A method and system for implementing inter-application cooperation in a resource-constrained device

Abstract

The application relates to a method and system for realizing inter-application cooperation in a resource-limited device and belongs to the technical field of computer security. The method comprises the following steps: a client application initiates a service request, provides a client application identifier and a specified service identifier to a service access module; the service access module calls a registration service interface method of a service application to obtain a registration service interface, and authenticates the client application through the registration service; after the authentication, the service requested by the client application is registered through a service management module; the client application calls a service interface method of the service application through the service access module to obtain a service interface, and uses the service; and the client application calls the service access module to create a shadow array object, so that data exchange between applications is realized. The application can effectively avoid fake client applications, and prevent unauthorized use of service application resources; since the service application does not authenticate the client according to the client application identifier, even if the service application has been deployed, the service application can still support access of a post-installed client application.

Description

Technical Field

[0001] This invention belongs to the field of computer security technology, specifically a method and system for enabling inter-application collaboration in resource-constrained devices, used to achieve secure communication between applications on resource-constrained devices such as smart cards and security elements. Background Technology

[0002] In implementing virtual machine technology on resource-constrained devices, traditional techniques provide runtime environment privileges, runtime environment entry point objects, global arrays, and shared interface object mechanisms to support inter-application collaboration. The first three mechanisms are used for interaction between the runtime environment and applications, while the shared interface object mechanism aims to provide collaboration between applications. Traditional techniques define a marker interface called Shareable; any interface extending the Shareable interface is considered a shared interface, and firewall mechanisms allow requests for services to be made to objects implementing the shared interface.

[0003] The existing shared interface object mechanism has some security flaws and shortcomings, such as impersonation of client applications and unauthorized use of resources. Since the service application relies on the client application identifier (AID) to authenticate the client, if the service application is not upgraded after it has been deployed, it will not be able to support access to the service application by the client applications installed later. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the present invention aims to provide a method and system for enabling inter-application collaboration in resource-constrained devices. This method and system can effectively prevent counterfeit client applications and unauthorized use of service application resources, while also supporting access to service applications by newly installed client applications without requiring service application upgrades.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A system for enabling inter-application collaboration in a resource-constrained device includes a service application, a service management module, a service access module, a runtime environment, and a client application, wherein:

[0007] The service application provides a variety of services to the client application. Each service includes a service identifier, a service interface, and a registration service interface for authenticating the client before using the service. The service interface and the registration service interface are marked as output interfaces through the annotation mechanism provided by the high-level programming language. The object that implements the output interface is called the output interface object. The compiler / converter generates output flags for the output interface and the class of the output interface object in the interface definition of the executable file.

[0008] The service management module is used to manage the services output by the service application and the registered services. The management functions include: installing services, managing the service requests from client applications, obtaining the registration service interface and service interface of a specified service identifier, and querying whether a specified service is authorized for use.

[0009] The runtime environment includes a virtual machine for executing the client application and the service application. The client application and the service application are protected by a firewall mechanism implemented by the runtime environment during execution. The firewall mechanism ensures that the client application cannot access objects owned by the service application, and the service application cannot access objects owned by the client application. The virtual machine allows the client application to call the output interface methods implemented by the output interface object of the service application across the firewall mechanism according to the output flag, thereby realizing communication between the client application and the service application.

[0010] The service access module is implemented by the runtime environment and is used to replace the client application in requesting the output interface method of the service application. The client application uses the output service of the service application through the service access module.

[0011] Furthermore, in the system for enabling inter-application collaboration in a resource-constrained device as described above, the service application determines and implements the authentication method for the registered client. When a challenge / response authentication mechanism is used, the service application and the client application share a secret data in advance.

[0012] Furthermore, in the system for implementing inter-application collaboration in a resource-constrained device as described above, the service management module is implemented as a service application superclass, and specific service applications inherit from the service application superclass.

[0013] Furthermore, in the system for implementing inter-application collaboration in a resource-constrained device as described above, the operating environment implements the service access module through an application programming interface.

[0014] Furthermore, in the system for implementing inter-application collaboration in a resource-constrained device as described above, the service access module also provides a function to create a shadow array object of an array object, which is used to realize data sharing between the client application and the service application. The shadow array object and the source array object have the same member type and the same storage location of the members. The shadow array object is owned by the service application specified when it is created.

[0015] A method for implementing inter-application collaboration in a resource-constrained device using the above system includes the following steps:

[0016] S1. The client application initiates a service request, providing the service access module with the client application's identifier and the service identifier for the requested service;

[0017] S2. The service access module queries the service application based on the service identifier of the service requested by the client, and calls the registration service interface method provided by the service application to obtain the registration service interface corresponding to the service application. The registration service interface method provided by the service application contains the identifier of the client application. The client application completes the authentication of the client application by the service application through the registration service.

[0018] S3. After the client application is authenticated, the service application registers the services requested by the client application through the service management module.

[0019] S4. The client application obtains the service interface corresponding to the service application by calling the service interface method provided by the service application through the service access module, and then uses the requested service.

[0020] Furthermore, in the method for implementing inter-application collaboration in a resource-constrained device as described above, when the service access module in step S2 is implemented using an application programming interface, the authentication process of the client application is specifically as follows:

[0021] The application programming interface requests the registration service interface object corresponding to the service application based on the identifier of the client application and the service identifier of the requested service;

[0022] The service application returns an output interface object that implements the registration service through a general registration service interface.

[0023] The client application performs type conversion on the general registration service interface and then calls the corresponding registration service interface method.

[0024] The client application can complete the authentication of the client application by the service application by calling the registration service interface method through the virtual machine's firewall.

[0025] Furthermore, in the method for implementing inter-application collaboration in a resource-constrained device as described above, step S3 specifically includes:

[0026] The service management module registers the services requested by the client application using the client application's identifier and the service identifier of the requested service, and saves the authorization status in the RAM area.

[0027] Furthermore, in the method for implementing inter-application collaboration in a resource-constrained device as described above, the process of the client application using the service in step S4 specifically includes:

[0028] The application programming interface requests the service interface object corresponding to the service application based on the identifier of the client application and the service identifier of the requested service;

[0029] The service management module queries whether the specified service is authorized to be used based on the identifier of the customer application and the service identifier of the requested service;

[0030] If authorized, the service application returns the output interface object that implements the service in the form of a generic service interface;

[0031] The client application performs type conversion on the general service interface and then calls the corresponding service interface method.

[0032] Client applications can call the service interface methods through the virtual machine's firewall and use the requested service.

[0033] Furthermore, in the method for implementing inter-application collaboration in resource-constrained devices as described above, the client application calls the service access module as needed to create a shadow array object of the array object, thereby enabling data exchange between the client application and the service application. Specific steps include:

[0034] The client application calls the application programming interface to create a shadow array object of the source array object owned by the specified service application. The shadow array object is owned by the service application.

[0035] When a client application calls an output interface method, it passes the shadow array object as a parameter to the service application.

[0036] The service application accesses the shadow array object through the shadow array object parameters, reads input data from the client application or writes data to the shadow array object, and realizes the function of returning data to the client application.

[0037] When the output interface method returns, the client application obtains the data returned by the service application by reading the source array of the shadow array object.

[0038] The method and system for enabling inter-application collaboration in resource-constrained devices as described in this invention have the following significant technical advantages:

[0039] This invention uses the annotation mechanism provided by a high-level programming language compiler / converter to mark the service interfaces and registration service interfaces of the service application as output interfaces. Output flags are generated in the interface definition of the executable file. Based on these output flags, the virtual machine allows client applications to call the output interface methods implemented by the service application's output interface objects across firewall mechanisms. Before a client application can access a service of the service application, it must first be authenticated through the corresponding registration service. After successful authentication, the requested service is registered through the service management module before the service can be used. The entire process is managed by the service management module, which manages both the services output by the service application and the registered services. The service access module calls the service application's output interface methods on behalf of the client application, and data sharing between the client application and the service application is achieved through the shadow array object function. This effectively avoids impersonating client applications and prevents unauthorized use of the service application's resources. Because the service application does not rely on client application identifiers for authentication, it can support access from subsequently installed client applications even after the service application has been deployed. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of a system structure for enabling inter-application collaboration in a resource-constrained device, provided by the present invention.

[0041] Figure 2 This is a flowchart of a method for enabling inter-application collaboration in a resource-constrained device provided by the present invention;

[0042] Figure 3 This is a flowchart of a method for implementing inter-application collaboration in a resource-constrained device, provided in an embodiment of the present invention. Detailed Implementation

[0043] The present invention will now be further described with reference to specific embodiments and the accompanying drawings.

[0044] This invention describes a method and system for implementing inter-application collaboration in resource-constrained devices. The inter-application collaboration method is executed by an inter-application collaboration system installed in resource-constrained devices such as smart cards, secure elements, and secure MCUs. Some key technologies involved in the embodiments of this application are explained below.

[0045] like Figure 1 As shown, this inter-application collaboration system can be configured in a resource-constrained device. It includes a client application 101, a service access module 102, a runtime environment 103, a service application 104, and a service management module 105, wherein:

[0046] Service Application 104: Provides various services to Client Application 101. Each service consists of a corresponding service identifier 1041, a service interface 1042, and a registration service interface 1043 that requires client authentication before using the service. The service application uses annotations provided by the high-level programming language compiler / converter to mark service interface 1042 and registration service interface 1043 as output interfaces. Each output interface defines a set of output interface methods, and an instance of a class implementing the output interface is called an output interface object. Output flags are generated for the output interfaces and the classes of output interface objects in the interface definition of the executable file.

[0047] Service application 104 provides a corresponding registration service interface 1043 for each output service. The authentication method used for registration is determined by service application 104, such as a challenge / response authentication mechanism, which requires service application 104 and client application 101 to share a secret data in advance. Client application 101 must first authenticate using the registration service corresponding to the requested service. After successful authentication, service application 104 registers the application identifier (AID) and service identifier 1041 of client application 101.

[0048] After service application 104 registers the service requested by the client, client application 101 requests the service interface object, and service application 104 returns a general service interface, which is then called after type conversion.

[0049] Specifically, the functions provided by service application 104 include:

[0050] Designated service identifier 1041;

[0051] Create an instance of the class that implements service interface 1042, i.e., the service interface object;

[0052] Create an instance of the class that implements service interface 1043, i.e., the registration service interface object;

[0053] Request the service management module 105 to register each service to be output;

[0054] A method is provided that can be called by the runtime environment 103 instead of the client application 101 to provide output services, which is implemented by the service application 104 through requesting the service management module 105.

[0055] Service Management Module 105: Used to manage the services output and registered services of Service Application 104. Service Management Module 105 can be implemented as a superclass of Service Application 104, and specific service applications can inherit from the Service Application superclass.

[0056] The management functions provided by the service management module 105 include:

[0057] For installation services, the service application needs to provide the corresponding service identifier 1041, service interface 1042, and registration service interface 1043 for authenticating customers when installing services.

[0058] This is used to manage the request services of client application 101, including services for registering / unregistering client application requests, locking / unlocking client application requests, querying service status, etc.

[0059] The registration service interface 1043 and service interface 1042 are used to obtain the specified service identifier 1041;

[0060] This is used to query whether a specified service is authorized for use. The authorization status can be stored in the RAM area. It can be cleared upon reset or by deselection. Each time the client application 101 calls the service interface method, it needs to query whether the service is authorized for use.

[0061] The runtime environment 103 includes a virtual machine for executing client application 101 and service application 104. During execution, client application 101 and service application 104 are protected by a firewall mechanism 106 implemented in the runtime environment 103. The firewall mechanism 106 ensures that client application 101 cannot access objects owned by service application 104, and service application 104 cannot access objects owned by client application 101. When the virtual machine performs a firewall check, it can, based on output flags, allow client application 101 to call output interface methods implemented by the output interface object of service application 104 across the firewall mechanism 106, thereby enabling communication between client application 101 and service application 105.

[0062] The service access module 102 is implemented by the runtime environment 103 and is used to replace the client application 101 in requesting the output interface method of the service application 104. The runtime environment 103 typically implements the service access module 102 through an application programming interface, but it can also be implemented in other ways.

[0063] Client application 101 uses the output service of service application 104 through service access module 102. When service access module 102 is implemented using an application programming interface (API), client application 101 calls the API, providing the identifier of the service application to be accessed (such as AID) and the service identifier of the requested service. It first obtains the server-authenticated client registration service interface, completes the service application's authentication of the client application through the registration service, and after successful authentication, the client application can request the service application to return a service interface object to use the output service.

[0064] The service access module 102 also provides a function to create shadow array objects of array objects, used to realize data exchange between client applications and service applications. In one specific embodiment, the client application 101 calls the application programming interface as needed to create a shadow array object of its own array. The shadow array object is owned by the service application specified at the time of creation. The shadow array object and the source array object have the same member type and the same member storage location, but the shadow array object is owned by the specified service application, and therefore has different access permissions and security attributes.

[0065] When client application 101 calls the output interface method, it can pass the shadow array object as a parameter to service application 104 as needed. Since the shadow array object is owned by service application 104, service application 104 can access the shadow array object, read input data from client application 101, and write data to the shadow array object. When the output interface method returns, client application 101 can obtain the data returned by service application 104 by reading the source array of the shadow array object, thereby realizing data exchange between client application 101 and service application 104.

[0066] Based on the above system, this embodiment of the invention provides a method for implementing inter-application collaboration in a resource-constrained device. Figure 2 A flowchart of the method is shown, which includes:

[0067] S1. The client application initiates a service request, providing the service access module with the client application's identifier and the service identifier for the requested service.

[0068] S2. The service access module queries the service application based on the service identifier of the service requested by the client, and calls the registration service interface method provided by the service application to obtain the registration service interface corresponding to the service application. The registration service interface method provided by the service application contains the identifier of the client application. The client application completes the authentication of the client application by the service application through the registration service.

[0069] In one specific embodiment, the service access module is implemented using an application programming interface (API). The API requests the registration service interface object corresponding to the service application based on the identifier of the client application and the service identifier of the requested service. The service application returns an output interface object that implements the registration service through a general registration service interface. The client application performs type conversion on the general registration service interface and calls the corresponding registration service interface method. The client application's call to the registration service interface method can be checked by the virtual machine's firewall, thus completing the authentication of the client application by the service application.

[0070] S3. After the client application is authenticated, the service application registers the services requested by the client application through the service management module.

[0071] Service applications implement service and customer registration management functions by accessing different functions of the service management module. In one specific embodiment, the service management module uses the customer application's identifier and the service identifier of the requested service to register the service requested by the customer application. The authorization status can be stored in the RAM area. Each time the customer application 101 calls a service interface method, it needs to query whether the service has been authorized for use.

[0072] S4. The client application obtains the service interface corresponding to the service application by calling the service interface method provided by the service application through the service access module, and then uses the requested service.

[0073] In one specific embodiment, the service access module is implemented using an application programming interface (API). The API requests the service interface object corresponding to the service application based on the identifier of the client application and the service identifier of the requested service. The service management module queries whether the specified service is authorized for use based on the identifier of the client application and the service identifier of the requested service. If authorized, the service application returns an output interface object implementing the service in the form of a generic service interface. The client application performs type conversion on the generic service interface and calls the corresponding service interface method. The client application's call to the service interface method can be checked by the virtual machine's firewall, and the client application uses the requested service.

[0074] In one specific embodiment, the client application calls the service access module to create a shadow array object of the array as needed, thereby realizing data exchange between the client application and the service application. The specific steps include:

[0075] Client application 101 calls the application programming interface to create a shadow array object of its own source array for a specified service application 104, wherein the shadow array object is owned by the specified service application 104;

[0076] When client application 101 calls the output interface method, it passes the shadow array object parameter to service application 104.

[0077] Service application 104 accesses the shadow array object through the shadow array object parameter, reads the input data of client application 101 or writes data to the shadow array object, and realizes the function of returning the data to the client application.

[0078] When the output interface method returns, client application 101 obtains the data returned by service application 104 by reading the source array of the shadow array object.

[0079] Based on the aforementioned methods and systems for achieving inter-application collaboration in resource-constrained devices, a specific implementation example is presented below for reference. Figure 3 As shown.

[0080] tgomos.base package

[0081] Define a generic service interface (Service)

[0082] All output service interfaces need to inherit this interface.

[0083] Interface Service;

[0084] Define a generic registration service interface RegisterService

[0085] All registration service interfaces need to inherit from this interface;

[0086] Interface RegisterService;

[0087] Define the ServiceManager interface for the service management module.

[0088] ServiceManager should include at least the following methods:

[0089] registerService(serviceID,Service,RegisterService);

[0090] isAuthorized(serviceID,Client);

[0091] block(Client);

[0092] isBlocked(Client);

[0093] registerClient(serviceID,Client);

[0094] unRegisterClient(serviceID,Client);

[0095] isClientRegistered(serviceID,Client);

[0096] ...

[0097] Define the application base class Application

[0098] This abstract class defines an application based on virtual machine technology. Applications that need to be loaded, installed, and executed on a virtual machine platform must inherit the Application class.

[0099] The following callback method needs to be implemented.

[0100] installApplication

[0101] selectApplication

[0102] processAPDU

[0103] deselectApplication

[0104] Define the base class ServerApplication for the service application.

[0105] Applications that provide output services need to inherit from ServerApplication.

[0106] ServerApplication extend Application

[0107] Implement shared service management functions

[0108] At least the following methods are included

[0109] @CallBack

[0110] RegisterService getRegisterService(clientAID,serviceID)

[0111] @CallBack

[0112] Service getService(clientAID,serviceID)

[0113] ServiceManager getServiceManager()

[0114] ...

[0115] The methods getRegisterService and getService are callback methods that can be called by the runtime environment.

[0116] A subclass of ServerApplication calls the getServiceManager method of its parent class to return the ServiceManager interface and access the output service manager provided by the parent class.

[0117] ServerApplication constructor

[0118] ServerApplication(maxRegistrations,storageMode)

[0119] `maxRegistrations` allows for the maximum number of services that can be registered.

[0120] storageMode allows you to store various registration information in either persistent or volatile memory. For volatile memory, you can specify options to clear it upon reset or deselect it.

[0121]

[0122]

[0123]

[0124] This invention provides a method and system for enabling inter-application collaboration in resource-constrained devices. It utilizes annotation mechanisms provided by a high-level programming language compiler / converter to mark service interfaces and registration service interfaces of service applications as output interfaces. Output flags are generated in the interface definitions of executable files. The virtual machine, based on these output flags, allows client applications to call the output interface methods implemented by the service application's output interface objects across firewall mechanisms. Before accessing a service of a service application, a client application must first be authenticated through the corresponding registration service. After successful authentication, the requested service is registered through the service management module before the service can be used. The entire process is managed by the service management module, which manages the services output and registration services of the service application. A service access module calls the service application's output interface methods on behalf of the client application. Data sharing between the client application and the service application is achieved through shadow array objects, effectively preventing impersonation of client applications and unauthorized use of service application resources. Because the service application does not rely on client application identifiers for authentication, it can support access from subsequently installed client applications even after the service application has been deployed.

[0125] The above embodiments are merely illustrative examples of the present invention. The present invention may also be implemented in other specific ways or forms without departing from its spirit or essential characteristics. Therefore, the described embodiments should be considered illustrative rather than limiting in any respect. The scope of the present invention should be defined by the appended claims, and any variations equivalent to the intent and scope of the claims should also be included within the scope of the present invention.

Claims

1. A system for enabling inter-application collaboration in resource-constrained devices, characterized in that, The system includes service applications, a service management module, a service access module, a runtime environment, and client applications, wherein: The service application provides a variety of services to the client application. Each service includes a service identifier, a service interface, and a registration service interface for authenticating the client before using the service. The service interface and the registration service interface are marked as output interfaces through the annotation mechanism provided by the high-level programming language. The object that implements the output interface is called the output interface object. The compiler / converter generates output flags for the output interface and the class of the output interface object in the interface definition of the executable file. The service management module is used to manage the services output by the service application and the registered services. The management functions include: installing services, managing the service requests from client applications, obtaining the registration service interface and service interface of a specified service identifier, and querying whether a specified service is authorized for use. The runtime environment includes a virtual machine for executing the client application and the service application. The client application and the service application are protected by a firewall mechanism implemented by the runtime environment during execution. The firewall mechanism ensures that the client application cannot access objects owned by the service application, and the service application cannot access objects owned by the client application. The virtual machine allows the client application to call the output interface methods implemented by the output interface object of the service application across the firewall mechanism according to the output flag, thereby realizing communication between the client application and the service application. The service access module is implemented by the runtime environment and is used to replace the client application in requesting the output interface method of the service application. The client application uses the output service of the service application through the service access module.

2. The system for enabling inter-application collaboration in a resource-constrained device according to claim 1, characterized in that, The service application determines and implements the authentication method for the registered customer. When a challenge / response authentication mechanism is used, the service application and the customer application share a secret data in advance.

3. The system for enabling inter-application collaboration in a resource-constrained device according to claim 2, characterized in that, The service management module is implemented as a service application superclass, and specific service applications inherit from the service application superclass.

4. The system for enabling inter-application collaboration in a resource-constrained device according to claim 1, characterized in that, The runtime environment implements the service access module through an application programming interface.

5. The system for enabling inter-application collaboration in a resource-constrained device according to claim 1, characterized in that, The service access module also provides a function to create a shadow array object of an array object, which is used to realize data sharing between the client application and the service application. The shadow array object and the source array object have the same member type and the same storage location of the members. The shadow array object is owned by the service application specified when it is created.

6. A method for implementing inter-application collaboration in a resource-constrained device using the system of any one of claims 1-5, comprising the following steps: S1. The client application initiates a service request, providing the service access module with the client application's identifier and the service identifier for the requested service; S2. The service access module queries the service application based on the service identifier of the service requested by the client, and calls the registration service interface method provided by the service application to obtain the registration service interface corresponding to the service application. The registration service interface method provided by the service application contains the identifier of the client application. The client application completes the authentication of the client application by the service application through the registration service. S3. After the client application is authenticated, the service application registers the services requested by the client application through the service management module. S4. The client application obtains the service interface corresponding to the service application by calling the service interface method provided by the service application through the service access module, and then uses the requested service.

7. The method for implementing inter-application collaboration in a resource-constrained device according to claim 6, characterized in that, When the service access module described in step S2 is implemented using an application programming interface, the authentication process of the client application is as follows: The application programming interface requests the registration service interface object corresponding to the service application based on the identifier of the client application and the service identifier of the requested service; The service application returns an output interface object that implements the registration service through a general registration service interface. The client application performs type conversion on the general registration service interface and then calls the corresponding registration service interface method. The client application can complete the authentication of the client application by the service application by calling the registration service interface method through the virtual machine's firewall.

8. The method for implementing inter-application collaboration in a resource-constrained device according to claim 7, characterized in that, Step S3 is as follows: The service management module registers the services requested by the client application using the client application's identifier and the service identifier of the requested service, and saves the authorization status in the RAM area.

9. The method for implementing inter-application collaboration in a resource-constrained device according to claim 8, characterized in that, The process of the client application using the service described in step S4 is as follows: The application programming interface requests the service interface object corresponding to the service application based on the identifier of the client application and the service identifier of the requested service; The service management module queries whether the specified service is authorized to be used based on the identifier of the customer application and the service identifier of the requested service; If authorized, the service application returns the output interface object that implements the service in the form of a generic service interface; The client application performs type conversion on the general service interface and then calls the corresponding service interface method. Client applications can call the service interface methods through the virtual machine's firewall and use the requested service.

10. The method for implementing inter-application collaboration in a resource-constrained device according to any one of claims 7-9, characterized in that, The client application calls the service access module to create a shadow array object of the array object as needed, enabling data exchange between the client application and the service application. Specific steps include: The client application calls the application programming interface to create a shadow array object of the source array object owned by the specified service application. The shadow array object is owned by the service application. When a client application calls an output interface method, it passes the shadow array object as a parameter to the service application. The service application accesses the shadow array object through the shadow array object parameters, reads input data from the client application or writes data to the shadow array object, and realizes the function of returning data to the client application. When the output interface method returns, the client application obtains the data returned by the service application by reading the source array of the shadow array object.

Images