An application installation device and method based on sandbox installation

Abstract

This invention relates to an application installation apparatus and method based on sandbox installation. The method includes at least: installing a sandbox module to each mobile terminal; uploading the application to be used to an app store within the sandbox module to detect whether the application poses a security threat; if the application does not pose a security threat, it can be uploaded to the app store, where the user can view the application available for use. The method can be applied to the application installation apparatus.

Description

Technical Field

[0001] This invention relates to the field of computer software security technology, and in particular to an application installation device and method based on sandbox installation. Background Technology

[0002] Applications installed on mobile devices (such as smartphones) may access information about the device (such as SMS messages, call logs, contacts, and IMSI). Without monitoring these mobile applications, personal privacy information may be compromised. For example, mobile devices may be used on insecure networks (such as public Wi-Fi hotspots), making them susceptible to malware infection and data leaks. Jailbreaking or rooting also introduces additional security risks. Accessing company networks via a stolen or unauthorized mobile device can lead to the leakage of sensitive data. Furthermore, having too many applications installed on a user's mobile device can cause user resentment.

[0003] The existing technical solutions for monitoring applications include the following:

[0004] One approach combines decompilation with static scanning: by decompiling application files to obtain decompiled code, and then scanning and matching functions within the decompiled code that retrieve phone information. The drawbacks of this technique are that it is prone to false positives and cannot decompile hardened applications.

[0005] Another method is to insert hook (reflection) code into the mobile terminal, but this method is prone to compromising the integrity of the application package and may pose security risks such as viruses.

[0006] In addition, the built-in full-disk data encryption function of the mobile terminal can be used to encrypt all data generated by the application. However, this method can easily cause the mobile terminal (such as a mobile phone) to become sluggish or overheat. Furthermore, after the release of new versions of Android / HarmonyOS, the above methods also require framework adaptation of the underlying source code. Applications installed in the sandbox that use less common compilation technologies also require code adaptation.

[0007] For example, Chinese patent document CN110427752A discloses a method, mobile terminal, and storage medium for sandbox monitoring applications. The method includes: defining a behavior for acquiring mobile terminal information and locating the source code of the behavior on the mobile terminal; the sandbox system generates and outputs a system log when the application executes the behavior of acquiring mobile terminal information. When the application calls a function to acquire mobile terminal information, a log output function inserted into the function's source code can generate a system log to monitor the application. However, this invention still has the following technical shortcomings: the method cannot detect the security of the application before it is uploaded to the sandbox system. Therefore, it is necessary to improve upon the shortcomings of the prior art.

[0008] Furthermore, on the one hand, there are differences in understanding among those skilled in the art; on the other hand, the applicant studied a large number of documents and patents when making this invention, but due to space limitations, not all details and contents were listed in detail. However, this does not mean that the present invention does not possess the features of these prior art. On the contrary, the present invention already possesses all the features of the prior art, and the applicant reserves the right to add relevant prior art to the background art. Summary of the Invention

[0009] To address the shortcomings of existing technologies, this invention provides an application installation method based on sandbox installation. The method includes at least: installing a sandbox module onto each mobile terminal; uploading the application to be used to an app store within the sandbox module to detect whether the application poses a security threat; if the application does not pose a security threat, it can be uploaded to the app store, where the user can view the application available for use.

[0010] Through this configuration method, the sandbox module or the mobile terminal configured with the sandbox module serves as a security management platform for mobile services, providing comprehensive protection for business data when users conduct mobile business. For example, the sandbox module can provide real-time management / security protection and unified configuration for different types of mobile terminals, mobile data, and applications, thereby meeting users' data security needs for mobile services.

[0011] Unlike app stores on regular mobile devices, this sandbox module is primarily used to monitor the security of applications within enterprises. This is because app stores on mobile devices manufactured by major mobile terminal (e.g., smartphones) have relatively robust application review systems, typically staffed with dedicated reviewers. Furthermore, most applications in these app stores are developed by companies that have been operating legally for many years, possess the necessary qualifications, and have a high industry reputation, thus ensuring a relatively good level of security. However, enterprise applications are often developed internally, outsourced to external developers, or downloaded from application development sharing websites. The sources of these applications are highly diverse, resulting in a large number of non-mainstream applications within enterprise applications, and the original developer information for these non-mainstream applications is often unclear. In addition, due to the specific nature of some enterprises, these app stores are constantly undergoing rapid iteration and updates or being replaced in batches. Simultaneously, due to management costs and other reasons, these enterprises often lack the personnel to properly review these applications, leading to unreliable security guarantees for the applications used on their mobile terminals. This solution configures the sandbox on the mobile devices used by users within the enterprise, and the sandbox configuration is also linked to user attributes. All applications imported into the app store are first automatically imported into the sandbox. The sandbox performs automatic security checks based on data unpacking, automatically determining the application's security. Applications deemed secure are then shown to users based on their attributes, creating a variable verification scenario. This means that at least one criterion for determining the security of certain applications is based on user attributes. In short, some applications may not pose a security problem for enterprise user A because user A does not have permission to use a potentially security-critical function within the application. However, these applications may pose a security problem for enterprise user B. Therefore, this solution effectively implements variable verification display based on a security sandbox, allowing different users to access different applications based on their attributes, and even ensuring that these applications exhibit varying levels of security depending on the user's usage.

[0012] According to a preferred embodiment, the specific steps of "uploading the application to be used to the app store within the sandbox module to detect whether the application has any security threats" are as follows: A management backend is set up within the sandbox module to perform security checks on the applications within the sandbox module; the user uploads the application to be installed in the sandbox module to the management backend; after the upload operation is completed, the management backend can use an automatic script to unpack and analyze the APK to check whether the application has any security threats; if the management backend does not find any security threats in the application, it uploads the application to the app store for the user to download and use; if the management backend finds that the application has any security threats, it terminates the upload operation and sends a notification message to the relevant application developer.

[0013] According to a preferred embodiment, the method further includes: defining a behavior for acquiring mobile terminal information, and locating the source code of the behavior for acquiring mobile terminal information in the original system; inserting a log output function into the source code to compile and generate a sandbox module, and installing the sandbox module in the mobile terminal; when the application executes the behavior for acquiring mobile terminal information, the sandbox module generates and outputs system logs.

[0014] According to a preferred embodiment, the actions of obtaining mobile terminal information include, but are not limited to, at least one of the following: deleting / querying SMS messages, querying call logs / contacts, obtaining the International Mobile Equipment Identity (IMSI), obtaining the International Mobile Subscriber Identity (IMSI), recording audio, opening the mobile terminal's camera, locating the device, and obtaining administrator user permissions for the mobile terminal.

[0015] According to a preferred embodiment, the step of the sandbox module generating and outputting system logs includes: locating the application that obtains the mobile terminal information behavior based on the UID of the mobile terminal information behavior.

[0016] According to a preferred embodiment, the step of the sandbox module generating and outputting system logs further includes: locating the function executed by the application that performs the action of obtaining mobile terminal information based on the method call stack of the application that performs the action of obtaining mobile terminal information.

[0017] According to a preferred embodiment, the step of "inserting a log output function into the source code to compile and generate a sandbox module, and installing the sandbox module in the mobile terminal" further includes: the sandbox module being installed in the mobile terminal via fastboot or recovery.

[0018] According to a preferred embodiment, the step of "inserting a log output function into the source code to compile and generate a sandbox module, and installing the sandbox module on the mobile terminal" further includes: installing a test application on the mobile terminal.

[0019] The present invention also provides an application installation apparatus based on sandbox installation. The apparatus includes a processor and a storage medium. The storage medium integrates a sandbox module executable by the processor. When executed by the processor, the sandbox module can implement any of the application installation methods described above.

[0020] According to a preferred embodiment, the storage medium stores one or more programs. These programs can be executed by one or more processors. Attached Figure Description

[0021] Figure 1 This is a simplified schematic diagram of the module connection relationship of a preferred embodiment provided by the present invention.

[0022] List of reference numerals

[0023] 1: Processor; 2: Storage medium. Detailed Implementation

[0024] The following is a detailed explanation with reference to the accompanying drawings.

[0025] The sandbox module provided by this invention is a virtualization engine for Android / HarmonyOS applications.

[0026] This sandbox module can create virtual spaces and allow other applications to run within these virtual spaces.

[0027] Application isolation is implemented based on Android's multi-user mechanism, meaning each application is assigned different Android user attributes upon installation. Furthermore, in the enterprise sandbox, sub-applications and the main application (the sandbox itself) are applications with the same user attributes.

[0028] Upload the application package to be downloaded / used to the app store on the server, then confirm that the application package was uploaded successfully and check its security. The app store can act as a security portal.

[0029] Users can access the virtual space created by the sandbox module using their mobile devices and download the required applications from the aforementioned application package in the app store. After the applications are downloaded, they can be silently installed. Outside the virtual space, the downloaded and installed applications will not be found. Enterprise-level applications can be installed within the virtual space.

[0030] The sandbox module establishes a DSA data isolation zone to ensure the security of data within the sandbox. The sandbox module accesses the virtual file system through the DSA driver layer. The virtual file system is essentially a virtual memory segment on the hard drive, used as virtual space. This virtual space can be used to store files. The virtual space is transparent internally but hidden externally. Upper-layer applications can read and write data by calling the virtual file system interface. DSA automatically performs data fragmentation and encryption protection. The DSA data isolation zone uses high-strength encryption. Applications outside the DSA data isolation zone cannot access any data details within it. The DSA includes disk partition information, a file directory table, a key vault area, and an encrypted file storage area. Files stored via DSA are protected using a one-time pad random key and the AES256 encryption algorithm. The random session key is encrypted using a PKI public key and stored in a secure key vault. The sandbox module's use of DSA technology achieves a high level of encryption protection and effectively resists data analysis and cracking.

[0031] Enterprise applications can be installed in the sandbox module.

[0032] The sandbox module can automatically encrypt and decrypt data stored within it.

[0033] The application installation list on the mobile device will only display applications installed within the sandbox module, and will not display applications outside the sandbox module.

[0034] Users can only see and use enterprise-level applications installed in the sandbox module via their mobile devices when they are at work.

[0035] The sandbox module creates a virtual space that provides a secure and convenient operating environment for enterprise applications. At the same time, relevant information management departments within the enterprise can also use the sandbox module to manage and control applications installed within it.

[0036] The app store within the sandbox module can provide mobile devices with enterprise-level backend application upload and review operations.

[0037] The sandbox module can provide users with usage permissions corresponding to their job functions and departments. For example, usage permissions can be used to determine which users can see or not see certain applications installed in the sandbox module.

[0038] Applications within the sandbox module can be displayed based on the user's permissions.

[0039] The request permissions for deeper enterprise applications within the sandbox module (such as requesting sensitive permissions like real-time location tracking and access to contacts) can also be configured and issued through the management backend.

[0040] For example, if the company uses the WeChat Work application and has already uploaded it to the aforementioned app store, and WeChat Work requests access to contacts and location permissions, relevant company administrators or the sandbox module can configure a policy to prohibit WeChat Work from requesting such permissions, and distribute the policy to all applications within the sandbox module.

[0041] Once the applications within the sandbox module receive the above policy, they can prevent WeChat Work from requesting the aforementioned permissions.

[0042] All enterprise applications installed within the sandbox module are encrypted by default, effectively protecting the data within enterprise applications.

[0043] The sandbox module can scan applications to be uploaded to the app store to identify security threats (such as vulnerabilities and / or viruses) within the applications.

[0044] The specific steps for "the application to be used is uploaded to the application store within the sandbox module to detect whether the application poses a security threat" are as follows:

[0045] (1) Set up a management backend in the sandbox module to perform security checks on the applications in the sandbox module;

[0046] (2) The user uploads the application that needs to be installed in the sandbox module to the management backend;

[0047] (3) After the upload operation is completed, the management backend can use an automatic script to unpack and analyze the APK to check whether the application has any security threats.

[0048] (4) If the management backend does not find any security threats to the application, the application will be uploaded to the app store for the user to download and use;

[0049] (5) If the management backend discovers that the above application has a security threat, it will terminate the upload operation of the application and send a prompt message to the developer of the relevant application so that the developer can make rectification.

[0050] In addition, it's necessary to confirm whether the applications within the sandbox module and those outside the sandbox module run consistently. For example, a user installs WeChat Work outside the sandbox module and logs in with account A. Simultaneously, another identical WeChat Work application is installed inside the sandbox module and logged in with account B. These two WeChat Work applications will not interfere with each other. This method confirms whether the applications within and outside the sandbox module run consistently.

[0051] Next, it is necessary to check whether the application has been installed correctly:

[0052] (1) Check whether the application is silently installed within the sandbox module.

[0053] (2) After the application is installed silently, click "Open" to check if the application can be opened. If the application can be opened normally, it means that the application has been successfully installed.

[0054] (3) Return the sandbox module to the management backend and enter the application management bar in the settings directory of the mobile terminal to check if the above application exists. If the above application exists, it means that the above application has been successfully installed.

[0055] Based on the underlying Linux principle of Android, the sandbox module can be understood as a middleware tool responsible for communication / information transfer between the framework layer and the application layer.

[0056] For example, during the development of an Android application, functionality is achieved by calling API interfaces provided by the Android framework layer. A sandbox module essentially provides a virtual framework layer environment. When an application runs on these APIs, it's equivalent to calling the sandbox module's APIs. The sandbox module then uses a proxy to communicate with the mobile terminal's framework layer, enabling the application within the sandbox module to function correctly.

[0057] For example, regarding data reading and writing, the sandbox module uses a read / write method to proxy the application's read / write operations; that is, all read / write operations are performed under the control of the sandbox module. After acquiring data, the sandbox module can freely encrypt and process the acquired data as if it were its own data, and then pass the encrypted and processed data to the mobile terminal's framework layer.

[0058] The sandbox module is mainly used for data protection of enterprise-level applications (such as mobile OA for government agencies, WeChat for enterprises, etc.).

[0059] The steps for using the sandbox module include:

[0060] The sandbox module was installed on each mobile device;

[0061] The applications to be used are uploaded to the app store within the sandbox module to detect whether the applications pose any security threats;

[0062] If the application does not pose a security threat, it can be uploaded to the app store, where users can view the application available for their use.

[0063] The sandbox module encrypts application data during the user's use of the application within the sandbox module.

[0064] For example, when WeChat Work is installed within a sandbox module, users can send documents to each other using WeChat Work, and the sandbox module will handle the document reading and writing on their behalf. Therefore, the sandbox module can automatically monitor the document reading and writing and encrypt / decrypt the document accordingly.

[0065] The main function of the sandbox module is to create a virtual space where applications can run.

[0066] The sandbox module can replace the mobile terminal to implement the environment in which an application runs.

[0067] The sandbox module has the highest level of control over the applications within it.

[0068] For example, after WeChat Work is installed in the sandbox module on a mobile device, if WeChat Work attempts to request permissions such as location access or contact reading, the sandbox module can request these permissions on behalf of WeChat Work on the mobile device. If the administrator deems these permissions too private, they can disable them through the sandbox configuration policy in the management backend.

[0069] Upon receiving a permission request, the sandbox module can determine whether the management backend allows the configuration of that permission before requesting it from the mobile terminal. If the management backend does not allow it, the sandbox module is prohibited from requesting the permission from the mobile terminal, thus preventing the aforementioned application from having the prohibited permission.

[0070] Various operating systems are installed on existing mobile devices. Users install and run applications within these systems. For example, a user installs the Android system on a smartphone, or installs / runs different APK files (application files) within the Android system. Applications installed on mobile devices retrieve information stored on the mobile device or information about the mobile device itself by calling system functions.

[0071] Sandbox modules can be generated by compiling system functions. When an application calls system functions to obtain information, the sandbox module generates system logs based on the called system functions, allowing monitoring of applications within the sandbox module through these system logs.

[0072] First, the original system in the mobile terminal needs to be modified to generate the sandbox module.

[0073] The specific implementation steps, applications, and principles for generating the sandbox module are as follows:

[0074] Locate the source code in the original system of the mobile terminal.

[0075] Locating the source code requires determining what specific information the application obtains from the mobile terminal. Therefore, the first step is to define the application's behavior regarding obtaining mobile terminal information.

[0076] S100: Defines the application's behavior for obtaining information from the mobile terminal.

[0077] In one embodiment of the present invention, the mobile terminal includes, but is not limited to, smartphones, tablet computers, etc.

[0078] Applications' actions in obtaining mobile terminal information include, but are not limited to:

[0079] Query / delete SMS messages stored on the mobile terminal, query call logs / contacts, obtain the International Mobile Equipment Identity (IMEI) of the mobile terminal, obtain the International Mobile Subscriber Identity (IMSI) of the SIM card installed in the mobile terminal, record or query audio files through the mobile terminal, open the camera of the mobile terminal, locate, and obtain administrator user privileges (root privileges) of the mobile terminal.

[0080] S200: Locating the source code.

[0081] Based on the application's behavior of obtaining information from the mobile terminal, the source code within the original system of the mobile terminal that needs to be modified can be located.

[0082] S300: Insert a log output function into the source code.

[0083] Insert or add a log output function to the corresponding function source code mentioned above. The log output function outputs a system log when the corresponding function's source code is executed. When an application calls a system function to obtain phone information, the log output function within that system function can generate and output the system log. Users can monitor whether the application is obtaining phone information through the system log.

[0084] S400: Compiles and generates sandbox modules.

[0085] The modified system source code is then compiled to generate a sandbox module. In a preferred embodiment of the invention, the modified system source code is compiled into a sandbox module using the `make -j` command. The above code compilation process can employ various compilation methods.

[0086] S500: Install a sandbox module in the mobile terminal.

[0087] The sandbox module compiled above can be installed on a mobile device to monitor applications installed within it. The sandbox module can be installed via fastboot or recovery.

[0088] This invention monitors applications within a sandbox module by inserting a log output function into the original system source code. When an application retrieves information from the mobile terminal, it calls the corresponding function source code within the mobile terminal's system. The sandbox module then outputs system logs through the log output function inserted in the source code, thereby monitoring the applications within the sandbox module.

[0089] Regardless of whether the application is hardened or encrypted, system logs are generated whenever the application calls system functions. Meanwhile, whether the application itself is hardened or encrypted does not affect the sandbox module's monitoring of the application.

[0090] S600: Install test applications.

[0091] Install a test application in the sandbox module to monitor the information obtained by the application from the mobile terminal through the sandbox module.

[0092] When an application obtains information from a mobile terminal, the sandbox module and the application within the mobile terminal operate according to the following process:

[0093] R100: The application executes the behavior of obtaining information from the mobile terminal.

[0094] R200: The sandbox module receives and executes application requests.

[0095] R300: The sandbox module outputs system logs through a log output function.

[0096] The mobile terminal includes a processor 1 and a storage medium 2.

[0097] Storage medium 2 stores sandbox modules that can be executed by the processor 1.

[0098] When the sandbox module is executed by processor 1, it can implement the method of monitoring the application as described above.

[0099] The mobile terminal uses a sandbox module to monitor the information acquisition behavior of applications installed on the mobile terminal, thereby enhancing the information security performance of the mobile terminal.

[0100] Users can understand how applications obtain information from the mobile terminal by using system logs generated by the sandbox module installed in the mobile terminal, thereby preventing information leakage from the mobile terminal.

[0101] This invention also provides an application installation device based on sandbox installation. For example... Figure 1 As shown, the device includes a processor 1 and a storage medium 2. The storage medium 2 integrates a sandbox module that can be executed by the processor 1. When executed by the processor 1, the sandbox module can implement the application installation method described above.

[0102] According to a preferred embodiment, the storage medium 2 stores one or more programs that can be executed by one or more processors 1.

[0103] It should be noted that the specific embodiments described above are exemplary. Those skilled in the art can devise various solutions inspired by the disclosure of this invention, and these solutions all fall within the scope of this invention and its protection. Those skilled in the art should understand that this specification and its accompanying drawings are illustrative and not intended to limit the scope of the claims. The scope of protection of this invention is defined by the claims and their equivalents. This specification contains multiple inventive concepts; terms such as "preferredly," "according to a preferred embodiment," or "optionally" indicate that the corresponding paragraph discloses an independent concept. The applicant reserves the right to file divisional applications based on each inventive concept.

Claims

1. A method for installing applications based on sandbox installation, characterized in that, At least including: The sandbox module is installed on each mobile device, and the configuration of the sandbox module is associated with the user's attributes; The applications to be used are uploaded to the app store within the sandbox module to detect whether the applications pose a security threat. A management backend is set up within the sandbox module to perform security checks on the applications within the sandbox module. The user uploads the applications that need to be installed in the sandbox module to the management backend; After the upload operation is completed, the management backend can use an automatic script to unpack and analyze the APK to check whether the application has any security threats. If the management backend does not detect any security threats to the application, it will upload the application to the app store for the user to download and use; if the management backend detects any security threats to the application, it will terminate the upload operation and send a notification message to the relevant application developer. At least one criterion for determining whether an application is secure is based on user attributes. The sandbox configuration is associated with user attributes. All applications imported into the app store are first automatically imported into the sandbox. The sandbox automatically detects applications based on unpacking to determine their security. Applications whose security is confirmed are then shown to users based on user attributes. If the application does not pose a security threat, it can be uploaded to the app store, where users can view the applications available to them. The application installation list on the mobile terminal will only display applications installed within the sandbox module, and will not display applications outside the sandbox module.

2. The method according to claim 1, characterized in that, The method further includes: Define the behavior of acquiring mobile terminal information, and locate the source code of the behavior of acquiring mobile terminal information in the original system; Insert a log output function into the source code to compile and generate a sandbox module, and then install the sandbox module on the mobile terminal; When the application performs the action of obtaining information from the mobile terminal, the sandbox module generates and outputs system logs.

3. The method according to claim 2, characterized in that, The act of acquiring mobile terminal information includes: Delete / query SMS messages, query call logs / contacts, obtain mobile device international identification code, obtain international mobile subscriber identification code, record audio, open the mobile terminal's camera, locate, obtain administrator user permissions for the mobile terminal.

4. The method according to claim 2, characterized in that, The steps for the sandbox module to generate and output system logs include: The application that obtains the mobile terminal information behavior is located based on the UID of the obtained mobile terminal information behavior.

5. The method according to claim 2, characterized in that, The steps for the sandbox module to generate and output system logs also include: The function executing the action of obtaining mobile terminal information is located based on the method call stack of the application that performs the action.

6. The method according to claim 2, characterized in that, The step of inserting a log output function into the source code to compile and generate a sandbox module, and installing the sandbox module on the mobile terminal, further includes: the sandbox module being installed on the mobile terminal via fastboot or recovery.

7. The method according to claim 2, characterized in that, The step of inserting a log output function into the source code to compile and generate a sandbox module, and installing the sandbox module on the mobile terminal, further includes: installing a test application on the mobile terminal.

8. An application installation device based on sandbox installation, characterized in that, It includes a processor (1) and a storage medium (2), the storage medium (2) integrating a sandbox module that can be executed by the processor (1), the sandbox module being executed by the processor (1) to implement the method as described in any one of claims 1 to 7.

9. The apparatus according to claim 8, characterized in that, The storage medium (2) stores one or more programs that can be executed by one or more processors (1).

Images