Method and related device for managing untrusted application communication

Abstract

The present application discloses a method and related apparatus for managing communications with untrusted applications. The method includes: a host process obtaining an access request from an untrusted application for a first program, and replacing the communication handle carried in the access request with the communication handle of the first management application. Therefore, the first program can only communicate with the untrusted application through the communication handle of the first management application, and cannot directly communicate with the untrusted application through the communication handle of the untrusted application. Direct communication renders the host process unable to perform management functions, thereby reducing the risk of privacy data leakage and operating system abnormalities caused by the operation of the untrusted application.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and more particularly to a method and related apparatus for managing communications of untrusted applications. Background Art

[0002] The Android operating system is one of the most popular mobile operating systems today, and numerous developers develop applications based on it. The Android operating system adheres to an open source license, allowing third-party vendors to develop customized versions based on the source code. This, to a certain extent, reduces the security of the Android operating system. Furthermore, the Android operating system allows users to install applications from third-party channels. While this provides convenience, untested or untrusted applications can increase the risk of privacy data leakage and operating system malfunctions.

[0003] Therefore, it is necessary to manage the communication behavior of untested or untrusted applications to reduce risks such as privacy data leakage and operating system abnormalities. Summary of the Invention

[0004] The embodiments of the present application provide a method and related apparatus for managing communications of untrusted applications, which can reduce risks such as privacy data leakage and abnormal operation of the operating system when the untrusted application is running.

[0005] A first aspect of an embodiment of the present application provides a method for managing communication of untrusted applications, including: a first process obtains a first request from a second process for a first program, where the first program can be an Android system program or a third-party application; the first request can be an access request to a third application, or a request to establish a communication connection with the first program, and carries at least one request parameter, a first management application is running in the first process, and an untrusted application is running in the second process; based on at least one request parameter containing a first communication handle, the first process replaces the first communication handle in at least one request parameter with the communication handle of the first management application; then the first process sends a second request for the first program to a target process, the second request carries at least one request parameter containing the communication handle of the first management application, and the first program is running in the target process.

[0006] The first process obtains the first request, and replaces the communication handle of the untrusted application contained in the request parameters carried by the first request with the communication handle of the first management application in the first process, and then sends a second request carrying the communication handle of the first management application to the target process; in this way, the communication handle obtained by the target process is the communication handle of the first management application, not the communication handle of the untrusted application, so the target process can only communicate with the first process through the communication handle of the first management application, and cannot communicate with the second process through the communication handle of the untrusted application, thereby preventing the target process from communicating directly with the second process, causing the first process to be unable to play a management role, thereby reducing the risk of privacy data leakage, operating system abnormality, etc. caused by the operation of untrusted applications.

[0007] As an implementable manner, the first request is included in a communication package, wherein the communication package can be regarded as a serialized manner; after the first process obtains the first request for the first program from the second process, and before the first process replaces the first communication handle in at least one request parameter with the communication handle of the first management application based on at least one request parameter containing the first communication handle, the method also includes: the first process determines the storage location information of the first communication handle in the communication package based on a storage identification bit, the storage identification bit is used to mark the starting position of the target storage area in the communication package, and the target storage area is used to store the first communication handle; the first process obtains the first communication handle based on the storage location information.

[0008] This implementation provides a feasible solution for parsing and obtaining the first communication handle from the communication package, which is applicable to the scenario where the first request is included in the communication package.

[0009] As an implementable method, the first program is a third-party application, the first request is used to request the communication handle of the first program, the second request is used to request the communication handle of the first program, and the first communication handle is the communication handle of an untrusted application; before the first process obtains the first request for the first program from the second process, the method also includes: the first process replaces the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application, so that the second process sends the first request to the first process through the communication handle of the first management application, wherein, in the Android system, the application management service is used for inter-process management, and when the second process needs to send the first request to the target process, it needs to first send the first request to the application management service, and then the application management service forwards the first request to the target process where the first program is located.

[0010] Since the first process replaces the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application, the second process will use the communication handle of the first management application as the communication handle of the application management service; in this way, when the second process wants to send a first request to the target process where the first program is located, the second process will send the first request to the first process through the communication handle of the first management application; after receiving the first request, the first process will send a second request for establishing a communication connection to the target process to establish a communication connection between the first process and the target process, thereby realizing the first process's management of the process of establishing a communication connection between the second process and the target process; and, after the communication connection is established, the messages transmitted between the second process and the target process need to be forwarded through the first process, thereby realizing the first process's management of the second process's communication and reducing the risks of privacy data leakage, operating system abnormality, etc.

[0011] As an implementable manner, after the first process obtains the first request for the first program from the second process, the method further includes: the first process associating the communication handle of the untrusted application with the communication handle of the first management application.

[0012] Since the communication handle of the untrusted application is associated with the communication handle of the first management application, after the target process sends a message to the first process through the communication handle of the first management application, the first process can determine the communication handle of the untrusted application based on the communication handle of the first management application, and then send the message to the second process through the communication handle of the untrusted application, thereby realizing message forwarding and avoiding the message sending error caused by the first process sending the message through the communication handle of other programs except the untrusted application.

[0013] As an implementable manner, the first program is a third-party application, the first request is used to access the first program, and the second request is used to access the first program; the communication handle of the first program stored in the address space of the second process is the communication handle of the first management application; the first process obtains the first request from the second process for the first program, including: the first process receives the first request from the second process for the first program through the communication handle of the first management application.

[0014] Since the communication handle of the first program stored in the address space of the second process is the communication handle of the first management application, the second process sends a request to access the first program through the communication handle of the first management application. After receiving the first request, the first process proxies the second process to access the first program in the target process, thereby enabling the first process to manage the process of untrusted applications accessing third-party applications.

[0015] As an implementable method, the communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application; the first process sends a second request for the first program to the target process, including: the first process sends the second request to the target process through the communication handle of the first program associated with the communication handle of the first management application.

[0016] Based on the association between the communication handle of the first program and the communication handle of the first management application, the host can determine the communication handle of the first program associated with the communication handle of the first management application, and after the second process sends a request to the first process through the communication handle of the first management application, send the second request through the communication handle of the first program associated with the communication handle of the first management application, and avoid the first process sending the second request through the communication handle of other programs except the first program, resulting in an error in sending the second request.

[0017] As an implementable manner, the first program is a system program, which refers to an Android system program, and specifically may include a clipboard program, a mobile hotspot WIFI, and other system programs. The first request is used to access the first program, and the second request is used to access the first program. Before the first process obtains the first request for the first program from the second process, the method also includes: the first process adds a communication handle of the first management application to replace the communication handle of the first program and an identifier of the first program in the service manager in the address space corresponding to the second process, so that the second process sends a first request to the first process through the communication handle of the first management application, and at least one request parameter also includes the identifier of the first program.

[0018] Since the first process adds the communication handle of the first management application and the identifier of the first program to replace the communication handle of the first program in the service manager in the address space corresponding to the second process, the second process will send the first request for accessing the first program to the first process through the communication handle of the first management application. In this way, the first process can proxy the second process to access the first program in the target process, thereby realizing the first process's management of the untrusted application's access to the system program.

[0019] As an implementable manner, after the first process obtains the first request for the first program from the second process, and before the first process sends the second request for the first program to the target process, the method also includes: the first process queries the service manager in the address space corresponding to the first process, the communication handle of the first program corresponding to the identifier of the first program; the first process sending the second request to the target process includes: the first process sends the second request to the target process through the communication handle of the first program.

[0020] This implementation provides a specific solution for a first process to send a second request.

[0021] As an implementable manner, after the first process sends a second request to the target process, the method also includes: the first process receives a first response to the second request from the target process, the first response carrying at least one response parameter; based on the at least one response parameter containing a second communication handle, the first process replaces the second communication handle in the at least one response parameter with the communication handle of the first management application; the first process sends a second response to the first request to the second process, the second response carrying at least one response parameter containing the communication handle of the first management application.

[0022] The first process obtains a second response from the target process, replaces the second communication handle in the response parameter carried by the second response with the communication handle of the first management application, and then sends the communication handle carrying the first management application to the second process; in this way, the second process can only receive the communication handle of the first management application, and will not receive the second communication handle that is different from the communication handle of the first management application, so as to avoid the second process directly communicating with other processes outside the first process through the second communication handle, causing the first process to be unable to play a management role, thereby reducing the risk of privacy data leakage, operating system abnormality, etc. caused by the operation of untrusted applications.

[0023] As an implementable manner, the first program is a third-party application, the first request is used to request the communication handle of the first program, the second request is used to request the communication handle of the first program, and the second communication handle is the communication handle of the first program; after the first process receives a first response to the second request from the target process, the method also includes: the first process associates the communication handle of the first program with the communication handle of the first management application.

[0024] Since the communication handle of the first program is associated with the communication handle of the first management application, after the second process sends a message to the first process through the communication handle of the first management application, the first process can determine the communication handle of the first program based on the communication handle of the first management application, and then send the message to the second process through the communication handle of the first program, thereby realizing message forwarding and avoiding message sending errors caused by the first process sending the message through the communication handle of other programs except the first program.

[0025] As an implementable manner, the method also includes: the first process receives a third request from the second process through the communication handle of the first management application, the third request carries the identifier of the second program and the identifier of the application program interface API of the second program; the first process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program in the third request, wherein the second program mainly refers to a system program that cannot be directly accessed through the Binder mechanism because the communication handle is not stored in the service manager, such as the alarm service AlarmManager, the audio manager AudioManager, etc.

[0026] In this implementation, the first process receives a third request for accessing the API of the second program, which is applicable to a scenario where the communication handle of the second program is not stored in the service manager and cannot be directly accessed through the Binder mechanism.

[0027] As an implementable manner, the method further includes: the first process sending, to the second process through the communication handle of the untrusted application, the access result of the API of the second program.

[0028] In this implementation, the first process accesses the API of the second program on behalf of the second process, thereby managing the process of an untrusted application program accessing the API of the second program.

[0029] The second aspect of an embodiment of the present application provides a method for managing communications of untrusted applications, including: a second process queries a communication handle of a first program from a service manager in an address space corresponding to the second process, obtains the communication handle of the first management application and an identifier of the first program, wherein the first program is a system program; the second process sends a first request to the first process through the communication handle of the first management application, the first request is used to access the first program, and at least one request parameter also includes an identifier of the first program.

[0030] Since the second process queries the communication handle of the first management application instead of the communication handle of the first program, when the second process needs to access the first program, the second process will send a first request to the first process through the communication handle of the first management application, thereby realizing the first process's management of the system program whose communication handle is stored in the service manager for the untrusted application to access.

[0031] As an implementable manner, the method also includes: the second process loads a custom class in the address space of the second process through a custom class loader, the identifier of the custom class is the same as the identifier of the second program, the identifier of the application program interface API of the custom class is the same as the identifier of the API of the second program, the API of the custom class is used to enable the second process to send a third request to the first process through the communication handle of the first management application, the third request carries the identifier of the second program and the identifier of the API of the second program; when the second process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the second process accesses the API of the custom class; the second process sends the third request to the first process through the communication handle of the first management application.

[0032] Since the identifier of the custom class is the same as the identifier of the second program, when the second process accesses the second program, the second process will access the custom class; and since the identifier of the custom class API is the same as the identifier of the second program API, when the second process accesses the second program API, the second process will access the custom class API; the second process accessing the custom class API causes the second process to send a third request to the first process through the communication handle of the first management application, thereby enabling the first process to manage the process of untrusted applications accessing the second program's API.

[0033] A third aspect of an embodiment of the present application provides an apparatus for managing communications of untrusted applications, including:

[0034] a transceiver unit configured to obtain a first request from a second process for a first program, the first request carrying at least one request parameter, a first management application running in the first process, and an untrusted application running in the second process;

[0035] a processing unit, configured to replace the first communication handle in the at least one request parameter with the communication handle of the first management application based on the at least one request parameter including the first communication handle proxy;

[0036] The transceiver unit is used to send a second request to a target process, wherein the second request carries at least one request parameter including a communication handle of a first management application program, and the first program is running in the target process.

[0037] As an implementation method, the first request is included in the communication package; the processing unit is also used to determine the storage location information of the first communication handle in the communication package based on the storage identification bit, the storage identification bit is used to mark the starting position of the target storage area in the communication package, and the target storage area is used to store the first communication handle; the first communication handle is obtained based on the storage location information.

[0038] As an implementation, the first program is a third-party application, the first request is used to request a communication handle of the first program, the second request is used to request a communication handle of the first program, and the first communication handle is a communication handle of an untrusted application.

[0039] Correspondingly, the processing unit is also used to replace the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application, so that the second process sends the first request to the first process through the communication handle of the first management application.

[0040] As an implementation manner, the processing unit is further configured to associate the communication handle of the untrusted application with the communication handle of the first management application.

[0041] As an implementation method, the first program is a third-party application, the first request is used to access the first program, and the second request is used to access the first program; the communication handle of the first program stored in the address space of the second process is the communication handle of the first management application.

[0042] Correspondingly, the transceiver unit is further configured to receive a first request for the first program from the second process through the communication handle of the first management application.

[0043] As an implementation manner, a communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application.

[0044] Correspondingly, the transceiver unit is further configured to send a second request to the target process via the communication handle of the first program associated with the communication handle of the first management application.

[0045] As an implementation manner, the first program is a system program, the first request is used to access the first program, and the second request is used to access the first program;

[0046] The processing unit is also used to add a communication handle of the first management application and an identifier of the first program to replace the communication handle of the first program in the service manager in the address space corresponding to the second process, so that the second process sends a first request to the first process through the communication handle of the first management application, and at least one request parameter also includes the identifier of the first program.

[0047] As an implementation manner, the processing unit is further configured to query, from a service manager in an address space corresponding to the first process, a communication handle of the first program corresponding to the identifier of the first program;

[0048] The transceiver unit is further configured to send a second request to the target process through the communication handle of the first program.

[0049] As an implementation manner, the transceiver unit is further configured to receive a first response to the second request from the target process, where the first response carries at least one response parameter.

[0050] The processing unit is further configured to replace the second communication handle in the at least one response parameter with the communication handle of the first management application based on the at least one response parameter including the second communication handle.

[0051] The transceiver unit is further configured to send a second response to the first request to the second process, where the second response carries at least one response parameter including the communication handle of the first management application.

[0052] As an implementation manner, the first program is a third-party application, the first request is used to request a communication handle of the first program, the second request is used to request a communication handle of the first program, and the second communication handle is the communication handle of the first program.

[0053] Correspondingly, the processing unit is further configured to enable the first process to associate the communication handle of the first program with the communication handle of the first management application.

[0054] As an implementation method, the transceiver unit is also used for the first process to receive a third request from the second process through the communication handle of the first management application, the third request carrying the identifier of the second program and the identifier of the application program interface API of the second program; based on the identifier of the second program and the identifier of the API of the second program in the third request, access the API of the second program.

[0055] As an implementation manner, the transceiver unit is further configured to send the access result of the API of the second program to the second process through the communication handle of the untrusted application.

[0056] For the specific implementation, relevant instructions and technical effects of the above units, please refer to the description of the first aspect of the embodiment of this application.

[0057] A fourth aspect of the embodiments of the present application further provides an apparatus for managing communications of untrusted applications, including:

[0058] a processing unit, configured to query a communication handle of the first program from the service manager in the address space corresponding to the second process, to obtain the communication handle of the first management application program and an identifier of the first program, wherein the first program is a system program;

[0059] The transceiver unit is configured to send a first request to the first process via the communication handle of the first management application, wherein at least one request parameter further includes an identifier of the first program.

[0060] As an implementation method, the processing unit is also used to load a custom class in the address space of the second process through a custom class loader, the identifier of the custom class is the same as the identifier of the second program, the identifier of the application program interface API of the custom class is the same as the identifier of the API of the second program, and the API of the custom class is used to enable the second process to send a third request to the first process through the communication handle of the first management application, and the third request carries the identifier of the second program and the identifier of the API of the second program; when the second process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the API of the custom class is accessed.

[0061] The transceiver unit is further configured for the second process to send a third request to the first process via the communication handle of the first management application.

[0062] For the specific implementation, relevant instructions and technical effects of the above units, please refer to the description of the second aspect of the embodiment of this application.

[0063] The fifth aspect of an embodiment of the present application provides a terminal device, comprising: one or more processors and a memory; wherein the memory stores computer-readable instructions; the one or more processors read the computer-readable instructions to enable the computer device to implement the method described in any implementation method of the first aspect.

[0064] The sixth aspect of an embodiment of the present application provides a terminal device, comprising: one or more processors and a memory; wherein the memory stores computer-readable instructions; the one or more processors read the computer-readable instructions to enable the computer device to implement the method described in any implementation method of the second aspect.

[0065] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium, including computer-readable instructions. When the computer-readable instructions are executed on a computer, the computer executes the method described in any implementation of the first aspect or the second aspect.

[0066] In an eighth aspect, the present application provides a chip comprising one or more processors, some or all of which are configured to read and execute a computer program stored in a memory to perform the method of any possible implementation of the first or second aspect.

[0067] Optionally, the chip includes a memory, and the memory is connected to the processor via a circuit or wire. Further optionally, the chip also includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and / or information to be processed, and the processor obtains the data and / or information from the communication interface, processes the data and / or information, and outputs the processing results through the communication interface. The communication interface can be an input / output interface.

[0068] In some implementations, some of the one or more processors may implement some steps of the above method through dedicated hardware. For example, processing involving a neural network model may be implemented by a dedicated neural network processor or graphics processor.

[0069] The method provided in the embodiment of the present application can be implemented by one chip or by multiple chips working together.

[0070] A ninth aspect of the embodiments of the present application provides a computer program product, which includes computer software instructions. The computer software instructions can be loaded by a processor to implement the method described in any one of the implementation methods of the first aspect above.

[0071] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0072] The first process obtains the first request and replaces the communication handle of the untrusted application contained in the request parameters carried by the first request with the communication handle of the first management application in the first process, and then sends a second request carrying the communication handle of the first management application to the target process; in this way, the communication handle obtained by the target process is the communication handle of the first management application, not the communication handle of the untrusted application, so the target process can only communicate with the first process through the communication handle of the first management application, and cannot communicate with the second process through the communication handle of the untrusted application, thereby preventing the target process from communicating directly with the second process, causing the first process to be unable to play a management role, thereby reducing the risk of privacy data leakage, operating system abnormality, etc. caused by the operation of untrusted applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 A schematic diagram of the system architecture in an embodiment of the present application;

[0074] Figure 2 This is a schematic diagram of the Binder mechanism;

[0075] Figure 3 This is a schematic diagram of the framework corresponding to the method in the embodiment of the present application;

[0076] Figure 4A schematic diagram of an embodiment of a method for managing communication of untrusted applications in an embodiment of the present application;

[0077] Figure 5 This is a schematic diagram of another embodiment of the method for managing untrusted application communication in an embodiment of the present application;

[0078] Figure 6 This is a schematic diagram of the first application example in the embodiments of the present application;

[0079] Figure 7 This is a schematic diagram of a second application example in the embodiments of the present application;

[0080] Figure 8 A schematic diagram of an embodiment of a device for managing communications of untrusted applications in an embodiment of the present application;

[0081] Figure 9 This is a schematic diagram of another embodiment of an apparatus for managing communications of untrusted applications in an embodiment of the present application;

[0082] Figure 10 This is a schematic diagram of an embodiment of a terminal device in an embodiment of the present application. DETAILED DESCRIPTION

[0083] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present application, rather than all the embodiments. Those skilled in the art will appreciate that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0084] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or that are inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time or logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can be changed in the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0085] The embodiments of the present application can be applied to Figure 1In the system architecture shown in Figure 1 As shown, the system is located in the Android environment, which specifically includes isolated processes, host processes, third-party applications and Android system programs.

[0086] A process is the running entity of a program. A program is a description of instructions, data, and their organization; a process is the running entity of a program. A process can contain multiple threads, each executing different tasks in parallel. While a thread can be the actual operating unit of a process, the embodiments of this application do not make a clear distinction between threads and processes; the term "process" will be used throughout the description.

[0087] An isolated process is a special process in the Android system that is “without permission”. Applications running in an isolated process cannot communicate with the outside world (including Figure 1 The Android system programs and third-party applications shown in the figure cannot communicate directly with each other, and can only communicate with the external environment through the host process, thus providing a sandbox environment for applications. Sandbox, also known as sandbox, refers to a security mechanism that provides an isolated environment for running applications.

[0088] The host process is a regular process in the Android system, used to establish a connection with the isolated process, manage and proxy the communication between the isolated process and the external environment.

[0089] Android system programs refer to the system that controls and coordinates Android devices and external devices, supports the development and operation of application software, and is a collection of various programs that do not require user intervention.

[0090] Third-party applications correspond to system software. They are a collection of various programming languages ​​that users can use, as well as programs compiled in various programming languages. They are divided into application software packages and user programs.

[0091] To reduce the risk of running untested or untrusted applications (hereinafter referred to as untrusted applications), you can run untrusted applications on Figure 1 In the isolated process shown, the first management application is run in Figure 1 In the host process shown in FIG. , the host process establishes a connection with the isolated process. After that, the host process receives all external access requests from the isolated process and then performs security checks on the access requests.

[0092] For access requests that meet security verification requirements, the host process will proxy the access request to the untrusted application in the isolated process and pass the access result back to the untrusted application in the isolated process. For access requests that do not meet security verification requirements, the host process will terminate the access request. In this way, the host process can manage and proxy the communication between the isolated process and the external environment.

[0093] It should be understood that both Android system programs and third-party applications run in corresponding processes. Therefore, the communication process between untrusted applications and the external environment belongs to inter-process communication (IPC).

[0094] IPC can be implemented in many ways. For example, two processes can communicate through a communication handle, which is also called an inter-process communication handle.

[0095] In the Android system, this communication handle can be an Ibinder. When the communication handle is an Ibinder, the two processes communicate using the Binder mechanism. The following uses Program A and Program B as examples to explain the Binder mechanism. Program A can be an Android system program or a third-party application; similarly, Program B can be an Android system program or a third-party application.

[0096] like Figure 2 As shown, program A can apply to the Binder driver to create a Binder in the process where program A is located. The Binder can also be called a Binder entity or a local object. Similarly, program B can apply to the Binder driver to create a Binder in the process where program B is located. The Binder can also be called a Binder entity or a local object.

[0097] If programs A and B want to communicate using the Binder mechanism, they must first establish a Binder connection. Establishing a Binder connection means that program A obtains the IBinder of program B, and program B obtains the IBinder of program A. The IBinder can also be called an IBinder reference, a remote object, or a Binder proxy. For ease of description, the term "Binder proxy" is used here instead of "IBinder."

[0098] Among them, IBinder defines a basic interface for remotely callable objects, which describes an abstract protocol for interacting with remotely callable objects; Binder is the base class of remotely callable objects and the implementation class of IBinder, providing a standard local implementation of objects such as IBinder.

[0099] When program A initiates access to program B, program A can initiate access to program B through program B's Binder agent. The access process can be understood as follows: program A sends an access request to the Binder driver through program B's Binder agent. The Binder driver processes the access request and allocates two buffers. One buffer is used to write the parameters in the access request, and program B can read the parameters of the access request from the buffer; the other buffer is used to write the parameters in the access response from program B, and program A can read the parameters of the access response from the buffer.

[0100] Similarly, when program B initiates access to program A, program B can initiate access to program A through program A's Binder agent. The access process can be understood by referring to the above process of program A accessing program B.

[0101] Based on the above description, any two programs that can communicate through the Binder mechanism can communicate with each other directly through the Binder proxy after obtaining the Binder proxies of both parties.

[0102] Then, for an untrusted application, if the untrusted application obtains the Binder proxy of other programs except the first management application in the host process, the untrusted application can directly communicate with other programs through the Binder proxy, which means that the host process cannot manage the communication behavior of the isolated process, thereby increasing the risk caused by the operation of the untrusted application.

[0103] To this end, an embodiment of the present application provides a method that enables the host process to obtain a request from the isolated process and replace the Binder proxy in the request during the process of proxying the isolated process to access; the method also enables the host process to obtain the response sent to the isolated process and replace the Binder proxy in the request to prevent the isolated process from obtaining the Binder proxy of other applications, thereby reducing the risks caused by the running of untrusted applications.

[0104] Before introducing the method provided in the embodiments of the present application, other professional terms involved in the embodiments of the present application are first explained.

[0105] Parcel is a message container. Messages packaged in this message container (including data and object references) can be delivered through the IBinder mechanism.

[0106] Hook technology is a series of computer programming technologies that change or enhance the behavior of the operating system, application or other software components by intercepting function calls, messages or events passed between software components.

[0107] The Service Manager is an important class in the Android system. It is used to manage all Android system programs and maintain Binder communication between Android system programs and third-party applications.

[0108] The application management service (ActivityManagerService), also known as the job management application, is the core service of the Android system component. It is responsible for the startup, switching, scheduling, process management and scheduling of the four major components (Activity, Service, BroadcastReceiver, ContentProvider) in the system.

[0109] PackageManagerService: The core service of the Android system component, responsible for all Package-related tasks, such as application installation and uninstallation.

[0110] The method provided in the embodiments of the present application is introduced below.

[0111] For ease of understanding, the method provided in the embodiment of the present application is described below using the Android system as an example, and the Binder mechanism is used as a method of inter-process communication. Accordingly, the Binder agent is used instead of the communication handle.

[0112] It should be noted that the system to which the method provided in the embodiment of the present application is applied is not limited to the Android system.

[0113] In addition, the method provided in the embodiment of the present application is applied to the target process, the first process and the second process, wherein the first process is a process for managing communications of untrusted applications, the second process is a process for running untrusted applications, and the target process is a process for running the first program; for ease of explanation, the host process is used below to replace the first process, and the isolated process is used to replace the second process.

[0114] See also Figure 3 , Figure 3 A schematic diagram of the framework corresponding to the method provided in the embodiment of the present application is shown.

[0115] like Figure 3 As shown, in the Android system environment, a client accesses an untrusted application, and the client can be a client corresponding to any third-party application.

[0116] The process of a client accessing an untrusted application may include a process of loading the untrusted application, a process of managing the lifecycle of the untrusted application, and a process of running the untrusted application.

[0117] The untrusted application loading process is as follows.

[0118] First, the client launches the host process, which runs the first management application. The host process then launches the isolated process, which loads the second management application. The first management application then establishes a connection with the second management application through the Binder mechanism. This means the first management application obtains the second management application's Binder proxy, and the second management application obtains the first management application's Binder proxy. The first management application then loads the untrusted application into the isolated process through the second management application. Since the client accesses the untrusted application, loading the untrusted application is considered dynamic loading.

[0119] The process of loading an untrusted application into an isolated process may include: loading the untrusted application into the isolated process from the storage path of the untrusted application through a custom class loader, wherein the custom class loader may adopt an overriding loadClass method or a findClass method.

[0120] Loading untrusted applications in the above way can solve the problem that untrusted applications in isolated processes cannot be managed and installed by the Android system's PackageManagerService.

[0121] It should be noted that the client is unaware of whether the untrusted application is running in the sandbox environment provided by the isolated process.

[0122] The lifecycle management process of untrusted applications is as follows.

[0123] Considering that the untrusted application is not registered in the application management service of the Android system, the host process cannot directly manage the life cycle of the untrusted application. Therefore, in an embodiment of the present application, a service pile is created by the application management service. This service pile can be regarded as an application. There is a corresponding relationship between the function of the life cycle of the service pile and the function of the life cycle of the untrusted application. In this way, the host process can realize the management of the life cycle of the untrusted application by managing the life cycle of the service pile.

[0124] After the above two processes are completed, the untrusted application can be run. During the running of the untrusted application, the method provided in the embodiment of the present application can be used to manage the communication behavior of the untrusted application. Figure 4 The present application provides a method for managing untrusted application communications, including:

[0125] In step 101, the host process obtains a first request for a first program from the isolated process. The first request carries at least one request parameter. A first management application is running in the host process, and an untrusted application is running in the isolated process.

[0126] The first program serves as the request object of the first request, and the request object may be an Android system program or a third-party application program.

[0127] The type of the first request is related to the first program.

[0128] Specifically, when the first program is an Android system program, the first request is usually an access request to the Android system program.

[0129] When the first program is a third-party application, the first request can be a request to access the third application or a request to establish a Binder connection with the first program; when the first request is a request to establish a Binder connection with the first program, the first request is used to request the Binder agent of the first program.

[0130] The first request can be transmitted in a variety of forms, which are not specifically limited in the embodiments of the present application. For example, the first request can be packaged to obtain a communication package containing the first request, thereby transmitting the first request by transmitting the communication package. The communication package can also be called a cross-process communication package, which can be specifically a Parcel object. The Parcel object can be regarded as a serialization method. Accordingly, the first request obtained by the host process is contained in the Parcel object.

[0131] The type and quantity of the request parameters in the first request are related to the type of the first request. The embodiment of the present application does not specifically limit the type and quantity of the request parameters in the first request.

[0132] Based on the above description, it can be seen that there can be multiple types of first programs and multiple types of first requests, and the scenario in which the host process obtains the first request is related to the type of the first program and the type of the first request. Therefore, there can be multiple scenarios in which the host process obtains the first request. The scenario in which the host process obtains the first request will be specifically introduced below.

[0133] In step 102, the host process determines the storage location information of the first Binder proxy in the communication package based on the storage identification bit, where the storage identification bit is used to mark the starting position of the target storage area in the communication package, and the target storage area is used to store the first Binder proxy.

[0134] Based on the relevant description of step 101 , it can be known that the first request may be included in a communication package. In this case, the first Binder proxy may be obtained from the first request through steps 102 and 103 .

[0135] It should be understood that a Binder proxy is typically stored in a fixed target storage area within a communication package. The starting location of this target storage area is identified by a storage identifier, which can be stored in the native layer. Therefore, the host process can determine the storage location information of the first Binder proxy within the communication package based on this storage identifier.

[0136] Specifically, starting from the position identified by the storage identification bit, the target storage area is traversed at intervals of four bytes to search for the storage location information of the first Binder agent in the communication package.

[0137] Step 103: The host process obtains a first Binder proxy based on the storage location information.

[0138] After searching for the storage location information of the first Binder proxy in the communication package, the host process can read the first Binder proxy from the communication package based on the storage location information.

[0139] It should be noted that steps 102 and 103 are executed after step 101 and before step 104; and, only when the first request is included in the communication package can the first Binder proxy be obtained through steps 102 and 103, so steps 102 and 103 are optional.

[0140] Step 104: The host process replaces the first Binder proxy in at least one request parameter with the Binder proxy of the first management application.

[0141] In actual implementation, the first binder agent and the binder agent of the first management application are different, so the replacement operation can be performed directly, but a judgment step can also be added before step 104, and the replacement is performed when it is judged that the two are different.

[0142] Based on the relevant description of the Binder mechanism, it can be seen that if the isolated process obtains the Binder agent of other programs except the first management application, the isolated process can directly communicate with other processes through the Binder agent of other programs; similarly, if the target process where the first program is located obtains the Binder agent of an untrusted application, the target process can also communicate directly with the isolated process through the Binder agent of the untrusted application.

[0143] Therefore, in an embodiment of the present application, the host process replaces the first Binder proxy in the first request; specifically, the host process replaces the first Binder proxy with the Binder proxy of the first management application, so that the target process where the first program is located can only obtain the Binder proxy of the first management application.

[0144] When the first request is included in the communication package, the process of the host process replacing the first Binder proxy with the Binder proxy of the first management application may include: replacing the first Binder proxy in the storage location indicated by the storage location information in step 103 with the Binder proxy of the first management application; since the communication package can also be a Parcel object, Figure 3 As shown, this process can also be called Parcel object semantic replacement.

[0145] It should be noted that the first Binder agent can be a Binder agent of an untrusted application, or a Binder agent of other programs except the Binder agent of the untrusted application and the Binder agent of the first management application. The embodiment of the present application does not make specific limitations on this.

[0146] Step 105: The host process sends a second request for the first program to the target process. The second request carries at least one request parameter of the Binder agent containing the first management application. The first program is running in the target process.

[0147] It is understandable that the role of the host process is to proxy the isolated process to access the target process, so except for the Binder proxy, the parameters in the second request are the same as those in the first request.

[0148] In an embodiment of the present application, the host process obtains a first request, and replaces the Binder proxy of the untrusted application contained in the request parameters carried by the first request with the Binder proxy of the first management application in the host process, and then sends a second request carrying the Binder proxy of the first management application to the target process; in this way, the Binder proxy obtained by the target process is the Binder proxy of the first management application, not the Binder proxy of the untrusted application, so the target process can only communicate with the host process through the Binder proxy of the first management application, and cannot communicate with the isolated process through the Binder proxy of the untrusted application, thereby preventing the target process from communicating directly with the isolated process, causing the host process to be unable to play a management role, thereby reducing the risk of privacy data leakage, operating system abnormality, etc. caused by the operation of untrusted applications.

[0149] Step 106: The host process receives a first response to the second request from the target process, where the first response carries at least one response parameter.

[0150] It is understandable that after executing step 105, the target process may send a first response corresponding to the second request to the host process, and accordingly, the host process will receive the response.

[0151] Based on the relevant description of step 101, it can be known that there can be multiple types of first requests, and the type of first response corresponds to the type of the first request, so there can also be multiple types of first responses. Please refer to the relevant description of the first request for details.

[0152] The response parameters are related to the request parameters in the first request. Similar to the request parameters, the embodiment of the present application does not specifically limit the type and quantity of the response parameters.

[0153] Step 107: The host process replaces the second Binder proxy in at least one response parameter with the Binder proxy of the first management application.

[0154] Based on the relevant instructions of step 104, it can be seen that the request parameters in the first request may include a first Binder proxy that is different from the Binder proxy of the first management application. Similarly, the response parameters may also include a second Binder proxy that is different from the Binder proxy of the first management application. When the response parameters include a second Binder proxy that is different from the Binder proxy of the first management application, the host process will replace the second Binder proxy with the Binder proxy of the first management application.

[0155] Among them, the second Binder agent can be the Binder agent of the first program, or it can be the Binder agent of other programs except the Binder agent of the first program and the Binder agent of the host process. This embodiment of the present application does not specifically limit this.

[0156] For example, the first program is program C, and the second Binder agent can be the Binder agent of program C or the Binder agent of program D. That is, the response parameter can instruct the isolated process to access the process where program D is located through the Binder agent of program D.

[0157] Step 108: The host process sends a second response to the first request to the isolated process, where the second response carries at least one response parameter of the Binder agent containing the first management application.

[0158] The relationship between the second response and the first response is similar to the relationship between the second request and the first request. For details, please refer to the relevant descriptions of the second request and the first request mentioned above.

[0159] It should be noted that for a certain type of second request, the target process may not send a first response to the host process, and accordingly, the host process will not send a second response to the isolated process; for example, if the first request is used to request the first program to play audio, and similarly, the second request is also used to request the first program to play audio, then after receiving the second request, the target process will perform the operation of playing audio and will not send a first response to the host process.

[0160] Therefore, steps 106 to 108 are optional and applicable to a scenario where the target process sends a second response to the host process.

[0161] In an embodiment of the present application, the host process obtains a second response from the target process, replaces the second Binder proxy in the response parameters carried by the second response with the Binder proxy of the first management application, and then sends the Binder proxy carrying the first management application to the isolated process; in this way, the isolated process can only receive the Binder proxy of the first management application, and will not receive the second Binder proxy that is different from the Binder proxy of the first management application, so as to avoid the isolation process directly communicating with other processes outside the host process through the second Binder proxy, causing the host process to be unable to play a management role, thereby reducing the risk of privacy data leakage, operating system abnormality, etc. caused by the operation of untrusted applications.

[0162] Based on the foregoing description, there are multiple scenarios in which the host process obtains the first request. The following describes three scenarios in which the host process obtains the first request.

[0163] The first scenario in which the host process obtains the first request: the isolated process sends the first request to request to establish a Binder connection with the target process.

[0164] Accordingly, the first program is a third-party application, the first request is used to request the Binder agent of the first program, the second request is used to request the Binder agent of the first program, and the first Binder agent is a Binder agent of an untrusted application.

[0165] It should be understood that in the Android system, the application management service is used for inter-process management, so when the isolated process needs to communicate with other processes, it needs to communicate with other processes through the application management service; that is, when the isolated process needs to send a first request to the target process, it needs to first send the first request to the application management service, and then the application management service forwards the first request to the target process where the first program is located.

[0166] In the embodiment of the present application, in order to implement the host process's management of isolated process communications, before step 101, the method may further include:

[0167] The host process replaces the Binder agent of the application management service in the address space corresponding to the isolation process with the Binder agent of the first management application, so that the isolation process sends the first request to the host process through the Binder agent of the first management application.

[0168] In an embodiment of the present application, since the host process replaces the Binder proxy of the application management service in the address space corresponding to the isolation process with the Binder proxy of the first management application, the isolation process will use the Binder proxy of the first management application as the Binder proxy of the application management service; in this way, when the isolation process wants to send a first request to the target process where the first program is located, the isolation process will send the first request to the host process through the Binder proxy of the first management application. Accordingly, step 101 may specifically include: the host process receives the first request from the isolation process through the Binder proxy of the first management application.

[0169] It should be understood that since the first request is used to request to establish a Binder connection with the target process, the request parameters in the first request will carry the Binder proxy of the untrusted application, so that the target process can obtain the Binder proxy of the untrusted application; the second response will also carry the Binder proxy of the first program, so that the isolated process can obtain the Binder proxy of the first program, thereby realizing the Binder connection between the isolated process and the target process.

[0170] In the embodiment of the present application, the second request sent by the host process to the target process carries the host process's Binder proxy, and the second response sent by the host process to the isolated process also carries the host process's Binder proxy. Therefore, what is actually established is a Binder connection between the isolated process and the host process, and a Binder connection between the host process and the target process. From then on, communication between the target process and the isolated process must rely on the host process.

[0171] However, the host process can have multiple Binder proxies and can establish Binder connections with processes other than the target process and the isolated process. Therefore, when the target process sends an access request for an untrusted application to the host process through the host process's Binder proxy, the host process must first determine the untrusted application's Binder proxy based on the target process's Binder proxy before forwarding the access request to the isolated process through the untrusted application's Binder proxy.

[0172] Therefore, after step 101 , the method may further include: the host process associating the Binder proxy of the untrusted application with the Binder proxy of the first management application.

[0173] In this way, the host process can determine the Binder proxy of the untrusted application that the access request needs to access based on the association relationship between the Binder proxy of the untrusted application and the Binder proxy of the first management application.

[0174] Similarly, when the isolated process sends an access request to the first program to the host process through the host process's Binder agent, the host process needs to first determine the Binder agent of the first program based on the Binder agent used by the target process, and then forward the access request to the target process through the Binder agent of the first program.

[0175] Therefore, after step 106, the method further includes:

[0176] The host process associates the Binder proxy of the first program with the Binder proxy of the first management application.

[0177] In this way, the host process can determine the Binder proxy of the first program that the access request needs to access based on the association relationship between the Binder proxy of the first program and the Binder proxy of the first management application.

[0178] The above process is described below with a specific example.

[0179] For example, the host process has Binder proxy 1 and Binder proxy 2. During the process of establishing a Binder connection, the host process replaces both the Binder proxy of the untrusted application and the Binder proxy of the first program with Binder proxy 1. That is, the second request carries Binder proxy 1, and the second response also carries Binder proxy 1. Therefore, the host process establishes a Binder connection with the target process and the isolated process respectively through Binder proxy 1. In addition, the host process also establishes a Binder connection with another third-party application through Binder proxy 2.

[0180] When the isolated process sends an access request for the first program to the host process through Binder agent 1, the host process can determine to forward the access request through the Binder agent of the first program instead of forwarding the access request through the Binder agent of another third-party application through the association relationship between Binder agent 1 and the Binder agent of the first program.

[0181] Similarly, when the target process sends an access request for an untrusted application to the host process through Binder proxy 1, the host process can determine to forward the access request through the Binder proxy of the untrusted application instead of forwarding the access request through the Binder proxy of another third-party application based on the association relationship between Binder proxy 1 and the Binder proxy of the untrusted application.

[0182] In the first scenario, if Figure 3 As shown, through request transfer, the first request that should be sent to the application management service is transferred to the host process, and then the host process completes the IPC transfer. The IPC transfer can be understood as the host process sending a second request to the third-party application.

[0183] In an embodiment of the present application, the host process replaces the Binder agent of the application management service in the address space corresponding to the isolated process with the Binder agent of the first management application, so the host process will receive a first request from the isolated process to establish a Binder connection; thereafter, the host process sends a second request to establish a Binder connection to the target process, and finally establishes a Binder connection between the isolated process and the host process, and also establishes a Binder connection between the host process and the target process, thereby realizing the host process's management of the process of establishing a Binder connection between the isolated process and the target process.

[0184] A second scenario in which the host process obtains the first request: the isolated process sends the first request to request access to the third-party application.

[0185] Correspondingly, the first program is a third-party application, the first request is used to access the first program, the second request is used to access the first program, and the Binder agent of the first program stored in the address space of the isolation process is the Binder agent of the first management application.

[0186] The second scenario refers to that the host process establishes a Binder connection with the isolated process, and after the host process establishes a Binder connection with the target process, the isolated process sends a first request to access the first program.

[0187] Therefore, in the second scenario, the isolation process obtains the Binder proxy of the first management application, that is, the Binder proxy of the first management application is stored in the address space of the isolation process, and the isolation process will use the Binder proxy of the first management application as the Binder proxy of the first program.

[0188] Based on this, when the isolation process needs to send a first request to the first program through the Binder mechanism, the isolation process will send the first request through the Binder agent of the first management application.

[0189] Accordingly, the host process obtaining the first request for the first program from the isolated process may include:

[0190] The host process receives a first request for a first program from the isolated process through a Binder agent of the first management application.

[0191] In the second scenario, the target process obtains the Binder proxy of the first management application, and based on the relevant description of the first scenario, the host process associates the Binder proxy of the first program with the Binder proxy of the first management application.

[0192] Therefore, as an implementation manner, the Binder proxy of the first program is stored in the address space of the host process, and the Binder proxy of the first program is associated with the Binder proxy of the first management application.

[0193] Accordingly, the host process sends a second request for the first program to the target process, including:

[0194] The host process sends a second request to the target process through the Binder agent of the first program associated with the Binder agent of the first management application.

[0195] It can be understood that the host process determines the Binder proxy of the first program associated with the Binder proxy of the first management application based on the association relationship between the Binder proxy of the first program and the Binder proxy of the first management application, and then sends the second request through the Binder proxy of the first program associated with the Binder proxy of the first management application.

[0196] In the second scenario, if Figure 3 As shown, through request transfer, the first request that should be sent to the application management service is transferred to the host process, and then the host process completes the IPC transfer. The IPC transfer can be understood as the host process sending a second request to the third-party application.

[0197] In an embodiment of the present application, the Binder agent of the first program stored in the address space of the isolation process is the Binder agent of the first management application. The isolation process sends a request to access the first program through the Binder agent of the first management application. After receiving the first request, the host process uses the isolation process to access the first program in the target process, thereby enabling the host process to manage the process of untrusted applications accessing third-party applications.

[0198] The third scenario in which the host process obtains the first request: the isolated process sends the first request to request access to the Android system program.

[0199] Accordingly, the first program is a system program, which refers to an Android system program, and specifically may include a clipboard program, a mobile hotspot WIFI, and other system programs; the first request is used to access the first program, and the second request is used to access the first program.

[0200] Different from the first and second scenarios, in the third scenario, the first program is a system program, that is, the isolated process sends a first request to access the system program.

[0201] Based on the above description, it can be seen that in the Android system, the service manager is used to manage all Android system programs and maintain Binder communication between Android system programs and third-party applications. Each process can have its own service manager. Specifically, the service manager stores the Binder proxies of Android system programs. Both third-party applications and untrusted applications can query the Binder proxies of each Android system program from the service manager.

[0202] Taking an untrusted application as an example, after the untrusted application queries the Binder proxy of the system program from the service manager, it can directly communicate with the system program through the Binder proxy of the system program.

[0203] In the embodiment of the present application, in order to implement the host process's management of isolated process communications, before step 101, the method further includes:

[0204] The host process adds a Binder agent of the first management application and the identifier of the first program to the service manager in the address space corresponding to the isolated process, which is used to replace the Binder agent of the first program, so that the isolated process sends a first request to the host process through the Binder agent of the first management application, and at least one request parameter also includes the identifier of the first program.

[0205] It is understandable that since the isolated process is a special "unauthorized" process, in order to prevent untrusted applications from obtaining the Binder agent of the system program from the service manager in the address space corresponding to the isolated process, the service manager in the address space corresponding to the isolated process usually does not store any Binder agent of the system program. In an embodiment of the present application, the host process adds the Binder agent of the first management application and the first degree of identification in the service manager in the address space corresponding to the isolated process, so that the isolated process uses the Binder agent of the first management application as the Binder agent of the first program.

[0206] The Binder proxy of the first management application and the identifier of the first program can be regarded as the packaged Binder proxy of the first management application, that is, the Binder proxy of the packaged first management application is used to replace the Binder proxy of the first program.

[0207] Specifically, the host process can add multiple packaged Binder proxies of the first management application to the service manager to replace the Binder proxies of all Android system programs, thereby achieving the purpose of replacing the Binder proxies of the first program with the Binder proxies of the packaged first management application; it should be noted that since the identification of each Android system program is different, the identification of the Android system program is different in the Binder proxies of the packaged first management application corresponding to different Android system programs.

[0208] Since the first program is an Android system program, the host process usually adds the Binder agent of the first management application and the identifier of the first program in the process of starting the isolation process (which can be understood as isolation process initialization).

[0209] Based on this, when the isolated process needs to access the first program, the isolated process queries the Binder agent of the first program from the service manager in the address space corresponding to the isolated process, obtains the Binder agent of the first management application and the identifier of the first program, and the first program is a system program;

[0210] The isolated process sends a first request to the host process through the Binder agent of the first management application, and at least one request parameter also includes an identifier of the first program.

[0211] Accordingly, step 101 includes: the host process receives a first request for a first program from the isolation process through a Binder agent of the host process, where a request parameter in the first request includes an identifier of the first program.

[0212] It is understandable that after obtaining the identifier of the first program, the host process can query the Binder agent of the first program from the service manager, and then send the second request through the Binder agent of the first program.

[0213] As an implementation manner, after step 101 and before step 102, the method further includes:

[0214] The host process queries the service manager in the address space corresponding to the host process for a Binder agent of the first program corresponding to the identifier of the first program.

[0215] Accordingly, the host process sends the second request to the target process including:

[0216] The host process sends a second request to the target process through the Binder agent of the first program.

[0217] In the third scenario, if Figure 3 As shown, through request transfer, the first request that should be sent to the target process is transferred to the host process, and then the host process completes the IPC transfer. The IPC transfer can be understood as the host process sending a second request to the Android system program.

[0218] In an embodiment of the present application, the host process adds a Binder agent of the first management application and the identifier of the first program to the service manager in the address space corresponding to the isolated process, so that the isolated process sends a first request to the host process through the Binder agent of the first management application. In this way, the host process can proxy the isolated process to access the first program in the target process, thereby realizing the host process's management of the untrusted application's access to the system program; wherein, when the first program is a system program, the way in which the host process proxies the isolated process to access the first program can also be called a stub agent.

[0219] In each of the above embodiments, the host process manages the communication between the isolated process and the first process via the Binder mechanism. Based on the foregoing description, it is clear that the isolated process can also communicate with the first process by directly accessing the API. Therefore, the following describes how the host process manages the communication between the isolated process and the first process via API access.

[0220] Based on the above embodiments, the present application also provides another embodiment of a method for managing untrusted application communication, such as Figure 5 As shown, this embodiment includes:

[0221] In step 201, the isolated process loads a custom class in the address space of the isolated process through a custom class loader. The identifier of the custom class is the same as the identifier of the second program, and the identifier of the API of the custom class is the same as the identifier of the API of the second program. The API of the custom class is used to enable the isolated process to send a third request to the host process through the Binder agent of the first management application. The third request carries the identifier of the second program and the identifier of the API of the second program.

[0222] Among them, the custom class can be regarded as a class object. In the Android system, any functional component such as the application management service and service manager is also a class object.

[0223] Since the identifier of the custom class is the same as the identifier of the second program, when the isolated process accesses the second program, the isolated process will access the custom class; and since the identifier of the custom class API is the same as the identifier of the second program API, when the isolated process accesses the second program API, the isolated process will access the custom class API.

[0224] Since the custom class is customized by the user according to needs, the user can set the API of the custom class so that the isolation process sends the third request to the host process through the Binder agent of the first management application.

[0225] Step 202: When the isolated process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the isolated process accesses the API of the custom class.

[0226] Based on the relevant description of step 201, it can be known that when the isolated process accesses the API of the second program, the isolated process will access the API of the custom class.

[0227] Step 203: The isolation process sends a third request to the host process through the Binder agent of the first management application.

[0228] Based on the relevant description of step 201, it can be seen that since the API of the custom class enables the isolation process to send a third request to the host process through the Binder agent of the first management application, the isolation process accessing the API of the custom class will prompt the isolation process to send a third request through the Binder agent of the first management application.

[0229] Correspondingly, the host process receives a third request from the isolated process through the Binder agent of the first management application, where the third request carries the identifier of the second program and the identifier of the API of the second program.

[0230] Step 204: The host process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program in the third request.

[0231] It is understandable that after receiving the third request, the host process will access the API of the second program based on the identifier of the second program and the identifier of the API of the second program, that is, the host process proxy isolates the process to access the API of the second program.

[0232] In step 205 , the host process sends the access result of the API of the second program to the isolated process through the Binder agent of the untrusted application.

[0233] After the host process obtains the access result of the API of the second program, the host process can use the Binder mechanism to send the access result of the API of the second program to the isolated process.

[0234] In the embodiment of the present application, the system program represented by the second program is different from the system program represented by the first program in the third scenario in the aforementioned embodiment. The second program mainly refers to the system program whose Binder proxy is not stored in the service manager, and the system program represented by the first program in the third scenario refers to the system program whose Binder proxy is stored in the service manager; specifically, the Binder proxy of the system program represented by the first program in the third scenario will be stored in the service manager, and the system program represented by the second program may also have a Binder proxy, but the Binder proxy will not be stored in the service manager. Therefore, the Binder proxy of the system program represented by the second program cannot be queried through the service manager, and the second program can only be accessed through the API of the second program.

[0235] The system program represented by the second program may be an alarm service AlarmManager, an audio manager AudioManager, and the like.

[0236] In order to better understand the method provided in the embodiments of the present application, two specific application examples are provided below.

[0237] The first application example is as follows.

[0238] like Figure 6 As shown, the client needs to use the context awareness service Awareness Kit to register the time fence DuringTimePeriod. When the device is within the preset time period, the status of the time fence is True.

[0239] Specifically, the client launches the host process, the host process launches the isolation process, the isolation process loads the context-aware service (ie, an untrusted application), and the host process establishes a service stub bound to the context-aware service.

[0240] When the context-aware service performs logic processing for time fences, it needs to access the AlarmManager in the system program. At this time, based on the custom class with the same identifier as the AlarmManager loaded in the isolated process, the isolated process will send a request to the host process to access the AlarmManager API when accessing the AlarmManager API. For details, please refer to Figure 5 Relevant description of the embodiment shown; after receiving the request of the AlarmManager API, the host process will access the AlarmManager API and send the access result to the isolated process, that is, complete the IPC transfer.

[0241] Finally, the context-aware service in the isolated process returns the time-fence response result to the client through the host process.

[0242] The second application example is as follows.

[0243] like Figure 7 As shown, the client needs to use the GetBehaviorStatus function of the Awareness Kit's activity recognition snapshot function, which is used to query the device's current motion status information, such as walking, running, etc.

[0244] Specifically, the client launches the host process, the host process launches the isolation process, the isolation process loads the context-aware service (ie, an untrusted application), and the host process establishes a service stub bound to the context-aware service.

[0245] When the context-aware service performs logical processing of activity identification snapshots, it needs to access the MSDP service. At this time, the isolated process will first establish a Binder connection with the process where the MSDP service is located through the host process. The process of establishing the Binder connection can refer to the relevant description of the first scenario in the aforementioned embodiment. After the Binder connection is established, the isolated process can access the MSDP service through the host process and send the access result to the isolated process, thus completing the IPC transfer.

[0246] Finally, the context-aware service in the isolated process returns the device's operating status information queried by the activity recognition snapshot to the client through the host process.

[0247] The embodiment of the present application does not require obtaining the root permission of the Android system, does not require modifying the application framework layer of the Android system and the source code of the untrusted application, constructs a permission-controlled operating environment for the untrusted application, and realizes effective management of all communication behaviors of the untrusted application; and, after a large number of tests, the response time of the untrusted application running in the isolated process is not much different from the response time of the untrusted application running in the non-isolated process, so the embodiment of the present application can ensure that the operation of this untrusted application has higher performance efficiency.

[0248] like Figure 8 As shown, the embodiment of the present application also provides an embodiment of a device for managing communication of untrusted applications, including:

[0249] The transceiver unit 301 is configured to obtain a first request from a second process for a first application, the first request carrying at least one request parameter, the first management application running in the first process, and the untrusted application running in the second process;

[0250] The processing unit 302 is configured to replace the first communication handle in the at least one request parameter with the communication handle of the first management application;

[0251] The transceiver unit 301 is configured to send a second request to a target process, where the second request carries at least one request parameter including a communication handle of a first management application program, and a first program is running in the target process.

[0252] As an implementation method, the first request is included in the communication package; the processing unit 302 is also used to determine the storage location information of the first communication handle in the communication package based on the storage identification bit, the storage identification bit is used to mark the starting position of the target storage area in the communication package, and the target storage area is used to store the first communication handle; the first communication handle is obtained based on the storage location information.

[0253] As an implementation, the first program is a third-party application, the first request is used to request a communication handle of the first program, the second request is used to request a communication handle of the first program, and the first communication handle is a communication handle of an untrusted application.

[0254] Correspondingly, the processing unit 302 is also used to replace the communication handle of the job application management service in the address space corresponding to the second process with the communication handle of the first management application, so that the second process sends the first request to the first process through the communication handle of the first management application.

[0255] As an implementation manner, the processing unit 302 is further configured to associate the communication handle of the untrusted application with the communication handle of the first management application.

[0256] As an implementation method, the first program is a third-party application, the first request is used to access the first program, and the second request is used to access the first program; the communication handle of the first program stored in the address space of the second process is the communication handle of the first management application.

[0257] Correspondingly, the transceiver unit 301 is further configured to receive a first request for the first program from the second process through the communication handle of the first management application.

[0258] As an implementation manner, a communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application.

[0259] Correspondingly, the transceiver unit 301 is further configured to send a second request to the target process through the communication handle of the first program associated with the communication handle of the first management application.

[0260] As an implementation manner, the first program is a system program, the first request is used to access the first program, and the second request is used to access the first program;

[0261] The processing unit 302 is also used to add the communication handle of the first management application and the identifier of the first program to replace the communication handle of the first program in the service manager in the address space corresponding to the second process, so that the second process sends a first request to the first process through the communication handle of the first management application, and at least one request parameter also includes the identifier of the first program.

[0262] As an implementation manner, the processing unit 302 is further configured to query, from a service manager in an address space corresponding to the first process, a communication handle of the first program corresponding to the identifier of the first program;

[0263] The transceiver unit 301 is further configured to send a second request to the target process through the communication handle of the first program.

[0264] As an implementation manner, the transceiver unit 301 is further configured to receive a first response to the second request from the target process, where the first response carries at least one response parameter.

[0265] The processing unit 302 is further configured to replace the second communication handle in the at least one response parameter with the communication handle of the first management application.

[0266] The transceiver unit 301 is further configured to send a second response to the first request to the second process, where the second response carries at least one response parameter including the communication handle of the first management application.

[0267] As an implementation manner, the first program is a third-party application, the first request is used to request a communication handle of the first program, the second request is used to request a communication handle of the first program, and the second communication handle is the communication handle of the first program.

[0268] Correspondingly, the processing unit 302 is further configured to enable the first process to associate the communication handle of the first program with the communication handle of the first management application program.

[0269] As an implementation method, the transceiver unit 301 is also used for the first process to receive a third request from the second process through the communication handle of the first management application, the third request carrying the identifier of the second program and the identifier of the application program interface API of the second program; based on the identifier of the second program and the identifier of the API of the second program in the third request, access the API of the second program.

[0270] As an implementation manner, the transceiver unit 301 is further configured to send the access result of the API of the second program to the second process through the communication handle of the untrusted application.

[0271] For the specific implementation, relevant instructions and technical effects of the above units, please refer to the description of the first aspect of the embodiment of this application.

[0272] like Figure 9 As shown, the embodiment of the present application also provides an embodiment of a device for managing communication of untrusted applications, including:

[0273] The processing unit 401 is configured to query the communication handle of the first program from the service manager in the address space corresponding to the second process, obtain the communication handle of the first management application program and the identifier of the first program, wherein the first program is a system program;

[0274] The transceiver unit 402 is configured to send a first request to the first process via the communication handle of the first management application, wherein at least one request parameter further includes an identifier of the first program.

[0275] As an implementation method, the processing unit 401 is also used to load a custom class in the address space of the second process through a custom class loader, the identifier of the custom class is the same as the identifier of the second program, the identifier of the application program interface API of the custom class is the same as the identifier of the API of the second program, and the API of the custom class is used to enable the second process to send a third request to the first process through the communication handle of the first management application, and the third request carries the identifier of the second program and the identifier of the API of the second program; when the second process accesses the API of the second program based on the identifier of the second program and the identifier of the API of the second program, the API of the custom class is accessed.

[0276] The transceiver unit 402 is further configured for the second process to send a third request to the first process through the communication handle of the first management application.

[0277] For the specific implementation, relevant instructions and technical effects of the above units, please refer to the description of the second aspect of the embodiment of this application.

[0278] The present application also provides another terminal device, such as Figure 10 For ease of explanation, only the parts related to the embodiments of the present application are shown. For specific technical details not disclosed, please refer to the method part of the embodiments of the present application. The terminal can be any terminal device including a mobile phone, a tablet computer, a personal digital assistant (English full name: Personal Digital Assistant, English abbreviation: PDA), a sales terminal (English full name: Point of Sales, English abbreviation: POS), a car computer, etc., taking the mobile phone as an example:

[0279] Figure 10 The block diagram shows a partial structure of a mobile phone related to the terminal provided in the embodiment of the present application. Figure 10 The mobile phone includes: Radio Frequency (RF) circuit 1010, memory 1020, input unit 1030, display unit 1040, sensor 1050, audio circuit 1060, wireless fidelity (WiFi) module 1070, central processing unit CPU 1080 and power supply and other components. Those skilled in the art will understand that Figure 10 The mobile phone structure shown in the figure does not constitute a limitation to the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0280] The following combination Figure 10 A detailed introduction to the various components of a mobile phone:

[0281] RF circuitry 1010 is used for transmitting and receiving information or receiving signals during calls. Specifically, it receives downlink information from the base station and transmits it to CPU 1080 for processing. It also transmits uplink data to the base station. Typically, RF circuitry 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, and more. RF circuitry 1010 can also communicate with the network and other devices via wireless communication. The above-mentioned wireless communications may use any communication standard or protocol, including but not limited to Global System of Mobile Communications (Global System of Mobile communication, English abbreviation: GSM), General Packet Radio Service (English full name: General Packet Radio Service, GPRS), Code Division Multiple Access (English full name: Code Division Multiple Access, English abbreviation: CDMA), Wideband Code Division Multiple Access (English full name: Wideband Code Division Multiple Access, English abbreviation: WCDMA), Long Term Evolution (English full name: Long Term Evolution, English abbreviation: LTE), email, Short Messaging Service (English full name: Short Messaging Service, SMS), etc.

[0282] Memory 1020 can be used to store software programs and modules. CPU 1080 executes the various functional applications and data processing of the mobile phone by running the software programs and modules stored in memory 1020. Memory 1020 may mainly include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area may store data created based on the use of the mobile phone (such as audio data, a phone book, etc.). In addition, memory 1020 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0283] The input unit 1030 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or near the touch panel 1031) and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch direction and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the CPU 1080. It can also receive commands sent by the CPU 1080 and execute them. In addition, the touch panel 1031 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1031, the input unit 1030 may further include other input devices 1032. Specifically, the other input devices 1032 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick.

[0284] The display unit 1040 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 1040 may include a display panel 1041. Optionally, the display panel 1041 may be configured in the form of a liquid crystal display (English full name: Liquid Crystal Display, English abbreviation: LCD), an organic light-emitting diode (English full name: Organic Light-Emitting Diode, English abbreviation: OLED), etc. Further, the touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it is transmitted to the CPU 1080 to determine the type of touch event. Subsequently, the CPU 1080 provides corresponding visual output on the display panel 1041 according to the type of touch event. Although in Figure 10 In the embodiment, the touch panel 1031 and the display panel 1041 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0285] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1041 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1041 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that the mobile phone can also be configured with, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be described here.

[0286] Audio circuit 1060, speaker 1061, and microphone 1062 provide an audio interface between the user and the phone. Audio circuit 1060 converts received audio data into electrical signals and transmits them to speaker 1061, where they are converted into sound signals for output. Microphone 1062, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 1060 and converted into audio data. The audio data is then output to CPU 1080 for processing, then sent via RF circuit 1010 to, for example, another phone, or to memory 1020 for further processing.

[0287] WiFi is a short-range wireless transmission technology. The mobile phone can help users send and receive emails, browse the web and access streaming media through the WiFi module 1070. It provides users with wireless broadband Internet access. Figure 10 A WiFi module 1070 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0288] CPU 1080 is the control center of the phone, connecting all parts of the phone using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 1020 and accessing data stored in memory 1020, it performs various phone functions and processes data, thereby providing overall monitoring of the phone. Optionally, CPU 1080 may include one or more processing units; preferably, CPU 1080 may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into CPU 1080.

[0289] The mobile phone also includes a power source (such as a battery) for supplying power to various components. Preferably, the power source can be logically connected to the CPU 1080 through a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.

[0290] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0291] In an embodiment of the present application, the CPU 1080 included in the terminal can run the host process and the isolation process in the aforementioned embodiment.

[0292] The present application also provides a chip including one or more processors. Some or all of the processors are used to read and execute computer programs stored in a memory to perform Figure 4 and Figure 5 The corresponding methods of each embodiment.

[0293] Optionally, the chip includes a memory, and the memory is connected to the processor via a circuit or wire. Further optionally, the chip also includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and / or information to be processed, and the processor obtains the data and / or information from the communication interface, processes the data and / or information, and outputs the processing results through the communication interface. The communication interface can be an input / output interface.

[0294] In some implementations, some of the one or more processors may implement some steps of the above method through dedicated hardware. For example, processing involving a neural network model may be implemented by a dedicated neural network processor or graphics processor.

[0295] The method provided in the embodiment of the present application can be implemented by one chip or by multiple chips working together.

[0296] An embodiment of the present application further provides a computer storage medium for storing computer software instructions used by the above-mentioned computer device, including a program designed for executing the computer device.

[0297] The computer device may include the aforementioned Figure 8 and Figure 9 Apparatus for managing communications of untrusted applications is described.

[0298] The present application also provides a computer program product, which includes computer software instructions that can be loaded by a processor to implement the aforementioned Figure 4 or Figure 5 The process in the method shown.

[0299] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0300] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0301] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0302] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0303] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A method for managing untrusted application communications, characterized in that include: The first process replaces the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application; The first process obtains a first request for a first program from the second process, the first request carrying at least one request parameter, a first management application running in the first process, and the untrusted application running in the second process; The first process replaces the first communication handle in the at least one request parameter with the communication handle of the first management application; The first process sends a second request for the first program to a target process, where the second request carries the at least one request parameter including the communication handle of the first management application program, and the first program is running in the target process.

2. The method according to claim 1, characterized in that The first request is contained in a communication package; After the first process obtains the first request for the first program from the second process, and before the first process replaces the first communication handle in the at least one request parameter with the communication handle of the first management application, the method further includes: The first process determines storage location information of the first communication handle in the communication package based on a storage identification bit, where the storage identification bit is used to mark a starting position of a target storage area in the communication package, and the target storage area is used to store the first communication handle; The first process obtains the first communication handle based on the storage location information.

3. The method according to claim 1, characterized in that The first program is a third-party application, the first request is used to request a communication handle of the first program, the second request is used to request a communication handle of the first program, and the first communication handle is a communication handle of the untrusted application.

4. The method according to claim 3, characterized in that After the first process obtains the first request for the first program from the second process, the method further includes: The first process associates the communication handle of the untrusted application with the communication handle of the first management application.

5. The method according to claim 1, wherein The first program is a third-party application, the first request is used to access the first program, and the second request is used to access the first program; The communication handle of the first program stored in the address space of the second process is the communication handle of the first management application; The first process obtaining the first request for the first program from the second process includes: The first process receives a first request for a first program from the second process through the communication handle of the first management application.

6. The method according to claim 5, characterized in that The communication handle of the first program is stored in the address space of the first process, and the communication handle of the first program is associated with the communication handle of the first management application; The first process sending a second request for the first program to the target process includes: The first process sends the second request to the target process through the communication handle of the first program associated with the communication handle of the first management application.

7. The method according to claim 1, characterized in that The first program is a system program, the first request is used to access the first program, and the second request is used to access the first program; Before the first process obtains the first request for the first program from the second process, the method further includes: The first process adds the communication handle of the first management application and the identifier of the first program to replace the communication handle of the first program in the service manager in the address space corresponding to the second process, so that the second process sends the first request to the first process through the communication handle of the first management application, and the at least one request parameter also includes the identifier of the first program.

8. The method according to claim 7, characterized in that After the first process obtains the first request for the first program from the second process, and before the first process sends the second request for the first program to the target process, the method further includes: The first process queries, from a service manager in an address space corresponding to the first process, a communication handle of the first program corresponding to the identifier of the first program; The first process sending the second request to the target process includes: The first process sends the second request to the target process through the communication handle of the first program.

9. The method according to any one of claims 1 to 8, characterized in that After the first process sends the second request to the target process, the method further includes: The first process receives a first response to the second request from the target process, where the first response carries at least one response parameter; The first process replaces the second communication handle in the at least one response parameter with the communication handle of the first management application; The first process sends a second response to the first request to the second process, where the second response carries the at least one response parameter including the communication handle of the first management application.

10. The method according to claim 9, characterized in that The first program is a third-party application, the first request is used to request a communication handle of the first program, the second request is used to request a communication handle of the first program, and the second communication handle is the communication handle of the first program; After the first process receives a first response to the second request from the target process, the method further includes: The first process associates the communication handle of the first program with the communication handle of the first management application.

11. The method according to any one of claims 1 to 8, characterized in that The method further comprises: The first process receives a third request from the second process through the communication handle of the first management application, wherein the third request carries an identifier of the second program and an identifier of an application program interface of the second program; The first process accesses the application program interface of the second program based on the identifier of the second program and the identifier of the application program interface of the second program in the third request.

12. The method according to claim 11, characterized in that The method further comprises: The first process sends the access result of the application program interface of the second program to the second process through the communication handle of the untrusted application program.

13. A device for managing untrusted application communications, characterized in that: include: a processing unit, configured to replace the communication handle of the application management service in the address space corresponding to the second process with the communication handle of the first management application; a transceiver unit, configured to obtain a first request from the second process for the first program, the first request carrying at least one request parameter, the first management application running in the first process, and the untrusted application running in the second process; The processing unit is further configured to replace the first communication handle in the at least one request parameter with the communication handle of the first management application; The transceiver unit is used to send a second request to a target process, wherein the second request carries at least one request parameter including the communication handle of the first management application, and the first program is running in the target process.

14. A terminal device, characterized in that: include: One or more processors and memory; wherein the memory stores computer-readable instructions; The one or more processors read the computer-readable instructions to cause the computer device to implement the method according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that The method comprises computer-readable instructions, which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 12.

16. A computer program product, characterized in that The method comprises computer-readable instructions, which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 12.

Images