Anti-cracking method and device

Abstract

The present application discloses an anti-cracking method and device, which relates to the field of computer technology and solves the problem of APP anti-cracking in MEC scenarios. The specific scheme is: after the edge dog module receives the first request for requesting the first MAC, it calculates the first MAC according to the operating environment information of the APP, and returns the first MAC to the proxy module or APP, and the proxy module or APP compares the MAC calculated by itself and the received first MAC to verify whether the edge dog module is legal. The embodiment of the present application is used for APP anti-cracking.

Description

[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on December 31, 2019, with application number 201911418601.3 and application name “Anti-cracking method and device”, the entire contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of computer technology, and in particular to an anti-cracking method and device. Background Art

[0003] After selling the APP to the user, the application (APP) manufacturer will take some additional measures to restrict the use of the APP, that is, to restrict the APP from cracking. Currently, there are two commonly used methods to prevent APP from cracking:

[0004] 1. Use universal serial bus (USB) dongle for protection. When each APP purchaser buys the APP, the APP manufacturer will provide a matching USB dongle. When the APP purchaser uses the APP, the USB dongle must be plugged into the computer where the APP is installed so that the APP can run normally. Figure 1 As shown, a dongle agent is integrated in the APP. During the operation of the APP, the dongle agent will request a fingerprint (such as an expected string or data, etc.) from the USB dog. After receiving the request, the USB dog generates a fingerprint and feeds the generated fingerprint back to the dongle agent. If the fingerprint received by the dongle agent meets the preset conditions, the operation is legal and the APP runs normally.

[0005] 2. APP manufacturers bind APP with specified hardware information and only allow it to run on computers with specified hardware information. The specific method is: APP users report the hardware information of the computer where the APP is to be installed to the APP manufacturer, the APP manufacturer writes the hardware information into the APP license, the APP user inputs the license bound with the hardware information into the APP, the APP reads the hardware information in the running environment and compares it with the hardware information in the stored license, and stops activation or running if any inconsistency is found.

[0006] At present, with the development of computer technology and communication technology, mobile edge computing (MEC) has become a key technology for the fifth generation (5G) mobile network. In the MEC scenario, APP manufacturers will deploy APPs on the mobile edge platform (MEC) provided by operators. At this time, APP manufacturers also have the same APP anti-cracking requirements. If the above two solutions are still used for protection, the following problems exist: 1. The USB dog requires a hardware USB port. When multiple APPs are deployed on the MEP, the USB ports provided by the server are limited and cannot meet the anti-cracking requirements of all APPs. 2. In the MEC scenario, the APP will be deployed in a virtual machine (VM) or a container. Both the VM and the container will be migrated. At this time, the hardware information of the server cannot be bound, that is, the two existing anti-cracking methods are not suitable for APP anti-cracking in the MEC scenario. Summary of the invention

[0007] The present application provides an anti-cracking method and device, which solves the problem of APP anti-cracking in the MEC scenario.

[0008] In order to achieve the above objectives, this application adopts the following technical solutions:

[0009] In a first aspect, the present application provides an anti-cracking method, the method comprising: a edge dog module receives a first request for requesting a first message authentication code (MAC) including the operating environment information of an APP, calculates a first MAC for verifying whether the edge dog module is legal based on the operating environment information of the APP, and sends the first MAC.

[0010] Alternatively, the edge dog module can also use an asymmetric key method to use the private key of the edge dog module to sign the operating environment information of the APP and send the signed information, so that after the proxy module or APP receives the signed information, it can decrypt the signed information according to the public key of the edge dog module, verify whether the edge dog module is legal according to the decrypted information, and perform corresponding operations on the APP according to the legality of the edge dog module.

[0011] Based on the method described in the first aspect, after receiving the request for MAC, the edge dog module can generate a MAC according to the operating environment information of the APP, and feed back the MAC to the other end, such as the proxy module or the APP, so that the proxy module or the APP can compare the MAC generated by itself and the received MAC to verify whether the edge dog module is legal, such as when the MAC generated by the proxy module and the MAC generated by the edge dog module are the same, it means that the edge dog module is legal and can perform corresponding operations on the APP. In this way, the edge dog module is bound to the operating environment of the APP. The edge dog module can only calculate the expected MAC when the legitimate user runs the APP in the allowed operating environment, and the verification is successful. Even if the illegal user obtains the APP, the MAC different from the received MAC will be calculated because the APP is not run in the allowed operating environment. The verification fails and the APP cannot be stolen. Compared with the prior art, the method provided in the first aspect can ensure the security of APP use in the MEC scenario.

[0012] In the second aspect, the present application provides an anti-cracking method, the method also includes: the edge dog module receives a first request for requesting to obtain a first MAC and including a fourth MAC and the operating environment information of the APP, the fourth MAC is used to verify whether the edge dog module is legal; the edge dog module calculates the first MAC according to the operating environment information of the APP, compares the first MAC and the fourth MAC, and sends a response to the first request. Wherein, when the first MAC and the fourth MAC are the same, the response of the first request to the APP indicates that the edge dog module is legal, and when the first MAC and the fourth MAC are different, the response of the first request to the APP indicates that the edge dog module is illegal.

[0013] Based on the method described in the second aspect, after receiving a request to obtain a MAC, the edge dog module can generate a MAC according to the operating environment information of the APP, and compare the generated MAC with the MAC generated by the proxy module to verify whether the edge dog module is legal, such as: when the MAC generated by the proxy module and the MAC generated by the edge dog module are the same, it means that the edge dog module is legal and can perform corresponding operations on the APP. In this way, the edge dog module is bound to the operating environment of the APP. The edge dog module can only calculate the expected MAC when the legitimate user runs the APP in the allowed operating environment, and the verification is successful. Even if the illegal user obtains the APP, the MAC different from the received MAC will be calculated because the APP is not run in the allowed operating environment. The verification fails and the APP cannot be stolen. Compared with the prior art, the method provided in the second aspect can ensure the security of APP use in the MEC scenario.

[0014] In a possible design, the edge dog module calculates the first MAC according to the running environment information of the APP, including: the edge dog module uses the running environment information of the APP as an input parameter to calculate the first MAC.

[0015] Based on this possible design, a first MAC can be derived according to the running environment information of the APP, and the running environment information of the APP can be bound to the first MAC, so that when the APP runs in a permitted environment, the edge dog module generates a MAC consistent with the MAC generated by the proxy module, thereby ensuring the normal operation of the APP and improving the security of the APP in the MEC scenario.

[0016] In one possible design, the method further includes: the edge dog module determines that the running environment information of the APP matches the preset running environment information representing the legal running environment of the APP.

[0017] Based on this possible design, a first MAC can be generated when the APP is running in a permitted environment, and then the legitimacy of the first operation of the APP can be verified based on the generated first MAC, thereby avoiding the power consumption caused by the anti-cracking method provided by the above aspects of this application being executed even though the APP is not deployed in a permitted operating environment.

[0018] In a possible design, the edge dog module calculates the first MAC according to the operating environment information of the APP, including: the edge dog module calculates the first MAC according to the operating environment information and security parameters of the APP.

[0019] Based on this possible design, in addition to binding the APP's operating environment information to the APP, the edge dog module can also bind the security parameters to the APP, and jointly calculate the MAC used to verify the legitimacy of the APP's operation based on the security parameters and the APP's operating environment information, ensuring that only users with legal security parameters and running the APP in the specified operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because the user cannot obtain legal security parameters and does not run the APP in the specified operating environment. The MAC cannot be calculated and the MAC is the same as the received MAC, and the APP cannot be stolen. This possible design calculates the MAC based on multiple parameters to improve the security level of APP use in MEC scenarios.

[0020] In a third aspect, the present application provides an anti-cracking method, which includes: the edge dog module receives a first request for requesting a first MAC, calculates a first MAC for verifying whether the edge dog module is legitimate based on security parameters, and sends the first MAC.

[0021] Alternatively, the edge dog module can also use an asymmetric key method to sign the security parameters using the private key of the edge dog module and send the signed information, so that after the proxy module or APP receives the signed information, it can decrypt the signed information according to the public key of the edge dog module, verify whether the edge dog module is legal according to the decrypted information, and perform corresponding operations on the APP according to the legality of the edge dog module.

[0022] Based on the method described in the third aspect, after receiving a request to obtain a MAC, the edge dog module can generate a MAC according to the security parameters, and feed back the generated MAC to the other end, such as a proxy module or an APP, so that the proxy module or the APP can compare the MAC generated by the proxy module and the MAC generated by the edge dog module to verify whether the edge dog module is legal, such as when the MAC generated by the proxy module and the MAC generated by the edge dog module are the same, it means that the edge dog module is legal and corresponding operations can be performed on the APP. In this way, a legal user calculates the expected MAC using legal security parameters through the edge dog module, and performs corresponding operations on the APP while ensuring the legality of the edge dog module. It is achieved that only users with legal security parameters can use the APP, and even if an illegal user obtains the APP, the verification fails because the user cannot obtain the legal security parameters to generate a MAC consistent with the MAC generated by the proxy module, and cannot steal the APP. Compared with the prior art, the method provided in the third aspect ensures the security of APP use in the MEC scenario.

[0023] In a fourth aspect, the present application provides an anti-cracking method, the method further comprising: the edge dog module receives a first request including a fourth MAC, the fourth MAC is used to verify whether the edge dog module is legal; the edge dog module calculates the first MAC according to the security parameter, compares the first MAC and the fourth MAC, and sends a response to the first request. Wherein, when the first MAC and the fourth MAC are the same, the response of the first request indicates that the first operation is legal and the first operation is successful; when the first MAC and the fourth MAC are different, the response of the first request indicates that the first operation is illegal and the first operation fails.

[0024] Based on the method described in the fourth aspect, after receiving a request to obtain a MAC, the edge dog module can generate a MAC according to the security parameters, and compare the generated MAC with the MAC generated by the proxy module to verify whether the edge dog module is legal, such as: when the MAC generated by the proxy module and the MAC generated by the edge dog module are the same, it means that the edge dog module is legal and can perform corresponding operations on the APP. In this way, a legitimate user can use the edge dog module to calculate the expected MAC using legal security parameters, and perform corresponding operations on the APP while ensuring the legality of the edge dog module. Only users with legal security parameters can use the APP, and even if an illegal user obtains the APP, the MAC generated by the proxy module will be generated because the legal security parameters cannot be obtained, resulting in verification failure and the inability to steal the APP. Compared with the prior art, the method provided in the fourth aspect can ensure the security of APP use in the MEC scenario.

[0025] In a possible design, the edge dog module calculates the first MAC according to the security parameter, including: the edge dog module uses the security parameter as an input parameter to calculate the first MAC.

[0026] Based on this possible design, the first MAC can be derived according to the security parameters, and the security parameters can be bound to the first MAC, so that when the edge dog module has legal security parameters, a MAC consistent with the MAC generated by the proxy module can be generated, thereby ensuring the normal operation of the APP and improving the security of the APP in the MEC scenario.

[0027] In a possible design, the edge dog module calculates the first MAC according to the security parameters, including: the edge dog module calculates the first MAC according to the security parameters and the operating environment information of the APP.

[0028] Based on this possible design, in addition to binding security parameters to the APP, the edge dog module can also bind the APP's operating environment information to the APP, and jointly calculate the MAC used to verify the legitimacy of the APP's operation based on the security parameters and the APP's operating environment information, ensuring that only users with legal security parameters and running the APP in the specified operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because the user cannot obtain legal security parameters and does not run the APP in the specified operating environment. The MAC is the same as the received MAC, and the APP cannot be stolen. This possible design calculates MAC based on multiple parameters to improve the security level of APP use in MEC scenarios.

[0029] In a possible design, the edge dog module calculates the first MAC based on the security parameters and the operating environment information of the APP, including: the edge dog module uses the security parameters and the operating environment information of the APP as input parameters to calculate the first MAC.

[0030] Based on this possible design, a first MAC can be derived according to the security parameters and the operating environment information of the APP, and the security parameters and the operating environment information of the APP can be bound to the first MAC, so that when the edge dog module has legal security parameters and the APP runs in a permitted environment, a MAC consistent with the MAC generated by the proxy module is generated to ensure the normal operation of the APP and improve the security of the APP in the MEC scenario.

[0031] In one possible design, the operating environment information of the above-mentioned APP includes any one or more of the following: the identifier of the mobile edge platform (MEP) where the APP is located, the information of the virtual machine (VM) or container where the APP is located, the trusted platform module (TPM) information of the APP running platform, and the hardware information of the VM or container where the APP is running.

[0032] Based on this possible design, the MEP identifier, the information of the virtual machine / container where the APP is located, the TPM information of the APP running platform, and the hardware information of the VM or container where the APP is running can be used as the APP's running environment information to increase the diversity of the APP's running environment information. The diverse running environment information of the APP can be used to improve the security level of the APP running on the MEC.

[0033] In one possible design, the above security parameters are pre-configured to the edge dog module by the APP manufacturer.

[0034] Based on this possible design, the APP manufacturer can pre-configure security parameters to the edge dog module, and the third-party manufacturer can authorize the use of legal security parameters to prevent the edge dog module from being copied by others who are not authorized by the third-party manufacturer, thereby improving the security level of verifying the legal use of the APP through the edge dog module.

[0035] In a possible design, the method further includes: if the first request also carries an indication to activate the APP, the edge dog determines that the number of activations of the APP is less than the maximum allowed number of activations.

[0036] Based on this possible design, the anti-cracking method provided by the above aspects of the present application can be executed when the number of activations of the APP is less than the maximum allowed number of activations, thereby avoiding the power consumption caused by still executing the anti-cracking method provided by the above aspects of the present application when the APP has no remaining activations.

[0037] In one possible design, the method also includes: the edge dog module receives an activation success message indicating that the APP is successfully activated, and updates the activation count of the APP based on the activation success message, and increases the activation count of the APP by 1.

[0038] Based on this possible design, when the APP is successfully activated, the activation count of the APP can be updated, and the activation count of the APP can be increased by 1, to ensure that the activation count of the APP stored locally is updated in time and is consistent with the actual number of successful activations of the APP, thereby improving the accuracy of monitoring the activation count of the APP.

[0039] In one possible design, the method further includes: the edge dog module receives a status synchronization request including the activation count of the APP from the proxy module, and updates the activation count of the APP stored locally to the activation count of the APP.

[0040] Based on this possible design, the activation times of the APP stored in the edge dog module and the proxy module can be synchronized so that the two have the same understanding of the activation times of the APP, avoiding the problem of verification failure caused by inconsistent understanding of the activation times of the APP.

[0041] In one possible design, the method further includes: the edge dog module receives a second request including a second MAC for requesting to deactivate the APP, the second MAC is used to verify whether the operation of deactivating the APP is legal, calculates a third MAC based on security parameters, compares the second MAC and the third MAC, and sends a deactivation response. When the second MAC and the third MAC are the same, the deactivation response is used to indicate that the APP is successfully deactivated, and when the second MAC and the third MAC are different, the deactivation response is used to indicate that the APP has failed to be deactivated.

[0042] Based on this possible design, the edge dog module can verify whether the operation of deactivating the APP is legal according to the security parameters, and bind the security parameters to the operation of deactivating the APP, so that only users with legal security parameters can successfully activate the APP, avoiding problems caused by illegal persons maliciously activating the APP.

[0043] In one possible design, the APP and the proxy module are deployed together, and the edge dog module receives the first request, including: the edge dog module receives the first request from the proxy module. In combination with any aspect from the first aspect to the second aspect or any possible design from the first aspect to the second aspect, the edge dog module sends a first MAC, including: the edge dog module sends a first MAC to the proxy module. In combination with any aspect from the third aspect to the fourth aspect or any possible design from the third aspect to the fourth aspect, the edge dog module sends a response to the first request, including: the edge dog module sends a response to the first request to the proxy module.

[0044] Based on this possible design, when the proxy module and the APP are deployed together, the edge dog module receives the first request from the proxy module and sends a response to the first MAC / first request to the proxy module, that is, the first operation of the APP is verified through the interaction between the edge dog module and the proxy module in the APP, which is simple and easy.

[0045] In one possible design, the APP is deployed separately from the proxy module, and the edge dog module receives the first request, including: the edge dog receives the first request from the APP. In combination with any aspect from the first aspect to the second aspect or any possible design from the first aspect to the second aspect, the edge dog module sends a first MAC, including: the edge dog module sends a first MAC to the APP. In combination with any aspect from the third aspect to the fourth aspect or any possible design from the third aspect to the fourth aspect, the edge dog module sends a response to the first request, including: the edge dog module sends a response to the first request to the APP.

[0046] Based on this possible design, when the proxy module and the APP are deployed separately, the edge dog module receives the first request from the APP and sends a response to the first MAC / first request to the APP. There is no need for the edge dog module to verify the first operation of the APP through interaction with the proxy module, thereby reducing the power consumption of the proxy module.

[0047] In a fifth aspect, the present application provides an anti-cracking method, the method comprising: the edge dog module receives a second request for requesting to deactivate the APP, including a second MAC, the second MAC is used to verify whether the operation of deactivating the APP is legal, and according to the security parameter, a third MAC is calculated, the second MAC and the third MAC are compared, and a deactivation response is sent. When the second MAC and the third MAC are the same, the deactivation response is used to indicate that the APP is successfully deactivated, and when the second MAC and the third MAC are different, the deactivation response is used to indicate that the APP has failed to be deactivated.

[0048] Based on the method provided in the fifth aspect, the edge dog module can verify whether the operation of deactivating the APP is legal according to the security parameters, and bind the security parameters to the operation of deactivating the APP, so that only users with legal security parameters can successfully activate the APP, avoiding problems caused by illegal persons maliciously activating the APP.

[0049] In one possible design, the APP and the proxy module are deployed together, and the edge dog module receives the second request, including: the edge dog module receives the second request from the proxy module, and the edge dog module sends a deactivation response, including: the edge dog module sends a deactivation response to the proxy module.

[0050] Based on this possible design, when the proxy module and the APP are deployed together, the edge dog module receives the second request from the proxy module and sends a deactivation response to the proxy module. The deactivation operation of the APP can be verified through the interaction between the edge dog module and the proxy module in the APP, which is simple and easy.

[0051] In one possible design, the APP module and the proxy module are deployed separately; the edge dog module receives the second request, including: the edge dog module receives the second request from the APP, and the edge dog module sends a deactivation response, including: the edge dog module sends a deactivation response to the APP.

[0052] Based on this possible design, when the proxy module and the APP are deployed separately, the edge dog module receives the second request from the APP and sends a deactivation response to the APP. There is no need for the edge dog module to verify the deactivation operation of the APP through interaction with the proxy module, thereby reducing the power consumption of the proxy module.

[0053] In a sixth aspect, the present application provides a marginal dog module, which may be a functional module for implementing the method described in any one of the first to fifth aspects or any possible design of any one of the first to fifth aspects. The marginal dog module may implement the functions specified by the marginal dog module in any one of the first to fifth aspects or any possible design of any one of the first to fifth aspects, and the functions may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The marginal dog module includes: a receiving unit, a processing unit, a sending unit;

[0054] In one possible design, a receiving unit is used to receive a first request for requesting a first MAC, including operating environment information of an APP; a processing unit is used to calculate a first MAC for verifying whether the edge dog module is legal based on the operating environment information of the APP; and a sending unit is used to send the first MAC.

[0055] In another possible design, the receiving unit is used to receive a first request for requesting to obtain a first MAC and including a fourth MAC, and the fourth MAC is used to verify whether the edge dog module is legal; the processing unit is used to calculate the first MAC according to the operating environment information of the APP, and compare the first MAC and the fourth MAC; the sending unit is used to send a response to the first request. When the first MAC and the fourth MAC are the same, the response to the first request indicates that the edge dog module is legal, and when the first MAC and the fourth MAC are different, the response to the first request indicates that the edge dog module is illegal.

[0056] In one possible design, a receiving unit is used to receive a first request for requesting a first MAC; a processing unit is used to calculate, based on security parameters, a first MAC for verifying whether the edge dog module is legitimate; and a sending unit is used to send the first MAC.

[0057] In another possible design, the receiving unit is used to receive a first request for requesting to obtain a first MAC and including a fourth MAC, and the fourth MAC is used to verify whether the edge dog module is legal; the processing unit is used to calculate the first MAC according to the security parameter, and compare the first MAC and the fourth MAC; the sending unit is used to send a response to the first request. When the first MAC and the fourth MAC are the same, the response of the first request indicates that the edge dog module is legal, and when the first MAC and the fourth MAC are different, the response of the first request indicates that the edge dog module is illegal.

[0058] In another possible design, the receiving unit is used to receive a second request including a second MAC for requesting to deactivate the APP, and the second MAC is used to verify whether the operation of deactivating the APP is legal; the processing unit is used to calculate a third MAC based on the security parameters, and compare the second MAC with the third MAC; the sending unit is used to send a deactivation response. When the second MAC and the third MAC are the same, the deactivation response is used to indicate that the APP is successfully deactivated, and when the second MAC and the third MAC are different, the deactivation response is used to indicate that the APP has failed to be deactivated.

[0059] Among them, the relevant descriptions of security parameters and APP's operating environment information can refer to any possible design of any aspect from the first aspect to the fifth aspect mentioned above; the specific execution process of the receiving unit, the processing unit, and the sending unit can refer to the corresponding actions described in any possible design of any aspect from the first aspect to the fifth aspect mentioned above, and will not be repeated here.

[0060] In the seventh aspect, a computer-readable storage medium is provided, which may be a readable non-volatile storage medium, and which stores computer instructions or programs. When the computer-readable storage medium is run on a computer, the computer executes the anti-cracking method described in any possible design of any one of the first to fifth aspects or any one of the first to fifth aspects.

[0061] In an eighth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the anti-cracking method described in any one of the first to fifth aspects or any possible design of any one of the first to fifth aspects.

[0062] Among them, the technical effects brought about by any design method in the sixth to eighth aspects can refer to the technical effects brought about by any possible design in any one of the first to fifth aspects or any one of the first to fifth aspects, and will not be repeated here.

[0063] In a ninth aspect, the present application provides an anti-cracking method, the method comprising: the proxy module sends a first request to the edge dog module for requesting a first MAC, including the operating environment information of the APP; the proxy module receives the first MAC from the edge dog module for verifying whether the edge dog module is legal; the proxy module calculates a fourth MAC based on the operating environment information of the APP, compares the first MAC with the fourth MAC, and if the first MAC is the same as the fourth MAC, determines that the edge dog module is legal; if the first MAC is different from the fourth MAC, determines that the edge dog module is illegal.

[0064] Alternatively, the proxy module can also receive information signed by the edge dog module using the private key of the edge dog module to indicate the operating environment information of the APP, decrypt the signed information according to the public key of the edge dog module, verify whether the edge dog module is legal according to the decrypted information, and perform corresponding operations on the APP according to the legality of the edge dog module.

[0065] Based on the method described in the ninth aspect, after receiving a request to obtain the first MAC including the operating environment information of the APP, the proxy module can generate a MAC based on the operating environment information of the APP, and compare the MAC generated by itself with the received MAC to verify whether the edge dog module is legal, such as: when the MAC generated by itself is the same as the received MAC, it means that the edge dog module is legal, and the corresponding operation is performed on the APP. In this way, the edge dog module is bound to the operating environment of the APP. The edge dog module can only calculate the expected MAC when the legitimate user runs the APP in the allowed operating environment, and the verification is successful. Even if the illegal user obtains the APP, the MAC different from the received MAC will be calculated because the APP is not run in the allowed operating environment. The verification fails and the APP cannot be stolen. Compared with the prior art, the method provided in the ninth aspect can ensure the security of APP use in the MEC scenario.

[0066] In the tenth aspect, the present application provides an anti-cracking method, which includes: the proxy module sends a first request for requesting a first MAC to the edge dog module, receives a first MAC from the edge dog module for verifying whether the edge dog module is legal, calculates a fourth MAC based on security parameters, compares the first MAC with the fourth MAC, and if the first MAC is the same as the fourth MAC, determines that the edge dog module is legal, otherwise, determines that the edge dog module is illegal.

[0067] Alternatively, the proxy module can also receive information after the edge dog module signs the security parameters using the private key of the edge dog module, decrypt the signed information according to the public key of the edge dog module, verify whether the edge dog module is legal based on the decrypted information, and perform corresponding operations on the APP based on the legality of the edge dog module.

[0068] Based on the method described in the tenth aspect, after receiving a request to obtain the first MAC, the proxy module can generate a MAC according to the security parameters, and compare the MAC generated by itself and the received MAC to verify whether the edge dog module is legal, such as: when the MAC generated by itself is the same as the received MAC, it means that the edge dog module is legal, and the corresponding operation is performed on the APP. In this way, the legal user calculates the expected MAC using the legal security parameters through the edge dog module, and performs the corresponding operation on the APP while ensuring the legality of the edge dog module. It is realized that only users with legal security parameters can use the APP, and even if the illegal user obtains the APP, it will fail to obtain the legal security parameters to generate a MAC consistent with the MAC generated by the proxy module, resulting in verification failure and the inability to steal the APP. Compared with the prior art, the method provided in the tenth aspect ensures the security of APP use in the MEC scenario.

[0069] In one possible design, the proxy module calculates the fourth MAC based on the security parameter, including: the proxy module uses the security parameter as an input parameter to calculate the fourth MAC.

[0070] Based on this possible design, a fourth MAC can be derived according to the security parameters, and the security parameters can be bound to the fourth MAC, so that when the proxy module has legal security parameters, a MAC consistent with the MAC generated by the proxy module is generated, thereby ensuring the normal operation of the APP and improving the security of the APP in the MEC scenario.

[0071] In a possible design, the proxy module calculates the fourth MAC according to the security parameters, including: the proxy module calculates the fourth MAC according to the security parameters and the operating environment information of the APP.

[0072] Based on this possible design, in addition to binding security parameters to the APP, the proxy module can also bind the APP's operating environment information to the APP, and jointly calculate the MAC used to verify the legitimacy of the APP's operation based on the security parameters and the APP's operating environment information, ensuring that only users with legal security parameters and running the APP in the specified operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because the user cannot obtain legal security parameters and does not run the APP in the specified operating environment, and cannot calculate the same MAC as the received MAC, and cannot misuse the APP. This possible design calculates MAC based on multiple parameters to improve the security level of APP use in MEC scenarios.

[0073] In the eleventh aspect, the present application provides an anti-cracking method, where the proxy module receives a third request from the APP for requesting a fourth MAC, calculates a fourth MAC for verifying whether the edge dog module is legal based on security parameters, and sends the fourth MAC to the APP.

[0074] Based on the method described in the eleventh aspect, after receiving the request to obtain the fourth MAC, the proxy module generates a MAC based on the security parameters and sends the generated MAC to the APP, so that the APP sends the MAC generated by the proxy module to the edge dog module. The edge dog module compares the MAC generated by the proxy module and the MAC generated by the edge dog module to verify whether the edge dog module is legal. In this way, only users with legal security parameters can use the APP, and even if illegal users obtain the APP, they will not be able to obtain the legal security parameters to generate a MAC consistent with the MAC generated by the proxy module, resulting in verification failure and the inability to steal the APP. Compared with the prior art, the method provided in the tenth aspect ensures the security of APP use in the MEC scenario.

[0075] In the twelfth aspect, the present application provides an anti-cracking method, where the proxy module receives a third request from the APP for requesting a fourth MAC, including the operating environment information of the APP, calculates the fourth MAC used to verify whether the edge dog module is legal based on the operating environment information of the APP, and sends the fourth MAC to the APP.

[0076] Based on the method described in aspect 12, after receiving the request to obtain the fourth MAC, the proxy module generates a MAC based on the operating environment information of the APP, and sends the generated MAC to the APP, so that the APP sends the MAC generated by the proxy module to the edge dog module. The edge dog module compares the MAC generated by the proxy module and the MAC generated by the edge dog module to verify whether the edge dog module is legal. In this way, the APP is bound to the operating environment of the APP. The legitimate user can only calculate the expected MAC when running the APP in the allowed operating environment, and the verification is successful. Even if the illegal user obtains the APP, the MAC different from the received MAC will be calculated because the APP is not run in the allowed operating environment. The verification fails and the APP cannot be stolen. Compared with the prior art, the method provided in aspect 9 can ensure the security of APP use in MEC scenarios.

[0077] In a possible design, the proxy module calculates the fourth MAC according to the operating environment information of the APP, including: the proxy module uses the operating environment information of the APP as an input parameter to calculate the fourth MAC.

[0078] Based on this possible design, a fourth MAC can be derived according to the running environment information of the APP, and the running environment information of the APP can be bound to the fourth MAC, so that when the APP runs in a permitted environment, the proxy module generates a MAC consistent with the MAC generated by the proxy module, thereby ensuring the normal operation of the APP and improving the security of the APP in the MEC scenario.

[0079] In one possible design, the method further includes: the proxy module determines that the operating environment information of the APP matches the preset operating environment information representing the legitimate operating environment of the APP.

[0080] Based on this possible design, a fourth MAC can be generated when the APP is running in a permitted environment, and then the legitimacy of the first operation of the APP can be verified based on the generated fourth MAC, thereby avoiding the power consumption caused by the anti-cracking method provided by the above aspects of this application being executed even though the APP is not deployed in a permitted operating environment.

[0081] In a possible design, the proxy module calculates the fourth MAC according to the operating environment information of the APP, including: the proxy module calculates the fourth MAC according to the operating environment information and security parameters of the APP.

[0082] Based on this possible design, in addition to binding the APP's operating environment information to the APP, the proxy module can also bind the security parameters to the APP, and jointly calculate the MAC used to verify the legitimacy of the APP's operation based on the security parameters and the APP's operating environment information, ensuring that only users with legal security parameters and running the APP in the specified operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because the user cannot obtain legal security parameters and does not run the APP in the specified operating environment, and cannot calculate the same MAC as the received MAC, and cannot misuse the APP. This possible design calculates MAC based on multiple parameters to improve the security level of APP use in MEC scenarios.

[0083] In one possible design, the proxy module calculates the fourth MAC based on the security parameters and the operating environment information of the APP, including: the proxy module uses the security parameters and the operating environment information of the APP as input parameters to calculate the fourth MAC.

[0084] Based on this possible design, a fourth MAC can be derived according to the security parameters and the operating environment information of the APP, and the security parameters and the operating environment information of the APP can be bound to the fourth MAC, so that when the proxy module has legal security parameters and the APP runs in a permitted environment, a MAC consistent with the MAC generated by the proxy module is generated, thereby ensuring the normal operation of the APP and improving the security of the APP in the MEC scenario.

[0085] In one possible design, security parameters are pre-configured by the APP manufacturer to the edge dog module.

[0086] Based on this possible design, the APP manufacturer can pre-configure security parameters to the proxy module, and the third-party manufacturer can authorize the use of legal security parameters to prevent the edge dog module from being copied by others who are not authorized by the third-party manufacturer, thereby improving the security level of verifying the legal use of the APP through the edge dog module.

[0087] In one possible design, the identifier of the MEP where the APP is located, the information of the VM or container where the APP is located, the TPM information of the APP running platform, and the hardware information of the VM or container where the APP is running.

[0088] Based on this possible design, the MEP identifier, the information of the virtual machine / container where the APP is located, the TPM information of the APP running platform, and the hardware information of the VM or container where the APP is running can be used as the APP's running environment information to increase the diversity of the APP's running environment information. The diverse running environment information of the APP can be used to improve the security level of the APP running on the MEC.

[0089] In one possible design, the method further includes: if the first request also carries an indication to activate the APP, the proxy module determines that the number of activations of the APP is less than the maximum allowed number of activations.

[0090] Based on this possible design, the anti-cracking method provided by the above aspects of the present application can be executed when the number of activations of the APP is less than the maximum allowed number of activations, thereby avoiding the power consumption caused by still executing the anti-cracking method provided by the above aspects of the present application when the APP has no remaining activations.

[0091] In one possible design, the method further includes: the proxy module calculates a second MAC for verifying whether the operation of deactivating the APP is legal based on the security parameters, and sends a second request including the second MAC to the edge dog module. Alternatively, the proxy module receives a fourth request from the APP for requesting to deactivate the APP, calculates a second MAC for verifying whether the operation of deactivating the APP is legal based on the security parameters, and sends the second MAC to the APP.

[0092] Based on this possible design, the proxy module can calculate the MAC used to verify whether the operation of deactivating the APP is legal according to the security parameter verification. In this way, the security parameters are bound to the operation of deactivating the APP, so that only users with legal security parameters can successfully deactivate the APP, avoiding problems caused by illegal persons maliciously deactivating the APP.

[0093] In one possible design, in combination with any aspect from the seventh to the tenth aspect or any possible design of any aspect from the seventh to the tenth aspect, the method also includes: the proxy module sends a status synchronization request to the edge dog module, wherein the status synchronization request includes the number of activations of the APP.

[0094] Based on this possible design, the activation times of the APP stored in the edge dog module and the proxy module can be synchronized so that the two have the same understanding of the activation times of the APP, avoiding the problem of verification failure caused by inconsistent understanding of the activation times of the APP.

[0095] In the thirteenth aspect, the present application provides an agent module, which can be a functional module for implementing the method described in any one of aspects 9 to 12 or any possible design of any one of aspects 9 to 12. The agent module can implement the functions specified by the agent module in any one of aspects 9 to 12 or any possible design of any one of aspects 9 to 12, and the functions can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The agent module includes: a receiving unit, a processing unit, a sending unit;

[0096] In one possible design, a sending unit is used to send a first request for requesting a first MAC, including operating environment information of the APP, to the edge dog module; a receiving unit is used to receive a first MAC from the edge dog module for verifying whether the edge dog module is legal; a processing unit is used to calculate a fourth MAC based on the operating environment information of the APP, compare the first MAC with the fourth MAC, and if the first MAC is the same as the fourth MAC, determine that the edge dog module is legal; if the first MAC is different from the fourth MAC, determine that the edge dog module is illegal.

[0097] In another possible design, the receiving unit is used to receive a third request from the APP for requesting a fourth MAC; the processing unit is used to calculate, based on the security parameters, a fourth MAC for verifying whether the edge dog module is legitimate; and the sending unit is used to send the fourth MAC to the APP.

[0098] In another possible design, a sending unit is used to send a first request for requesting a first MAC to the edge dog module; a receiving unit is used to receive a first MAC from the edge dog module for verifying whether the edge dog module is legal; and a processing unit is used to calculate a fourth MAC based on security parameters, compare the first MAC with the fourth MAC, and if the first MAC is the same as the fourth MAC, determine that the edge dog module is legal; otherwise, determine that the edge dog module is illegal.

[0099] In another possible design, the receiving unit is used to receive a third request from the APP for requesting a fourth MAC, including the operating environment information of the APP; the processing unit is used to calculate the fourth MAC for verifying whether the edge dog module is legal based on the operating environment information of the APP; and the sending unit is used to send the fourth MAC to the APP.

[0100] Among them, the relevant descriptions of security parameters and APP's operating environment information can refer to any possible design of any aspect from the ninth aspect to the twelfth aspect mentioned above; the specific execution process of the receiving unit, the processing unit, and the sending unit can refer to the corresponding actions in any possible design of any aspect from the ninth aspect to the twelfth aspect mentioned above, and will not be repeated here.

[0101] In the fourteenth aspect, a computer-readable storage medium is provided, which may be a readable non-volatile storage medium, and which stores computer instructions or programs. When the computer-readable storage medium is run on a computer, the computer executes the anti-cracking method described in any possible design of any one of the above-mentioned aspects 9 to 12 or any one of the aspects 9 to 12.

[0102] In the fifteenth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the anti-cracking method described in any one of the above-mentioned aspects 9 to 12 or any possible design of any one of the aspects 9 to 12.

[0103] Among them, the technical effects brought about by any design method in aspects 13 to 15 can refer to the technical effects brought about by any possible design in aspects 9 to 12 or any possible design in aspects 9 to 12, and will not be repeated here.

[0104] In a sixteenth aspect, the present application further provides a mobile edge host, the server comprising one or more processors and a memory, a VM or a container running on the one or more processors, the one or more containers comprising a proxy module and an edge dog module, the proxy module and the APP being deployed in unison or the proxy module and the APP being deployed separately;

[0105] The edge dog module is used to execute the anti-cracking method described in any one of the first to fifth aspects or any possible design of any one of the first to fifth aspects;

[0106] When the proxy module is deployed in conjunction with the APP, the proxy module is used to execute the anti-cracking method described in the ninth aspect or the tenth aspect or any possible design of the ninth aspect or any possible design of the tenth aspect. When the proxy module is deployed separately from the APP, the proxy module is used to execute the anti-cracking method described in the eleventh aspect or the twelfth aspect or any possible design of the eleventh aspect or any possible design of the twelfth aspect.

[0107] In the seventeenth aspect, the present application also provides an anti-cracking method, which is executed by a terminal on which an application APP client is deployed. The method includes: the terminal receives a first request from an APP server for requesting a first MAC and carrying an identifier of an MEP, and calculates a first MAC based on the identifier of the MEP, wherein the first MAC is used to verify whether the APP is legal, and the terminal sends the first MAC to the APP server.

[0108] Based on the method described in aspect 17, the terminal can calculate the MAC used to verify whether the APP is legitimate, and provide the verification MAC value to the APP server, so that the APP server can verify the legitimacy of the APP based on the MAC calculated by itself and the MAC calculated by the terminal, effectively binding the front and back ends, and with the help of the front-end terminal, the server with the APP deployed on the back end also has anti-copying and cracking features.

[0109] In one possible design, in combination with the seventeenth aspect, the terminal calculates the first MAC based on the identifier of the MEP, including: the terminal calculates the first MAC based on the identifier of the MEP and hardware security parameters, wherein the hardware security parameters are pre-configured in the network function virtualization infrastructure NFVI, or the hardware security parameters are pre-configured in the terminal.

[0110] Based on this possible design, in addition to binding the MEP identifier to the APP, the terminal can also bind the hardware security parameters to the APP, and calculate the MAC used to verify the legitimacy of the APP based on the hardware security parameters and the MEP identifier, ensuring that only users with legal hardware security parameters and running the APP in the specified MEP operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because they cannot obtain legal hardware security parameters and do not run the APP in the specified MEP operating environment. The MAC cannot be calculated and the APP cannot be stolen. This possible design calculates the MAC based on multiple parameters to improve the security level of APP use.

[0111] In one possible design, in combination with aspect seventeen or any possible design of aspect seventeen, the hardware security parameters include one or more parameters of a security chip identification ID, a security chip preset parameters, and a processor ID in the security chip, and the security chip preset parameters include a random number or a root key.

[0112] Based on this possible design, the hardware security parameters are configured as parameters inherent in the security chip itself, so that the hardware security parameters have the characteristics of being unchanged, non-copyable, and difficult to crack, so that the legal APP verified based on the hardware security parameters also has anti-copying and anti-cracking characteristics.

[0113] In the eighteenth aspect, the present application provides an anti-cracking device, which can be a terminal or a chip or system on chip in the terminal, and can also be a module or unit in the terminal for implementing the anti-cracking method described in the embodiment of the present application. The anti-cracking device can implement the functions performed by the terminal in the above-mentioned aspects or possible designs, and the functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. For example, the anti-cracking device may include: an agent module and a processing module. Furthermore, the processing module may include a security module or a security chip, and the security module or security chip may pre-configure hardware security parameters.

[0114] The proxy module is used to receive a first request carrying an identifier of the MEP for requesting a first MAC from an APP server, wherein the first MAC is used to verify whether the APP is legal.

[0115] The processing module is used to calculate a first MAC according to the identifier of the MEP, and send the first MAC to the APP server through the proxy module.

[0116] The specific implementation of the anti-cracking device can refer to the behavior function of the terminal in the anti-cracking method provided in the seventeenth aspect or any possible design of the seventeenth aspect, and will not be repeated here. Therefore, the anti-cracking device provided can achieve the same beneficial effects as the seventeenth aspect or any possible design of the seventeenth aspect.

[0117] In the nineteenth aspect, an anti-cracking device is provided, which can be a terminal or a chip or system on chip in the terminal. The anti-cracking device can implement the functions performed by the terminal in the above aspects or possible designs, and the functions can be implemented by hardware. In one possible design, the anti-cracking device may include: a processor, a communication interface and a security chip, and the security chip may be pre-configured with hardware security parameters. The processor can be used to support the anti-cracking device to implement the functions involved in the above seventeenth aspect or any possible design of the seventeenth aspect, for example: the processor is used to receive a first request carrying the MEP identifier from the APP server through the communication interface for requesting a first MAC, calculate the first MAC according to the MEP identifier, and send the first MAC to the APP server. In another possible design, the anti-cracking device may also include a memory, which is used to store computer-executable instructions and data necessary for the anti-cracking device. When the anti-cracking device is running, the processor executes the computer-executable instructions stored in the memory, so that the anti-cracking device performs the anti-cracking method described in the above seventeenth aspect or any possible design of the seventeenth aspect.

[0118] In the twentieth aspect, a computer-readable storage medium is provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer can execute the anti-cracking method described in the seventeenth aspect or any possible design of the above aspects.

[0119] In the twenty-first aspect, a computer program product comprising instructions is provided. The computer program product may include program instructions. When the computer program product runs on a computer, the computer can execute the anti-cracking method described in the seventeenth aspect or any possible design of the above aspects.

[0120] In the twenty-second aspect, a chip system is provided, which includes a processor and a communication interface; further, it may also include a security chip, and the security chip may be pre-configured with hardware security parameters. The chip system can be used to implement the functions performed by the terminal in the above-mentioned seventeenth aspect or any possible design of the seventeenth aspect, for example, the processor is used to receive a first request carrying the MEP identifier from the APP server through the communication interface for requesting a first MAC, calculate the first MAC according to the MEP identifier, and send the first MAC to the APP server. In one possible design, the chip system also includes a memory, which is used to store program instructions and / or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices, without limitation.

[0121] Among them, the technical effects brought about by any design method from the nineteenth to the twenty-second aspects can refer to the technical effects brought about by the above-mentioned seventeenth aspect or any possible design of the seventeenth aspect, and will not be repeated here.

[0122] In a twenty-third aspect, the present application further provides an anti-cracking method, which is applied to an application APP server, and the method includes: the APP server sends a first request to a terminal, wherein the first request is used to request a first message authentication code MAC; the first request carries an identifier of a mobile edge platform MEP;

[0123] The APP server receives the first MAC from the terminal, and the first MAC is used to verify whether the APP is legitimate;

[0124] The APP server obtains the second MAC, which is used to verify whether the APP is legitimate;

[0125] The APP server compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal. If the first MAC is different from the second MAC, the APP is determined to be illegal.

[0126] Based on the method described in aspect 23, the APP server can receive a MAC from the terminal for verifying whether the APP is legitimate, and verify the legitimacy of the APP based on the obtained MAC and the MAC calculated by the terminal, thereby effectively binding the front-end and back-end, and with the help of the front-end terminal, the server with the APP deployed on the back-end also has anti-copying and cracking features.

[0127] In one possible design, in combination with the twenty-third aspect, the APP server obtains the second MAC, including: the APP server calculates the second MAC based on the identifier of the MEP.

[0128] Based on this possible design, the APP server binds the MEP identifier to the APP to calculate the MAC, ensuring that only users who run the APP in the specified MEP operating environment can use the APP. Even if an illegal user obtains the APP, because the APP is not run in the specified MEP operating environment, it cannot calculate the MAC that is the same as the received MAC, and the verification fails, and the APP cannot be stolen.

[0129] In one possible design, in combination with the twenty-third aspect or any possible design of the twenty-third aspect, the APP server calculates the second MAC based on the MEP identifier, including: the APP server calculates the second MAC based on the MEP identifier and hardware security parameters, wherein the APP server receives the hardware security parameters from the NFVI, or the APP server receives the hardware security parameters from the terminal.

[0130] Based on this possible design, in addition to binding the MEP identifier to the APP, the APP server can also bind the hardware security parameters to the APP, and calculate the MAC used to verify the legitimacy of the APP based on the hardware security parameters and the MEP identifier, ensuring that only users with legal hardware security parameters and running the APP in the specified MEP operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because they cannot obtain legal hardware security parameters and do not run the APP in the specified MEP operating environment. The MAC cannot be calculated and the APP cannot be stolen. This possible design calculates the MAC based on multiple parameters to improve the security level of APP use.

[0131] In one possible design, in combination with the twenty-third aspect or any possible design of the twenty-third aspect, the APP server obtains the second MAC, including: the APP server sends a second request, wherein the second request is used to request the second MAC; the APP server receives the second MAC.

[0132] Based on this possible design, the APP server can receive the second MAC from other network elements without calculating the MAC itself, thereby reducing the power consumption caused by the APP server calculating the MAC.

[0133] In one possible design, in combination with aspect 23 or any possible design of aspect 23, the second request carries the identifier of the MEP, or the second request carries the identifier of the MEP and hardware security parameters.

[0134] Based on this possible design, the APP server can send the MEP's identifier and / or hardware security parameters to other network elements, so that other network elements can calculate the MAC based on the MEP's identifier and / or hardware security parameters, thereby improving the security level of APP verification.

[0135] In one possible design, in combination with the twenty-third aspect or any possible design of the twenty-third aspect, the APP server sends a second request including: the APP sends a second request to the MEP; the APP server receives the second MAC including: the APP server receives the second MAC from the MEP; or, the APP server sends a second request including: the APP sends a second request to the network function virtualization infrastructure NFVI; the APP server receives the second MAC including: the APP server receives the second MAC from the NFVI.

[0136] Based on this possible design, the APP server can request the MEP or NFVI to calculate the second MAC without calculating the MAC itself, which reduces the power consumption caused by the APP server calculating the MAC. The second MAC is calculated by the MEP or NFVI, so that the input parameters required for calculating the MAC, such as the MEP ID and hardware security parameters, do not need to be transmitted to the MEP or NFVI through signaling interaction, preventing the input parameters from being tampered with and improving the accuracy of APP verification.

[0137] In one possible design, in combination with aspect twenty-third or any possible design of aspect twenty-third, the hardware security parameters include one or more parameters of a security chip identification ID, a security chip preset parameters, and a processor ID in the security chip, and the security chip preset parameters include a random number or a root key.

[0138] Based on this possible design, the hardware security parameters are configured as parameters inherent in the security chip itself, so that the hardware security parameters have the characteristics of being unchanged, non-copyable, and difficult to crack, so that the legal APP verified based on the hardware security parameters also has anti-copying and anti-cracking characteristics.

[0139] In the twenty-fourth aspect, the present application provides an anti-cracking device, which can be an APP server or a chip or system on chip in the APP server, and can also be a module or unit in the APP server for implementing the anti-cracking method described in the embodiment of the present application. The anti-cracking device can implement the functions performed by the APP server in the above aspects or possible designs, and the functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. For example, the anti-cracking device may include: an agent module and a processing module.

[0140] The proxy module is used to send a first request to the terminal and receive a first MAC from the terminal, wherein the first request is used to request the first MAC; the first request carries an identifier of the MEP;

[0141] The proxy module is also used to obtain the second MAC, which is used to verify whether the APP is legal;

[0142] The processing module is used to compare the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0143] The specific implementation of the anti-cracking device can refer to the behavior function of the terminal in the anti-cracking method provided in the twenty-third aspect or any possible design of the twenty-third aspect, and will not be repeated here. Therefore, the provided anti-cracking device can achieve the same beneficial effect as the twenty-third aspect or any possible design of the twenty-third aspect.

[0144] In the twenty-fifth aspect, an anti-cracking device is provided, which can be an APP server or a chip or system on chip in the APP server. The anti-cracking device can implement the functions performed by the APP server in the above aspects or possible designs, and the functions can be implemented by hardware. In one possible design, the anti-cracking device may include: a processor, a communication interface, and a security chip, and the security chip may be pre-configured with hardware security parameters. The processor can be used to support the anti-cracking device to implement the functions involved in the above twenty-third aspect or any possible design of the twenty-third aspect, for example: the processor is used to send a first request to the terminal through the communication interface, receive a first MAC from the terminal, wherein the first request is used to request the first MAC; the first request carries the identifier of the MEP; and obtain a second MAC, the second MAC is used to verify whether the APP is legal, compare the first MAC with the second MAC, if the first MAC is the same as the second MAC, then determine that the APP is legal, if the first MAC is different from the second MAC, then determine that the APP is illegal. In another possible design, the anti-cracking device may also include a memory, the memory is used to store the necessary computer execution instructions and data for the anti-cracking device. When the anti-cracking device is running, the processor executes the computer execution instructions stored in the memory to enable the anti-cracking device to perform the anti-cracking method described in the above-mentioned twenty-third aspect or any possible design of the twenty-third aspect.

[0145] In the twenty-sixth aspect, a computer-readable storage medium is provided, which stores instructions. When the computer-readable storage medium is run on a computer, the computer can execute the anti-cracking method described in the above-mentioned twenty-third aspect or any possible design of the above-mentioned aspects.

[0146] In the twenty-seventh aspect, a computer program product comprising instructions is provided. The computer program product may include program instructions. When the computer program product runs on a computer, the computer can execute the anti-cracking method described in the above-mentioned twenty-third aspect or any possible design of the above-mentioned aspects.

[0147] In aspect 28, a chip system is provided, which includes a processor and a communication interface; further, it may also include a security chip, and the security chip may be pre-configured with hardware security parameters. The chip system can be used to implement the functions performed by the APP server in aspect 23 or any possible design of aspect 23, for example, the processor is used to send a first request to the terminal through the communication interface, and receive a first MAC from the terminal, wherein the first request is used to request the first MAC; the first request carries the identifier of the MEP, and obtains the second MAC, the second MAC is used to verify whether the APP is legal, compare the first MAC with the second MAC, if the first MAC is the same as the second MAC, then the APP is determined to be legal, if the first MAC is different from the second MAC, then the APP is determined to be illegal. In one possible design, the chip system also includes a memory, and the memory is used to store program instructions and / or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices, without limitation.

[0148] Among them, the technical effects brought about by any design method in aspects 25 to 28 can refer to the technical effects brought about by the above-mentioned aspect 23 or any possible design of aspect 23, and will not be repeated here.

[0149] In the twenty-ninth aspect, the present application also provides an anti-cracking method, which is applied to MEP or NFVI, and the method includes: receiving a second request, wherein the second request is used to request a second MAC; the second request includes an identifier of the MEP; based on the identifier of the MEP, calculating a second MAC, wherein the second MAC is used to verify whether the APP is legal.

[0150] Based on the method described in aspect 29, the MEP or NFVI can calculate a MAC for verifying whether the APP is legitimate based on the MEP or NFVI, and provide the verification MAC value to the APP server, so that the APP server can verify the legitimacy of the APP based on the MAC calculated by the MEP or NFVI and the MAC calculated by the terminal, effectively binding the front and back ends, and with the help of the front-end terminal, the server with the APP deployed on the back end also has anti-copying and cracking features.

[0151] In one possible design, in combination with aspect 29 or any possible design of aspect 29, the second request also includes hardware security parameters; and according to the identifier of the MEP, the second MAC is calculated, including: the MEP calculates the second MAC according to the identifier of the MEP and the hardware security parameters.

[0152] Based on this possible design, in addition to binding the MEP identifier to the APP, the hardware security parameters can also be bound to the APP, and the MAC used to verify the legitimacy of the APP can be calculated based on the hardware security parameters and the MEP identifier, ensuring that only users with legal hardware security parameters and running the APP in the specified MEP operating environment can use the APP. Even if an illegal user obtains the APP, the verification fails because the user cannot obtain legal hardware security parameters and does not run the APP in the specified MEP operating environment, and cannot calculate the same MAC as the received MAC, and cannot steal the APP. This possible design calculates the MAC based on multiple parameters to improve the security level of APP use.

[0153] In one possible design, in combination with aspect 29 or any possible design of aspect 29, the hardware security parameters include one or more parameters of a security chip identification ID, a security chip preset parameters, and a processor ID in the security chip, and the security chip preset parameters include a random number or a root key.

[0154] Based on this possible design, the hardware security parameters are configured as parameters inherent in the security chip itself, so that the hardware security parameters have the characteristics of being unchanged, non-copyable, and difficult to crack, so that the legal APP verified based on the hardware security parameters also has anti-copying and anti-cracking characteristics.

[0155] In one possible design, in combination with aspect 29 or any possible design of aspect 29, the method also includes: sending a second MAC.

[0156] Based on this possible design, MEP or NFVI can send out the MAC calculated by itself to verify whether the APP is legitimate, so that the APP server receives the MAC value, and verifies the legitimacy of the APP based on the MAC calculated by MEP or NFVI and the MAC calculated by the terminal, effectively binding the front and back ends. With the help of the front-end terminal, the server deployed with the APP on the back end also has anti-copying and cracking features.

[0157] In one possible design, in combination with aspect 29 or any possible design of aspect 29, sending the second MAC includes: sending the second MAC to the APP server; or, sending the second MAC to the MEP.

[0158] Based on this possible design, the MEP or NFVI can directly interact with the APP server to send the calculated MAC to the APP server, or send it to the APP server through the MEP. The sending methods are flexible and diverse, adapting to various application scenarios.

[0159] In one possible design, in combination with the twenty-ninth aspect or any possible design of the twenty-ninth aspect, when the method is applied to NFVI, the second request also includes a first MAC, and the method also includes: comparing the first MAC with the second MAC, if the first MAC is the same as the second MAC, determining that the APP is legal, if the first MAC is different from the second MAC, determining that the APP is illegal.

[0160] Based on this possible design, NFVI can also verify the legitimacy of the APP based on the MAC, without the need for the APP server to verify the legitimacy of the APP, thereby reducing the power consumption caused by the APP server verifying the legitimacy of the APP.

[0161] In one possible design, in combination with aspect 29 or any possible design of aspect 29, receiving the second request includes: receiving a second request from an APP server; or, when the method is applied to NFVI, receiving the second request includes: receiving a second request from a MEP.

[0162] Based on this possible design, MEP or NFVI can directly communicate with the APP server to receive the second request sent by the APP; or, NFVI receives the second request sent by the APP server through MEP. The sending method is flexible and diverse and can adapt to various application scenarios.

[0163] In the thirtieth aspect, the present application provides an anti-cracking device, which can be a MEP or a chip or a system on chip in the MEP, and can also be a module or unit in the MEP for implementing the anti-cracking method described in the embodiment of the present application. It can also be a NFVI or a chip or a system on chip in the NFVI, and can also be a module or unit in the NFVI for implementing the anti-cracking method described in the embodiment of the present application. The anti-cracking device can implement the functions performed by the MEP or NFVI in the above-mentioned aspects or possible designs, and the functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. For example, the anti-cracking device may include: a receiving module and a processing module. When the anti-cracking device is a NFVI or a chip or a system on chip in the NFVI, it may also include a security chip, in which hardware security parameters are pre-configured.

[0164] The receiving module receives a second request, wherein the second request is used to request a second MAC; and the second request includes an identifier of the MEP.

[0165] The processing module is used to calculate a second MAC according to the identifier of the MEP, wherein the second MAC is used to verify whether the APP is legal.

[0166] The specific implementation of the anti-cracking device can refer to the behavior function of the terminal in the anti-cracking method provided in the twenty-ninth aspect or any possible design of the twenty-ninth aspect, and will not be repeated here. Therefore, the provided anti-cracking device can achieve the same beneficial effects as the twenty-ninth aspect or any possible design of the twenty-ninth aspect.

[0167] In the thirty-first aspect, an anti-cracking device is provided, which can be a MEP or a chip or system on chip in the MEP, or a module or unit in the MEP for implementing the anti-cracking method described in the embodiment of the present application. It can also be a NFVI or a chip or system on chip in the NFVI, or a module or unit in the NFVI for implementing the anti-cracking method described in the embodiment of the present application. The anti-cracking device can implement the functions performed by the MEP or NFVI in the above aspects or possible designs. In one possible design, the anti-cracking device may include: a processor, a communication interface, and a security chip, and the security chip may be pre-configured with hardware security parameters. The processor can be used to support the anti-cracking device to implement the functions involved in the above twenty-ninth aspect or any possible design of the twenty-ninth aspect, for example: the processor is used to receive a second request through the communication interface, wherein the second request is used to request a second MAC; the second request includes an identifier of the MEP, and the second MAC is calculated according to the identifier of the MEP, wherein the second MAC is used to verify whether the APP is legal. In another possible design, the anti-cracking device may also include a memory, which is used to store computer execution instructions and data necessary for the anti-cracking device. When the anti-cracking device is running, the processor executes the computer execution instructions stored in the memory to enable the anti-cracking device to perform the anti-cracking method described in the above-mentioned aspect 29 or any possible design of the aspect 29.

[0168] In the thirty-second aspect, a computer-readable storage medium is provided, which stores instructions, and when the computer-readable storage medium is run on a computer, the computer can execute the anti-cracking method described in the above-mentioned twenty-ninth aspect or any possible design of the above-mentioned aspects.

[0169] In the thirty-third aspect, a computer program product comprising instructions is provided. The computer program product may include program instructions. When the computer program product runs on a computer, the computer can execute the anti-cracking method described in the above-mentioned twenty-ninth aspect or any possible design of the above-mentioned aspects.

[0170] In the thirty-fourth aspect, a chip system is provided, which includes a processor and a communication interface; further, it may also include a security chip, and the security chip may be pre-configured with hardware security parameters. The chip system can be used to implement the functions performed by the MEP or NFVI in the above-mentioned twenty-ninth aspect or any possible design of the twenty-ninth aspect, for example, the processor is used to receive a second request through the communication interface, wherein the second request is used to request a second MAC; the second request includes an identifier of the MEP, and a second MAC is calculated based on the identifier of the MEP, wherein the second MAC is used to verify whether the APP is legal. In one possible design, the chip system also includes a memory, which is used to store program instructions and / or data. The chip system may be composed of a chip, or may include a chip and other discrete devices, without limitation.

[0171] Among them, the technical effects brought about by any design method in aspects 31 to 34 can refer to the technical effects brought about by the above-mentioned aspect 29 or any possible design of aspect 29, and will not be repeated here.

[0172] In aspect 35, the present application also provides an anti-cracking system, which may include the anti-cracking device described in any one of aspects 18 to 22, the anti-cracking device described in any one of aspects 24 to 28, and the anti-cracking device described in any one of aspects 30 to 34. BRIEF DESCRIPTION OF THE DRAWINGS

[0173] Figure 1 A schematic diagram of an anti-cracking method provided by the prior art;

[0174] Figure 2 A schematic diagram of the architecture of a MEC system provided for this application;

[0175] Figure 3 A schematic diagram of the composition of a mobile edge host provided in this application;

[0176] Figure 4 A flowchart of an anti-cracking method provided in an embodiment of the present application;

[0177] Figure 5 A flowchart of an anti-cracking method when activating an APP provided in an embodiment of the present application;

[0178] Figure 6 A flowchart of a method for preventing cracking when running an APP provided in an embodiment of the present application;

[0179] Figure 7 A flowchart of a method for preventing cracking when deactivating an APP provided in an embodiment of the present application;

[0180] Figure 8 A flowchart of an anti-cracking method provided in an embodiment of the present application;

[0181] Fig. 9 A flowchart of an anti-cracking method when activating an APP provided in an embodiment of the present application;

[0182] Fig.10 A flowchart of a method for preventing cracking when running an APP provided in an embodiment of the present application;

[0183] Fig.11 A flowchart of a method for preventing cracking when deactivating an APP provided in an embodiment of the present application;

[0184] Fig.12 A flowchart of a synchronization method provided in an embodiment of the present application;

[0185] Fig.13 A structural diagram of an edge dog module 130 provided in an embodiment of the present application;

[0186] Fig.14 A structural diagram of an agent module 140 provided in an embodiment of the present application;

[0187] Fig.15 A schematic diagram of the system architecture of an APP provided for this application deployed on a client and a server;

[0188] Fig.16 A flowchart of another anti-cracking method provided in an embodiment of the present application;

[0189] Fig.17 A flowchart of another anti-cracking method provided in an embodiment of the present application;

[0190] Fig.18 A flowchart of another anti-cracking method provided in an embodiment of the present application;

[0191] Fig.19 A flowchart of another anti-cracking method provided in an embodiment of the present application;

[0192] Fig. 20 A flowchart of another anti-cracking method provided in an embodiment of the present application;

[0193] Fig.21 A flowchart of another anti-cracking method provided in an embodiment of the present application;

[0194] Fig. 22 A flowchart of another anti-cracking method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0195] The implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0196] The anti-cracking method provided in this application can be applied to mobile edge computing (MEC) systems to implement APP anti-cracking in MEC scenarios. Figure 2 This is a schematic diagram of the architecture of the MEC system. Figure 2 As shown, the MEC system may include: multiple mobile edge hosts, a mobile edge platform manager (MEPM), a virtualization infrastructure manager (VIM), and a container infrastructure manager (CIM).

[0197] Among them, the mobile edge platform manager mainly has the following functions: managing the life cycle of mobile edge applications, such as notifying the mobile edge coordinator / orchestrator of relevant events of mobile edge applications; providing element management functions for the mobile edge platform; managing the rules and requirements of mobile edge applications, such as managing the service authorization, traffic rules, domain name system (DNS) configuration and conflict resolution of mobile edge applications.

[0198] Among them, VIM can support the virtualization management of VMs and the management of containers, and mainly has the following two functions: first, allocate, manage and release virtualization resources (such as computing, storage and network resources) on the virtualization infrastructure; prepare the virtualization infrastructure for running software images, such as configuring the virtualization infrastructure, receiving and storing software images, etc.; quickly configure mobile edge applications, such as collecting and reporting the performance and fault information of virtualization resources; perform mobile edge program relocation, etc.

[0199] CIM can support container management. Its main functions are as follows: allocate, manage, and release container-related resources (such as computing, storage, and network resources); receive and store container images; support rapid configuration of mobile edge applications, and collect and report performance and fault information of container-related resources. It should be noted that CIM can be deployed independently of VIM. Figure 2 In the MEC system shown, they can also be centrally deployed in the same functional entity without restriction.

[0200] The mobile edge host can be a physical host or server, which is mainly used to provide computing, storage and network resources for mobile edge applications. Figure 2As shown, the mobile edge host may include / install a mobile edge platform (MEP), multiple applications (APP), virtualization infrastructure (VI) and container infrastructure (CI). VI has the function of a VM engine, and CI has the function of a container engine, such as: having the function of a docker engine. In the MEC system, APP can also be called a mobile edge application (ME APP) or other names without limitation. This application is illustrated by taking APP as an example.

[0201] Among them, the mobile edge platform is mainly used to provide mobile edge services (mobile edgeservice) for mobile edge applications and provide intermediary services for mobile edge applications, such as: providing services for discovery and use between mobile edge applications.

[0202] Among them, APP can include applications (applications, APPs) running in virtual machines (VMs) on virtualized infrastructure, and can also include APPs in containers running on container infrastructure. APPs can interact with the mobile edge platform to provide mobile edge services, and can also interact with the mobile edge platform to perform processes related to the mobile edge application life cycle, such as indicating the availability of the mobile edge application, relocating the user status, etc. In addition, the mobile edge application also has a certain number of rules and requirements associated with it, such as: the resources required by the mobile edge application, the maximum delay, the required services or useful services, etc.

[0203] In the present application, in order to ensure that the APP is not cracked, a proxy module and an edge dog module corresponding to the APP can be installed and deployed in the mobile edge host, and a symmetric key method is used, in which the proxy module and the edge dog module calculate the MAC based on a series of parameters such as security parameters and / or the operating environment information of the APP, and the MAC generated by the proxy module is compared with the MAC generated by the edge dog module to verify whether the edge dog module is legal, and then the APP is ensured not to be cracked based on the verification result; or, an asymmetric key method is used, in which the edge dog module uses the private key of the edge dog module to sign a series of parameters such as security parameters and / or the operating environment information of the APP, and the proxy module uses the public key of the edge dog module to authenticate the signature of the edge dog module to verify whether the edge dog module is legal, and then the APP is ensured not to be cracked based on the verification result. Specifically, the proxy module can be used to perform the following Figures 4 to 11The edgedog module can be used to perform the following actions specified by the proxy module: Figures 4 to 11 The actions specified by the edgedog module.

[0204] Among them, Figure 2 As shown, one APP corresponds to one proxy module. The proxy module can be deployed together with the APP or separately from the APP, such as the proxy module and the APP are independently deployed in a VM / container. When the proxy module is deployed separately from the APP, a software development kit (SDK) can be installed in the APP, and the proxy module can interact with the APP through the SDK. One or more APPs correspond to one edge dog module, and the legitimacy of the edge dog module corresponding to the APP is verified to ensure that the APP is not cracked. Figure 2 In the MEC system shown, the edge dog module can be deployed in the same VM / container as the APP, or in different VM / containers without restriction. Figure 2 As shown, APP1 is deployed together with the proxy module 1, APP1 corresponds to the edge dog module 1, and is deployed in the same VM / container, and APP2 is deployed separately from the proxy module 2, APP2 corresponds to the edge dog module 2, and is deployed in different VMs / containers.

[0205] exist Figure 2 In the MEC system shown in the figure, the mobile edge hosts and the components in the mobile edge hosts can communicate with each other through the interface of the mobile edge platform (mobile edge point, Mp), the mobile edge hosts and other devices in the MEC system can communicate with each other through the mobile edge management (mobile edge management, Mm), and other devices in the MEC system except the mobile edge hosts can also communicate with each other through the Mm interface without limitation. Figure 2 As shown, the mobile edge platform and the mobile edge application can communicate with each other through Mp1, the mobile edge platform and the data plane in the virtualized infrastructure can communicate with each other through Mp2, and the mobile edge hosts can communicate with each other through Mp3. The mobile edge platform manager and the mobile edge platform can communicate with each other through Mm5, and the mobile edge platform manager and the virtualized infrastructure manager can communicate with each other through Mm6. The virtualized infrastructure manager and the virtualized infrastructure can communicate with each other through Mm7.

[0206] It should be pointed out that Figure 2 The accompanying drawings are for illustrative purposes only. Figure 2 The number of network elements included in the MEC system shown is unlimited, except Figure 2 In addition to the network elements shown, the MEC system may also include other devices. Figure 2The names of the devices and interfaces between devices are not restricted, except Figure 2 In addition to the names shown, each device and the interfaces between devices can also be named with other names without restriction.

[0207] Specifically, Figure 2 The mobile edge hosts in the Figure 3 Parts shown, such as Figure 3 As shown, the mobile edge host 300 may include a processor 301 and a network resource 302. Further, the mobile edge host 300 may also include a memory 303. The processor 301, the memory 303 and the network resource 302 may communicate with each other via a communication line ( Figure 3 (not shown) connection. Figure 3 In the mobile edge host shown, the processor 301 can provide computing resources, and the memory 303 can provide storage resources. In practical applications, the storage resources, computing resources, and network resources can be divided as needed to form a VM / container, and the APP including the proxy module and the edge dog module can be run on the VM / container; or, the proxy module and the APP are deployed separately, and the proxy module and the APP are run separately without restriction. Specifically, the process of building a VM / container can refer to the prior art and will not be described in detail.

[0208] The processor 301 may be a central processing unit (CPU), a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 301 may also be other devices with processing functions, such as circuits, devices, or software modules.

[0209] The network resource 302 is used to communicate with other devices or other communication networks. The other communication network may be Ethernet, a radio access network (RAN), a wireless local area network (WLAN), etc. The network resource 302 may be a radio frequency module or any device capable of achieving communication. The embodiment of the present application only takes the network resource 302 as a radio frequency module as an example for explanation, wherein the radio frequency module may include an antenna, a radio frequency circuit, etc., and the radio frequency circuit may include a radio frequency integrated chip, a power amplifier, etc.

[0210] The memory 303 is used to store program instructions and installation packages corresponding to the APP. The program instructions may be computer programs, including program instructions for implementing functions specified by the proxy module and program instructions for implementing functions specified by the edge dog module, etc., without limitation.

[0211] Among them, the memory 303 can be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage, magnetic disk storage medium or other magnetic storage device, and the optical disc storage includes a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.

[0212] It should be noted that the memory 303 can exist independently of the processor 301, or can be integrated with the processor 301. The memory 303 can be used to store instructions or program codes or some data, etc. The memory 303 can be located in the mobile edge host 300, or can be located outside the mobile edge host 300, without limitation. The processor 301 is used to execute the instructions stored in the memory 303 to implement the anti-cracking method provided in the following embodiments of the present application.

[0213] In one example, the processor 301 may include one or more CPUs, such as Figure 3 CPU0 and CPU1 in.

[0214] As an optional implementation, the mobile edge host 300 includes multiple processors, for example, Figure 3 In addition to the processor 301, a processor 304 may also be included.

[0215] As an optional implementation, the mobile edge host 300 further includes an output device and an input device. For example, the input device is a keyboard, a mouse, a microphone, a joystick, and the output device is a display screen, a speaker, and the like.

[0216] It should be noted that the mobile edge host 300 can be a desktop computer, a portable computer, a network server, a tablet computer, an embedded device, a chip system or a Figure 3 In addition, Figure 3 The structure shown in the figure does not constitute a limitation on the mobile edge host, except Figure 3 In addition to the components shown, the mobile edge host may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0217] In the embodiment of the present application, the chip system may be composed of a chip, or may include a chip and other discrete devices.

[0218] Combine the following Figure 2 The MEC system shown in the figure is deployed with the proxy module and the APP in one, and the proxy module compares the MAC generated by itself with the MAC generated by the edge dog module, and verifies whether the edge dog module is legal based on the comparison result as an example to illustrate the anti-cracking method provided by this application:

[0219] Figure 4 A flowchart of an anti-cracking method provided by this application, such as Figure 4 As shown, the method includes:

[0220] Step 401: The proxy module sends a first request to the edge dog module.

[0221] The proxy module can be deployed together with the APP, and the APP can be Figure 2 The edge dog module can be associated with the APP, and the edge dog module is used together with the proxy module to protect the APP. For example, the proxy module can be Figure 2 The agent module 1 in the edge dog module is Figure 2 Edge Dog Module 1, APP is Figure 2 APP1 in.

[0222] Among them, the first request can be used to request a first MAC. The first request can be triggered when the APP user performs a first operation on the APP. The first operation can be to activate the APP or run the APP. The first request can also be named as an activation request or a run request or a fingerprint request or other names without restriction.

[0223] The first request may include the operating environment information of the APP, and may also include one or more parameters such as the serial number (serialno) of the APP, the identifier (ID) of the APP, and the timestamp (timestamp). The operating environment information of the APP, the serial number of the APP, the identifier of the APP, and the timestamp of the APP may be pre-configured in the proxy module.

[0224] Among them, the operating environment information of the APP can be used to indicate the operating environment of the APP, and the operating environment information of the APP may include any one or more of the following: the identifier of the MEP where the APP is located, the information of the VM or container where the APP is located, the TPM information of the APP operating platform, and the hardware information of the VM or container where the APP is running. The identifier of the MEP can be used to identify the MEP. The identifier of the MEP can be the number of the MEP in the MEC system, or the data network access identifier (datanetwork access identifier, DNAI) of the MEP, etc., without limitation. The information of the VM can be used to uniquely identify the VM. The information of the VM may include the VM ID, the universally unique identifier (universally unique identifier, UUID) of the VM or the central processing unit identifier (central processing unit identifier, ID), the media access control (mediaaccess control, MAC) address of the network card, hard disk information, volume serial number, memory ID, motherboard ID, processor core ID, etc. The container information can be used to uniquely identify the container. The container information can include the container identifier (Pod ID), UUID or CPU ID, MAC address of the network card, hard disk information, volume serial number, memory ID, motherboard ID, processor core ID, etc. The hardware information of the VM or container of the APP running platform can include the host ID, or CPU ID, MAC address of the network card, hard disk information, volume serial number, memory ID, motherboard ID, processor core ID, etc., without restriction.

[0225] Among them, the serial number of the APP may refer to the factory number of the APP, and the serial number of the APP may be configured by the manufacturer of the APP.

[0226] Among them, the APP identifier can be used to identify an APP in the MEC system, and the APP identifier can be configured to the proxy module by the user of the MEC system.

[0227] The timestamp may refer to the time when the first operation was successfully performed on the APP last time. It should be noted that in this application, the initial value of the timestamp is zero or empty. Subsequently, each time the first operation is successfully performed, the locally stored timestamp is updated to the time when the first operation is successfully performed.

[0228] Exemplarily, the proxy module may send a first request to the edge dog module after receiving an operation request from an APP user to activate or run the APP, wherein the operation request may be an operation request from an APP user clicking an APP icon on the human-computer interaction interface of the mobile edge host.

[0229] The proxy module may pre-store an Internet protocol (IP) address of the edge dog module, and the proxy module sending the first request to the edge dog module may include: the proxy module sending the first request to the edge dog module according to the IP address of the edge dog module.

[0230] Before executing step 401, it is necessary to determine whether the following condition 1 and / or condition 2 are met. If so, step 401 is executed; otherwise, step 401 is not executed:

[0231] Condition 1: The number of activations of the app is less than the maximum allowed number of activations.

[0232] Exemplarily, if the first request also carries an indication to activate the APP, after the proxy module receives the operation request sent by the APP, it determines whether the number of activations of the APP is less than the maximum allowed number of activations. If the number of activations of the APP is less than the maximum allowed number of activations, step 401 is executed; otherwise, it is returned that the number of activations of the APP has exceeded the maximum allowed number of activations.

[0233] The maximum number of activations allowed can be set by the APP manufacturer as needed and pre-configured in the proxy module.

[0234] The number of activations of the APP may refer to the total number of times the APP is successfully activated, and the number of activations of the APP may be stored in the proxy module in correspondence with the APP identifier. Initially, the number of activations of the APP is zero or empty, and each time the APP is successfully activated, the number of activations of the APP stored locally is updated, and the number of activations of the APP is increased by 1.

[0235] Condition 2: The operating environment information of the APP is included in the preset operating environment information.

[0236] Exemplarily, the proxy module determines whether the operating environment information of the APP is included in the preset operating environment information. If the operating environment information of the APP is included in the preset operating environment information, it means that the APP is running in a safe environment, and step 401 is executed. Otherwise, it means that the APP is not running in a safe environment, and step 401 is not executed.

[0237] The preset operating environment information may represent an environment in which the APP is allowed to run, and the preset operating environment information may be pre-configured in the proxy module.

[0238] Step 402: The edge dog module receives the first request and calculates a first MAC according to the running environment information of the APP.

[0239] In one example, the edge dog module calculates the first MAC according to the running environment information of the APP, which may include: the edge dog module uses the running environment information of the APP as an input parameter and inputs it into a preset algorithm f to obtain the first MAC. For example: the first MAC = f (running environment information of the APP).

[0240] In another example, the edge dog module calculates the first MAC according to the operating environment information of the APP, which may include: the edge dog module calculates the first MAC according to the security parameters and the operating environment information of the APP.

[0241] For example, the edge dog module can take the security parameters and the running environment information of the APP as input parameters and input them into the preset algorithm f to obtain the first MAC, such as: first MAC=f(security parameters, running environment information of the APP).

[0242] The security parameters may be pre-configured by the APP manufacturer to the edge dog module. The security parameters may be parameters composed of numbers, letters or other symbols.

[0243] For example, the edge dog module obtains the first MAC according to the security parameters and / or the operating environment information of the APP, which may include: the edge dog module uses the security parameters and / or the operating environment information of the APP as input parameters, and inputs them into the preset algorithm f to obtain the first MAC. For example: the first MAC = f (security parameters), or, the first MAC = f (operating environment information of the APP), or, the first MAC = f (security parameters, operating environment information of the APP).

[0244] In each embodiment of the present application, the preset algorithm f may be an HMEC algorithm, such as HMEC-secure hash algorithm (SHA)-256, or other CMEC algorithms or other algorithms, without limitation. The preset algorithm f may be pre-configured in the proxy module and the edge dog module.

[0245] It should be noted that step 402 may also be replaced by the edge dog module receiving the first request and obtaining the first MAC according to the security parameter, that is, obtaining the first MAC with the security parameter as an input parameter, without limitation.

[0246] In another example, the edge dog module obtains the first MAC according to the running environment information of the APP, which may include: when the edge dog module determines that the running environment information of the APP matches the preset running environment information, the first MAC is calculated.

[0247] For example, the edge dog module can determine whether the operating environment information of the APP is included in the preset operating environment information. If the operating environment information of the APP is included in the preset operating environment information, the security parameters and / or the operating environment information of the APP are used as input parameters and input into the preset algorithm f to obtain the first MAC. Conversely, if the operating environment information of the APP is not included in the preset operating environment information, it means that the APP is not running in the allowed operating environment, which is an illegal operation. At this time, the edge dog module can return to the proxy module that the operating environment information is illegal, and the process ends.

[0248] Among them, if the first request also carries an indication to activate the APP, after the edge dog module receives the first request, it determines whether the number of activations of the APP is less than the maximum allowed number of activations. If the number of activations of the APP is less than the maximum allowed number of activations, step 402 is executed. Otherwise, it returns to the proxy module that the number of activations of the APP has exceeded the maximum allowed number of activations, and the process ends.

[0249] Among them, the maximum number of activations allowed can be set by the APP manufacturer as needed and pre-configured in the edge dog module. The number of activations of the APP can refer to the total number of times the APP is successfully activated, and the number of activations of the APP can be saved in the edge dog module. Initially, the number of activations of the APP is zero or empty. Each time the APP is successfully activated, the proxy module sends an activation success message to the edge dog module to indicate that the APP is successfully activated, so that the edge dog module updates the number of activations of the locally stored APP based on the received activation success message, and increases the number of activations of the APP by 1.

[0250] In the embodiment of the present application, in order to ensure the accuracy of MAC verification, the activation times of the APP stored in the proxy module and the edge dog module need to be kept synchronized. Fig.12 The method synchronizes the number of activations of the APP stored in the proxy module with the number of activations of the APP stored in the edge dog module.

[0251] It should be noted that the present application is not limited to obtaining the first MAC by using one or more of the security parameters and the operating environment information of the APP as input parameters. When the first request includes one or more parameters of the serial number of the APP, the identifier of the APP, and the timestamp, the security parameters, the operating environment information of the APP, and the serial number of the APP, the identifier of the APP, and the timestamp are input as input parameters to the preset algorithm f to obtain the first MAC. That is, the edge dog module can obtain the first MAC according to any of the following methods (1) to (16):

[0252] (1) Using the security parameter as input parameter to obtain the first MAC.

[0253] (2) Using the running environment information of the APP as an input parameter to obtain the first MAC.

[0254] (3) The security parameter, the serial number of the APP, the identification of the APP, and the timestamp are used as input parameters to obtain the first MAC.

[0255] (4) The first MAC is obtained by taking the APP's operating environment information, the APP's serial number, the APP's identifier, and the timestamp as input parameters.

[0256] (5) The security parameter and the serial number of the APP are used as input parameters to obtain the first MAC.

[0257] (6) The first MAC is obtained by taking the running environment information of the APP and the serial number of the APP as input parameters.

[0258] (7) The security parameter and the APP identifier are used as input parameters to obtain the first MAC.

[0259] (8) Using the APP's operating environment information and the APP's identifier as input parameters to obtain a first MAC.

[0260] (9) The security parameter and timestamp are used as input parameters to obtain the first MAC.

[0261] (10) The running environment information and timestamp of the APP are used as input parameters to obtain the first MAC.

[0262] (11) The security parameter, the serial number of the APP, and the identifier of the APP are used as input parameters to obtain the first MAC.

[0263] (12) The APP's operating environment information, the APP's serial number, and the APP's identifier are used as input parameters to obtain a first MAC.

[0264] (13) The security parameter, the serial number of the APP, and the timestamp are used as input parameters to obtain the first MAC.

[0265] (14) The first MAC is obtained by taking the APP's operating environment information, the APP's serial number, and the timestamp as input parameters.

[0266] (15) The security parameter, the APP identifier, and the timestamp are used as input parameters to obtain the first MAC.

[0267] (16) The APP's operating environment information, APP's identifier, and timestamp are used as input parameters to obtain a first MAC.

[0268] In addition, in the above methods (1) to (16), the key k can also be used as an input parameter, and the key k can be pre-configured to the proxy module and the edge dog module. When the first operation is to run the APP, the number of activations of the APP can also be used as an input parameter without limitation.

[0269] Step 403: The edge dog module sends a first MAC to the proxy module.

[0270] Exemplarily, the edge dog module may send a response to the first request to the proxy module, and the response to the first request may include the first MAC. When the first request also carries an activation APP indication, the response to the first request may be an activation response. When the first operation is to run the APP, the response to the first request may be a fingerprint response.

[0271] Step 404: The proxy module receives the first MAC and calculates a fourth MAC according to the running environment information of the APP.

[0272] Exemplarily, the proxy module calculates the fourth MAC according to the running environment information of the APP, and the process of obtaining the first MAC according to the running environment information of the APP by the edge dog module can be referred to.

[0273] Specifically, the proxy module may obtain the fourth MAC by referring to any one of the above methods (1) to (16).

[0274] The preset algorithm f and input parameters used by the proxy module to calculate the fourth MAC are the same as the preset algorithm f and input parameters used by the edge dog module to calculate the first MAC, and are agreed upon in advance by both parties.

[0275] It should be noted that the input parameters used by the above-mentioned proxy module when calculating the fourth MAC are the same as the input parameters used by the edge dog module when calculating the first MAC, which means that the input parameters used by the proxy module when calculating the fourth MAC and the input parameters used by the edge dog module when calculating the first MAC are the same type of parameters, such as: both are security parameters, or, both are the operating environment information of the APP, or both are security parameters and the operating environment information of the APP, as well as one or more of the following parameters: the serial number of the APP, the identification of the APP, and the timestamp.

[0276] Step 405: The proxy module compares the first MAC and the fourth MAC to verify whether the edge dog module is legitimate.

[0277] Exemplarily, when the first MAC is the same as the fourth MAC, the edge dog module is legal and allows corresponding operations to be performed on the APP, such as: activating the APP or continuing to run the APP, etc.; when the first MAC is different from the fourth MAC, the edge dog module is illegal and prevents the first operation from being performed on the APP.

[0278] For example, if the first MAC calculated by the edgedog module is 10 and the fourth MAC calculated by the proxy module is 11, the first MAC is different from the fourth MAC, the edgedog module is illegal, and the corresponding operation on the APP is not allowed.

[0279] Furthermore, if the first request also carries an indication for activating the APP and the edge dog module is legal, the method may also include: the proxy module activates the APP, and after successful activation, sets the status of the APP to "activated", and at the same time, increases the number of activations of the locally stored APP by 1, and sends an activation success message to the edge dog module to indicate that the APP is successfully activated, so that after the edge dog module receives the activation success message, it updates the number of activations of the locally stored APP in the edge dog module and increases the number of activations of the locally stored APP by 1.

[0280] Furthermore, if the first operation is to run the APP, and the edge dog module is legal, the method may further include: the proxy module triggers the APP to continue running.

[0281] Figure 4 In the method shown, the legitimacy of the edge dog module is determined by comparing the MAC, that is, the legitimacy of the edge dog module is verified by a symmetric key method. Alternatively, the legitimacy of the edge dog module can also be verified by an asymmetric key method. For example, the edge dog module can also use the private key of the edge dog module to sign a series of parameters such as the operating environment information of the APP, and send the signed information to the proxy module or the APP, so that after the proxy module or the APP receives the signed information, it obtains the public key of the edge dog module according to the certificate of the edge dog module, and uses the public key of the edge dog module to decrypt the signed information, and verifies whether the edge dog module is legal according to the decrypted information, and performs corresponding operations on the APP according to the legality of the edge dog module.

[0282] Among them, the private key of the edge dog module and the public key of the edge dog module are a pair of asymmetric keys, and the private key of the edge dog module and the public and private key of the edge dog module can be pre-configured in the edge dog module by the manufacturer of the APP or the manufacturer of the edge dog module. The certificate of the edge dog module can be pre-configured in the proxy module by the manufacturer of the APP.

[0283] based on Figure 4According to the method shown, after receiving a request to obtain a first MAC, the edge dog module can generate a MAC based on the operating environment information of the APP, and feed the MAC back to the proxy module. The proxy module compares the MAC generated by itself and the received MAC to verify whether the edge dog module is legal. For example, when the MAC generated by itself is the same as the received MAC, it indicates that the edge dog module is legal and performs corresponding operations on the APP. In this way, the edge dog module is bound to the operating environment of the APP. The edge dog module can only calculate the expected MAC when the legitimate user runs the APP in the allowed operating environment, and the verification is successful. Even if the illegal user obtains the APP, the MAC calculated by the illegal user is different from the received MAC because the APP is not run in the allowed operating environment. The verification fails and the APP cannot be stolen. Compared with the prior art, Figure 4 The method shown can ensure the security of APP use in MEC scenarios.

[0284] The following example takes the deployment of the proxy module and the APP as one, and the first request also carries the activation APP instruction, security parameters, and the APP's operating environment information as input parameters. Figure 4 The method shown is described in detail.

[0285] Figure 5 A flowchart of another anti-cracking method provided by this application, such as Figure 5 As shown, the method includes:

[0286] Step 501: The proxy module receives an activation request from an APP user.

[0287] The activation request may be used to request activation of the APP. The activation request may be a request issued by the APP user when clicking on the human-computer interaction interface on the mobile edge host.

[0288] Step 502: The proxy module determines whether the number of activations of the APP is less than the maximum allowed number of activations and whether the operating environment information of the APP is included in the preset operating environment information; if the number of activations of the APP is less than the maximum allowed number of activations and is included in the preset operating environment information, execute steps 502 to 513; otherwise, the proxy module returns to the APP user that the number of activations of the APP has exceeded the maximum allowed number of activations and / or is not in a legal operating environment, and the process ends.

[0289] Step 503: The proxy module sends a first request to the edge dog module.

[0290] Among them, step 503 can refer to step 401 and will not be described in detail.

[0291] Step 504: The edge dog module receives the first request and determines whether the operating environment information of the APP is included in the preset operating environment information. If the operating environment information of the APP is included in the preset operating environment information, execute steps 505 to 513; otherwise, it is illegal to send the operating environment information to the proxy module and the process ends.

[0292] Step 505: The edge dog module determines whether the number of activations of the APP is less than the maximum allowed number of activations; if the number of activations of the APP is less than the maximum allowed number of activations, execute steps 506 to 513; otherwise, if the number of activations of the APP is equal to or greater than the maximum allowed number of activations, the edge dog module returns to the proxy module that the number of activations of the APP has exceeded the maximum allowed number of activations, and the process ends.

[0293] Step 506: The edge dog module uses the security parameters and the operating environment information of the APP as input parameters to calculate the first MAC.

[0294] The execution process of step 506 may refer to the description of step 402 and will not be described in detail.

[0295] Step 507: The edge dog module sends the first MAC to the proxy module.

[0296] The execution process of step 507 may refer to the description of step 403 and will not be described in detail.

[0297] Step 508: The proxy module receives the first MAC, takes the security parameter and the operating environment information of the APP as input parameters, and calculates a fourth MAC.

[0298] The execution process of step 508 may refer to the description of step 404 and will not be described in detail.

[0299] Step 509: The proxy module compares the first MAC and the fourth MAC to verify whether activation of the APP is allowed.

[0300] The execution process of step 509 may refer to the description of step 405 and will not be described in detail.

[0301] Step 510: If activation of the APP is allowed, the proxy module activates the APP.

[0302] Step 511: After the APP is successfully activated, the proxy module increases the activation count of the APP stored locally by 1, and at the same time, the proxy module sets the status of the APP to "activated".

[0303] Step 512: The proxy module sends an activation success message to the edge dog module to indicate that the APP is successfully activated.

[0304] Step 513: The Edge Dog module receives the activation success message, sets the status of the APP to "activated", and at the same time, updates the activation count of the APP stored locally in the Edge Dog module, and increases the activation count of the APP stored locally by 1.

[0305] based on Figure 5 The method shown can be that after receiving a request to activate the APP, the edge dog module generates a MAC based on the security parameters and the operating environment information of the APP, and feeds the MAC back to the proxy module. The proxy module compares the MAC generated by itself and the received MAC to verify whether the edge dog module is legal, such as: when the MAC generated by itself is the same as the received MAC, it means that the edge dog module is legal and the APP is activated. In this way, the legal user can use the legal security parameters and the operating environment information of the APP through the edge dog module to calculate the expected MAC, ensure the legal use of the APP, and realize that only users with legal input parameters such as security parameters can use the APP. Even if the illegal user obtains the APP, he will not be able to obtain the legal input parameters and calculate a MAC different from the received MAC, and cannot steal the APP and activate the APP.

[0306] The following example takes the deployment of the proxy module and the APP as one, the first operation is to run the APP, and the security parameters and the APP's operating environment information are used as input parameters. Figure 4 The method shown is described in detail.

[0307] Figure 6 A flowchart of another anti-cracking method provided by this application, such as Figure 6 As shown, the method includes:

[0308] Step 601: The proxy module receives a running request from an APP user.

[0309] The run request may be used to request the running of an APP, and may be a request issued by an APP user clicking on a human-computer interaction interface on a mobile edge host.

[0310] Step 602: The proxy module determines whether the APP has been activated and whether the operating environment information of the APP is included in the preset operating environment information; if the APP has been activated and the operating environment information of the APP is included in the preset operating environment information, execute steps 602 to 513; otherwise, the proxy module returns to the APP user that the APP has not been activated and / or the operating environment information is illegal, and the process ends.

[0311] Step 603: The proxy module sends a first request to the edge dog module.

[0312] Among them, step 603 can refer to step 401 and will not be described in detail.

[0313] Step 604: The edge dog module receives the first request and determines whether the operating environment information of the APP is included in the preset operating environment information. If the operating environment information of the APP is included in the preset operating environment information, execute steps 605 to 513; otherwise, it is illegal to send the operating environment information to the proxy module and the process ends.

[0314] Step 605: The edge dog module determines whether the APP has been activated; if the APP has been activated, execute steps 606 to 513; otherwise, if the APP has not been activated, the edge dog module returns to the proxy module that it has not been activated, and the process ends.

[0315] Step 606: The edge dog module uses the security parameters and the operating environment information of the APP as input parameters to calculate the first MAC.

[0316] The execution process of step 606 may refer to the description of step 402 and will not be described in detail.

[0317] Step 607: The edge dog module sends the first MAC to the proxy module.

[0318] The execution process of step 607 may refer to the description of step 403 and will not be described in detail.

[0319] Step 608: The proxy module receives the first MAC, and calculates a fourth MAC based on the security parameter and the operating environment information of the APP as input parameters.

[0320] The execution process of step 608 may refer to the description of step 404 and will not be described in detail.

[0321] Step 609: The proxy module compares the first MAC and the fourth MAC to verify whether the APP is allowed to run.

[0322] The execution process of step 609 may refer to the description of step 405 and will not be described in detail.

[0323] Step 610: If the APP is allowed to run, the proxy module continues to run the APP.

[0324] based on Figure 6In the method shown, after receiving a request to execute the APP, the edge dog module can generate a MAC based on the security parameters and the operating environment information of the APP, and feed the MAC back to the proxy module. The proxy module compares the MAC generated by itself and the received MAC to verify whether the APP is allowed to run, such as: when the MAC generated by itself is the same as the received MAC, it means that the APP is allowed to run. In this way, a legitimate user can use the edge dog module to calculate the expected MAC using the legitimate security parameters and the operating environment information of the APP, ensuring the legitimate use of the edge dog module, and realizing that only users with legitimate input parameters such as security parameters can use the APP, and even if an illegal user obtains the APP, he will not be able to obtain the legitimate input parameters and calculate a MAC different from the received MAC, and cannot steal and run the APP.

[0325] The following describes the anti-cracking process when the APP is deactivated by deploying the proxy module and the APP together:

[0326] Figure 7 A flowchart of another anti-cracking method provided by this application, such as Figure 7 As shown, the method includes:

[0327] Step 701: The proxy module determines that the conditions for deactivating the APP are met.

[0328] The conditions for deactivating the APP include one or more of the following conditions: Condition (1): receiving an APP uninstall request sent by the APP user, where the APP uninstall request is used to request uninstalling the APP. Condition (2): reaching the validity period of the APP. The validity period of the APP can be pre-set and is not restricted.

[0329] Step 702: The proxy module calculates and obtains a second MAC according to the security parameters.

[0330] The second MAC may be used to verify whether the operation of deactivating the APP is legal.

[0331] Exemplarily, the proxy module may input the security reference as an input parameter into a preset algorithm f to obtain the second MAC.

[0332] Among them, when preventing the deactivated APP from cracking, the present application is not limited to using security parameters as input parameters, but can also use one or more parameters such as the APP identifier, key k, number of APP activations, APP serial number, timestamp, etc. as input parameters to calculate the second MAC.

[0333] Step 703: The proxy module sends a second request to the edge dog module.

[0334] The second request may be used to request deactivation of the APP, and the second request may include the second MAC, and may also include one or more parameters such as the APP identifier, the number of activations of the APP, the serial number of the APP, and a timestamp. The second request may also be named a deactivation request.

[0335] Exemplarily, the proxy module sending the second request to the edge dog module can refer to the process of the proxy module sending the first request to the edge dog module in step 401, which is not described in detail.

[0336] Step 704: The edge dog module receives the second request, takes the security parameter as an input parameter, and calculates a third MAC.

[0337] The execution process of step 706 may refer to the description of step 702 and will not be described in detail.

[0338] Step 705: The edge dog module compares the second MAC and the third MAC to verify whether deactivation of the APP is allowed.

[0339] The execution process of step 706 may refer to the description of step 405 and will not be described in detail.

[0340] Step 706: The edge dog module sends a deactivation response to the proxy module.

[0341] Among them, the deactivation response can be used to indicate whether APP deactivation is allowed, such as: when the second MAC is the same as the third MAC, the deactivation response is used to indicate that APP deactivation is allowed, otherwise, when the second MAC is different from the third MAC, the deactivation response can be used to indicate that APP deactivation is not allowed.

[0342] Step 707: If deactivation of the APP is allowed and the condition for deactivating the APP is condition (one), the edge dog module will reduce the number of activations of the locally stored APP by 1, and at the same time, mark the status of the APP as "deactivated"; if deactivation of the APP is allowed and the condition for deactivating the APP is condition (two), the edge dog module will mark the status of the APP as "deactivated".

[0343] It should be noted that the present application does not limit the execution order of step 706 and step 707. Step 706 may be executed first and then step 707, or step 707 may be executed first and then step 706. There is no limitation.

[0344] based on Figure 7The method shown can be that after receiving a request to deactivate an APP, the edge dog module generates a MAC based on security parameters, and compares the self-generated MAC with the received MAC to verify whether deactivation of the APP is allowed, such as: when the self-generated MAC is the same as the received MAC, it means that deactivation of the APP is allowed. In this way, a legitimate user can use the edge dog module to calculate the expected MAC using the legitimate security parameters and the deactivation environment information of the APP, ensuring the legitimate use of the edge dog module, and realizing that only users with legitimate input parameters such as security parameters can use the APP, and even if an illegal user obtains the APP, he will not be able to obtain the legitimate input parameters and calculate a MAC different from the received MAC, and cannot steal and deactivate the APP.

[0345] Above Figures 4 to 7 , taking the deployment of the proxy module and APP as an example, the anti-cracking process when the APP is activated, the anti-cracking process when the APP is running, and the anti-cracking process when the APP is deactivated are described. The following takes the deployment of the proxy module and APP separately as an example, and describes the anti-cracking process when the APP is activated, the anti-cracking process when the APP is running, and the anti-cracking process when the APP is deactivated.

[0346] Figure 8 A flowchart of an anti-cracking method provided by this application, such as Figure 8 As shown, the method includes:

[0347] Step 801: The APP sends a third request to the proxy module.

[0348] The APP can be deployed separately from the proxy module. For example, the proxy module can be Figure 2 The proxy module 2 in the edge dog module can be Figure 2 Edge Dog Module 2 in the APP can be Figure 2 APP2 in.

[0349] The third request may be used to request a fourth MAC.

[0350] The third request may include the operating environment information of the APP, and may also include one or more parameters such as the serial number of the APP, the identifier of the APP, and the timestamp of the APP. The description of the serial number of the APP, the identifier of the APP, and the timestamp of the APP may refer to the description in step 401, and will not be repeated here.

[0351] Exemplarily, after receiving an operation request from an APP user to perform a first operation on the APP, the APP may send a third request to the proxy module. The description of the first operation may refer to the description in the above step 401. The operation request may be an operation request issued by the APP user when clicking on the APP icon on the human-computer interaction interface of the mobile edge host.

[0352] Exemplarily, the APP may send the third request to the proxy module through the SDK.

[0353] Step 802: The proxy module receives the third request and calculates a fourth MAC according to the running environment information of the APP.

[0354] Exemplarily, if the first request also carries an indication to activate the APP, after the proxy module receives the operation request issued by the APP, it determines whether the number of activations of the APP is less than the maximum allowed number of activations. If the number of activations of the APP is less than the maximum allowed number of activations, a fourth MAC is calculated based on the security parameters. Otherwise, it is returned that the number of activations of the APP has exceeded the maximum allowed number of activations.

[0355] The proxy module may obtain the fourth MAC by referring to any one of the above methods (1) to (16).

[0356] The preset algorithm f and input parameters used by the proxy module to calculate the fourth MAC are the same as the preset algorithm f and input parameters used by the edge dog module to calculate the first MAC, and are agreed upon in advance by both parties.

[0357] It should be noted that the input parameters used by the above-mentioned proxy module when calculating the fourth MAC are the same as the input parameters used by the edge dog module when calculating the first MAC, which means that the input parameters used by the proxy module when calculating the fourth MAC and the input parameters used by the edge dog module when calculating the first MAC are the same type of parameters, such as: both are security parameters, or, both are the operating environment information of the APP, or both are security parameters and / or the operating environment information of the APP, as well as one or more of the following parameters: the serial number of the APP, the identification of the APP, and the timestamp.

[0358] Step 803: The proxy module sends the fourth MAC to the APP.

[0359] Exemplarily, the proxy module may send the fourth MAC to the APP through the SDK.

[0360] Step 804: The APP sends a first request to the edge dog module.

[0361] Among them, the first request can be used to request to obtain the first MAC, the first request can include the fourth MAC, and can also include one or more parameters of the APP operating environment information, APP identification, APP serial number, and timestamp described in step 401.

[0362] Step 805: The edge dog module receives the first request and calculates a first MAC according to the running environment information of the APP.

[0363] Among them, the edge dog module can obtain the first MAC by referring to any one of the methods (1) to (16), which will not be described in detail.

[0364] Step 806: The edge dog module compares the first MAC and the fourth MAC to verify whether the edge dog module is legitimate.

[0365] Exemplarily, when the first MAC is the same as the fourth MAC, the edge dog module is legal and is allowed to perform corresponding operations on the APP; when the first MAC is different from the fourth MAC, the edge dog module is illegal.

[0366] Step 807: The Edge Dog module sends the verification result to the APP.

[0367] Furthermore, if the first request also carries an indication to activate the APP, and the edge dog module is legal, the method may further include: the APP activates the APP, and after the activation is successful, sends an activation success message to the proxy module and the edge dog module indicating that the APP is successfully activated. The proxy module receives the activation success message, sets the status of the APP to "activated", and at the same time, increases the activation count of the locally stored APP by 1. After receiving the activation success message, the edge dog module updates the activation count of the locally stored APP in the edge dog module, and increases the activation count of the locally stored APP by 1.

[0368] Furthermore, if the first operation is to run the APP, and the Edge Dog module is illegal, it means that the running environment of the APP is not safe, and the running of the APP is exited.

[0369] It should be noted that in Figure 8 In the method shown, alternatively, the APP can also compare the first MAC and the fourth MAC to verify whether the edge dog module is legal, such as: the above steps 806 to 807 can be replaced by: the edge dog module sends the first MAC to the APP, and the APP compares the first MAC and the fourth MAC to verify whether the edge dog module is legal.

[0370] based on Figure 8According to the method shown, after receiving the request for obtaining the first MAC sent by the APP, the edge dog module can generate a MAC according to the security parameters and / or the operating environment information of the APP, compare the MAC generated by itself and the received MAC, and verify whether the edge dog module is legal, such as: when the MAC generated by itself is the same as the received MAC, it means that the edge dog module is legal, and feed back the verification result to the APP so that the APP can perform subsequent operations. In this way, a legitimate user can calculate the MAC through the edge dog module using legitimate security parameters and other parameters, and match the MAC generated by the proxy module with the MAC generated by itself to verify whether the operation on the APP is legal, ensure the legal use of the edge dog module, and implement that only users with legitimate input parameters such as security parameters can use the APP, and even if an illegal user obtains the APP, he will not be able to obtain the legitimate input parameters and calculate a MAC different from the received MAC, and will not be able to steal the APP. Compared with the prior art, Figure 8 The method shown can ensure the security of APP use in MEC scenarios.

[0371] The following example takes the proxy module and the APP as separate deployments, and the first request also carries the APP activation instruction, security parameters, and APP operating environment information as input parameters. Figure 8 The method shown is described in detail.

[0372] Fig. 9 A flowchart of another anti-cracking method provided by this application, such as Fig. 9 As shown, the method includes:

[0373] Step 901: The APP receives an activation request from an APP user.

[0374] The activation request may be used to request activation of the APP. The activation request may be a request issued by the APP user when clicking on the human-computer interaction interface on the mobile edge host.

[0375] Step 902: The APP sends a third request to the proxy module.

[0376] Among them, the relevant description of the third request and the execution process of step 902 can refer to the description of step 801 and will not be repeated here.

[0377] Step 903: The proxy module receives the third request and determines whether the number of activations of the APP is less than the maximum allowed number of activations; if the number of activations of the APP is less than the maximum allowed number of activations, execute steps 904 to 914; otherwise, if the number of activations of the APP is equal to or greater than the maximum allowed number of activations, the proxy module returns to the APP that the number of activations of the APP has exceeded the maximum allowed number of activations, and the process ends.

[0378] Step 904: The proxy module calculates and obtains a fourth MAC according to the security parameters.

[0379] The execution process of step 904 may refer to the description of step 802 and will not be described in detail.

[0380] Step 905: The proxy module sends the fourth MAC to the APP.

[0381] The execution process of step 905 may refer to the description of step 803 and will not be described in detail.

[0382] Step 906: The APP sends a first request to the edge dog module.

[0383] Among them, step 906 can refer to step 804 and will not be described in detail.

[0384] Step 907: The edge dog module receives the first request and determines whether the operating environment information of the APP is included in the preset operating environment information. If the operating environment information of the APP is included in the preset operating environment information, execute steps 908 to 914; otherwise, it is illegal to send the operating environment information to the APP and the process ends.

[0385] Step 908: The edge dog module determines whether the number of activations of the APP is less than the maximum allowed number of activations; if the number of activations of the APP is less than the maximum allowed number of activations, execute steps 909 to 914; otherwise, if the number of activations of the APP is equal to or greater than the maximum allowed number of activations, the edge dog module returns to the APP that the number of activations of the APP has exceeded the maximum allowed number of activations, and the process ends.

[0386] Step 909: The edge dog module uses the security parameters and the operating environment information of the APP as input parameters to calculate the first MAC.

[0387] The execution process of step 909 may refer to the description of step 805 and will not be described in detail.

[0388] Step 910: The edge dog module compares the first MAC and the fourth MAC to verify whether the edge dog module is legitimate.

[0389] The execution process of step 910 may refer to the description of step 806 and will not be described in detail.

[0390] Step 911: The Edge Dog module sends the verification result to the APP.

[0391] Step 912: If the APP activation is allowed, the APP activates the APP, and after the activation is successful, sends an activation success message to the proxy module and the edge dog module indicating that the APP is successfully activated.

[0392] Step 913: The proxy module receives the activation success message, increases the activation count of the locally stored APP by 1, and at the same time, the proxy module sets the status of the APP to "activated".

[0393] Step 914: The Edge Dog module receives the activation success message, increases the activation count of the locally stored APP by 1, and at the same time, the proxy module sets the status of the APP to "activated".

[0394] It should be noted that in Fig. 9 In the method shown, alternatively, the APP can also compare the first MAC and the fourth MAC to verify whether the edge dog module is legal, such as: the above steps 910 to 911 can be replaced by: the edge dog module sends the first MAC to the APP, and the APP compares the first MAC and the fourth MAC to verify whether activation of the APP is allowed.

[0395] based on Fig. 9 The method shown can be that after receiving a request from the APP to activate the APP, the edge dog module generates a MAC based on the security parameters and the operating environment information of the APP, compares the MAC generated by itself with the received MAC, and verifies whether the edge dog module is legal, such as: when the MAC generated by itself is the same as the received MAC, it indicates whether the edge dog module is legal, and activates the APP. In this way, a legitimate user can use the edge dog module to calculate the expected MAC using the legitimate security parameters and the operating environment information of the APP, ensuring the legitimate use of the edge dog module, and realizing that only users with legitimate input parameters such as security parameters can use the APP, and even if an illegal user obtains the APP, he will not be able to obtain the legitimate input parameters and calculate a MAC different from the received MAC, and cannot steal the APP and activate the APP.

[0396] The following example takes the deployment of the proxy module and the APP separately, the first operation is to run the APP, and the security parameters and the APP's operating environment information are used as input parameters. Figure 8 The method shown is described in detail.

[0397] Fig.10 A flowchart of another anti-cracking method provided by this application, such as Fig.10 As shown, the method includes:

[0398] Step 1001: The APP receives a running request from an APP user.

[0399] The run request may be used to request the running of an APP, and may be a request issued by an APP user clicking on a human-computer interaction interface on a mobile edge host.

[0400] Step 1002: The APP sends a third request to the proxy module.

[0401] Among them, the relevant description of the third request and the execution process of step 1002 can refer to the description of step 801 and will not be repeated here.

[0402] Step 1003: The proxy module receives the third request and determines whether the APP is activated; if the APP is activated, steps 1004 to 1011 are executed; otherwise, the proxy module returns to the APP that the APP is not activated, and the process ends.

[0403] Step 1004: The proxy module calculates a fourth MAC based on the security parameters and the operating environment information of the APP.

[0404] The execution process of step 1004 may refer to the description of step 802 and will not be described in detail.

[0405] Step 1005: The proxy module sends the fourth MAC to the APP.

[0406] The execution process of step 1005 may refer to the description of step 803 and will not be described in detail.

[0407] Step 1006: The APP sends a first request to the edge dog module.

[0408] Among them, the relevant description of the first request and step 1006 can refer to step 804 and will not be repeated here.

[0409] Step 1007: The edge dog module receives the first request and determines whether the operating environment information of the APP is included in the preset operating environment information. If the operating environment information of the APP is included in the preset operating environment information, execute steps 1008 to 1011; otherwise, it is illegal to send the operating environment information to the APP and the process ends.

[0410] Step 1008: The Edge Dog module determines whether the APP is activated; if the APP is activated, execute steps 1009 to 1011; otherwise, the proxy module returns to the APP that the APP is not activated, and the process ends.

[0411] Step 1009: The edge dog module uses the security parameters and the operating environment information of the APP as input parameters to calculate the first MAC.

[0412] The execution process of step 1009 may refer to the description of step 805 and will not be described in detail.

[0413] Step 1010: The edge dog module sends a first MAC to the APP.

[0414] Step 1011: The APP compares the first MAC and the fourth MAC to verify whether the edge dog module is legitimate.

[0415] Exemplarily, if the first MAC is the same as the fourth MAC, it means that the edge dog module is legal, and the APP is allowed to run, and the APP continues to run. On the contrary, if the first MAC is different from the fourth MAC, it means that the edge dog module is illegal, and the APP stops running.

[0416] It should be noted that in Fig.10 In the method shown, alternatively, the edge dog module can also compare the first MAC and the fourth MAC to verify that the edge dog module is illegal, such as: the above steps 1010 to 1011 can be replaced by: the edge dog module compares the first MAC and the fourth MAC to verify whether the APP is allowed to run, and sends the verification result to the APP.

[0417] based on Fig.10 The method shown can be that after receiving a request from an APP to run the APP, the proxy module generates a MAC based on the security parameters and the operating environment information of the APP, and feeds the MAC back to the APP. After receiving a request from an APP to run the APP, the edge dog module generates a MAC based on the security parameters and the operating environment information of the APP, and feeds the MAC back to the APP. The APP compares the MAC generated by the proxy module with the MAC generated by the edge dog module to verify whether the APP is allowed to run. In this way, a legitimate user can use the edge dog module to calculate the expected MAC using the legitimate security parameters and the operating environment information of the APP, ensuring the legitimate use of the edge dog module, and realizing that only users with legitimate input parameters such as security parameters can use the APP, and even if an illegal user obtains the APP, he will not be able to obtain the legitimate input parameters and calculate a MAC different from the received MAC, and cannot steal and run the APP.

[0418] The following describes the anti-cracking process when the APP is deactivated by deploying the proxy module separately from the APP:

[0419] Fig.11 A flowchart of another anti-cracking method provided by this application, such as Fig.11 As shown, the method includes:

[0420] Step 1101: The APP determines that a condition for deactivating the APP is met.

[0421] The conditions for deactivating the APP and the process by which the APP determines that the conditions for deactivating the APP are met may refer to the above step 701 and will not be described in detail.

[0422] Step 1102: The APP sends a fourth request to the proxy module.

[0423] The fourth request may be used to request to deactivate the APP. The fourth request may include one or more parameters such as an APP identifier, a serial number of the APP, and a timestamp.

[0424] Step 1103: The proxy module receives the fourth request and calculates a second MAC according to the security parameter.

[0425] The second MAC may be used to verify whether the operation of deactivating the APP is legal.

[0426] Exemplarily, the proxy module may perform step 1103 with reference to the above step 702, which will not be described in detail.

[0427] Step 1104: If the condition for deactivating the APP is condition (one), the proxy module reduces the activation count of the locally stored APP by one, and at the same time, marks the status of the APP as "deactivated"; if the condition for deactivating the APP is condition (two), the proxy module marks the status of the APP as "deactivated".

[0428] It should be noted that the present application does not limit the execution order of step 1103 and step 1104. They can be executed one after the other or simultaneously. Step 1104 can also be executed first and then step 1103. There is no limitation.

[0429] Step 1105: The proxy module sends the second MAC to the APP.

[0430] Step 1106: The APP sends a second request to the edge dog module.

[0431] The second request may be used to request to deactivate the APP, and the second request may include the second MAC. The second request may also be named a deactivation request.

[0432] The proxy module sending the second request to the edge dog module can refer to the process of the proxy module sending the first request to the edge dog module in step 401, which will not be described in detail.

[0433] Step 1107: The edge dog module receives the second request, takes the security parameter as an input parameter, and calculates a third MAC.

[0434] The execution process of step 1106 may refer to the description of step 706 and will not be described in detail.

[0435] Step 1108: The edge dog module compares the second MAC and the third MAC to verify whether deactivation of the APP is allowed.

[0436] The execution process of step 1108 may refer to the description of step 405 and will not be described in detail.

[0437] Step 1109: The edge dog module sends a deactivation response to the proxy module.

[0438] Among them, the deactivation response can be used to indicate whether APP deactivation is allowed, such as: when the second MAC is the same as the third MAC, the deactivation response is used to indicate that APP deactivation is allowed, otherwise, when the second MAC is different from the third MAC, the deactivation response can be used to indicate that APP deactivation is not allowed.

[0439] Step 1110: If deactivation of the APP is allowed and the condition for deactivating the APP is condition (one), the edge dog module will reduce the number of activations of the locally stored APP by 1, and at the same time, mark the status of the APP as "deactivated"; if deactivation of the APP is allowed and the condition for deactivating the APP is condition (two), the edge dog module will mark the status of the APP as "deactivated".

[0440] It should be noted that the present application does not limit the execution order of step 1109 and step 1110. Step 1109 may be executed first and then step 1110, or step 1110 may be executed first and then step 1109. There is no limitation.

[0441] based on Fig.11 The method shown can be that after receiving a request to deactivate an APP, the edge dog module generates a MAC based on security parameters, and compares the self-generated MAC with the received MAC to verify whether deactivation of the APP is allowed, such as: when the self-generated MAC is the same as the received MAC, it means that deactivation of the APP is allowed. In this way, a legitimate user can use the edge dog module to calculate the expected MAC using the legitimate security parameters and the deactivation environment information of the APP, ensuring the legitimate use of the edge dog module, and realizing that only users with legitimate input parameters such as security parameters can use the APP, and even if an illegal user obtains the APP, he will not be able to obtain the legitimate input parameters and calculate a MAC different from the received MAC, and cannot steal and deactivate the APP.

[0442] In order to ensure that the activation times of the APPs at both ends of the proxy module and the edge dog module are synchronized, the present application also provides a synchronization method. Fig.12 A flowchart of another state synchronization method provided by this application, such as Fig.12 As shown, including:

[0443] Step 1201: The proxy module sends a status synchronization request to the edge dog module.

[0444] The status synchronization request may include the number of activations of the APP.

[0445] Exemplarily, the proxy module may send a status synchronization request to the edge dog module when the activation status of the APP is not successfully notified to the edge dog module; or, the proxy module may periodically send a status synchronization request to the edge dog module without restriction.

[0446] Step 1202: The edge dog module receives the status synchronization request from the proxy module, and updates the activation count of the APP stored locally to the activation count of the APP.

[0447] Step 1203: The edge dog module sends a status synchronization response to the proxy module.

[0448] The state synchronization response may be used to instruct the edge dog module to synchronize the activation times of its own APP to be consistent with the activation times of the APP of the proxy module.

[0449] based on Fig.12 The method described can synchronize the activation times of the APP stored in the proxy module and the edge dog module, so that the two have the same understanding of the activation times of the APP.

[0450] In the above-mentioned embodiments provided by the present application, the methods provided by the embodiments of the present application are introduced from the perspective of the interaction between the proxy module and the edge dog module. It can be understood that in order to realize the various functions in the methods provided by the above-mentioned embodiments of the present application, each network element, such as the proxy module and the edge dog module, the network device and the terminal device include hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0451] The embodiment of the present application can divide the proxy module and the edge dog module into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0452] In the case of dividing each functional module into corresponding functional modules, Fig.13The structure diagram of an edge dog module 130 is shown, and the edge dog module 130 can be deployed on a VM / container of a mobile edge host. The edge dog module 130 can be used to perform the functions of the edge dog module involved in the above method embodiment. Fig.13 The edge dog module 130 shown includes: a receiving unit 1301, a processing unit 1302, and a sending unit 1303;

[0453] In a possible design, the receiving unit 1301 is used to receive a first request for requesting a first MAC, including the operating environment information of the APP. For example, the receiving unit 1301 is used to support the edge dog module 130 to execute steps 402 and 805.

[0454] The processing unit 1302 is used to calculate a first MAC for verifying whether the edge dog module is legitimate according to the running environment information of the APP. For example, the processing unit 1302 is used to support the edge dog module 130 to execute step 402, step 805, and step 806.

[0455] The sending unit 1303 is configured to send a first MAC. For example, the sending unit 1303 is configured to support the edgedog module 130 to execute step 403 and step 807.

[0456] In another possible design, the receiving unit 1301 is used to receive a first request for requesting to obtain a first MAC and including a fourth MAC, and the fourth MAC is used to verify whether the edge dog module is legal; the processing unit 1302 is used to calculate the first MAC according to the operating environment information of the APP, and compare the first MAC and the fourth MAC; the sending unit 1303 is used to send a response to the first request. When the first MAC and the fourth MAC are the same, the response to the first request indicates that the edge dog module is legal, and when the first MAC and the fourth MAC are different, the response to the first request indicates that the edge dog module is illegal.

[0457] In another possible design, the receiving unit 1301 is used to receive a first request for requesting a first MAC; the processing unit 1302 is used to calculate, based on security parameters, a first MAC for verifying whether the edge dog module is legitimate; and the sending unit 1303 is used to send the first MAC.

[0458] In another possible design, the receiving unit 1301 is used to receive a first request for requesting to obtain a first MAC and including a fourth MAC, and the fourth MAC is used to verify whether the edge dog module is legal; the processing unit 1302 is used to calculate the first MAC according to the security parameter, and compare the first MAC and the fourth MAC; the sending unit 1303 is used to send a response to the first request. When the first MAC and the fourth MAC are the same, the response of the first request indicates that the edge dog module is legal, and when the first MAC and the fourth MAC are different, the response of the first request indicates that the edge dog module is illegal.

[0459] In another possible design, the receiving unit 1301 is used to receive a second request including a second MAC for requesting to deactivate the APP, and the second MAC is used to verify whether the operation of deactivating the APP is legal; the processing unit 1302 is used to calculate a third MAC based on the security parameters, and compare the second MAC with the third MAC; the sending unit 1303 is used to send a deactivation response. When the second MAC and the third MAC are the same, the deactivation response is used to indicate that the APP is deactivated successfully, and when the second MAC and the third MAC are different, the deactivation response is used to indicate that the APP is deactivated unsuccessfully.

[0460] Among them, the relevant descriptions of security parameters and APP operating environment information can be referred to above Figures 4 to 12 As described in the method shown, the specific execution process of the receiving unit 1301, the processing unit 1302, and the sending unit 1303 can refer to the above Figures 4 to 12 The actions specified by the edge dog module in the method shown are not repeated here.

[0461] In the case of dividing each functional module into corresponding functional modules, Fig.14 The structure diagram of a proxy module 140 is shown. The proxy module 140 can be deployed on a VM / container of a mobile edge host. The proxy module 140 can be used to perform the functions of the proxy module involved in the above method embodiment. Fig.14 The proxy module 140 shown includes: a receiving unit 1401, a processing unit 1402, and a sending unit 1403;

[0462] In a possible design, the sending unit 1403 is used to send a first request for requesting a first MAC and including the operating environment information of the APP to the edge dog module. For example, the sending unit 1403 can support the proxy module 140 to perform step 401.

[0463] The receiving unit 1401 is configured to receive a first MAC from the edgedog module for verifying whether the edgedog module is legitimate. For example, the receiving unit 1401 may support the proxy module 140 to perform step 404 .

[0464] The processing unit 1402 is used to calculate the fourth MAC according to the running environment information of the APP, compare the first MAC with the fourth MAC, and if the first MAC is the same as the fourth MAC, determine that the edge dog module is legal; if the first MAC is different from the fourth MAC, determine that the edge dog module is illegal. For example, the processing unit 1402 can support the proxy module 140 to execute steps 404 and 405.

[0465] In another possible design, the receiving unit 1401 is used to receive a third request from the APP for requesting a fourth MAC; the processing unit 1402 is used to calculate, based on the security parameters, a fourth MAC for verifying whether the edge dog module is legal; and the sending unit 1403 is used to send the fourth MAC to the APP.

[0466] In another possible design, the sending unit 1403 is used to send a first request for requesting a first MAC to the edge dog module; the receiving unit 1401 is used to receive a first MAC from the edge dog module for verifying whether the edge dog module is legal; the processing unit 1402 is used to calculate a fourth MAC based on the security parameters, compare the first MAC with the fourth MAC, if the first MAC is the same as the fourth MAC, then the edge dog module is determined to be legal, otherwise, the edge dog module is determined to be illegal.

[0467] In another possible design, the receiving unit 1401 is configured to receive a third request from the APP for requesting a fourth MAC, including the operating environment information of the APP. For example, the receiving unit 1401 may support the proxy module 140 to perform step 802.

[0468] The processing unit 1402 is configured to calculate, according to the running environment information of the APP, a fourth MAC for verifying whether the edge dog module is legitimate. For example, the processing unit 1402 may support the proxy module 140 to perform step 802 .

[0469] The sending unit 1403 is configured to send the fourth MAC to the APP. For example, the sending unit 1403 supports the proxy module 140 to perform step 803.

[0470] Among them, the relevant descriptions of security parameters and APP operating environment information can be referred to above Figures 4 to 12 As described in the method shown, the specific execution process of the receiving unit 1401, the processing unit 1402, and the sending unit 1403 can refer to the above Figures 4 to 12 The actions specified by the proxy module in the method shown are not repeated here.

[0471] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by a computer program to instruct the relevant hardware, and the program can be stored in the above computer-readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be an internal storage unit of the communication device (including the data sending end and / or the data receiving end) of any of the above embodiments, such as a hard disk or memory of the communication device. The above computer-readable storage medium can also be an external storage device of the above communication device, such as a plug-in hard disk equipped on the above communication device, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. Further, the above computer-readable storage medium can also include both the internal storage unit of the above communication device and an external storage device. The above computer-readable storage medium is used to store the above computer program and other programs and data required by the above communication device. The above computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0472] In another possible design, in a certain application scenario, the APP may be deployed on the client and the server. The client is usually deployed in the terminal at the front end, and the APP deployed on the client has strong anti-copying and cracking features, while the server is deployed in the virtual environment of the back end, such as: deployed in the MEC system, the APP deployed therein is easy to be copied and cracked, reducing the security of the APP deployed on the server.

[0473] In order to solve the risk that the APP is easily copied and cracked in the back-end server when it is deployed on the client and server, the embodiment of the present application also provides an anti-cracking method, in which the front-end terminal provides a verification MAC value for the back-end server to verify whether the APP deployed on the server is legal, so that if the APP is illegal, corresponding remedial measures or processing measures can be adopted to improve the security of the APP deployed on the server. The anti-cracking method can effectively bind the front-end and back-end, and with the help of the front-end terminal, the server with the APP deployed on the back-end also has anti-copying and cracking characteristics.

[0474] It should be noted that in the embodiment of the present application, the following terminal may refer to a terminal on which a client is deployed, and an APP is deployed on the client, and the client may be referred to as an APP client; in addition, for the sake of ease of description, a server on which an APP is deployed may be referred to as an APP server.

[0475] The following is attached to the instruction manual Figure 15-Figure 22 , describes another anti-cracking method provided by this application.

[0476] Fig.15 This is another system architecture diagram provided in the embodiment of the present application. The system is suitable for scenarios where the APP is deployed on the client and the server. Fig.15 As shown, the system may include: a terminal, an APP server, and may also include a MEP and a NFVI. The terminal is deployed with an APP client, and the APP client is deployed with an agent module, which can be used to execute the execution process of the terminal in the following method embodiment. In addition, the terminal may also be deployed with a security module, which stores hardware security parameters, and the security module may be a fifth generation (5 th The APP server and the MEP can be deployed on the network function virtualized infrastructure (NFVI). The NFVI can also have a security module, which can pre-store hardware security parameters. The security module can include secure hardware or security chips such as a trusted platform module (TPM). The APP server can be connected to the terminal and can be connected to the MEP.

[0477] Among them, in the embodiment of the present application, the hardware security parameters can be used to verify whether the APP on the APP server is legal, and the hardware security parameters can be pre-configured in the security module in the terminal and / or pre-configured in the security module of the NFVI. Specifically, the hardware security parameters may include but are not limited to the security chip identifier (indentifier, ID), the security chip preset parameters, one or more parameters in the processor ID in the security chip, and the security chip preset parameters may include but are not limited to random numbers or root keys.

[0478] It should be noted that Fig.15 The accompanying drawings are for illustrative purposes only. Fig.15 The MEP and APP server can be deployed in NFVI or outside NFVI without limitation. This application takes the MEP and APP server independently deployed outside NFVI as an example. When the MEP and APP server are independently deployed outside NFVI, the APP server can interact with NFVI through MEP. Fig.15 In addition to the components described above, the system also includes other components without limitation.

[0479] The terminal may be terminal equipment, user equipment (UE), mobile station (MS), or mobile terminal (MT), etc. Specifically, the terminal may be a mobile phone, a tablet computer, or a computer with wireless transceiver function, or a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in smart grid, a wireless terminal in smart city, a smart home, a vehicle-mounted terminal, etc.

[0480] The APP server can be used to provide APP services to users, such as Fig.15 The APP server may include a proxy module, which may perform the following Figure 16 to Figure 22 The actions specified by the APP server in the method embodiment shown.

[0481] Among them, NFVI includes a virtualization layer (hypervisor or container management system, such as Docker, and vSwitch) and physical resources, such as switches, storage devices, etc. NFVI can be deployed across several physical locations. In this case, the network that provides data connections for these physical sites is also called part of NFVI. In order to be compatible with the existing network architecture, the network access point of NFVI must be able to interconnect with other physical networks. NFV supports multiple vendors. NFVI is a universal virtualization layer. All virtual resources should be in a unified shared resource pool and should not be restricted or treated specially for certain virtualized network functions (VNFs) running on it.

[0482] Combine the following Fig.15 The system describes another anti-cracking method of the embodiment of the present application.

[0483] Fig.16 A flowchart of an anti-cracking method provided in an embodiment of the present application, which can be interactively executed by a terminal deployed with an APP client, an APP server, and a MEP platform, a secure transport layer security (TLS) connection is established between the terminal and the APP server, and a TLS connection is established between the APP server and the MEP; Fig.16 As shown, the method may include:

[0484] Step 1601: The APP server sends a first request to the terminal.

[0485] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0486] It should be noted that in each embodiment of the present application, verifying whether the APP is legal can also be described as / replaced with verifying whether the APP on the APP server is legal, or verifying whether the APP server operates in a secure environment, or verifying whether the front-end APP client and MEP are legal.

[0487] Specifically, the first request may include an identifier of the MEP, and may also include one or more parameters such as a serial number of the APP, an ID of the APP, a timestamp, a counter, and other parameters.

[0488] The MEP identifier can be used to uniquely identify the MEP. For details about the APP serial number, APP ID, and timestamp, refer to Figure 4 The counter may be the number of times the first MAC is successfully requested, and the value of the counter is increased by 1 each time the first MAC is successfully requested.

[0489] Specifically, the first request may be a fingerprint request, which may be used to verify whether the APP on the server or the APP server operates in a secure environment, or to verify the legitimacy of the front-end APP client and MEP.

[0490] Step 1602: The terminal receives the first request and calculates a first MAC according to the identifier of the MEP.

[0491] Among them, the terminal calculates the first MAC according to the identifier of the MEP, which may include: the terminal calculates the first MAC according to the identifier of the MEP and the hardware security parameters. For example, the identifier of the MEP is input as an input parameter to the above-mentioned preset algorithm f to obtain the first MAC. Furthermore, the terminal can also calculate the first MAC according to one or more parameters of other parameters such as a key, a serial number of the APP, an ID of the APP, a timestamp, a counter, etc., such as: one or more parameters of other parameters such as a key, a serial number of the APP, an ID of the APP, a timestamp, a counter, etc. are input as input parameters to the above-mentioned preset algorithm f to obtain the first MAC.

[0492] Step 1603: The terminal sends a first MAC to the APP server.

[0493] Exemplarily, the terminal sends a response to the first request to the APP server, and the response to the first request may include the first MAC. In addition to carrying the first MAC, the response to the first request may also include other information, which is not limited.

[0494] Step 1604: The APP server receives the first MAC and sends a second request to the MEP.

[0495] The second request may be used to request a second MAC; the second request may carry the MEP identifier and may also carry other information, such as: the APP serial number, the APP ID, timestamp, counter and other parameters. The MEP identifier, the APP serial number, the APP ID, timestamp, counter and other related descriptions can be referred to above and will not be repeated here.

[0496] Step 1605: The MEP receives the second request and calculates a second MAC according to the MEP identifier.

[0497] The MEP may calculate the second MAC according to the MEP identifier by referring to the process in step 1602 in which the terminal calculates the second MAC according to the MEP identifier, and thus details thereof will not be given in detail.

[0498] Step 1606: The MEP sends a second MAC to the APP server.

[0499] Exemplarily, the MEP may send a response to the second request to the APP server, and the response to the second request may include the second MAC.

[0500] Step 1607: The APP server receives the second MAC, and compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal. If the first MAC is different from the second MAC, the APP is determined to be illegal and the operating environment of the APP server is unsafe.

[0501] It should be noted that Fig.16 The execution action of the terminal may be executed by a proxy module in the APP client in the terminal.

[0502] based on Fig.16 The method shown can be used by the front-end terminal to provide a verification MAC value to the APP server, so that the APP server can verify the legitimacy of the APP based on the MAC calculated by itself and the MAC calculated by the terminal, effectively binding the front-end and back-end, and with the help of the front-end terminal, the server deployed with the APP on the back-end also has anti-copying and cracking features.

[0503] Fig.17The flowchart of an anti-cracking method provided in an embodiment of the present application can be interactively executed by a terminal with an APP client, an APP server and NFVI, a TLS connection is established between the terminal and the APP server, a security module is deployed in the NFVI, and hardware security parameters are pre-configured in the security module. Fig.17 As shown, the method may include:

[0504] Step 1701: NFVI sends hardware security parameters to the APP server.

[0505] Among them, the hardware security parameters can be pre-configured in the security module within the NFVI. The relevant description of the hardware security parameters can be referred to in the above method embodiment and will not be repeated here.

[0506] Specifically, Fig.17 The actions specified by the NFVI in the illustrated method may be performed by a security module within the NFVI.

[0507] Step 1702: The APP server receives the hardware security parameters and sends a first request to the terminal.

[0508] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0509] Specifically, the first request may include the MEP identifier and hardware security parameters, and may also include one or more parameters of the APP serial number, APP ID, timestamp, counter, etc. The relevant descriptions of the MEP identifier, APP serial number, APP ID, timestamp, and counter can be referred to above and will not be repeated here.

[0510] Step 1703: The terminal receives the first request and calculates a first MAC according to the MEP identifier and hardware security parameters.

[0511] Among them, the terminal calculating the first MAC according to the identifier of the MEP may include: the terminal calculating the first MAC according to the identifier of the MEP and the hardware security parameters. For example, the identifier of the MEP and the hardware security parameters are input as input parameters to the above-mentioned preset algorithm f to obtain the first MAC. Furthermore, the terminal can also calculate the first MAC according to one or more parameters of other parameters such as a key, a serial number of the APP, an ID of the APP, a timestamp, a counter, etc., such as: one or more parameters of other parameters such as a key, a serial number of the APP, an ID of the APP, a timestamp, a counter, etc. are input as input parameters to the above-mentioned preset algorithm f to obtain the first MAC.

[0512] Step 1704: The terminal sends a first MAC to the APP server.

[0513] Exemplarily, the terminal sends a response to the first request to the APP server, and the response to the first request may include the first MAC. In addition to carrying the first MAC, the response to the first request may also include other information, which is not limited.

[0514] Step 1705: The APP server receives the first MAC and sends a second request to the NFVI.

[0515] The second request may be used to request a second MAC; the second request may carry the MEP identifier and may also carry other information, such as: the APP serial number, the APP ID, timestamp, counter and other parameters. The MEP identifier, the APP serial number, the APP ID, timestamp, counter and other related descriptions can be referred to above and will not be repeated here.

[0516] Step 1706: The NFVI receives the second request and calculates a second MAC according to the MEP identifier and hardware security parameters.

[0517] Among them, the process of NFVI calculating the second MAC according to the MEP identifier and hardware security parameters can refer to the process of the terminal calculating the first MAC in step 1703, which is not repeated here.

[0518] Step 1707: NFVI sends the second MAC to the APP server.

[0519] Exemplarily, the NFVI may send a response to the second request to the APP server, and the response to the second request may include a second MAC.

[0520] Step 1708: The APP server receives the second MAC, compares the first MAC with the second MAC, and if the first MAC is the same as the second MAC, determines that the APP is legal; if the first MAC is different from the second MAC, determines that the APP is illegal.

[0521] Alternatively, step 1707 and step 1708 may not be performed, and the first MAC may be carried in the second request and sent to NFVI. After calculating the second MAC, NFVI compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0522] It should be noted that Fig.17 The execution action of the terminal may be executed by a proxy module in the APP client in the terminal.

[0523] based on Fig.17The method shown can be used by the APP server to send the hardware security parameters in the NFVI to the terminal, and the front-end terminal can calculate the MAC value according to the hardware security parameters and provide the verification MAC value to the APP server, so that the APP server can verify the legitimacy of the APP according to the MAC calculated by the NFVI and the MAC calculated by the terminal, effectively binding the front-end and back-end, and with the help of the front-end terminal, the server deployed with the APP at the back-end also has anti-copying and cracking characteristics.

[0524] Fig.18 A flowchart of an anti-cracking method provided in an embodiment of the present application, the method can be interactively executed by a terminal deployed with an APP client, an APP server, a MEP, and NFVI, a TLS connection is established between the terminal and the APP server, and a TLS connection is established between the APP server and the MEP; Fig.18 As shown, the method may include:

[0525] Step 1801: NFVI sends hardware security parameters to MEP.

[0526] Among them, the hardware security parameters can be pre-configured in the security module within the NFVI. The relevant description of the hardware security parameters can be referred to in the above method embodiment and will not be repeated here.

[0527] Specifically, Fig.18 The actions specified by the NFVI in the illustrated method may be performed by a security module within the NFVI.

[0528] Step 1802: The MEP receives the hardware security parameters and sends the hardware security parameters to the APP server.

[0529] Step 1803: The APP server receives the hardware security parameters and sends a first request to the terminal.

[0530] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0531] Specifically, the first request may include the MEP identifier and hardware security parameters, and may also include one or more parameters of the APP serial number, APP ID, timestamp, counter, etc. The relevant descriptions of the MEP identifier, APP serial number, APP ID, timestamp, and counter can be referred to above and will not be repeated here.

[0532] Step 1804: The terminal receives the first request and calculates a first MAC according to the MEP identifier and hardware security parameters.

[0533] The process of calculating the first MAC by the terminal according to the MEP identifier and hardware security parameters is as described above. Fig.17The step 1703 in the method shown is not repeated here.

[0534] Step 1805: The terminal sends a first MAC to the APP server.

[0535] Exemplarily, the terminal sends a response to the first request to the APP server, and the response to the first request may include the first MAC. In addition to carrying the first MAC, the response to the first request may also include other information, which is not limited.

[0536] Step 1806: The APP server receives the first MAC and sends a second request to the MEP.

[0537] The second request may be used to request a second MAC; the second request may carry the MEP identifier and may also carry other information, such as: the APP serial number, the APP ID, timestamp, counter and other parameters. The MEP identifier, the APP serial number, the APP ID, timestamp, counter and other related descriptions can be referred to above and will not be repeated here.

[0538] Step 1807: The MEP receives the second request and sends the second request to the NFVI.

[0539] Step 1808: The NFVI receives the second request and calculates a second MAC according to the MEP identifier and hardware security parameters.

[0540] Among them, the process in which NFVI calculates the second MAC based on the MEP identifier and hardware security parameters is the same as the process in which the terminal calculates the second MAC based on the MEP identifier and hardware security parameters in step 1804, and is not repeated here.

[0541] Step 1809: NFVI sends a second MAC to the MEP.

[0542] Step 1810: The MEP sends a second MAC to the APP server.

[0543] Exemplarily, the MEP may send a response to the second request to the APP server, and the response to the second request may include the second MAC.

[0544] Step 1811: The APP server receives the second MAC, compares the first MAC with the second MAC, and if the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0545] Alternatively, steps 1809 to 1811 may not be performed, and the first MAC may be carried in the second request and sent to MEP, which then sends it to NFVI. After NFVI calculates the second MAC, it compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0546] It should be noted that Fig.18 The execution action of the terminal may be executed by a proxy module in the APP client in the terminal.

[0547] based on Fig.18 According to the method shown, NFVI can send the hardware security parameters in NFVI to the terminal through MEP and APP server, and the terminal at the front end calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server. At the same time, the NFVI server calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server through MEP, so that the APP server verifies the legitimacy of the APP according to the MAC calculated by the terminal and the MAC calculated by NFVI, effectively binding the front and back ends, and with the help of the front-end terminal, the server with the APP deployed at the back end also has anti-copying and cracking characteristics.

[0548] Fig.19 A flowchart of an anti-cracking method provided in an embodiment of the present application, the method can be interactively executed by a terminal deployed with an APP client, an APP server, and an NFVI, a TLS connection is established between the terminal and the APP server, and hardware security parameters are pre-configured in the security module in the terminal and the security module in the NFVI. The relevant description of the hardware security parameters can be referred to above and will not be repeated; Fig.19 As shown, the method may include:

[0549] Step 1901: The APP server sends a first request to the proxy module in the APP client.

[0550] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0551] Specifically, the first request may include the identifier of the MEP, and may also include one or more parameters of other parameters such as the serial number of the APP, the ID of the APP, a timestamp, and a counter. The relevant descriptions of the identifier of the MEP, the serial number of the APP, the ID of the APP, the timestamp, and the counter can be referred to above and will not be repeated here.

[0552] Step 1902: The proxy module in the APP client receives the first request and sends the first request to the security module of the terminal.

[0553] Step 1903: The security module of the terminal receives the first request and calculates a first MAC according to the identifier of the MEP and the hardware security parameters.

[0554] The process of calculating the first MAC by the terminal security module according to the MEP identifier and hardware security parameters is as described above. Fig.17 The step 1703 in the method shown is not repeated here.

[0555] Step 1904: The security module in the terminal sends the first MAC to the proxy module in the APP client.

[0556] Step 1905: The proxy module in the APP client receives the first MAC and sends the first MAC to the APP server.

[0557] Exemplarily, the proxy module in the APP client sends a response to the first request to the APP server, and the response to the first request may include the first MAC.

[0558] Step 1906: The APP server receives the first MAC and sends a second request to the NFVI.

[0559] The second request may be used to request a second MAC; the second request may carry the MEP identifier and may also carry other information, such as: the APP serial number, the APP ID, timestamp, counter and other parameters. The MEP identifier, the APP serial number, the APP ID, timestamp, counter and other related descriptions can be referred to above and will not be repeated here.

[0560] Step 1907: The NFVI receives the second request and calculates a second MAC according to the MEP identifier and hardware security parameters.

[0561] Among them, the process in which NFVI calculates the second MAC according to the MEP identifier and hardware security parameters can refer to the process in which the terminal security module calculates the second MAC according to the MEP identifier and hardware security parameters in step 1903, which is not repeated here.

[0562] Specifically, Fig.19 The actions specified by the NFVI in the illustrated method may be performed by a security module within the NFVI.

[0563] Step 1908: NFVI sends a second MAC to the APP server.

[0564] Exemplarily, the NFVI may send a response to the second request to the APP server, and the response to the second request may include a second MAC.

[0565] Step 1909: The APP server receives the second MAC, compares the first MAC with the second MAC, and if the first MAC is the same as the second MAC, determines that the APP is legal; if the first MAC is different from the second MAC, determines that the APP is illegal.

[0566] Alternatively, steps 1906 to 1907 may not be performed, and the first MAC may be carried in the second request and sent to MEP, which then sends it to NFVI. After NFVI calculates the second MAC, it compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0567] It should be noted that Fig.19 The execution action of the terminal may be executed by a proxy module in the APP client in the terminal.

[0568] based on Fig.19 The method shown can be that the front-end terminal calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server. At the same time, the NFVI server calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server, so that the APP server verifies the legitimacy of the APP according to the MAC calculated by the terminal and the MAC calculated by NFVI, effectively binding the front-end and back-end, and with the help of the front-end terminal, the server deployed with the APP at the back-end also has anti-copying and cracking characteristics.

[0569] Fig. 20 A flowchart of an anti-cracking method provided in an embodiment of the present application, the method can be interactively executed by a terminal deployed with an APP client and an APP server, and a TLS connection is established between the terminal and the APP server; the security module in the terminal is pre-configured with hardware security parameters, and the relevant description of the hardware security parameters can be referred to above and will not be repeated; Fig. 20 As shown, the method may include:

[0570] Step 2001: The APP server sends a first request to the proxy module in the APP client.

[0571] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0572] Specifically, the first request may include the identifier of the MEP, and may also include one or more parameters of other parameters such as the serial number of the APP, the ID of the APP, a timestamp, and a counter. The relevant descriptions of the identifier of the MEP, the serial number of the APP, the ID of the APP, the timestamp, and the counter can be referred to above and will not be repeated here.

[0573] Step 2002: The proxy module of the APP client receives the first request and sends the first request to the security module in the terminal.

[0574] Step 2003: The security module of the terminal receives the first request and calculates a first MAC according to the identifier of the MEP and the hardware security parameters.

[0575] The process of calculating the first MAC by the terminal security module according to the MEP identifier and hardware security parameters is as described above. Fig.17 The step 1703 in the method shown is not repeated here.

[0576] Step 2004: The security module in the terminal sends a first MAC to the proxy module in the APP client.

[0577] Step 2005: The proxy module in the APP client receives the first MAC and sends the first MAC to the APP server.

[0578] Exemplarily, the proxy module in the APP client sends a response to the first request to the APP server. The response to the first request may include a first MAC. In addition to the first MAC, the response to the first request also includes hardware security parameters.

[0579] Step 2006: The APP server receives the first MAC, and calculates a second MAC according to the MEP identifier and hardware security parameters.

[0580] Among them, the process of the APP server calculating the second MAC according to the MEP identifier and hardware security parameters can refer to the process of the terminal calculating the first MAC according to the MEP identifier and hardware security parameters, which will not be repeated here.

[0581] Step 2007: The APP server compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal. If the first MAC is different from the second MAC, the APP is determined to be illegal.

[0582] It should be noted that Fig. 20 The execution action of the terminal may be executed by a proxy module in the APP client in the terminal.

[0583] based on Fig. 20 The method shown can be that the front-end terminal calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server. At the same time, the APP server calculates the MAC value according to the hardware security parameters, and verifies the legitimacy of the APP based on the MAC calculated by the terminal and the MAC calculated by itself, effectively binding the front-end and back-end. With the help of the front-end terminal, the server deployed with the APP on the back-end also has anti-copying and cracking features.

[0584] Fig.21 A flowchart of an anti-cracking method provided in an embodiment of the present application, the method can be interactively executed by a terminal deployed with an APP client, an APP server, a MEP, and a NFVI, a TLS connection is established between the terminal and the APP server, a TLS connection is established between the APP server and the MEP, and hardware security parameters are pre-configured in the terminal and the NFVI. The relevant description of the hardware security parameters can be referred to above and will not be repeated; Fig.21 As shown, the method may include:

[0585] Step 2101: The APP server sends a first request to the proxy module in the APP client.

[0586] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0587] Specifically, the first request may include the identifier of the MEP, and may also include one or more parameters of other parameters such as the serial number of the APP, the ID of the APP, a timestamp, and a counter. The relevant descriptions of the identifier of the MEP, the serial number of the APP, the ID of the APP, the timestamp, and the counter can be referred to above and will not be repeated here.

[0588] Step 2102: The proxy module of the APP client receives the first request and sends the first request to the security module in the terminal.

[0589] Step 2103: The security module of the terminal receives the first request and calculates a first MAC according to the identifier of the MEP and the hardware security parameters.

[0590] The process of calculating the first MAC by the terminal security module according to the MEP identifier and hardware security parameters is as described above. Fig.17 The step 1703 in the method shown is not repeated here.

[0591] Step 2104: The security module in the terminal sends the first MAC to the proxy module in the APP client.

[0592] Step 2105: The proxy module in the APP client receives the first MAC and sends the first MAC to the APP server.

[0593] Exemplarily, the proxy module in the APP client sends a response to the first request to the APP server, and the response to the first request may include the first MAC.

[0594] Step 2106: The APP server receives the first MAC and sends a second request to the MEP.

[0595] The second request may be used to request a second MAC; the second request may carry the MEP identifier and may also carry other information, such as: the APP serial number, the APP ID, timestamp, counter and other parameters. The MEP identifier, the APP serial number, the APP ID, timestamp, counter and other related descriptions can be referred to above and will not be repeated here.

[0596] Step 2107: The MEP receives the second request and sends the second request to the NFVI.

[0597] Step 2108: The NFVI receives the second request and calculates a second MAC according to the MEP identifier and hardware security parameters.

[0598] The process in which NFVI calculates the second MAC based on the MEP identifier and hardware security parameters is the same as the process in which the terminal calculates the second MAC based on the MEP identifier and hardware security parameters, and is not described in detail.

[0599] Specifically, Fig.21 The actions specified by the NFVI in the illustrated method may be performed by a security module within the NFVI.

[0600] Step 2109: NFVI sends a second MAC to MEP.

[0601] Step 2110: The MEP sends a second MAC to the APP server.

[0602] Exemplarily, the MEP may send a response to the second request to the APP server, and the response to the second request may include the second MAC.

[0603] Step 2111: The APP server receives the second MAC, compares the first MAC with the second MAC, and if the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0604] Alternatively, steps 2107 to 2109 may not be performed, and the first MAC may be carried in the second request and sent to MEP, which then sends it to NFVI. After NFVI calculates the second MAC, it compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, the APP is determined to be legal; if the first MAC is different from the second MAC, the APP is determined to be illegal.

[0605] It should be noted that Fig.21 The execution action of the terminal may be executed by a proxy module in the APP client in the terminal.

[0606] based on Fig.21The method shown can be that the front-end terminal calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server. At the same time, the APP server requests NFVI to calculate the MAC value according to the hardware security parameters, and verifies the legitimacy of the APP based on the MAC calculated by the terminal and the MAC calculated by NFVI, effectively binding the front-end and back-end. With the help of the front-end terminal, the server deployed with the APP at the back-end also has anti-copying and cracking characteristics.

[0607] Fig. 22 A flowchart of an anti-cracking method provided in an embodiment of the present application, the method can be interactively executed by a terminal deployed with an APP client, an APP server, and a MEP platform, a TLS connection is established between the terminal and the APP server, a TLS connection is established between the APP server and the MEP, and hardware security parameters are pre-configured in the terminal. The relevant description of the hardware security parameters can be referred to above and will not be repeated; Fig. 22 As shown, the method may include:

[0608] Step 2201: The APP server sends a first request to the proxy module in the APP client.

[0609] The first request may be used to request a first MAC, and the first MAC may be used to verify whether the APP is legitimate.

[0610] Specifically, the first request may include the identifier of the MEP, and may also include one or more parameters of other parameters such as the serial number of the APP, the ID of the APP, a timestamp, and a counter. The relevant descriptions of the identifier of the MEP, the serial number of the APP, the ID of the APP, the timestamp, and the counter can be referred to above and will not be repeated here.

[0611] Step 2202: The proxy module of the APP client receives the first request and sends the first request to the security module in the terminal.

[0612] Step 2203: The security module of the terminal receives the first request and calculates a first MAC according to the identifier of the MEP and the hardware security parameters.

[0613] The process of calculating the first MAC by the security module in the terminal according to the MEP identifier and the hardware security parameters is as described above. Fig.17 The step 1703 in the method shown is not repeated here.

[0614] Step 2204: The security module in the terminal sends the first MAC to the proxy module in the APP client.

[0615] Step 2205: The proxy module in the APP client receives the first MAC and sends the first MAC to the APP server.

[0616] Exemplarily, the terminal sends a response to the first request to the APP server, and the response to the first request may include a first MAC and hardware security parameters.

[0617] Step 2206: The APP server receives the first MAC and sends a second request to the MEP.

[0618] The second request may be used to request a second MAC; the second request may carry the MEP identifier and hardware security parameters, and may also carry other information, such as: the APP serial number, the APP ID, timestamp, counter and other parameters. The MEP identifier, the APP serial number, the APP ID, timestamp, counter and other related descriptions can be referred to above and will not be repeated here.

[0619] Step 2207: The MEP receives the second request and calculates a second MAC according to the MEP identifier and hardware security parameters.

[0620] Among them, the process in which the MEP calculates the second MAC according to the MEP identifier and hardware security parameters is the same as the process in which the terminal calculates the second MAC according to the MEP identifier and hardware security parameters, which is not repeated here.

[0621] Step 2208: The MEP sends a second MAC to the APP server.

[0622] Exemplarily, the MEP may send a response to the second request to the APP server, and the response to the second request may include the second MAC.

[0623] Step 2209: The APP server receives the second MAC, compares the first MAC with the second MAC, and if the first MAC is the same as the second MAC, determines that the APP is legal; if the first MAC is different from the second MAC, determines that the APP is illegal.

[0624] based on Fig. 22 The method shown can be that the front-end terminal calculates the MAC value according to the hardware security parameters and provides the verification MAC value to the APP server. At the same time, the APP server calculates the MAC value according to the hardware security parameters, and verifies the legitimacy of the APP based on the MAC calculated by the terminal and the MAC calculated by itself, effectively binding the front-end and back-end. With the help of the front-end terminal, the server deployed with the APP on the back-end also has anti-copying and cracking features.

[0625] It should be noted that the terms "first" and "second" in the specification, claims and drawings of the present application are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0626] It should be understood that in the present application, "at least one (item)" means one or more, "more than one" means two or more, "at least two (items)" means two or three and more than three, and "and / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c means: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0627] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0628] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0629] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0630] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0631] In the method provided in the embodiment of the present application, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a terminal or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium (eg, an SSD), etc.

[0632] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for preventing cracking, characterized in that: The method comprises: The edge dog module receives a first request, wherein the first request is used to request a first message authentication code MAC, the first request carries the operating environment information of the application APP, and the edge dog module and the APP are deployed on the same mobile edge platform MEP; The edge dog module determines that the running environment information of the APP matches the preset running environment information, and the preset running environment information represents the environment in which the APP is allowed to run; The edge dog module calculates the first MAC according to the running environment information of the APP, wherein the first MAC is used to verify whether the edge dog module is legal; The edge dog module sends the first MAC.

2. The method according to claim 1, characterized in that The edge dog module calculates the first MAC according to the running environment information of the APP, including: The edge dog module calculates the first MAC according to the operating environment information and security parameters of the APP, The security parameters are pre-configured to the edge dog module by the manufacturer of the APP.

3. The method according to claim 1, characterized in that The operating environment information of the APP includes any one or more of the following: the identifier of the MEP where the APP is located, the information of the virtual machine VM or container where the APP is located, the trusted platform module TPM information of the APP running platform, and the hardware information of the VM or container where the APP is running.

4. The method according to claim 1, characterized in that: The method further comprises: If the first request also carries an indication for activating the APP, the edge dog determines that the number of activations of the APP is less than the maximum allowed number of activations.

5. The method according to claim 4, characterized in that The method further comprises: The edge dog module receives an activation success message, where the activation success message is used to indicate that the APP is successfully activated; The Edge Dog module updates the activation count of the APP according to the activation success message, and increases the activation count of the APP by 1.

6. The method according to claim 1, characterized in that The method further comprises: The edge dog module receives a status synchronization request from the proxy module, wherein the status synchronization request includes the activation times of the APP; The Edge Dog module updates the activation times of the locally stored APP to the activation times of the APP.

7. The method according to claim 1, characterized in that The method further comprises: The edge dog module receives a second request, wherein the second request is used to request deactivation of the APP, and the second request includes a second MAC, and the second MAC is used to verify whether the operation of deactivating the APP is legal; The edge dog module calculates and obtains a third MAC according to the security parameter; The edge dog module compares the second MAC and the third MAC and sends a deactivation response, wherein when the second MAC and the third MAC are the same, the deactivation response is used to indicate that the APP deactivation is successful, and when the second MAC and the third MAC are different, the deactivation response is used to indicate that the APP deactivation fails.

8. An anti-cracking method, characterized in that: The method comprises: The proxy module sends a first request to the edge dog module, wherein the first request is used to request a first message authentication code MAC; the first request carries the operating environment information of the application APP, and the edge dog module and the APP are deployed on the same mobile edge platform MEP; The proxy module receives the first MAC from the edge dog module, where the first MAC is used to verify whether the edge dog module is legal; The proxy module determines that the running environment information of the APP matches the preset running environment information, and the preset running environment information represents the environment in which the APP is allowed to run; The proxy module calculates a fourth MAC according to the operating environment information of the APP; The proxy module compares the first MAC with the fourth MAC, and if the first MAC is the same as the fourth MAC, determines that the edge dog module is legal; if the first MAC is different from the fourth MAC, determines that the edge dog module is illegal.

9. The method according to claim 8, characterized in that The proxy module calculates the fourth MAC according to the running environment information of the APP, including: The proxy module calculates the fourth MAC according to the operating environment information and security parameters of the APP, The security parameters are pre-configured to the proxy module by the manufacturer of the APP.

10. The method according to claim 8, characterized in that The operating environment information of the APP includes any one or more of the following: the identifier of the MEP where the APP is located, the information of the virtual machine VM or container where the APP is located, the trusted platform module TPM information of the APP running platform, and the hardware information of the VM or container where the APP is running.

11. The method according to claim 8, characterized in that The method further comprises: If the first request also carries an instruction to activate the APP, the proxy module determines that the number of activations of the APP is less than a maximum allowed number of activations.

12. The method according to claim 8, characterized in that The method further comprises: The proxy module calculates a second MAC according to the security parameter, wherein the second MAC is used to verify whether the operation of deactivating the APP is legal; The proxy module sends a second request to the edge dog module, wherein the second request is used to request to deactivate the APP, and the second request includes the second MAC.

13. The method according to claim 8, characterized in that The method further comprises: The proxy module sends a status synchronization request to the edge dog module, wherein the status synchronization request includes the activation times of the APP.

14. A method for preventing cracking, characterized in that: The method comprises: The proxy module receives a third request from the application APP, wherein the third request is used to request a fourth message authentication code MAC; the third request includes the operating environment information of the application APP; The proxy module determines that the running environment information of the APP matches the preset running environment information, and the preset running environment information represents the environment in which the APP is allowed to run; The proxy module calculates a fourth MAC according to the operating environment information of the APP, wherein the fourth MAC is used to verify whether the edge dog module is legal, and the edge dog module and the APP are deployed on the same mobile edge platform MEP; The proxy module sends the fourth MAC to the APP.

15. The method according to claim 14, characterized in that The proxy module calculates the fourth MAC according to the running environment information of the APP, including: The proxy module calculates the fourth MAC according to the operating environment information and security parameters of the APP, The security parameters are pre-configured to the proxy module by the manufacturer of the APP.

16. The method according to claim 14, characterized in that The APP operating environment information includes any one or more of the following: the identifier of the MEP where the APP is located, the information of the virtual machine VM or container where the APP is located, the trusted platform module TPM information of the APP operating platform, and the hardware information of the VM or container where the APP is running.

17. The method according to claim 14, characterized in that The method further comprises: If the third request also carries an instruction to activate the APP, the proxy module determines that the number of activations of the APP is less than a maximum allowed number of activations.

18. The method according to claim 14, characterized in that The method further comprises: The proxy module receives a fourth request from the APP, wherein the fourth request is used to request to deactivate the APP; The proxy module calculates a second MAC according to the security factor, wherein the second MAC is used to verify whether the operation of deactivating the APP is legal; The proxy module sends the second MAC to the APP.

19. The method according to claim 14, characterized in that The method further comprises: The proxy module sends a status synchronization request to the edge dog module, wherein the status synchronization request includes the activation times of the APP.

20. An anti-cracking system, characterized in that: The anti-cracking system includes: an agent module and an edge dog module; The proxy module is used to send a first request to the edge dog module, wherein the first request is used to request a first message authentication code MAC; the first request carries the operating environment information of the application APP, and the edge dog module and the APP are deployed on the same mobile edge platform MEP; The edge dog module is used to receive the first request and determine that the running environment information of the APP matches the preset running environment information, where the preset running environment information represents the environment in which the APP is allowed to run; The edge dog module is further used to calculate the first MAC according to the operating environment information of the APP, and send the first MAC to the proxy module, wherein the first MAC is used to verify whether the edge dog module is legal; The proxy module is also used to receive the first MAC from the edge dog module, calculate the fourth MAC according to the running environment information of the APP, compare the first MAC with the fourth MAC, if the first MAC is the same as the fourth MAC, then determine that the edge dog module is legal; if the first MAC is different from the fourth MAC, then determine that the edge dog module is illegal.

21. The anti-cracking system according to claim 20, characterized in that: The edge dog module is specifically used to calculate the first MAC according to the operating environment information and security parameters of the APP; The proxy module is specifically used for calculating the first MAC based on the operating environment information of the APP and the security parameters; wherein the security parameters are pre-configured to the edge dog module by the manufacturer of the APP.

22. The anti-cracking system according to claim 20, characterized in that: The operating environment information of the APP includes any one or more of the following: the identifier of the MEP where the APP is located, the information of the virtual machine VM or container where the APP is located, the trusted platform module TPM information of the APP running platform, and the hardware information of the VM or container where the APP is running.

23. The anti-cracking system according to claim 20, characterized in that: If the first request also carries an indication to activate the APP, the edge dog is further used to determine whether the activation times of the APP are less than the maximum allowed activation times, and the proxy module is further used to determine whether the activation times of the APP are less than the maximum allowed activation times.

24. The anti-cracking system according to claim 23, characterized in that: The proxy module is further used to send an activation success message to the edge dog module, wherein the activation success message is used to indicate that the APP is successfully activated; The edge dog module is also used to receive the activation success message, and update the activation times of the APP according to the activation success message, and increase the activation times of the APP by 1.

25. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions or programs, and when the computer instructions or programs are executed on a computer, the computer is enabled to execute the anti-cracking method according to any one of claims 1 to 7.

26. A computer program product, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the anti-cracking method according to any one of claims 1 to 7.

27. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions or programs, and when the computer instructions or programs are executed on a computer, the computer is enabled to execute the anti-cracking method according to any one of claims 8 to 13 or the anti-cracking method according to any one of claims 14 to 19.

28. A computer program product, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the anti-cracking method according to any one of claims 8 to 13 or the anti-cracking method according to any one of claims 14 to 19.

29. An anti-cracking method, characterized in that: The method is executed by a terminal, on which an application APP client is deployed, and the method includes: The terminal receives a first request from an APP server, wherein the first request is used to request a first message authentication code MAC, the first request carries an identifier of a mobile edge platform MEP, and the APP server is deployed on the MEP; The terminal calculates the first MAC according to the identifier of the MEP, wherein the first MAC is used to verify whether the APP is legal; The terminal sends the first MAC to the APP server.

30. The method according to claim 29, characterized in that The terminal calculating, according to the identifier of the MEP, the first MAC includes: The terminal calculates the first MAC according to the identifier of the MEP and the hardware security parameters, wherein the first MAC is used to verify whether the APP is legal, wherein the hardware security parameters are pre-configured in the network function virtualization infrastructure NFVI, or the hardware security parameters are pre-configured in the terminal.

31. The method according to claim 30, characterized in that The hardware security parameters include one or more parameters of a security chip identification ID, a security chip preset parameter, and a processor ID in the security chip, and the security chip preset parameter includes a random number or a root key. 32.An anti-cracking method, characterized in that: The method is applied to an application APP server, and the method comprises: The APP server sends a first request to the terminal, wherein the first request is used to request a first message authentication code MAC; the first request carries an identifier of a mobile edge platform MEP The APP server receives the first MAC from the terminal, where the first MAC is used to verify whether the APP is legitimate; The APP server obtains a second MAC, where the second MAC is used to verify whether the APP is legitimate; The APP server compares the first MAC with the second MAC. If the first MAC is the same as the second MAC, it is determined that the APP is legal. If the first MAC is different from the second MAC, it is determined that the APP is illegal.

33. The method according to claim 32, characterized in that The APP server obtains the second MAC, including: the APP server calculates the second MAC according to the identifier of the MEP.

34. The method according to claim 32, characterized in that The APP server calculates the second MAC according to the identifier of the MEP, including: the APP server calculates the second MAC according to the identifier of the MEP and hardware security parameters, wherein the APP server receives the hardware security parameters from the network function virtualization infrastructure NFVI, or the APP server receives the hardware security parameters from the terminal.

35. The method according to claim 32, characterized in that The APP server obtains the second MAC, including: the APP server sends a second request, wherein the second request is used to request the second MAC; The APP server receives the second MAC.

36. The method according to claim 35, characterized in that The second request carries the identifier of the MEP, or the second request carries the identifier of the MEP and hardware security parameters.

37. The method according to claim 35 or 36, characterized in that The APP server sending the second request includes: the APP sending the second request to the MEP; the APP server receiving the second MAC includes: the APP server receiving the second MAC from the MEP; or, The APP server sending the second request includes: the APP sending the second request to the network function virtualization infrastructure NFVI; the APP server receiving the second MAC includes: the APP server receiving the second MAC from the NFVI.

38. The method according to claim 34 or 36, characterized in that The hardware security parameters include one or more parameters of a security chip identification ID, a security chip preset parameter, and a processor ID in the security chip, and the security chip preset parameter includes a random number or a root key.

39. An anti-cracking method, characterized in that: The method is applied to a mobile edge platform MEP or a network function virtualization infrastructure NFVI, and the method includes: receiving a second request, wherein the second request is used to request a second message authentication code MAC; the second request includes an identifier of the MEP; The second MAC is calculated according to the identifier of the MEP, wherein the second MAC is used to verify whether the application APP is legal.

40. The method according to claim 39, characterized in that The second request further includes a hardware security parameter; and the calculating, according to the identifier of the MEP, obtaining the second MAC includes: The MEP calculates the second MAC according to the identifier of the MEP and the hardware security parameter.

41. The method according to claim 40, characterized in that The hardware security parameters include one or more parameters of a security chip identification ID, a security chip preset parameter, and a processor ID in the security chip, and the security chip preset parameter includes a random number or a root key.

42. The method according to any one of claims 39 to 41, characterized in that: The method further includes sending the second MAC.

43. The method according to claim 42, characterized in that The sending the second MAC comprises: Sending the second MAC to the APP server; or, Send the second MAC to the MEP.

44. The method according to any one of claims 39 to 41, characterized in that When the method is applied to the NFVI, the second request further includes a first MAC, and the method further includes: The first MAC is compared with the second MAC. If the first MAC is the same as the second MAC, it is determined that the APP is legal. If the first MAC is different from the second MAC, it is determined that the APP is illegal.

45. The method according to any one of claims 39 to 41, characterized in that The receiving the second request includes: receiving the second request from an APP server; or, When the method is applied to the NFVI, the receiving the second request includes: receiving the second request from the MEP. 46.An anti-cracking device, characterized in that: The device includes one or more processors and a communication interface, and the one or more processors and the communication interface are used to support the device to execute the anti-cracking method as described in any one of claims 29-31. 47.An anti-cracking device, characterized in that: The device includes one or more processors and a communication interface, and the one or more processors and the communication interface are used to support the device to execute the anti-cracking method as described in any one of claims 32-38. 48.An anti-cracking device, characterized in that: The device includes one or more processors and a communication interface, and the one or more processors and the communication interface are used to support the device to execute the anti-cracking method as described in any one of claims 39-45.

Images