Environment detection method, apparatus, device, and medium

Abstract

The present disclosure provides an environment detection method, which can be applied to the field of information security and the field of finance. The environment detection method for application software includes: determining class information corresponding to a system service according to the system service for deploying a target application, the class information including service class information for controlling a window and service class information for controlling an installation package; determining attribute information of the target application according to the class information corresponding to the system service, the attribute information being used to represent running information of the corresponding class; and in a case where it is detected that the attribute information includes a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information. The present disclosure also provides an environment detection device, equipment, storage medium and program product for application software.

Description

Technical Field

[0001] This disclosure relates to the financial sector and the information security sector, and more specifically to an environmental testing method, apparatus, electronic device, medium, and program product. Background Technology

[0002] Users can install various applications on their devices to meet different needs in different fields and for different problems. Due to Android's inherent security mechanisms, such as process isolation and access control, business attacks need to be carried out on untrusted devices, such as rooted environments or customized ROMs. Therefore, existing environment detection technologies generally target the devices with installed applications. Environment detection methods include checking the device's system for applications, program structures, and path files that could gain superuser privileges, such as the presence of su files, authorized applications like Magisk, and hook frameworks like Xposed.

[0003] With the development of technology, the use of virtual machines is becoming increasingly widespread. Virtual machine products can shield external Android system security restrictions, allowing application software to be installed and run within the virtual machine's process, undetected by the actual external system. This increases the risk to both the terminal device and the application software. Existing environment detection methods cannot detect the running environment of application software within a virtual machine product, nor can they guarantee the security of the terminal device. Summary of the Invention

[0004] In view of the above problems, this disclosure provides environmental testing methods, apparatus, equipment, media and procedures.

[0005] According to a first aspect of this disclosure, an environment detection method is provided, comprising: determining class information corresponding to a system service for deploying a target application, the class information including service class information for controlling a window and service class information for controlling an installation package; determining attribute information of the target application based on the class information corresponding to the system service, the attribute information being used to characterize the runtime information of the corresponding class; and determining the runtime environment of the target application based on parent information inherited from the attribute information when the attribute information includes a target identifier.

[0006] According to an embodiment of this disclosure, when the attribute information includes a target identifier, determining the runtime environment of the target application based on the parent information inherited from the attribute information includes: when the attribute information includes a first identifier, obtaining the first parent information inherited from the attribute information, wherein the first parent information includes parent class information corresponding to the subclass to which the attribute information belongs; and when the first parent information includes a proxy class, determining that the runtime environment of the target application is an abnormal environment and that the runtime environment is a first proxy mode.

[0007] According to an embodiment of the present disclosure, wherein, in the case that it is detected that the attribute information comprises the target identifier, the running environment of the target application is determined according to the parent information inherited from the attribute information, further comprising: in the case that it is detected that the attribute information comprises the second identifier, the second parent information inherited from the attribute information is acquired, the second parent information comprising a parent interface of a class to which the attribute information belongs; in the case that it is determined that the second parent information comprises the proxy interface, it is determined that the running environment of the target application is the abnormal environment, and the running environment is the second proxy mode.

[0008] According to an embodiment of the present disclosure, wherein the attribute information comprises sub-attribute information from multiple classes; in the case that it is detected that the attribute information comprises the target identifier, the running environment of the target application is determined according to the parent information inherited from the attribute information, comprising: performing traversal detection on the multiple sub-attribute information, in the case that it is detected that any sub-attribute information comprises the target identifier, the running environment of the target application is determined according to the parent information inherited from the attribute information.

[0009] According to an embodiment of the present disclosure, wherein the attribute information of the target application is determined according to the class information corresponding to the system service, comprising: the attribute information of the target application is acquired through a reflection method according to the class information corresponding to the system service, the reflection method comprising reflection through an object, reflection through a path, and reflection through a class name.

[0010] The target application comprises a first target application directly installed in the terminal device and a second target application installed in a virtual machine product in the terminal device, the first target application and the second target application being the same application, the first target application and the second target application being installed in the terminal device at the same time, further comprising: in the case that it is determined that the first target application is in the normal running environment, the second target application is started; in the case that it is determined that the running environment of the second target application is the abnormal environment, the running state of the first target application is maintained, and an environment abnormality flag and a termination running instruction are returned to the second target application.

[0011] According to an embodiment of the present disclosure, further comprising: in the case that it is determined that the running environment of the target application is the abnormal environment, an environment abnormality flag and a termination running instruction are returned to the target application; in the case that it is determined that the running environment of the target application is the normal environment, the running environment of the target application is detected by using an additional environment detection method.

[0012] The second aspect of the present disclosure provides an environment detection apparatus, comprising: a class information determination module configured to determine class information corresponding to a system service according to the system service used for deploying a target application, the class information comprising service class information used for controlling a window and service class information used for controlling an installation package; an attribute information determination module configured to determine attribute information of the target application according to the class information corresponding to the system service, the attribute information being used to represent running information of the corresponding class; and an environment detection module configured to determine a running environment of the target application according to parent information inherited from the attribute information when it is detected that the attribute information comprises a target identifier.

[0013] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the above-mentioned environment detection method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having stored executable instructions, which, when executed by a processor, cause the processor to perform the above-mentioned environment detection method.

[0015] The fifth aspect of the present disclosure further provides a computer program product comprising a computer program, which, when executed by a processor, implements the above-mentioned environment detection method. BRIEF DESCRIPTION OF DRAWINGS

[0016] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0017] Figure 1 An application scenario diagram of an environment detection method according to an embodiment of the present disclosure is schematically shown;

[0018] Figure 2 A flowchart of an environment detection method according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 A flowchart of a method for determining a running environment of a first proxy mode according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 A flowchart of a method for determining a running environment of a second proxy mode according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 5 An environment detection flowchart according to a specific embodiment of the present disclosure is schematically shown;

[0022] Figure 6 A structural block diagram of an environment detection apparatus according to an embodiment of the present disclosure is schematically shown; and

[0023] Figure 7 A block diagram of an electronic device suitable for an environmental detection method according to an embodiment of the disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description is merely illustrative of the disclosure and in no way limits the scope of the disclosure. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. However, it will be apparent to one skilled in the art that the embodiments can be practiced without these specific details. In other instances, well-known structures and techniques have been not described in detail in order to avoid obscuring aspects of the disclosure.

[0025] The terms used herein are merely used to describe specific embodiments and are not intended to limit the disclosure. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein, including technical and scientific terms, have meanings commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or overly formal manner.

[0027] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should be generally interpreted as including one or more of the items enumerated in the list (e.g., "a system having at least one of A, B, and C" should include, but not be limited to, a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.).

[0028] In the technical solutions of the disclosure, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information comply with relevant laws and regulations, necessary security measures are taken, and do not violate public order and good customs.

[0029] In the technical solutions of the disclosure, the authorization or consent of the user is obtained before the user's personal information is acquired or collected.

[0030] Embodiments of the present disclosure provide an environment detection method, comprising: determining class information corresponding to a system service according to the system service for deploying a target application, the class information comprising service class information for controlling a window and service class information for controlling an installation package; determining attribute information of the target application according to the class information corresponding to the system service, the attribute information being used to represent running information of the corresponding class; and in a case where it is detected that the attribute information comprises a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information.

[0031] For a terminal device of an Android system, the running environment of an application software depends on a secure running environment provided by the terminal device. Therefore, existing environment detection technologies generally check whether there is an application modifying user permissions in a system path of the terminal device. A virtual machine product can install multiple application softwares inside it, so that the use of the internal application software is not limited by the security mechanism of the terminal device. However, there is still a lack of a method for detecting the environment of the application software inside the virtual machine product.

[0032] Considering that the virtual machine provides services for the application software by proxying and wrapping the system service of the terminal device, the present application proposes an environment detection method for the virtual machine product from the principle of the virtual machine product, which can effectively detect whether the environment outside the application software is a virtual machine environment, and makes up for the deficiency of the existing environment detection means.

[0033] Figure 1 An application scenario diagram of the environment detection method according to an embodiment of the present disclosure is schematically shown.

[0034] As shown in Figure 1 , the application scenario 100 according to the embodiment can include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used as a medium to provide a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0035] A user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0036] The terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0037] The server 105 can be a server that provides various services, such as a background management server that provides support for a website browsed by a user using the terminal device 101, 102, or 103 (as an example only). The background management server can perform analysis and the like on received user requests and the like, and feed back a processing result (such as a webpage, information, or data obtained or generated according to a user request) to the terminal device.

[0038] It should be noted that the environment detection method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the environment detection apparatus provided in the embodiments of the present disclosure can generally be arranged in the server 105. The environment detection method provided in the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, or 103 and / or the server 105. Accordingly, the environment detection apparatus provided in the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, or 103 and / or the server 105.

[0039] It should be understood that the number of terminal devices, networks, and servers in the system shown in FIG. 1 is merely illustrative. According to the needs of implementation, there can be any number of terminal devices, networks, and servers. Figure 1

[0040] The following will be described based on the scenario described above, and the environment detection method of the embodiments of the present disclosure will be described in detail. Figure 1 Figures 2 to 4 The environment detection method according to the embodiments of the present disclosure is described in detail.

[0041] Figure 2 A flowchart of an environment detection method according to the embodiments of the present disclosure is schematically shown.

[0042] As shown in FIG. 2, the method includes operations S210-S230. Figure 2

[0043] In operation S210, according to a system service for deploying a target application, class information corresponding to the system service is determined, and the class information includes service class information for controlling a window and service class information for controlling an installation package.

[0044] According to the embodiments of the present disclosure, the terminal device itself carries an operating system, and the operating system includes a plurality of system services for controlling the terminal device to implement a plurality of functions, such as controlling a charging function, controlling storage, controlling an installation package to install application software, and the like. The application software installed on the terminal device can also call the system service to implement a characteristic service, for example, the application software calls the system service for controlling a window to display an interactive window of a preset size and preset attribute.

[0045] ​​​According to an embodiment of the present disclosure, there are multiple system services in the terminal device for installing the target application and for supporting the running of the target application, and a log file related to the target application can be stored in the terminal device.

[0046] According to an embodiment of the present disclosure, the log file can be obtained from the terminal device, and then the system service related to the deployment of the target application and the class information corresponding to the system service can be determined from the log file. The class information includes service class information for controlling a window, service class information for controlling an installation package, service class information for controlling a system operation activity, and the like. The classes corresponding to these system services are the entrances of the system services called by the application software to the Android operating system.

[0047] For example, the obtained system service classes include a system service class corresponding to an ActivityManager, a system service class corresponding to a PackageManager, a system service class corresponding to a WindowManager, and the like.

[0048] In operation S220, according to the class information corresponding to the system service, attribute information of the target application is determined, and the attribute information is used to represent the running information of the corresponding class.

[0049] According to an embodiment of the present disclosure, after obtaining the class information corresponding to the system service, one or more attribute information corresponding to the obtained class information is extracted. The attribute information is used to represent the running information of the target application corresponding to the class.

[0050] Specifically, the obtained attribute information includes a modifier of the class, a variable of the class, a constant of the class, a class name, interface information, and the like.

[0051] For example, an IActivityManagerSingleton attribute obtained from the ActivityManager from the ActivityManager, and an sPackageManager attribute obtained from the ActivityThread.

[0052] In operation S230, in a case where it is detected that the attribute information includes a target identifier, a running environment of the target application is determined according to parent information inherited from the attribute information.

[0053] According to an embodiment of the present disclosure, after obtaining the attribute information of the target application, the obtained attribute information is detected to determine whether the target identifier exists. The detection of the obtained attribute information can be achieved by detecting whether the target identifier with a preset length and a preset combination exists.

[0054] In a case where it is detected that the attribute information includes the target identifier, it is indicated that the running environment of the current target application can be abnormal, and further parent information inherited by the attribute information is acquired. Then, whether the target application is in an abnormal running environment is determined according to the inherited parent information.

[0055] According to an embodiment of the present disclosure, the inherited parent information includes attribute information of an inherited parent class, such as a static method, and further includes inherited parent interface information.

[0056] For example, taking a currently popular Android process-level virtual machine product VirtualApp as an example. VirtualApp shields the security restrictions of the external Android system itself, so that application software can be installed and run in the VirtualApp process without being perceived by the external actual system, and VirtualApp can completely monitor the behavior and data of the internal application software. VirtualApp is widely used in mobile office security, data isolation and many other technical fields. However, these features have simultaneously reduced the difficulty of attack and reduced the data security of the application software installed in the virtual machine product.

[0057] For a certain chat application installed in VirtualApp, in order to support the running of the chat application, VirtualApp will proxy and modify the key attributes of the system service class that deploys the chat application to simulate the operating system environment. Therefore, after acquiring the class information and attribute information corresponding to the system service that deploys the chat application, whether the running environment of the chat application is abnormal can be determined by detecting whether the attribute information has been proxy modified. In a case where one or more attribute information includes a dynamic proxy identifier, the running environment of the chat application is determined to be an abnormal environment.

[0058] It should be noted that the chat application itself can be directly installed on a terminal device, and does not need to rely on a virtual machine product to realize the corresponding function on the terminal device. For the chat application installed on the terminal device, the corresponding attribute information does not include a dynamic proxy identifier.

[0059] The present disclosure starts from the principle of a virtual machine product, considers that the virtual machine product needs to make dynamic proxy wrapping for attribute information corresponding to a system service, and then realizes running of internal application software. After class information of a system service of a deployment target application is acquired, key attribute information of the target application is acquired, and then it is detected whether the attribute information includes a dynamic proxy identifier, so that detection of an external running environment of the target application is realized. The environment detection method provided by the present disclosure does not need to detect whether an authorized application exists in a terminal device, nor does it need to detect whether a local device framework that implements a function of a target application exists in a terminal device, so as to determine a running environment of the target application. The environment detection method provided by the present disclosure is simple in logic and can perform environment detection on a virtual machine product that adopts a dynamic proxy technology, and fills a blank aspect of current environment detection.

[0060] Figure 3 A flowchart of a method for determining a running environment of a first proxy mode according to an embodiment of the present disclosure is schematically shown.

[0061] As shown in Figure 3 , operations S331-S332 can be taken as one specific embodiment of operation S230.

[0062] According to an embodiment of the present disclosure, the target identifier includes a first identifier and a second identifier, and the first identifier and the second identifier are both character identifiers including a preset number and a preset permutation and combination. Specifically, the first identifier represents a first proxy modification mode, and the second identifier represents a second proxy modification mode.

[0063] In operation S331, in a case where it is detected that the attribute information includes the first identifier, first parent information inherited by the attribute information is acquired, and the first parent information includes parent class information corresponding to a child class to which the attribute information belongs.

[0064] In operation S332, in a case where it is determined that the first parent information includes a proxy class, it is determined that the running environment of the target application is an abnormal environment, and the running environment is the first proxy mode.

[0065] According to an embodiment of the present disclosure, the attribute information includes a class name, in a case where it is detected that the class name includes the first identifier, parent class information corresponding to a child class to which the attribute information belongs is acquired, and the acquired parent class information is taken as first parent information. In a case where it is determined that the first parent class information includes a proxy class, it is determined that the running environment of the target application is an abnormal environment, and proxy modification of the running environment is implemented through the first proxy mode.

[0066] In a case where it is detected that the attribute information does not include the first identifier, it is determined that the running environment of the target application is a normal environment. In a case where it is detected that the attribute information includes the first identifier, but the first parent information does not include a proxy class, it is determined that the running environment of the target application is a normal environment.

[0067] According to an embodiment of the present disclosure, the first identifier comprises a "$Proxy" identifier, and the first proxy mode comprises a CGLIB (Code Generation Library) dynamic proxy encapsulation.

[0068] Figure 4 A flowchart of a method for determining a running environment of a second proxy mode is shown schematically according to an embodiment of the present disclosure.

[0069] As shown in Figure 4 , operations S431-S432 can be another specific embodiment of operation S230.

[0070] In operation S431, in a case where it is detected that the attribute information comprises a second identifier, second parent information inherited by the attribute information is obtained, and the second parent information comprises a parent interface of a class to which the attribute information belongs.

[0071] In operation S432, in a case where it is determined that the second parent information comprises a proxy interface, it is determined that the running environment of the target application is an abnormal environment, and the running environment is in a second proxy mode.

[0072] According to an embodiment of the present disclosure, in a case where it is detected that the class name comprises a second identifier, second parent information inherited by the attribute information is obtained, and the second parent information comprises a parent interface of a class to which the attribute information belongs. The second identifier is "EnhancerByCGLIB". In a case where it is determined that the second parent class information comprises a proxy interface, it is determined that the running environment of the target application is an abnormal environment, and the proxy transformation of the running environment is implemented through a second proxy mode.

[0073] According to an embodiment of the present disclosure, the second proxy mode comprises a JDK dynamic proxy encapsulation.

[0074] In a case where it is detected that the attribute information does not comprise the second identifier, it is determined that the running environment of the target application is a normal environment. In a case where it is detected that the attribute information comprises the second identifier, but the first parent information does not comprise the parent interface, it is determined that the running environment of the target application is a normal environment.

[0075] According to an embodiment of the present disclosure, the first proxy mode and the second proxy mode are two different proxy modes commonly used at present. The JDK dynamic proxy encapsulation can only generate a proxy for a class that implements an interface, but cannot be used for a class; the CGLIB is used for implementing a proxy for a class, mainly generating a subclass for a specified class to cover or inherit methods therein.

[0076] According to an embodiment of the present disclosure, the running of the application software generally utilizes a plurality of system services, each of which has corresponding attribute information. For the attribute information of the application software, the attribute information includes sub-attribute information from a plurality of classes. In the process of target identification detection, the plurality of sub-attribute information is detected in turn.

[0077] In the case where any sub-attribute information includes a target identification, it is determined according to the parent information inherited from the attribute information whether the class corresponding to the sub-attribute information has a proxy modification. As long as it is detected that the attribute information corresponding to one system service has a target identification, it is determined that the running environment of the target application is an abnormal environment.

[0078] According to an embodiment of the present disclosure, the determination of whether the plurality of sub-attribute information includes a target identification can be performed by parallel operation, and the plurality of sub-attribute information is detected at the same time. After it is determined that the running environment of the target application is an abnormal environment, the detection of other sub-attribute information is stopped, the efficiency of environment detection is improved, and the waste of computing resources is reduced.

[0079] According to an embodiment of the present disclosure, the determination of whether the plurality of sub-attribute information includes a target identification can also be performed in turn. After it is determined that the running environment of the target application is an abnormal environment, the detection of other sub-attribute information is not required.

[0080] According to an embodiment of the present disclosure, the attribute information of the target application is determined according to the class information corresponding to the system service, including: obtaining the attribute information of the target application by a reflection method according to the class information corresponding to the system service, the reflection method including one of object implementation reflection, path implementation reflection and class name implementation reflection. For example, the IActivityManagerSingleton attribute is obtained by reflection from the ActivityManager.

[0081] According to an embodiment of the present disclosure, the specific reflection obtaining method can be determined according to different virtual machine products and different target applications installed in the virtual machine products.

[0082] Figure 5 An environment detection flowchart according to an embodiment of the present disclosure is schematically shown.

[0083] As shown in Figure 5 , the method includes operation S510 to operation S590.

[0084] In operation S510, the class information corresponding to the system service is determined, and specifically, the class information can be determined through the obtained log file. After the class information corresponding to the system service is determined, operation S520 is entered to extract attribute information in the class information, and then operation S530 is entered to judge the target identifier. In a case where it is detected that the attribute information includes the first identifier, operation S540 is entered; in a case where it is detected that the attribute information includes the second identifier, operation S580 is entered, and it is further judged whether the running environment of the target application is an abnormal environment.

[0085] In a case where the first identifier is not detected and the second identifier is not detected in operation S530, it is indicated that the running environment of the target application is a normal environment, and operation S560 is entered to detect the environment as normal. Specifically, a normal environment flag can be returned.

[0086] In a case where it is detected that the attribute information includes the first identifier, operation S540 is entered to extract the parent class of the class. Specifically, the extracted parent class corresponds to the subclass to which the attribute information belongs. After the parent class information is extracted, operation S550 is entered to judge whether the parent class includes a proxy class. In a case where it is determined that the parent class includes the proxy class, operation S570 is entered to detect the environment as abnormal, and an environment abnormal flag is returned; in a case where it is determined that the parent class does not include the proxy class, operation S560 is entered to detect the environment as normal, and an environment normal flag is returned.

[0087] In a case where it is detected that the attribute information includes the second identifier, operation S580 is entered to extract the parent interface of the class. After the parent interface is extracted, operation S590 is entered to judge whether the parent interface includes a proxy interface. In a case where it is determined that the parent interface includes the proxy interface, operation S570 is entered to detect the environment as abnormal, and an environment abnormal flag is returned; in a case where it is determined that the parent interface does not include the proxy interface, operation S560 is entered to detect the environment as normal, and an environment normal flag is returned.

[0088] According to an embodiment of the present disclosure, the target application includes a first target application directly installed in a terminal device and a second target application installed in a virtual machine product in the terminal device, the first target application and the second target application are the same application, the first target application and the second target application are simultaneously installed in the terminal device, and the method further includes: in a case where it is determined that the first target application is in a normal running environment, starting the second target application; and in a case where it is determined that the running environment of the second target application is an abnormal environment, maintaining the running state of the first target application, and returning an environment abnormal flag and a termination running instruction to only the second target application.

[0089] Specifically, taking a chat application Q as an example, the chat application Q is a dual-opening application, which can be installed in a terminal device and a virtual machine product VirtualApp in the terminal device. The application Q1 is installed in the terminal device directly, and the application Q2 is installed in the virtual machine product VirtualApp. The application Q1 and the application Q2 are completely same, the application Q1 can be opened directly through the terminal, and the application Q2 needs to be opened in the VirtualApp. The application Q1 passes the environment detection, and in the case that it is determined that the first target application is in a normal running environment, the application Q2 in the VirtualApp is started.

[0090] In the case that it is detected by the above detection method that the running environment of the application Q2 is an abnormal environment, it is indicated that the external running environment of the application Q2 is a virtual environment, only the environment abnormality flag and the termination running instruction are returned to the application Q2, the running of the application Q2 is terminated, and the running of the application Q1 is not affected. In the case that the application Q1 is currently in a background running state, the application Q2 is terminated while the application Q1 is still normally running.

[0091] The present disclosure is only for the detection of the environment of the target application in the virtual machine product for the dual-opening or multi-opening target applications on the same terminal device, and does not affect the target application in the normal running environment. The targeted environment detection is realized, the normal running of the other opening target application is avoided from being affected when the problem occurs in the single opening target application, and the use experience of the user is avoided from being affected due to the inability to open the normal application.

[0092] According to the embodiments of the present disclosure, in the case that it is determined that the running environment of the target application is an abnormal environment, the environment abnormality flag and the termination running instruction are returned to the target application; in the case that it is determined that the running environment of the target application is a normal environment, the running environment of the target application is detected by using an additional environment detection method.

[0093] According to the embodiments of the present disclosure, the target application running in the abnormal environment has great security risks, including that the running data is easy to be lost, stolen, the core code of the application software is tampered, and the running environment of the terminal device is tampered, etc. Therefore, in order to ensure the information security of the user, in the case that it is detected that the running environment of the target application is an abnormal environment, the terminal device refuses to provide support for the target application.

[0094] Specifically, in the case that it is determined that the running environment of the target application is an abnormal environment, the terminal device returns the environment abnormality flag and the termination running instruction to the target application, reminds the target application that the running environment is abnormal and forces the target application to terminate running. The malicious analysis and use of the target application by the illegal person are prevented. On the basis of ensuring the security of the use data of the user, the system security of the terminal device is further ensured.

[0095] According to an embodiment of the present disclosure, determining whether the running environment of the target application is safe can be determined by the terminal device, and can also be implemented by the authorized application installed on the terminal device.

[0096] According to an embodiment of the present disclosure, in the case that the terminal device determines that the running environment of the target application is an abnormal environment, the terminal device returns an environment abnormality flag and a termination running instruction to the target application. In the case that the authorized application installed on the terminal device determines that the running environment of the target application is an abnormal environment, the authorized application can return abnormality information to the terminal device. After receiving the abnormality information, the terminal device returns an environment abnormality flag and a termination running instruction to the target application according to the abnormality information. The abnormality information includes an identifier of the target application, an identifier of the proxy mode, and the like.

[0097] According to an embodiment of the present disclosure, the additional environment detection method includes a root environment detection method, for example, checking whether a superuser permission application exists, performing a busybox test, and the like. The environment detection method of the present disclosure is only for the case that the external environment is a virtual machine environment, and is a supplement to the mainstream environment detection method. After detection by the additional environment detection method and the environment detection method provided by the present disclosure, it is further possible to detect whether the environment is a virtual machine environment on the basis of the related art, and to supplement the blank of the virtual machine environment detection method.

[0098] The present disclosure considers that the virtual machine product will dynamically proxy and wrap the attribute information corresponding to the system service, and then implement the running of the internal application software, starting from the principle of the virtual machine product. By obtaining the key attribute information of the target application according to the class information of the system service on which the target application is deployed, and then detecting one or more of the attribute information as a dynamic proxy identifier, the detection of the external running environment of the target application is implemented.

[0099] The environment detection method provided by the present disclosure does not need to detect whether the authorized application exists on the terminal device, and does not need to depend on the local device framework for implementing the function of the target application. The method is simple and general in logic, can detect whether the external environment in which the target application runs is credible (whether it is a VirtualApp), is suitable for all process virtual machine products using dynamic proxy technology, and can supplement the existing environment detection means.

[0100] Figure 6 A structural block diagram of an environment detection apparatus according to an embodiment of the present disclosure is schematically shown.

[0101] As shown in Figure 6 The environment detection apparatus 600 of this embodiment includes a class information determination module 610, an attribute information determination module 620, and an environment detection module 630.

[0102] The class information determination module 610 is configured to determine class information corresponding to the system service according to the system service used for deploying the target application, the class information including service class information used for controlling a window and service class information used for controlling an installation package. In an embodiment, the class information determination module 610 can be configured to perform operation S210 described above, and details are not described herein again.

[0103] The attribute information determination module 620 is configured to determine attribute information of the target application according to the class information corresponding to the system service, the attribute information being used to represent running information of the corresponding class. In an embodiment, the attribute information determination module 620 can be configured to perform operation S220 described above, and details are not described herein again.

[0104] The environment detection module 630 is configured to determine a running environment of the target application according to parent information inherited by the attribute information, in a case where it is detected that the attribute information includes a target identifier. In an embodiment, the environment detection module 630 can be configured to perform operation S230 described above, and details are not described herein again.

[0105] According to an embodiment of the present disclosure, the environment detection module 630 includes a first determination unit and a second determination unit.

[0106] The first determination unit is configured to acquire first parent information inherited by the attribute information, the first parent information including parent class information corresponding to a sub-class to which the attribute information belongs, in a case where it is detected that the attribute information includes a first identifier. In an embodiment, the first determination unit can be configured to perform operation S331 described above, and details are not described herein again.

[0107] The second determination unit is configured to determine that the running environment of the target application is an abnormal environment and that the running environment is a first proxy mode, in a case where it is determined that the first parent information includes a proxy class. In an embodiment, the second determination unit can be configured to perform operation S332 described above, and details are not described herein again.

[0108] According to an embodiment of the present disclosure, the environment detection module 630 further includes a third determination unit and a fourth determination unit.

[0109] The third determination unit is configured to acquire second parent information inherited by the attribute information, the second parent information including a parent interface of a class to which the attribute information belongs, in a case where it is detected that the attribute information includes a second identifier. In an embodiment, the third determination unit can be configured to perform operation S431 described above, and details are not described herein again.

[0110] The fourth determination unit is configured to determine that the running environment of the target application is an abnormal environment and that the running environment is a second proxy mode, in a case where it is determined that the second parent information includes a proxy interface. In an embodiment, the fourth determination unit can be configured to perform operation S432 described above, and details are not described herein again.

[0111] Figure 7 A block diagram schematically illustrating an electronic device suitable for an environment detection method according to an embodiment of the present disclosure is shown.

[0112] As shown in Figure 7 An electronic device 700 according to an embodiment of the present disclosure includes a processor 701 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 702 or loaded into a random access memory (RAM) 703 from a storage portion 708. The processor 701 can include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), and / or the like. The processor 701 can also include an on-board memory for cache use. The processor 701 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0113] In the RAM 703, various programs and data required for the operation of the electronic device 700 are stored. The processor 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. The processor 701 performs various operations of the method processes according to embodiments of the present disclosure by executing programs in the ROM 702 and / or the RAM 703. Note that the programs can also be stored in one or more memories other than the ROM 702 and the RAM 703. The processor 701 can also perform various operations of the method processes according to embodiments of the present disclosure by executing programs stored in the one or more memories.

[0114] According to embodiments of the present disclosure, the electronic device 700 can also include an input / output (I / O) interface 705 that is also connected to the bus 704. The electronic device 700 can also include one or more of the following components connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, and the like; an output portion 707 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage portion 708 including a hard disk, and the like; and a communication portion 709 including a network interface card such as a LAN card, a modem, and the like. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as necessary. A removable medium 711 such as a magnetic disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 710 as necessary, so that a computer program read therefrom is installed into the storage portion 708 as necessary.

[0115] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present disclosure.

[0116] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more of the ROM 702 and / or the RAM 703 described above, and / or one or more memories other than the ROM 702 and the RAM 703.

[0117] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the environment detection method provided by the embodiments of the present disclosure.

[0118] The above functions defined in the system / apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 701. According to an embodiment of the present disclosure, the system, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0119] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage medium, a magnetic storage medium, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal via a network medium, and be downloaded and installed via the communication part 709 and / or installed from the detachable medium 711. The program codes contained in the computer program can be transmitted via any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0120] In such embodiments, the computer program can be downloaded and installed from the network via the communication section 709, and / or installed from the removable media 711. When the computer program is executed by the processor 701, the above-described functions defined in the system of the embodiments of the present disclosure are executed. According to the embodiments of the present disclosure, the system, device, apparatus, module, unit, and the like described above can be implemented by the computer program modules.

[0121] According to the embodiments of the present disclosure, the program code for executing the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes, but is not limited to, such as Java, C++, python, "C" language, or similar programming language. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected through the Internet by using an Internet service provider).

[0122] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams can represent a module, a segment, or a portion of code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in a different order than that shown in the figures. For example, two blocks noted in succession can actually be executed substantially concurrently, or they can sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the flowcharts or block diagrams, and combinations of blocks in the flowcharts or block diagrams, can be implemented by dedicated hardware-based systems that perform the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0123] Those skilled in the art can understand that the features described in various embodiments of the present disclosure and / or claims can be combined or / and integrated, even if such combinations or integrations are not explicitly described in the present disclosure. In particular, the features described in various embodiments of the present disclosure and / or claims can be combined and / or integrated in various combinations, without departing from the spirit and teachings of the present disclosure. All these combinations and / or integrations fall within the scope of the present disclosure.

[0124] The above-described embodiments of the present disclosure are merely intended to further explain the purpose, technical solutions and beneficial effects of the present disclosure, and are not used to limit the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An environment detection method, comprising: determining class information corresponding to a system service for deploying a target application according to the system service, the class information comprising service class information for controlling a window and service class information for controlling an installation package; determining attribute information of the target application according to the class information corresponding to the system service, the attribute information being used to represent running information of a corresponding class; and in a case where it is detected that the attribute information comprises a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information; in a case where it is detected that the attribute information comprises a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information, comprising: in a case where it is detected that the attribute information comprises a first identifier, obtaining first parent information inherited from the attribute information, the first parent information comprising parent class information corresponding to a sub-class to which the attribute information belongs; in a case where it is determined that the first parent information comprises a proxy class, determining that the running environment of the target application is an abnormal environment and the running environment is a first proxy mode.

2. The method of claim 1, wherein, in a case where it is detected that the attribute information comprises a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information, further comprising: in a case where it is detected that the attribute information comprises a second identifier, obtaining second parent information inherited from the attribute information, the second parent information comprising a parent interface of a class to which the attribute information belongs; in a case where it is determined that the second parent information comprises a proxy interface, determining that the running environment of the target application is an abnormal environment and the running environment is a second proxy mode.

3. The method of claim 1, wherein, the attribute information comprises sub-attribute information from a plurality of classes; in a case where it is detected that the attribute information comprises a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information, comprising: iteratively detecting the plurality of sub-attribute information, and in a case where it is detected that any of the sub-attribute information comprises a target identifier, determining a running environment of the target application according to parent information inherited from the attribute information.

4. The method of claim 1, wherein, determining attribute information of the target application according to the class information corresponding to the system service, comprising: determining attribute information of the target application according to the class information corresponding to the system service by a reflection method, the reflection method comprising one of object-based reflection, path-based reflection and class name-based reflection.

5. The method of claim 1, wherein, the target application comprises a first target application directly installed in a terminal device and a second target application installed in a virtual machine product in the terminal device, the first target application and the second target application being the same application, the first target application and the second target application being simultaneously installed in the terminal device, further comprising: in a case where it is determined that the first target application is in a normal running environment, starting the second target application; in a case where it is determined that the running environment of the second target application is an abnormal environment, maintaining a running state of the first target application and returning an environment abnormality flag and a termination running instruction to the second target application.

6. The method of claim 1, further comprising: in a case where it is determined that the running environment of the target application is an abnormal environment, returning an environment abnormality flag and a termination running instruction to the target application; in a case where it is determined that the running environment of the target application is a normal environment, detecting the running environment of the target application by using an additional environment detection method.

7. An environment detection apparatus, comprising: a class information determination module configured to determine class information corresponding to a system service for deploying a target application according to the system service, the class information comprising service class information for controlling a window and service class information for controlling an installation package; an attribute information determination module configured to determine attribute information of the target application according to the class information corresponding to the system service, the attribute information being used to represent running information of a corresponding class; and an environment detection module configured to, in a case where it is detected that the attribute information comprises a target identifier, determine a running environment of the target application according to parent information inherited from the attribute information; the environment detection module is further configured to, in a case where it is detected that the attribute information comprises a first identifier, acquire first parent information inherited from the attribute information, the first parent information comprising parent class information corresponding to a sub-class to which the attribute information belongs; and in a case where it is determined that the first parent information comprises a proxy class, determine that the running environment of the target application is an abnormal environment and the running environment is a first proxy mode.

8. An electronic device, comprising: one or more processors; a storage apparatus configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method according to any one of claims 1-6.

9. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-6.

Images