the instruction being loaded and executed by the one or more processors to implement the data protection method.

[0013] On one hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the computer-readable storage medium, the instruction being loaded and executed by a processor to implement the data protection method.

[0014] On one hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned data protection method.

[0015] The technical solution provided in this application allows the first device to identify the permissions of the target device when the target device processes the first data on the first device. If the target device lacks data processing permissions, the first device will not execute the data processing operation performed by the target device on the first data. Instead, it will send second data (which lacks data processing capabilities) to the target device, thus ensuring that the first data is not corrupted or stolen by the target device. This method eliminates the need to store the first data separately on a server, thus avoiding interaction between the first device and the server. Even in poor network conditions, the application can directly read the first data from the first device without the time required to download it from the server, enabling normal application functionality. This improves the efficiency of human-computer interaction while ensuring the security of the first data. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the implementation environment of a data protection method provided in an embodiment of this application; Figure 2 This is a framework diagram of a data protection method provided in an embodiment of this application; Figure 3 This is a flowchart of a data protection method provided in an embodiment of this application; Figure 4 This is a flowchart of a data protection method provided in an embodiment of this application; Figure 5 This is a flowchart of an application layer execution step provided in an embodiment of this application; Figure 6 This is a schematic diagram of an authorization verification interface provided in an embodiment of this application; Figure 7 This is a schematic diagram of an authorization verification interface provided in an embodiment of this application; Figure 8 This is a flowchart of an instruction template matching method provided in an embodiment of this application; Figure 9 This is a flowchart of an application generation method provided in an embodiment of this application; Figure 10 This is a flowchart of an application generation method provided in an embodiment of this application; Figure 11 This is a schematic diagram of the structure of a data protection device provided in an embodiment of this application; Figure 12 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0019] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items with essentially the same function. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor are there any restrictions on quantity or execution order.

[0020] In this application, the term "at least one" means one or more, and "multiple" means two or more, for example, multiple reference face images means two or more reference face images.

[0021] A database (DB) can be simply viewed as an electronic filing cabinet—a place to store electronic files, where users can perform operations such as adding, querying, updating, and deleting data. A "database" is a collection of data stored together in a certain way, capable of being shared by multiple users, with minimal redundancy, and independent of application programs. A database can include database table names, column names, and the corresponding values ​​for each column.

[0022] Shared Preferences (SP) is a lightweight storage class on the Android platform used to save some commonly used configurations of an application. SP can also be considered as a protocol for storing key-value pairs on the Android platform.

[0023] An Integrated Development Environment (IDE) is an application that provides a program development environment. It typically includes tools such as a code editor, compiler, debugger, and graphical user interface. It's a suite of integrated development software services that combines code writing, analysis, compilation, and debugging capabilities. Any software or software suite (or group of software) possessing these characteristics can be called an IDE. This program can run independently or in conjunction with other programs.

[0024] Application Programming Interface (API): An API is an interface used by programmers when programming. Through this interface, applications can access system resources and obtain system services during program execution. It is also the only way for applications to obtain operating system services. Most operating systems' APIs consist of a set of system calls, each of which is a subroutine that performs a specific function.

[0025] Java Archive (Jar): A software package file format typically used to aggregate a large number of Java class files, related metadata, and resource files (text, images, etc.) into a single file for developing Java platform applications or libraries.

[0026] Reflective injection: Reflective injection is a novel injection method that, unlike traditional methods, does not require the injection file to be stored on disk, thus avoiding the risk of the injected file being deleted by security software. Because it does not load the file through system APIs, the operating system has no way of knowing that the injected process has loaded the file, and therefore detection software cannot detect it.

[0027] Hook function: also known as a hook function, before the system calls the target function, the hook function first captures the instruction to call the target function. The hook function can gain monitoring rights over the target function. At this time, the hook function can process (change) the execution behavior of the target function, and can also forcibly terminate the message passing of the target function.

[0028] Structured Query Language (SQL) is a special-purpose programming language used for database querying and programming. It is used to access, query, update, and manage relational database systems.

[0029] Android Application Package (APK) is an application package file format used by the Android operating system for distributing and installing mobile applications and middleware.

[0030] Figure 1 This is a schematic diagram illustrating the implementation environment of a data protection method provided in this application embodiment. See also... Figure 1 The implementation environment may include a first device 110, a target device 120, and a server 140.

[0031] The first device 110 can be a smartphone, tablet, smart TV, desktop computer, in-vehicle computer, or portable computer, etc. The first device 110 has installed and runs first applications supporting different functions, such as shopping applications, short video applications, and navigation applications. This application does not limit the type of application. The first device 110 can refer to one of multiple first devices; this embodiment only uses the first device 110 as an example.

[0032] The target device 120 can be a smartphone, desktop computer, or laptop computer, among other devices. Applications supporting data processing can be installed and run on the target device 120; for example, an application for acquiring code data from the first device 110 can be installed on the target device 120. The target device 120 can refer to one of multiple target devices; this embodiment uses target device 120 as an example only.

[0033] Server 140 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms. The first device 110, the target device 120, and the server 140 can be directly or indirectly connected via wired or wireless communication; this application does not impose any restrictions on this connection.

[0034] It should be noted that the data protection method provided in this application can be applied to a first device running different operating systems. In order to provide a clearer explanation of the data protection method provided in this application, the following embodiments will be described using the Android system running on the first device as an example.

[0035] First, the application scenarios of the data protection method provided in this application are explained: In some cases, criminals may attempt to steal or damage the code data of the first application through reverse engineering of the application. The methods employed by criminals may be as follows: 1. Criminals connect a PC to a device that has the first application installed, and send instructions from the PC to the first device to steal or damage the code data of the first application.

[0036] 2. Criminals can install a second application on the first device. This second application can access the code data of other applications. Through this second application, criminals can call different system functions to steal or damage the code data of the first application.

[0037] Of course, in addition to stealing the code data of the first application, criminals may also want to steal the privacy data of users of the first application. The methods for stealing user privacy data can also include the two mentioned above, which will not be elaborated here.

[0038] In addition, for developers, the maintenance of the first application code data also requires the above two methods. The data protection method provided in this application can ensure the security of the first application code data and user privacy data while ensuring that developers can maintain the code data normally.

[0039] Before describing the steps of the data protection method provided in this application, the framework of one such method will first be explained. (See attached document.) Figure 2 The framework includes an application layer 201, a data filtering layer 202, a data encryption / decryption layer 203, and a file storage layer 204.

[0040] Application layer 201 can be used to provide data processing entry points for different data processing tools. These tools can include various types of tools, such as development tools running on a personal computer (PC), Android Studio, or third-party tools like Chrome with DB and SP viewing capabilities, as well as applications on Android devices. The application layer can provide a common interface for different types of data processing tools. For example, it can provide an interface for the development tool that builds the first application, an interface for the user to use the first application, and an interface for calling a file manager to obtain the first data. Different data processing tools can perform data processing operations through the interface provided by the application layer. This application embodiment does not limit the type of data processing tool.

[0041] In addition, the application layer 201 can also be used to monitor data processing instructions for different target devices, that is, to monitor the process of creating data processing instructions.

[0042] Furthermore, application layer 201 can also be used to build a target application, through which developers can learn about changes in the primary data.

[0043] The data filtering layer 202 can be used to identify permissions and determine whether the target device has data processing permissions. The data filtering layer 202 can also be used to intercept data processing operations corresponding to data processing commands, such as intercepting database and SP modification-related operations.

[0044] The data encryption / decryption layer 203 can be used to encrypt data stored in the data filtering layer or to decrypt data read from the file storage layer.

[0045] File storage layer 204 can be used to verify data such as the size of disk storage space and to store encrypted data.

[0046] Figure 3 This is a flowchart of a data protection method provided in an embodiment of this application. See also... Figure 3 The methods include: 301. In response to a data processing instruction for the first data, the first device calls a target process. The data processing instruction carries the device information of the target device, and the target process is used to process the first data.

[0047] The data processing instructions can be at least one of the following: read instructions for the first data, write instructions for the first data, delete instructions for the first data, modify instructions for the first data, and instructions for generating an application based on the first data. The device identifier can be at least one of the following: processor information of the target device, processor instruction set identifier, static password, dynamic password, and network environment information. The format of the first data can be a database format (.db) or an SP format (.xml); this embodiment does not limit this. The first device is a computer device running the first application.

[0048] 302. The first device identifies the permissions of the target device through the device information.

[0049] 303. In response to the target device not having data processing permissions, the first device modifies the target process from pointing to the first data to pointing to the second data, and sends the second data to the target device through the modified process. The second data is data that does not have any data processing function.

[0050] The second data can be data whose field names and values ​​have no actual meaning.

[0051] The technical solution provided in this application allows the first device to identify the permissions of the target device when the target device processes the first data on the first device. If the target device lacks data processing permissions, the first device will not execute the data processing operation performed by the target device on the first data. Instead, it will send second data (which lacks data processing capabilities) to the target device, thus ensuring that the first data is not corrupted or stolen by the target device. This method eliminates the need to store the first data separately on a server, thus avoiding interaction between the first device and the server. Even in poor network conditions, the application can directly read the first data from the first device without the time required to download it from the server, enabling normal application functionality. This improves the efficiency of human-computer interaction while ensuring the security of the first data.

[0052] The above steps 301-303 are a brief description of the data protection method provided by this application. The following steps 401-404, with some examples, will provide a detailed description of the data protection method provided by this application.

[0053] Figure 4 This is a flowchart of a data protection method provided in an embodiment of this application. See also... Figure 4 The methods include: 401. In response to a data processing instruction for the first data, the first device calls the target process. The data processing instruction carries the device information of the target device, and the target process is used to process the first data.

[0054] The first data can be code data of the first application or privacy data of the user using the first application. Of course, in other possible implementations, the first data can also be other types of data. This application embodiment does not limit the type of the first data. Accordingly, if the first data is code data of the first application, then the data processing instructions for the first data can be at least one of the following: a code data read instruction, a code data write instruction, a code data delete instruction, and a code data modification instruction. If the first data is privacy data of the user using the application, then the data processing instructions for the first data can be at least one of the following: a privacy data read instruction, a privacy data write instruction, a privacy data delete instruction, and a privacy data modification instruction.

[0055] 402. The first device monitors the target process.

[0056] The first device monitors the target process, specifically the functions executed by the target process, to determine the data processing operations performed by the target process. Additionally, the first device can also intercept and modify the data processing operation before the target device processes the first data through the target process. The implementation method is explained below: In one possible implementation, the first device can inject target code data into the target process, and monitor the process created by the data processing instructions through the target code data.

[0057] In this implementation, in response to invoking the target process, the first device can inject target code data into the target process, ensuring that the first device can monitor the target process through the injected target code data. In other words, when the target device does not have data processing permissions, the first device can truncate or modify the operations performed by the target process.

[0058] Since data processing instructions may originate from different applications, such as development tools running on a PC connected to the first device or the first application itself, if the instructions originate from development tools running on a PC connected to the first device, it could mean that developers are using the PC to maintain the first application's first data, or it could mean that malicious actors are using the PC to steal the first application's first data. If the instructions originate from the first application itself, it could mean that the first application is performing normal processing of the first data during runtime, or it could mean that malicious actors are using an Android emulator to run the first application and steal the first data.

[0059] The above implementation methods will be described below using examples where the data processing instructions originate from a development tool running on a PC and from the first application itself.

[0060] Taking a development tool running on a PC as an example, developers use Android Studio or Chrome (a third-party tool with DB and SP viewing capabilities) to send data processing commands to the first device. For instance, the PC can load the Android Debug Bridge (ADB) tool through Android Studio or Chrome. The PC can then send data processing commands to the first device via ADB, such as "adb pull xxx.db" or "adb pull xxx.xml", where xxx and yyy are the filenames of the first data. In response to the data processing commands, the first device can call the target process created by the aforementioned system function and perform reflection injection on the target process. This involves calling the `Class.forName` function to determine the Class object corresponding to the target process, identifying the target field of the Class object through `JavaClass`, modifying the attribute of the target field to be accessible, and monitoring the Class object through a hook function. The first device can also modify the target field of the Class object through a hook function to achieve control over the target process.

[0061] With this implementation method, before the development tool running on the PC processes the first data through the data processing instructions, the first device can intercept the instructions sent by the development tool running on the PC. Then, the data processing permissions of the PC can be identified by judging the device identifier carried by the data processing instructions.

[0062] Taking a scenario where data processing commands originate from the first application itself as an example, the Android system stores the first application's code data and user privacy data in the `sharedUserID` directory. When a user uses the first application, the application calls system functions such as `Content Provider`, `SQL Lite Open Helper`, and `getShared Preference` to send data processing commands. For instance, during runtime, the first application might issue a command to retrieve a file from the `sharedUserID` directory. In response to these data processing commands, the first device can invoke the target process created by the aforementioned system functions to perform reflection injection on the target process. This involves calling the `Class.forName` function to determine the `Class` object corresponding to the target process, identifying the target field of that `Class` object through `JavaClass`, modifying the target field's attribute to be accessible, and monitoring the `Class` object through a `HOOK` function. The first device can also modify the target field of the `Class` object through a `HOOK` function to control the target process.

[0063] It should be noted that step 401 can be implemented by application layer 201. The execution steps of the application layer can be found in [reference needed]. Figure 5 .

[0064] 403. The first device obtains the device information of the target device from the data processing instructions.

[0065] The device information may include the target device's processor information, processor instruction set identifier, network environment information, static password, pseudo-static password, and dynamic password. In this embodiment, when the data processing instructions originate from a development tool running on a PC, the device information may be at least one of network environment information, static password, pseudo-static password, and dynamic password; when the data processing instructions originate from a first application, the device information may be at least one of the first device's processor information and processor instruction set identifier.

[0066] 404. The first device identifies the permissions of the target device through the device information.

[0067] In one possible implementation, the device information can be the network environment information of the target device. The first device can compare the network environment information of the target device with preset network environment information. If the network environment information of the target device matches the preset network environment information, the first device determines that the target device has data processing permissions. If the network environment information of the target device does not match the preset network environment information, the first device determines that the target device does not have data processing permissions, wherein the device indicated by the preset network environment information has data processing permissions. In other words, the first device can compare the network environment information of the target device with the preset network environment information of the device with data processing permissions. If the two match successfully, the first device determines that the target device has data processing permissions; if the two do not match successfully, the first device determines that the target device does not have data processing permissions. Since the network environment information can be used to represent the geographical location of the target device, the first device can determine whether the target device has data processing permissions based on the geographical location.

[0068] In this implementation, the first device can identify the target device's permissions based on the network environment information of the target device. For example, if the target device's network environment information matches that of the application development company's office equipment, the first device can determine that the target device has data processing permissions; if the target device's network environment information does not match, the first device can determine that the target device does not have data processing permissions. This prevents malicious actors outside the application development company's office network from obtaining data processing permissions, resulting in high data processing security.

[0069] For example, network environment information could be the target device's IP (Internet Protocol) address. The first device can compare the target device's IP address with a set of application development company IP addresses stored in storage space to determine whether the target device's IP address exists in the application development company's IP address set. If the target device's IP address exists in the application development company's IP address set, the first device can determine that the target device has data processing permissions; if the target device's IP address does not exist in the application development company's IP address set, the first device can determine that the target device does not have data processing permissions.

[0070] In one possible implementation, the device information can be a static password, which the first device can use to identify the permissions of the target device. The static password may include the developer's identity document (ID) and a pre-defined password. If the pre-defined password can be changed by the administrator at any time, then the static password can also be called a pseudo-static password.

[0071] In this implementation, since static or pseudo-static passwords are internally agreed upon by the application development company, using them to identify permissions on the target device can improve the security of the initial data. Especially for pseudo-static passwords, because they can be changed at any time, they offer better protection for the initial data, resulting in higher security.

[0072] The above implementation method is illustrated below with two examples: 1. When a developer inputs a command line to process the first data through the target device, they can simultaneously input a static password or a pseudo-static password. The target device can encrypt the static or pseudo-static password, for example, by mapping it to a hash string. The target device can generate a data processing instruction based on the encrypted static or pseudo-static password and the command line input by the developer, and send the data processing instruction to the first device. After receiving the data processing instruction from the target device, the first device can retrieve the encrypted static or pseudo-static password from the instruction. If the static or pseudo-static password is a hash string, the first device can compare the hash string in the data processing instruction with the hash string stored in the storage space. If the two hash strings are the same, the first device can determine that the target device has data processing rights; if any character in the two hash strings is different, the first device can determine that the target device does not have data processing rights.

[0073] 2. Developers can input command lines to process the first data via the target device. The target device can then send these command lines to the first device. Upon receiving the command line, the first device can send an authorization verification request to the target device. After receiving the authorization verification request, the target device can display it to the developer. The developer can then input a static password or a pseudo-static password via the target device. The target device can encrypt the static or pseudo-static password entered by the developer and send it to the first device. The first device can then verify the target device's permissions based on the encrypted static or pseudo-static password.

[0074] In one possible implementation, the device information is at least one of the target device's processor information and processor instruction set identifier. The first device can compare the target device's processor information with at least one of preset processor information and the target device's processor instruction set identifier with a preset processor instruction set identifier. In response to a match between the target device's processor information and the preset processor information, or a match between the target device's processor instruction set identifier and the preset processor instruction set identifier, the first device determines that the target device has data processing permissions. In response to a mismatch between the target device's processor information and the preset processor information, or a mismatch between the target device's processor instruction set identifier and the preset processor instruction set identifier, the first device determines that the target device does not have data processing permissions, and the device indicated by the preset processor information and the preset processor instruction set identifier has data processing permissions.

[0075] This implementation can be used to distinguish whether a user is using the native Android system or an Android emulator to process the first data. If the user is using the native Android system to process the first data, then the user may perform normal read and write operations on the first data through the first application, and the target device is also the first device. In this case, the first device can determine that the target device has the permission to process the data, and the processor architecture that supports the native Android system can be an Advanced Reduced Instruction Set Computing (RISC) machine. ARM processors use the ARM instruction set. Therefore, when a first device identifies the target device's processor architecture as ARM through processor information or by identifying the processor instruction set as ARM, it can determine that the target device has data processing permissions. However, if a user uses an Android emulator to process the first data, the user might reverse engineer the first application. In this case, the first device can determine that the target device does not have data processing permissions. Furthermore, processors that support Android emulators can be x86 architecture processors, which use the x86 instruction set. Therefore, when a first device identifies the target device's processor architecture as x86 through processor information or by identifying the processor instruction set as x86, it can determine that the target device does not have data processing permissions.

[0076] Additionally, for PCs as the target device, permission verification for PCs can also be performed by the server. This will be discussed in the following section. Figure 6 and Figure 7 Two examples are used to illustrate this implementation: 1. See Figure 6Developers can launch development tools on a PC. When the PC connects to the first device, a permission verification page 600 is displayed on the PC, showing a developer ID input box 601 and a password input box 602. Developers can enter their ID in the developer ID input box 601 and a pre-defined password in the password input box 602, then click the confirmation button 603. In response to clicking the confirmation button 603, the PC triggers a permission verification command, sending a permission verification request to the server, carrying the developer ID and pre-defined password. The server verifies the target device's permissions based on the developer ID and pre-defined password in the permission verification request. If the developer ID and pre-defined password match those stored in the database, the server determines that the target device has data processing permissions and sends a verification success message to the PC. Upon receiving the verification success message, the PC successfully establishes a connection with the first device. If the developer ID and agreed-upon password do not match those stored in the database, the server can determine that the target device does not have data processing permissions and can send a verification failure message to the PC. In response, the PC will be unable to establish a connection with the first device. Alternatively, after a successful connection is established between the PC and the first device, the first device can process the first data based on the data processing instructions sent by the PC without needing to re-verify the PC's data processing permissions.

[0077] In this implementation, the server can identify the permissions of the target device. Since the verification information of the target device is stored on the server rather than on the first device, and the server is often more difficult to crack, this can further improve the security of the first data.

[0078] 2. See Figure 7Developers can launch development tools on a PC. When the PC connects to the first device, an access verification page 700 is displayed on the PC. This page includes a developer ID input box 701, a dynamic password input box 702, and a dynamic password retrieval button 703. Developers can enter their ID in the developer ID input box 701 and click the dynamic password retrieval button 703. The target device can then send a dynamic password retrieval request to the server, carrying the developer's ID. Upon receiving the request, the server can randomly generate a dynamic password and send it to the user device bound to the developer's ID. The developer can then retrieve this dynamic password through the user device, enter it in the dynamic password input box 702 on the access verification page 700, and click the confirmation button 704 to send a dynamic password verification request to the server, carrying both the developer's ID and the dynamic password. The server can receive the verification request and verify that the dynamic password in the request matches the dynamic password sent to the user device bound to the developer's ID. If both passwords match, the server determines that the target device has data processing permissions and can send a successful verification message to the PC. The PC, in response, can successfully establish a connection with the first device. If the two passwords do not match, the server determines that the target device does not have data processing permissions and can send a failed verification message to the PC. The PC, in response to the failed verification message, cannot establish a connection with the first device. Furthermore, after a successful connection is established between the PC and the first device, the first device can process the first data based on the data processing instructions sent by the PC without needing to re-verify the PC's data processing permissions.

[0079] In this implementation, since the dynamic password is randomly generated by the server in real time, using the dynamic password to identify the permissions of the target device can improve the accuracy of permission identification, thereby improving the security of the primary data.

[0080] It should be noted that the server can support both of the above methods for verifying the target device's permissions simultaneously. This means developers can use either static or dynamic passwords for verification. Since dynamic password verification offers higher security, the server can use dynamic passwords for the initial verification of the target device's permissions. Subsequent verifications can then support both dynamic and static passwords, maximizing the security of the initial data.

[0081] It should be noted that step 404 can be implemented by the data filtering layer 202.

[0082] After step 404, the first device can determine whether to execute step 405 or step 406 based on the target device's permissions. If the target device does not have data processing permissions, the first device can execute step 405; if the target device has data processing permissions, the first device can execute step 406.

[0083] 405. In response to the target device not having data processing permissions, the first device modifies the target process from pointing to the first data to pointing to the second data, and sends the second data to the target device through the modified process. The second data is data that does not have any data processing function.

[0084] In one possible implementation, the device is identified as the network environment information of the target device. The first device can modify the target process from pointing to the first data to pointing to the second data, and send the second data to the target device through the modified process.

[0085] In this implementation, the first device determines that the target device does not have data processing permissions based on the target device's network environment information. Then, the first device can send second data to the target device, preventing the unauthorized target device from processing the first data and protecting the security of the first data.

[0086] Taking network environment information as IP addresses as an example, the target device's IP address could be 192.168.1.1. The first device, based on the target device's IP address 192.168.1.1, determines that the target device does not have data processing permissions. The first device can monitor the target process's hook function and modify the function executed by that process to send the second data. For example, if the target device originally obtains the first data through the target process, the first device can, before the target device obtains the first data through the target process, modify the function used by the target process to obtain the second data by hooking the function. In other words, it changes the address where the target process obtains data from the address of the first data to the address of the second data.

[0087] In addition to modifying the address where the target process obtains data through the hook function, the first device can also modify the function itself executed by the target process. For example, the target device can modify the first data through the target process, and the first device can modify the function executed by the target process through the hook function, changing the function used to modify the first data into a function to obtain the second data.

[0088] In one possible implementation, the device identifier is one of the processor information and processor instruction set identifier of the target device. The first device can modify the target process from pointing to the first data to pointing to the second data, and send the second data to the target device through the modified process.

[0089] In one possible implementation, the device is identified as at least one of a static password, a pseudo-static password, and a dynamic password. In response to the fact that either the static password or the pseudo-static password is different from the static password or the pseudo-static password stored on the first device, the first device can modify the target process from pointing to the first data to pointing to the second data, and send the second data to the target device through the modified process.

[0090] It should be noted that, in response to the target device not having data processing permissions, the first device can, in addition to sending the second data to the target device through the target process, directly terminate the target process or not respond to the data processing command. This application embodiment does not limit this.

[0091] 406. In response to the target device having data processing authority, the first device compares the data processing instruction with the instruction template. In response to the data processing instruction matching any instruction template, the first device executes step 407. In response to the data processing instruction not matching any instruction template, the first device executes step 408.

[0092] 407. In response to a data processing instruction matching any instruction template, the first device determines the data processing operation corresponding to the instruction template, and the first device processes the first data according to the data processing operation.

[0093] In this implementation, the first device compares the instruction template with the data processing instruction to obtain the data processing operation corresponding to the data processing instruction. In other words, the first device can obtain the data processing operation corresponding to the data processing instruction without performing semantic parsing. Since semantic parsing of data processing instructions is slow, using an instruction template to match data processing instructions is much faster. Therefore, the first device is more efficient at determining the data processing operation indicated by the data processing instruction through the instruction template.

[0094] For example, data processing instructions can be SQL statements. The first device can store multiple SQL statements as instruction templates, such as the commonly used statement for deleting a data table, `sql=delete from tab`. If the target device sends a data processing instruction of `sql=delete from tab1` (delete data table 1), the first device can use multiple instruction templates to match the data processing instruction and obtain the instruction template `sql=delete from tab` that matches the data processing instruction `sql=delete from tab1`. The first device can then determine that the data processing operation indicated by the instruction `sql=delete from tab` is deleting data table 1, and can perform the operation to delete data table 1 on the first device.

[0095] Furthermore, based on this implementation, the first device can also assign weights to the instruction templates. These weights represent the selection priority of the instruction template when comparing a data processing instruction with another instruction template. In other words, when the first device performs instruction matching on a data processing instruction, it can determine the matching order of the instruction templates and the data processing instruction according to their weights, prioritizing the matching of instruction templates with higher weights. In response to the first device successfully matching any instruction template with a data processing instruction, the first device can increase the weight of that instruction template. That is, when the first device performs instruction template matching on other data processing instructions the next time, it can advance the matching order of that instruction template.

[0096] In this implementation, the first device can assign weights to different instruction templates based on the number of times the instruction template has been successfully matched. When comparing instruction templates, the first device will prioritize comparing instruction templates with higher weights. A higher weight for an instruction template means that the instruction template has been successfully matched more times, and the success rate of comparison using that instruction template is higher. Thus, as the first device increases the number of times it compares instruction templates, the matching efficiency of the instruction templates will also increase.

[0097] In one possible implementation, in response to a device identifier having data processing authority, the first device can extract field names and corresponding field values ​​from data processing instructions, and determine the execution location of the data processing operation within the first data based on the field names and field values. The first device can then perform the data processing operation at the execution location to process the first data.

[0098] It should be noted that after the first device extracts the field name and the corresponding field value from the data processing instruction, if the data processing operation is to add a field to the first data, the first device can input the field name and field value into the data encryption / decryption layer 203. The data encryption / decryption layer 203 will encrypt the field name and field value, and then store the field value corresponding to the field name in the first data through the file storage layer 204. If the data processing operation is to modify the field value of a certain field name in the first data, the first device can input the field name and field value into the data encryption / decryption layer 203. The data encryption / decryption layer 203 will encrypt the field name and field value, and then change the field value corresponding to the encrypted field name to the encrypted field value through the file storage layer 204 and store it in the first data.

[0099] 408. In response to the data processing instruction not matching any instruction template, the first device performs semantic parsing on the data processing instruction to obtain the field names and field values ​​carried by the data processing instruction, and processes the first data according to the field names and field values ​​carried by the data processing instruction.

[0100] For example, the first device can use a lexical analyzer to convert data processing instructions into a set of words, such as converting the data processing instruction "ABC" into the word set {A, B, C}. The first device can then input the word set into a syntax analyzer, which determines whether the words in the set {A, B, C} conform to grammatical logic. The syntax analyzer can output an abstract syntax tree of the data processing instructions. There is a one-to-one correspondence between the data processing instructions and the abstract syntax tree. The first device can use the abstract syntax tree to obtain the field names and values ​​carried by the data processing instructions. Based on the field names and values ​​carried by the data processing instructions, the first device processes the first data.

[0101] Of course, the first device can also combine the above-mentioned implementation methods to perform step 404, see [link to relevant documentation]. Figure 8The first device can predefine a large number of template regular expression libraries, which are collections of instruction templates. The first device can match data processing instructions one by one based on these libraries. Upon matching any instruction template in the library, the first device can increase the weight of that instruction template, thus increasing its priority in subsequent instruction template matching processes. The first device can extract field names and their corresponding field values ​​from the data processing instructions and send them to the data encryption / decryption layer 203 for encryption. Upon not matching any instruction template in the library, the first device can perform semantic parsing on the data processing instructions to obtain the field names and their corresponding field values. Since data processing instructions can include at least one of adding, viewing, deleting, modifying, and searching for DB and SP, the first device's voice parsing of data processing instructions can also include parsing SQL instructions for DB processing and SP instructions for SP processing. After obtaining the field names and their corresponding field values ​​from the data processing instructions, the first device can send them to the data encryption / decryption layer 203 for encryption.

[0102] The technical solution provided in this application allows the first device to identify the permissions of the target device when the target device processes the first data on the first device. If the target device lacks data processing permissions, the first device will not execute the data processing operation performed by the target device on the first data. Instead, it will send second data (which lacks data processing capabilities) to the target device, thus ensuring that the first data is not corrupted or stolen by the target device. This method eliminates the need to store the first data separately on a server, thus avoiding interaction between the first device and the server. Even in poor network conditions, the application can directly read the first data from the first device without the time required to download it from the server, enabling normal application functionality. This improves the efficiency of human-computer interaction while ensuring the security of the first data.

[0103] In addition to steps 401-404 above, see Figure 9 This application also provides a method for generating a target application. When a first application and a target application are installed on a first device at the same time, the developer can use the target application to monitor the changes in the first application's first data in real time.

[0104] 901. The target device executes the target script to obtain the configuration data of the first application. The target script is used to generate the target application.

[0105] The target script can be a script file configured by the developer. The target device can automatically generate the target application by executing the target script. The first application is an application developed by the developer to implement a certain function, such as an application developed by the developer to provide users with a food delivery function.

[0106] In one possible implementation, developers can add a task to the application build task of the first application via the target device. This task executes the target script and generates the target application. When the target device executes the target script, it can copy the configuration file of the first application into the configuration file of the target application.

[0107] For example, see Figure 10 Developers can configure the `preBuild.depenOn` parameter in the `build.gradle` file of the first application. This parameter indicates that a specific task, named `subBuildTask`, needs to be executed before building the first application's APK package. The target device can define a `sharedUserId` and create a Gradle pre-build task. The target device can execute the target script `GenerateSubAppScript` within the `subBuildTask`. The target device can obtain the `sharedUserId` and `provider path` attributes from the `AndroidManifest` file of the first application, as well as the `minSdkVersion`, `targetSdkVersion`, `versionName`, and `versionCode` attributes from the `build.gradle` file of the first application.

[0108] 902. The target device generates a target application based on the configuration data and the user interface data of the target application carried by the target script. The target application shares the application data storage space with the first application.

[0109] The user interface data of the target application may include the user interface code and user interface images of the target application.

[0110] In one possible implementation, the target device can modify the configuration file of the first application via a target script. For example, it can configure the `sharedUserId` parameter in the `AndroidManifest.xml` file of the first application, allowing the target application and the first application to share application data storage space after installation. The target device can then release the user interface data of the target application carried by the target script into the target application's configuration file. Based on the modified target application's configuration file, the target device can generate the target application, where `sharedUserId` serves as the identifier for the shared data storage space between the target application and the first application after installation.

[0111] It should be noted that steps 901 and 902 above are described using the example of the target device generating the target application. In other possible implementations, the first device may also generate the target application, and this application embodiment does not limit this.

[0112] 903. Execute the target application via the first device.

[0113] In one possible implementation, the target device can send the installation packages of the target application and the first application to the first device, whereby the first device executes the target application and the installation packages of the first application, installing the target application and the first application on the first device. The first device can then execute the target application.

[0114] 904. In response to a change in data stored in the application data storage space of the first application, the first device displays the data change on the user interface of the target application.

[0115] In one possible implementation, the target application can scan its own application data storage space in real time, and in response to changes in the data in the application data storage space, the first device can display the data changes on the user interface of the target application.

[0116] In this implementation, since the target application and the first application share the application data storage space, when the data stored in the application data storage space of the first application changes, the first application can show the developers the changes, which makes it easier for developers to take timely measures to prevent other devices from modifying the data, thus improving data security.

[0117] For example, the target application can statically scan for read, write, and delete operations on the referenced data storage space. When the target application detects a change in the data in the data storage space, it can insert a broadcast notification at the location of the data change. The first device can then display the data change on the target application's user interface based on the broadcast notification.

[0118] Through steps 901-904 above, the target device can generate a target application with a single click using the target script. This generation process requires no developer intervention and is highly efficient. Furthermore, when both the target application and the first application are installed on the first device, they share a common application data storage space. When data in this space changes, the target application can display these changes to the developers via a user interface. Developers can then visually view the data changes in the database (DB) or service provider (SP) and take appropriate action, thus improving data security.

[0119] Figure 11 This is a schematic diagram of the structure of a data protection device provided in an embodiment of this application. See also... Figure 11 The device includes: a calling module 1101, a permission recognition module 1102, and a sending module 1103.

[0120] The calling module 1101 is used to call the target process in response to the data processing instruction for the first data. The data processing instruction carries the device information of the target device, and the target process is used to process the first data.

[0121] The permission recognition module 1102 is used to recognize the permissions of the target device through device information.

[0122] The sending module 1103 is used to respond to the fact that the target device does not have data processing permissions, modify the target process from pointing to the first data to pointing to the second data, and send the second data to the target device through the modified process. The second data is data that does not have any data processing function.

[0123] In one possible implementation, the device information of the target device includes at least one of the target device's processor information and the target device's processor instruction set identifier. The permission identification module is used to compare the target device's processor information with at least one of preset processor information and the target device's processor instruction set identifier with a preset processor instruction set identifier. In response to a match between the target device's processor information and the preset processor information, or a match between the target device's processor instruction set identifier and the preset processor instruction set identifier, it is determined that the target device has data processing permissions. In response to a mismatch between the target device's processor information and the preset processor information, or a mismatch between the target device's processor instruction set identifier and the preset processor instruction set identifier, it is determined that the target device does not have data processing permissions. The device indicated by the preset processor information and the preset processor instruction set identifier has data processing permissions.

[0124] In one possible implementation, the device information of the target device is the network environment information of the target device. The permission identification module compares the network environment information of the target device with preset network environment information. If the network environment information of the target device matches the preset network environment information, it is determined that the target device has the data processing permission. If the network environment information of the target device does not match the preset network environment information, it is determined that the target device does not have the data processing permission. The device indicated by the preset network environment information has the data processing permission.

[0125] In one possible implementation, the device further includes: The instruction determination module is used to determine the data processing operation indicated by the data processing instruction in response to the target device having data processing permissions.

[0126] The processing module is used to perform data processing operations and process the first data.

[0127] In one possible implementation, the instruction determination module is used to compare a data processing instruction with an instruction template, and in response to a data processing instruction matching any instruction template, determine the data processing operation corresponding to any instruction template.

[0128] In one possible implementation, the device further includes: The enhancement module is used to increase the weight of any instruction template. The weight is used to indicate the priority of selecting an instruction template when comparing data processing instructions with instruction templates.

[0129] In one possible implementation, the device further includes: The parsing module is used to perform semantic parsing on data processing instructions in response to the fact that no data processing instruction matches any instruction template, so as to obtain the field names and field values ​​carried by the data processing instruction.

[0130] In one possible implementation, the device further includes: The extraction module is used to extract field names and corresponding field values ​​from data processing instructions, and determine the execution position of the data processing operation in the first data based on the field names and field values.

[0131] The processing module is used to perform data processing operations at the execution location to process the first data.

[0132] In one possible implementation, the device further includes: The execution module is used to execute the target script and obtain the configuration data of the first application. The target script is used to generate the target application.

[0133] The generation module is used to generate the target application based on the configuration data and the user interface data of the target application carried by the target script. The target application shares the application data storage space with the first application.

[0134] The display module is used to execute the target application and, in response to changes in the data stored in the application data storage space of the first application, displays the changes in the data on the user interface of the target application.

[0135] The technical solution provided in this application allows the first device to identify the permissions of the target device when the target device processes the first data on the first device. If the target device lacks data processing permissions, the first device will not execute the data processing operation performed by the target device on the first data. Instead, it will send second data (which lacks data processing capabilities) to the target device, thus ensuring that the first data is not corrupted or stolen by the target device. This method eliminates the need to store the first data separately on a server, thus avoiding interaction between the first device and the server. Even in poor network conditions, the application can directly read the first data from the first device without the time required to download it from the server, enabling normal application functionality. This improves the efficiency of human-computer interaction while ensuring the security of the first data.

[0136] Furthermore, the target device can generate a target application with a single click using a target script. This process requires no developer intervention and is highly efficient. In addition, when both the target application and the first application are installed on the first device, they share a common application data storage space. When data in this space changes, the target application can display these changes to the developers through a user interface. This allows developers to be promptly informed of data changes and take appropriate action, thus improving data security.

[0137] Figure 12 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device 1200 can be a smartphone, tablet computer, laptop computer, or desktop computer. The computer device 1200 may also be referred to by other names such as user computer device, portable computer device, laptop computer device, desktop computer device, etc.

[0138] Typically, computer device 1200 includes one or more processors 1201 and one or more memories 1202.

[0139] Processor 1201 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1201 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 1201 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state. The coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1201 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 1201 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0140] The memory 1202 may include one or more computer-readable storage media, which may be non-transitory. The memory 1202 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage computer devices or flash memory computer devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1202 are used to store at least one instruction, which is executed by the processor 1201 to implement the data protection method or application generation method provided in the method embodiments of this application.

[0141] In some embodiments, the computer device 1200 may optionally include: a peripheral computer device interface 1203 and at least one peripheral computer device. The processor 1201, memory 1202, and peripheral computer device interface 1203 can be connected via a bus or signal line. Each peripheral computer device can be connected to the peripheral computer device interface 1203 via a bus, signal line, or circuit board. Specifically, the peripheral computer device includes at least one of: a radio frequency circuit 1204, a display screen 1205, a camera 1206, an audio circuit 1207, and a power supply 1209.

[0142] The peripheral computer device interface 1203 can be used to connect at least one peripheral computer device associated with I / O (Input / Output) to the processor 1201 and the memory 1202. In some embodiments, the processor 1201, memory 1202, and peripheral computer device interface 1203 are integrated on the same chip or circuit board. In some other embodiments, any one or two of the processor 1201, memory 1202, and peripheral computer device interface 1203 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0143] The radio frequency (RF) circuit 1204 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 1204 communicates with communication networks and other communication computer equipment via electromagnetic signals. The RF circuit 1204 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals back into electrical signals. Optionally, the RF circuit 1204 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc.

[0144] Display screen 1205 is used to display a user interface (UI). This UI may include graphics, text, icons, video, and any combination thereof. When display screen 1205 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as monitoring signals to processor 1201 for processing. In this case, display screen 1205 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard.

[0145] The camera assembly 1206 is used to capture images or videos. Optionally, the camera assembly 1206 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the computer device, and the rear-facing camera is located on the back of the computer device.

[0146] The audio circuit 1207 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals that are input to the processor 1201 for processing, or input to the radio frequency circuit 1204 to realize voice communication.

[0147] The power supply 1209 is used to supply power to the various components in the computer device 1200. The power supply 1209 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery.

[0148] In some embodiments, the computer device 1200 further includes one or more sensors 1210. The one or more sensors 1210 include, but are not limited to, an accelerometer 1211, a gyroscope 1212, a pressure sensor 1213, an optical sensor 1215, and a proximity sensor 1216.

[0149] Accelerometer 1211 can detect the magnitude of acceleration on the three coordinate axes of a coordinate system established by computer device 1200.

[0150] The gyroscope sensor 1212 can detect the orientation and rotation angle of the computer device 1200. The gyroscope sensor 1212 can work in conjunction with the accelerometer sensor 1211 to collect the user's 3D movements on the computer device 1200.

[0151] The pressure sensor 1213 can be installed on the side bezel of the computer device 1200 and / or on the lower layer of the display screen 1205. When the pressure sensor 1213 is installed on the side bezel of the computer device 1200, it can detect the user's grip signal on the computer device 1200, and the processor 1201 can perform left / right hand recognition or quick operation based on the grip signal collected by the pressure sensor 1213. When the pressure sensor 1213 is installed on the lower layer of the display screen 1205, the processor 1201 can monitor the operable controls on the UI interface based on the user's pressure operation on the display screen 1205.

[0152] An optical sensor 1215 is used to collect ambient light intensity. In one embodiment, the processor 1201 can monitor the display brightness of the display screen 1205 based on the ambient light intensity collected by the optical sensor 1215. A proximity sensor 1216 is used to collect the distance between the user and the front of the computer device 1200.

[0153] Those skilled in the art will understand that Figure 12 The structure shown does not constitute a limitation on the computer device 1200 and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0154] In an exemplary embodiment, a computer-readable storage medium is also provided, such as a memory including instructions that can be executed by a processor to perform the data protection method described above. For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage terminal, etc.

[0155] In an exemplary embodiment, a computer program product is also provided, including one or more instructions that can be executed by a processor of a computer device to perform the data protection methods provided in the various embodiments described above.

[0156] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0157] The above are merely optional embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data protection method, characterized in that, The method, executed by a first device having a first application installed, includes: In response to a data processing instruction for the first data of the first application, a target process is invoked, the data processing instruction carrying device information of the target device; Target code data is injected into the target process using reflection injection, and the target code data is used to monitor the target process through a hook function; If the data processing instruction originates from the first application, in response to a mismatch between the processor data in the device information and preset processor data, it is determined that the target device does not have data processing permissions; in response to a match between the processor data and preset processor data, it is determined that the target device has data processing permissions; the processor data includes at least one of the processor architecture and processor instruction set. If the data processing instruction originates from the development tool, and the network environment information in the device information matches the preset network environment information, it is determined that the target device has data processing permissions; if the network environment information does not match the preset network environment information, it is determined that the target device does not have data processing permissions. If the target device does not have data processing permissions, the address for the target process to obtain data is modified from the address of the first data to the address of the second data through the HOOK function; the modified target process sends the second data to the target device, which is data without actual meaning. If the target device has data processing permissions, in response to the data processing instruction matching a target instruction template in at least one instruction template, the device executes the data processing operation corresponding to the target instruction template, processes the first data, and increases the weight of the target instruction template; the weight is used to represent the matching priority of the target instruction template when matching the data processing instruction with the at least one instruction template.

2. The method according to claim 1, characterized in that, The network environment information is the IP address of the target device; The network environment information in the device information is matched with preset network environment information to determine that the target device has data processing permissions. In response to a mismatch between the network environment information and preset network environment information, determining that the target device does not have data processing permissions includes: Compare the IP address of the target device with the IP address set of the application development company; Since the IP address of the target device exists in the IP address set of the application development enterprise, it is determined that the target device has data processing permissions; Since the IP address of the target device does not exist in the IP address set of the application development enterprise, it is determined that the target device does not have data processing permissions.

3. The method according to claim 1, characterized in that, The device information also includes a static password or a pseudo-static password; the static password or the pseudo-static password is data that is synchronously entered when inputting a command line to process the first data through the target device. The command line is used to generate the data processing instructions; The method further includes: If the data processing instruction originates from the development tool, the hash string corresponding to the static password or the pseudo-static password is obtained from the data processing instruction; In response to the hash string being the same as the preset hash string, it is determined that the target device has data processing permissions; In response to the fact that the hash string is different from the preset hash string, it is determined that the target device does not have data processing permissions.

4. The method according to any one of claims 1 to 3, characterized in that, If the target device has data processing permissions, in response to the data processing instruction matching a target instruction template in at least one instruction template, the data processing operation corresponding to the target instruction template is executed to process the first data, including: If the target device has data processing permissions, the data processing instruction and the at least one instruction template are matched according to the weight corresponding to the at least one instruction template; wherein, the weight is used to determine the matching order of each instruction template in the at least one instruction template, and the instruction template with higher weight is matched with the data processing instruction first; In response to the data processing instruction matching the target instruction template, the data processing operation corresponding to the target instruction template is executed to process the first data.

5. The method according to any one of claims 1 to 3, characterized in that, In response to the target device having the data processing permission, after comparing the data processing instruction with the instruction template, the method further includes: If the target device has data processing permissions, in response to the data processing instruction not matching any of the at least one instruction template, the data processing instruction is semantically parsed to obtain the field name and field value carried by the data processing instruction.

6. The method according to any one of claims 1 to 3, characterized in that, The data processing operation corresponding to the target instruction template is executed to process the first data, including: Extract field names and corresponding field values ​​from the target instruction template, and determine the execution position of the data processing operation in the first data based on the field names and field values; The data processing operation is performed at the execution location to process the first data.

7. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Execute the target script to obtain the configuration data of the first application; the target script is used to generate the target application. The target application is generated based on the configuration data and the user interface data of the target application carried by the target script. The target application shares the application data storage space with the first application. When the target application is executed, in response to a change in the data stored in the application data storage space of the first application, the data change is displayed on the user interface of the target application, and the data in the application data storage space includes the first data.

8. The method according to claim 7, characterized in that, The step of generating the target application based on the configuration data and the user interface data of the target application carried by the target script includes: The target script configures shared parameters in the configuration data, whereby the shared parameters are identifiers of the application data storage space shared by the target application and the first application after installation. The user interface data of the target application carried by the target script is released into the configuration data of the target application to obtain the modified configuration data of the target application.

9. The method according to claim 7, characterized in that, The execution of the target application, in response to a change in data stored in the application data storage space of the first application, displays the data change on the user interface of the target application, including: Execute the target application and scan for data operations that reference the application's data storage space, the data operations including at least one of read operations, write operations, and delete operations; When the target application detects a change in the data in the application data storage space, it inserts a broadcast notification at the location of the data change; Based on the broadcast notification, the data changes are displayed on the user interface of the target application.

10. A data protection device, characterized in that, The device includes: The calling module is used to call the target process in response to a data processing instruction for the first data of the first application, wherein the data processing instruction carries device information of the target device; and to inject target code data into the target process by reflection injection, wherein the target code data is used to monitor the target process through a hook function; The permission identification module is configured to: if the data processing instruction originates from the first application, determine that the target device does not have data processing permission in response to a mismatch between the processor data in the device information and preset processor data; determine that the target device has data processing permission in response to a mismatch between the processor data and preset processor data; the processor data includes at least one of processor architecture and processor instruction set; if the data processing instruction originates from a development tool, determine that the target device has data processing permission in response to a mismatch between the network environment information in the device information and preset network environment information; determine that the target device does not have data processing permission in response to a mismatch between the network environment information and preset network environment information. The sending module is configured to, if the target device does not have data processing permissions, modify the address where the target process obtains data from the address of the first data to the address of the second data through the HOOK function; send the second data, which is meaningless data, to the target device through the modified target process; if the target device has data processing permissions, in response to the data processing instruction matching with at least one target instruction template, execute the data processing operation corresponding to the target instruction template, process the first data, and increase the weight of the target instruction template; the weight is used to represent the matching priority of the target instruction template when matching the data processing instruction with the at least one instruction template.

11. A computer device, characterized in that, The computer device includes one or more processors and one or more memories, wherein at least one instruction is stored in the one or more memories, the instruction being loaded and executed by the one or more processors to implement the data protection method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement the data protection method as described in any one of claims 1 to 9.

Images