Application monitoring method and apparatus, electronic device, and computer-readable storage medium

Abstract

The application provides an application monitoring method and device, electronic equipment and a computer readable storage medium, wherein the method comprises the following steps: calculating a first verification value according to application related files of a target application program at the beginning of running of the target application program; calculating a second verification value according to the application related files of the target application program in the running process of the target application program; comparing the first verification value with the second verification value to determine a verification result of the target application program; and determining a monitoring action according to the verification result and a monitoring strategy corresponding to the target application program.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and more specifically, to an application monitoring method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] With the increasing data flow interaction between various network devices and mobile devices, the security of each data exchange process is directly related to the security of user data and computer equipment. Within a complete data exchange process, the security of the applications that handle data sending, receiving, and processing is directly related to the security of the entire data exchange process. Current application monitoring typically involves setting monitoring policies to detect abnormal application behavior, but the security and reliability of current application monitoring methods remain insufficient. Summary of the Invention

[0003] The purpose of this application is to provide an application monitoring method, apparatus, electronic device, and computer-readable storage medium to improve the security deficiencies in application monitoring.

[0004] In a first aspect, the present invention provides an application monitoring method, comprising: calculating a first verification value based on application-related files of the target application at the beginning of the operation of the target application; calculating a second verification value based on application-related files of the target application during the operation of the target application; comparing the first verification value with the second verification value to determine the verification result of the target application; and determining a monitoring action based on the verification result and the monitoring strategy corresponding to the target application.

[0005] In the above implementation, by comparing whether there are changes in application-related files at the beginning of application operation and during operation, it can be determined whether the application has been tampered with, and whether there are security risks in the operation of the application. Based on the determination of the security risks, relevant monitoring actions can be provided. This can more accurately determine the security of the current application operation and provide corresponding monitoring actions. It can also provide beneficial operations for applications with potential risks, thereby improving the security of application operation.

[0006] In an optional implementation, the application-related files include the target application file of the target application and the target memory image of the target application;

[0007] The step of calculating a first verification value based on the application-related files of the target application at the beginning of the target application's operation includes: calculating a first application verification value based on the target application file of the target application at the beginning of the target application's operation; and calculating a first image verification value based on the target memory image of the target application.

[0008] The step of calculating a second verification value based on the application-related files of the target application during the operation of the target application includes: calculating a second application verification value based on the target application file of the target application during the operation of the target application; and calculating a second image verification value based on the target memory image of the target application.

[0009] The step of comparing the first application verification value with the second application verification value to determine the verification result of the target application includes: comparing the first application verification value with the second application verification value, and comparing the first image verification value with the second image verification value to determine the verification result of the target application.

[0010] In the above embodiments, the application files of the application and the memory image during the execution process can be monitored for any abnormalities, enabling more comprehensive application identification and detecting whether the application has been tampered with. This also makes application monitoring more accurate, and the corresponding monitoring actions can respond to monitoring needs more promptly, thereby improving application security.

[0011] In an optional implementation, calculating the second application verification value based on the target application file of the target application includes:

[0012] Using the first hash algorithm, a second application verification value is calculated based on the target application file of the target application.

[0013] The step of calculating the second image verification value based on the target memory image of the target application includes:

[0014] Using a second hash algorithm, a second image verification value is calculated based on the target memory image of the target application, wherein the first hash algorithm and the second hash algorithm are the same algorithm, or the first hash algorithm and the second hash algorithm are different algorithms.

[0015] In the above implementation, a first hash algorithm for matching the target application file and a second hash algorithm for matching the target memory image are used to adapt to the computational needs of different application files.

[0016] In an optional implementation, the first hash algorithm is a hash algorithm; the second hash algorithm is a hash operation message authentication code algorithm.

[0017] In the above implementation, the first hash algorithm uses a hash algorithm to improve the calculation efficiency of the verification value of the target application file, and the second hash algorithm uses a hash operation message authentication code algorithm to improve the security of the calculation of the target memory image, thus better adapting to the calculation needs of different files.

[0018] In an optional implementation, the step of using a second hash algorithm to calculate a second image verification value based on the target memory image of the target application includes: using a second hash algorithm to calculate a second image verification value based on the target memory image of the target application and a pre-stored calculation key.

[0019] In the above implementation, the second image verification value corresponding to the target memory image can be calculated by combining the calculation key. This can make the calculated second image verification value better reflect the target memory image and make the verification of the target memory image more accurate.

[0020] In an optional implementation, the step of using a second hash algorithm to calculate a second image verification value based on the target memory image of the target application and a pre-stored computation key includes:

[0021] The target cryptographic card is invoked, and the second hash algorithm provided by the target cryptographic card is used to calculate the second image verification value based on the target memory image and the pre-stored computing key.

[0022] In an optional implementation, the step of invoking the target cryptographic card and using the second hash algorithm provided by the target cryptographic card to calculate the second image verification value based on the target memory image and the pre-stored computation key includes:

[0023] The target cryptographic card is invoked, and the target memory image and the calculation key identifier are obtained through the second hash algorithm interface provided by the target cryptographic card;

[0024] The computation key is determined based on the computation key identifier;

[0025] Using the second hash algorithm provided by the second hash algorithm interface, a second image verification value is calculated based on the target memory image and the computation key.

[0026] In an optional implementation, the step of using a first hash algorithm to calculate a second application verification value based on the target application file of the target application includes:

[0027] The target cryptographic card is invoked, and a second application verification value is calculated based on the target application file of the target application using the first hash algorithm provided by the target cryptographic card.

[0028] In the above implementation, by calling the password card to calculate various verification values, the correctness, security, and effectiveness of the password algorithm for calculating various verification values ​​can be improved, thereby increasing the accuracy of the calculated verification values.

[0029] In an optional implementation, it is applied to an electronic device that runs an application monitoring service, the application monitoring service being used to perform a process of monitoring the target application;

[0030] Before calculating the first verification value based on the application-related files of the target application at the beginning of the target application's execution, the method further includes:

[0031] The target cryptographic card is initialized to generate a signature verification key pair and an encryption key pair;

[0032] The application monitoring service is initialized using the signature verification key pair and the encryption key pair to obtain the calculation key and the calculation key identifier corresponding to the calculation key.

[0033] In the above implementation, the target cryptographic card and application monitoring service can also be initialized to realize key management and configuration in the cryptographic card, making the use of the cryptographic card more secure and flexible.

[0034] In an optional implementation, the initialization process of the application monitoring service using the signature verification key pair and the encryption key pair to obtain the calculation key and the calculation key identifier corresponding to the calculation key includes:

[0035] The application monitoring service calls the generation interface of the target password card to generate a calculation key and a calculation key identifier corresponding to the calculation key;

[0036] The calculation key is signed using the signature key in the verification key pair to generate a key signature value;

[0037] The key signature value is encrypted using the encryption key in the encryption key pair to generate the signature ciphertext;

[0038] The application monitoring service calls the verification interface of the target password card and uses the decryption key corresponding to the encryption key to decrypt the signature ciphertext to obtain the decrypted signature value.

[0039] The decrypted signature value is verified using the verification key in the verification key pair;

[0040] If the decrypted signature value is verified, the initialization of the application monitoring service is complete.

[0041] In the above implementation, the call relationship between the application monitoring service and the password card can be initialized using the initialization key of the target password card, which can make the call between the application monitoring service and the password card smoother and more secure.

[0042] In an optional implementation, the method further includes: if the application monitoring service fails to call the generation interface of the target password card, or if the application monitoring service fails to call the verification interface of the target password card, returning an interface call exception prompt to the application monitoring service through the target password card.

[0043] In the above implementation, if the call to the password card interface fails during the application monitoring service initialization process, a prompt can be given to the user so that the user can take appropriate remedial measures.

[0044] In an optional implementation, the method further includes:

[0045] Start the application monitoring service and read the configuration file of the application monitoring service, which includes a list of applications to be monitored;

[0046] Determine if any currently running applications belong to the list of applications to be monitored;

[0047] If no application currently running is included in the list of applications to be monitored, an alarm message will be output.

[0048] In the above implementation, multiple applications can also be managed through the application monitoring service, and relevant alarm prompts can be output when no application is running, so as to improve the efficiency of the application monitoring service.

[0049] In an optional implementation, calculating the first verification value based on the application-related files of the target application includes: calling a target hook function, calling the target application through the target hook function to obtain the application-related files of the target application; and calculating the first verification value based on the application-related files.

[0050] The step of calculating the second verification value based on the application-related files of the target application includes: calling a target hook function, which in turn calls the target application to obtain the application-related files of the target application; and calculating the second verification value based on the application-related files.

[0051] In a second aspect, the present invention provides an application monitoring device, comprising:

[0052] The first calculation module is used to calculate the first verification value based on the application-related files of the target application at the beginning of the target application's operation.

[0053] The second calculation module is used to calculate the second verification value based on the application-related files of the target application during the operation of the target application.

[0054] The comparison module is used to compare the first verification value with the second verification value to determine the verification result of the target application;

[0055] The first determining module is used to determine the monitoring action based on the verification result and the monitoring policy corresponding to the target application.

[0056] Thirdly, the present invention provides an electronic device, including: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the machine-readable instructions are executed by the processor to perform the steps of the method described in any of the foregoing embodiments.

[0057] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the method described in any of the foregoing embodiments.

[0058] The beneficial effects of the embodiments of this application are: Attached Figure Description

[0059] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 A block diagram illustrating an electronic device provided in an embodiment of this application;

[0061] Figure 2 A flowchart illustrating the application monitoring method provided in this application embodiment;

[0062] Figure 3 Another flowchart of the application monitoring method provided in the embodiments of this application;

[0063] Figure 4 An optional flowchart of step 212 of the application monitoring method provided in the embodiments of this application;

[0064] Figure 5 Another flowchart of the application monitoring method provided in the embodiments of this application;

[0065] Figure 6 This is a schematic diagram of the functional modules of the application monitoring device provided in the embodiments of this application. Detailed Implementation

[0066] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0067] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0068] To improve application security, running applications are currently monitored. One common monitoring method involves first generating a trusted database of runtime environment factors, setting weights for each factor, and defining a target overall match rate. Then, the actual overall match rate is calculated by acquiring the runtime environment factors of the Linux system. This actual match rate is then compared to the set target overall match rate, and this is used to control whether the web application can continue running. As this method shows, applications already in operation may deviate from the specified limits, allowing them to continue running even when the environment is untrusted. This poses a security risk to the application.

[0069] Based on this, the application monitoring method, apparatus, electronic device, and computer-readable storage medium provided in this application can improve the security of application operation.

[0070] To facilitate understanding of this embodiment, the electronic device that performs the application monitoring method disclosed in this application embodiment will first be described in detail.

[0071] like Figure 1 The diagram shown is a block illustration of an electronic device. The electronic device 100 may include a memory 111 and a processor 113. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device 100. For example, the electronic device 100 may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0072] The memory 111 and processor 113 described above are electrically connected to each other directly or indirectly to enable data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines. The processor 113 described above is used to execute executable modules stored in the memory.

[0073] The memory 111 can be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The memory 111 stores programs, which are executed by the processor 113 upon receiving execution instructions. The methods executed by the electronic device 100 as defined in any embodiment of this application can be applied to or implemented by the processor 113.

[0074] The aforementioned processor 113 may be an integrated circuit chip with signal processing capabilities. The processor 113 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a digital signal processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor.

[0075] The electronic device 100 in this embodiment can be used to execute various steps in the various methods provided in the embodiments of this application. The implementation process of the application monitoring method is described in detail below through several embodiments.

[0076] Please see Figure 2 This is a flowchart of the application monitoring method provided in the embodiments of this application. The following will describe... Figure 2 The specific process shown will be explained in detail.

[0077] Step 220: At the beginning of the target application's operation, calculate the first verification value based on the application-related files of the target application.

[0078] For example, after starting application monitoring, when the target application is launched for the first time, a first verification value can be calculated based on the application-related files of the target application.

[0079] Optionally, after calculating the first verification value, the first verification value can be stored in a specified content space for subsequent verification of the target application.

[0080] Optionally, a target hook function can be called to invoke the target application to obtain the application-related files of the target application; based on the application-related files, a first verification value can be calculated.

[0081] Step 220: During the operation of the target application, calculate the second verification value based on the application-related files of the target application.

[0082] In this embodiment, the verification frequency for each application can be preset, so that a second verification value can be calculated based on the verification frequency during the operation of the target application.

[0083] Optionally, a target hook function is invoked, which in turn invokes the target application to obtain the application-related files of the target application; based on the application-related files, a second verification value is calculated.

[0084] Step 260: Compare the first verification value with the second verification value to determine the verification result of the target application.

[0085] If the first verification value is the same as the second verification value, it can be determined that the target application has not been tampered with during operation, and the target application's state can be determined to be normal. If the first verification value is different from the second verification value, it can be determined that the target application has not been tampered with during operation, and the target application's state can be determined to be abnormal.

[0086] Step 280: Based on the verification result and the monitoring policy corresponding to the target application, determine the monitoring action.

[0087] This monitoring policy can define different monitoring actions required for different verification results. For example, the monitoring actions may include: alert notification, exiting the application, marking the application status, and displaying the application's verification results.

[0088] Different verification results can correspond to different monitoring actions. For example, if the verification result indicates that the target application is in an abnormal state, an alarm can be output to alert the user that the target application may be malfunctioning. Alternatively, if the verification result indicates that the target application is in an abnormal state, the application can be terminated immediately to interrupt the exception and ensure the data security of the computer device and the target application. Finally, if the verification result indicates that the target application is in a normal state, the normal state can be recorded in the log data.

[0089] Of course, depending on the actual scenario, more monitoring actions can be set to adapt to different environmental needs.

[0090] In this example, by comparing whether there are changes to application-related files at the beginning of application operation and during operation, it can be determined whether the application has been tampered with, and whether there are any security risks in the operation of the application. Based on the determination of security risks, relevant monitoring actions are provided. This can more accurately determine the current security of the application operation and provide corresponding monitoring actions. It can also provide beneficial operations for applications with potential risks, thereby improving the security of application operation.

[0091] The main components representing an application are its application file and its memory image during runtime. To ensure the verification value more comprehensively reflects the application, two verification values ​​can be calculated separately based on the application file and the memory image. Therefore, the application-related files include the target application file and the target memory image of the target application. Step 220 above may include: calculating a first application verification value based on the target application file at the beginning of the target application's runtime; and calculating a first image verification value based on the target memory image of the target application.

[0092] Step 240 above may include: calculating a second application verification value based on the target application file of the target application during the operation of the target application; and calculating a second image verification value based on the target memory image of the target application.

[0093] In this embodiment, the algorithm used to calculate the first application verification value can be the same as the algorithm used to calculate the second application verification value, and the algorithm used to calculate the first image verification value can be the same as the algorithm used to calculate the second image verification value.

[0094] For example, if a key is required when calculating the image verification value, the key used to calculate the first image verification value is the same key used to calculate the second image verification value.

[0095] Optionally, a first hash algorithm can be used to calculate a first application verification value based on the target application file of the target application; that is, the first hash algorithm can be used to calculate a second application verification value based on the target application file of the target application.

[0096] Optionally, a second hash algorithm can be used to calculate the first image verification value based on the target memory image of the target application, that is, the second hash algorithm can be used to calculate the second image verification value based on the target memory image of the target application.

[0097] The first hash algorithm and the second hash algorithm can be the same algorithm, or they can be different algorithms.

[0098] Optionally, the first hash algorithm can be a hash algorithm, such as SM3 hash algorithm, MD5 algorithm, SHA-1 algorithm, etc.

[0099] Optionally, the second hash algorithm is the HMAC (Hash-based Message Authentication Code) algorithm.

[0100] In this embodiment, when the second hash algorithm is the HMAC algorithm, calculating the first image verification value and the second image verification value requires combining the key. Therefore, the second hash algorithm can be used to calculate the first image verification value based on the target memory image of the target application and the pre-stored calculation key; the second hash algorithm can also be used to calculate the second image verification value based on the target memory image of the target application and the pre-stored calculation key.

[0101] The computing key can be a key that is pre-stored in a specified memory space, and can be retrieved from that specified memory space when needed.

[0102] Step 260 above may include: comparing the first application verification value with the second application verification value, and comparing the first image verification value with the second image verification value, to determine the verification result of the target application.

[0103] If the first application verification value is the same as the second application verification value, and the first image verification value is also the same as the second image verification value, then it can be determined that the target application has not been tampered with during operation, and the target application is in a normal state.

[0104] If the first application verification value is different from the second application verification value, or if the first image verification value is different from the second image verification value, it can be determined that the application file or memory image of the target application has errors during operation and may have been tampered with, and the state of the target application can be determined to be abnormal.

[0105] By combining two hash algorithms to calculate the application verification value of the application file and the image verification value of the memory image, it is possible to identify multiple types of application files, thereby improving the accuracy of application monitoring.

[0106] In this embodiment, to improve the accuracy of the verification value calculation and the security of the calculation process, it can also be calculated by calling a cryptographic card. Based on this, step 240 above may include: calling the target cryptographic card, using the second hash algorithm provided by the target cryptographic card, and calculating the second image verification value according to the target memory image and the pre-stored calculation key.

[0107] In this embodiment, steps 220 to 280 can be implemented by an application monitoring service, which can be a device driver.

[0108] The application monitoring service calls the target cryptographic card and uses the second hash algorithm provided by the target cryptographic card to calculate the second image verification value based on the target memory image and the pre-stored calculation key.

[0109] Optionally, the target cryptographic card may be a PCI-E (peripheral component interconnect express, high-speed serial computer expansion bus standard) cryptographic card.

[0110] In this embodiment, the first image verification value calculated in step 220 can also be obtained by calling the target cryptographic card and using the second hash algorithm provided by the target cryptographic card, based on the target memory image and the pre-stored calculation key.

[0111] In this embodiment, the calculation key used to calculate the first image verification value is the same as the calculation key used to calculate the second image verification value.

[0112] The difference lies in the fact that the calculation of the first image verification value and the calculation of the second image verification value use the memory images of the target application at different stages.

[0113] To improve the security of the computation key, the transmission of the computation key between different programs can be reduced. This can be achieved by transmitting a computation key identifier. When computation is needed, the computation key corresponding to the identifier can be retrieved from the key storage location. The aforementioned invocation of the target cryptographic card, using the second hash algorithm provided by the target cryptographic card, calculates the second image verification value based on the target memory image and the pre-stored computation key, which may include the following steps a to c.

[0114] Step a: Invoke the target cryptographic card and obtain the target memory image and calculate the key identifier through the second hash algorithm interface provided by the target cryptographic card.

[0115] The target cryptographic card can provide multiple computation interfaces; for example, one of the computation interfaces can provide the second hash algorithm.

[0116] Step b: Determine the computing key based on the computing key identifier.

[0117] Alternatively, the computing key can be obtained by querying the database storing the computing key using the computing key identifier.

[0118] Step c: Using the second hash algorithm provided by the second hash algorithm interface, calculate the second image verification value based on the target memory image and the calculation key.

[0119] In this embodiment, the first image verification value can also be implemented in a similar manner to steps a to c.

[0120] In this embodiment, the calculation of the second application verification value can also be achieved through the target cryptographic card. Therefore, step 240 above may include: invoking the target cryptographic card, and using the first hash algorithm provided by the target cryptographic card, calculating the second application verification value based on the target application file of the target application.

[0121] For example, one of the multiple computing interfaces provided by the target cryptographic card may be used to provide a first hash algorithm.

[0122] The target password card can be invoked through the application monitoring service. Using the first hash algorithm provided by the target password card, the second application verification value can be calculated based on the target application file.

[0123] In this embodiment, the first application verification value calculated in step 220 can also be obtained by calling the target cryptographic card and using the first hash algorithm provided by the target cryptographic card, based on the target application file and the pre-stored calculation key.

[0124] In this embodiment, the calculation key used to calculate the first application verification value is the same as the calculation key used to calculate the second application verification value.

[0125] The difference lies in the fact that the calculation of the first application verification value and the calculation of the second application verification value use application files of the target application at different stages.

[0126] By calling the password card to calculate various verification values, the correctness, security, and effectiveness of the cryptographic algorithms used to calculate these verification values ​​can be improved, thereby increasing the accuracy of the calculated verification values.

[0127] The method in this embodiment can be applied to an electronic device that runs an application monitoring service. The application monitoring service is used to perform a process of monitoring the target application, that is, the application monitoring service can directly or indirectly execute the above steps 220 to 280.

[0128] Before step 220, such as Figure 3 As shown, the application monitoring method in this embodiment may further include steps 211 and 212.

[0129] Step 211: Initialize the target cryptographic card to generate a signature verification key pair and an encryption key pair.

[0130] Optionally, before initializing the target password card, a self-check can be performed on the target password card to determine whether the target password card has been initialized, so as to avoid duplicate initialization causing duplicate actions, or overwriting the previously initialized content, causing subsequent monitoring errors.

[0131] For example, if the self-test process finds that the target cryptographic card has already stored two key pairs in its secure storage unit, then it is determined that the target cryptographic card has been initialized and does not need to be initialized again.

[0132] For example, if a self-test detects that the secure storage unit in the target cryptographic card does not store two key pairs, the password data in the target cryptographic card may be cleared, and two key pairs may be generated. Alternatively, the two key pairs may be stored in the secure storage unit within the target cryptographic card.

[0133] Optionally, the two key pairs can be symmetric key pairs, for example, they can be represented as KeyS0 and KeyE0 respectively. KeyS0 can be used for signing and verification operations, and KeyE0 can be used for encryption and decryption operations.

[0134] Optionally, the two key pairs can be asymmetric key pairs, for example, the two key pairs can be represented as KeyS0, KeyS1 and KeyE0, KeyE1 respectively. Among them, key pair KeyS0, KeyS1 can be used for signing and verification operations, and key pair KeyE0, KeyE1 can be used for encryption and decryption operations.

[0135] Optionally, the two key pairs can be SM2 keys, SM3 keys, etc.

[0136] Step 212: Using the signature verification key pair and the encryption key pair, initialize the application monitoring service to obtain the calculation key and the corresponding calculation key identifier.

[0137] Optionally, such as Figure 4 As shown, step 212 above may include steps 2121 to 2124.

[0138] Step 2121: Generate a computation key and a corresponding computation key identifier by calling the generation interface of the target password card through the application monitoring service.

[0139] For example, the computation key can be represented as key KeyD0. The computation key identifier can be a unique identifier for the computation key, meaning that the computation key can be retrieved through this unique identifier.

[0140] For example, if the second hash calculation can be an HAMC calculation, then the calculation key can be an HMAC key, and the generation interface can be an HMAC key generation function interface.

[0141] Before step 2121, the database corresponding to the application monitoring service can be cleared, the specified memory space can be cleared, and the configuration file corresponding to the application monitoring service can be cleared. The application monitoring service can be a device driver running on an electronic device, and the database corresponding to the application monitoring service can be a database within the electronic device or a database supported by the electronic device. The specified memory space can be the memory space allocated for the application monitoring service within the electronic device.

[0142] Step 2122: Use the signature key in the signature verification key pair to sign the computation key and generate a key signature value.

[0143] The computation key KeyD0 can be signed using the key KeyS0 used for signing and verification operations to produce the key signature value SignKeyD0.

[0144] Step 2123: Use the encryption key in the encryption key pair to encrypt the key signature value to generate the signature ciphertext.

[0145] The key signature value SignKeyD0 can be encrypted using the key KeyE0 used for encryption and decryption operations to generate the signature ciphertext EncSignKeyD0.

[0146] In this embodiment, steps 2122 and 2123 described above can also be implemented using the target password card generation interface.

[0147] For example, after the application monitoring service successfully calls the generation interface, it can return the computation key identifier and the signature ciphertext EncSignKeyD0. Optionally, the computation key identifier and signature ciphertext can be stored in the database corresponding to the application monitoring service.

[0148] For example, if the application monitoring service fails to call the generation interface, the generation interface will return a failure reason to the application monitoring service. The failure reason could be failure to generate the computation key, failure to generate the signature ciphertext, etc.

[0149] Step 2124: The application monitoring service calls the verification interface of the target password card and uses the decryption key corresponding to the encryption key to decrypt the signature ciphertext to obtain the decrypted signature value.

[0150] This verification interface can be used to verify the validity of the generated computation key. This verification interface can also be an HMAC key integrity verification interface.

[0151] For example, the signature value can be decrypted using the encryption and decryption key KeyE0 to obtain the decrypted signature value SignKeyD0Tmp of EncSignKeyD0.

[0152] For example, the application monitoring service can transmit the computation key identifier and signature ciphertext to the verification interface, and the target cryptographic card can process the computation key identifier and signature ciphertext in subsequent steps 2124 and 2125.

[0153] Step 2125: Use the verification key from the verification key pair to verify the decrypted signature value.

[0154] For example, the decrypted signature value SignKeyD0Tmp can be verified to obtain KeyD0Tmp. It can then be determined whether KeyD0Tmp is the same as KeyD0. If they are the same, it indicates that the verification of the decrypted signature value has passed.

[0155] For example, the decrypted signature value SignKeyD0Tmp can be verified to obtain KeyD0Tmp. Then, KeyD0Tmp is compared with the computation key corresponding to the received computation key identifier. If they are the same, it can be determined that the verification of the decrypted signature value has passed.

[0156] If the decrypted signature value is verified, the initialization of the application monitoring service is complete. The computation key identifier corresponding to the aforementioned computation key is then used for calculations during the application monitoring process.

[0157] In this embodiment, if the application monitoring service fails to call the generation interface of the target password card, or if the application monitoring service fails to call the verification interface of the target password card, the target password card will return an interface call exception message to the application monitoring service.

[0158] Different failures can correspond to different prompts. If the verification of the decrypted signature value fails, or if the application monitoring service fails to call the verification interface of the target password card, the failure reason can be returned to the application monitoring service. For example, the failure reason could be decryption failure, signature verification failure, or interface call failure, etc.

[0159] The above method can initialize the call relationship between the application monitoring service and the password card using the initialization key of the target password card, which can make the call between the application monitoring service and the password card smoother and more secure.

[0160] The method in this embodiment can be implemented using an application monitoring service; therefore, as... Figure 5 As shown, before step 220, the application monitoring method may also include steps 213 and 215.

[0161] Step 213: Start the application monitoring service and read the configuration file of the application monitoring service.

[0162] The configuration file can be set as needed. Optionally, the configuration interface of the application monitoring service can be provided with a display interface, which can be used to receive the monitoring policy set by the user and generate a configuration file based on the monitoring policy.

[0163] For example, the configuration file may include a list of applications to be monitored. The configuration file may also include monitoring policies, different monitoring actions corresponding to different verification results, verification cycles, and other information. The verification cycle may represent the duration of the entire period for monitoring the applications in the list.

[0164] Step 214: Determine if any of the currently running applications belong to the list of applications to be monitored.

[0165] If no application currently running is included in the list of applications to be monitored, proceed to step 215.

[0166] Step 215: Output an alarm message.

[0167] For example, this alert can be used to indicate that there is currently no application that needs to be monitored.

[0168] After this alarm is displayed, the application monitoring service can wait for the applications in the above list of applications to be monitored to start.

[0169] Optionally, the application monitoring program can also determine whether each application in the list of applications to be monitored is running, according to the order of the list.

[0170] In this embodiment, the target application can be any application in the list of applications to be monitored.

[0171] Optionally, after receiving a request to view monitoring results on the configuration side of the application monitoring service, the monitoring results for each application in the list of applications to be monitored can be output. These monitoring results may include verification results of the application's verification values ​​and monitoring actions performed on the application.

[0172] By configuring the application monitoring service's configuration file, you can monitor each application based on the configuration file, making application monitoring more flexible.

[0173] Based on the same application concept, this application also provides an application monitoring device corresponding to the application monitoring method. Since the principle of the device in this application is similar to that of the aforementioned application monitoring method, the implementation of the device in this application can refer to the description in the above method embodiments, and the repeated parts will not be repeated.

[0174] Please see Figure 6 This is a functional module diagram of the application monitoring device provided in this application embodiment. Each module in the application monitoring device in this embodiment is used to execute the steps in the above method embodiments. The application monitoring device includes: a first calculation module 310, a second calculation module 320, a comparison module 330, and a first determination module 340; the contents of each module are as follows:

[0175] The first calculation module 310 is used to calculate the first verification value based on the application-related files of the target application at the beginning of the target application's operation.

[0176] The second calculation module 320 is used to calculate the second verification value based on the application-related files of the target application during the operation of the target application.

[0177] The comparison module 330 is used to compare the first verification value with the second verification value to determine the verification result of the target application;

[0178] The first determining module 340 is used to determine the monitoring action based on the verification result and the monitoring policy corresponding to the target application.

[0179] In one possible implementation, the application-related files include the target application file and the target memory image of the target application;

[0180] The first calculation module 310 is used to calculate a first application verification value based on the target application file of the target application at the beginning of the target application's operation; and to calculate a first image verification value based on the target memory image of the target application.

[0181] The second calculation module 320 is used to calculate a second application verification value based on the target application file of the target application during the operation of the target application; and to calculate a second image verification value based on the target memory image of the target application.

[0182] The comparison module 330 is used to compare the first application verification value with the second application verification value, and to compare the first image verification value with the second image verification value, so as to determine the verification result of the target application.

[0183] In one possible implementation, the second calculation module 320 is used to calculate a second application verification value based on the target application file of the target application using a first hash algorithm; and to calculate a second image verification value based on the target memory image of the target application using a second hash algorithm, wherein the first hash algorithm and the second hash algorithm are the same algorithm, or the first hash algorithm and the second hash algorithm are different algorithms.

[0184] In one possible implementation, the first hash algorithm is a hash algorithm; the second hash algorithm is a hash operation message authentication code algorithm.

[0185] In one possible implementation, the second computing module 320 is further configured to use a second hash algorithm to calculate a second image verification value based on the target memory image of the target application and a pre-stored computing key.

[0186] In one possible implementation, the second computing module 320 is further configured to invoke the target cryptographic card, and use the second hash algorithm provided by the target cryptographic card to calculate the second image verification value based on the target memory image and the pre-stored computing key.

[0187] In one possible implementation, the second computing module 320 is further configured to:

[0188] Invoke the target cryptographic card, and obtain the target memory image and calculate the key identifier through the second hash algorithm interface provided by the target cryptographic card;

[0189] The computation key is determined based on this computation key identifier;

[0190] Using the second hash algorithm provided by the second hash algorithm interface, the second image verification value is calculated based on the target memory image and the calculation key.

[0191] In one possible implementation, the second calculation module 320 is used to invoke the target cryptographic card and calculate the second application verification value based on the target application file of the target application using the first hash algorithm provided by the target cryptographic card.

[0192] In one possible implementation, it is applied to an electronic device that runs an application monitoring service, which performs a process of monitoring the target application.

[0193] The application monitoring device in this example may also include: a first initialization module, used to initialize the target cryptographic card to generate a signature verification key pair and an encryption key pair;

[0194] The second initialization module is used to initialize the application monitoring service using the signature verification key pair and the encryption key pair to obtain the calculation key and the calculation key identifier corresponding to the calculation key.

[0195] In one possible implementation, the second initialization module is used for:

[0196] The application monitoring service calls the generation interface of the target password card to generate a calculation key and a corresponding calculation key identifier.

[0197] Use the signature key from the signature verification key pair to sign the computation key, generating a key signature value;

[0198] The key signature value is encrypted using the encryption key in the encryption key pair to generate the signature ciphertext;

[0199] The application monitoring service calls the verification interface of the target password card, and uses the decryption key corresponding to the encryption key to decrypt the ciphertext of the signature to obtain the decrypted signature value;

[0200] Use the verification key from the verification key pair to verify the decrypted signature value;

[0201] If the decryption signature value is verified, the initialization of the application monitoring service is complete.

[0202] In one possible implementation, the application monitoring device in this example may further include: a first prompting module, used to return an interface call exception prompt to the application monitoring service through the target password card if the application monitoring service fails to call the generation interface of the target password card, or if the application monitoring service fails to call the verification interface of the target password card.

[0203] In one possible implementation, the application monitoring device in this example may further include:

[0204] The startup module is used to start the application monitoring service and read the configuration file of the application monitoring service, which includes a list of applications to be monitored.

[0205] The second determination module is used to determine whether any currently running application belongs to the list of applications to be monitored.

[0206] The second prompt module is used to output an alarm prompt if the currently running application does not belong to the application list to be monitored.

[0207] In one possible implementation, the first calculation module 310 is used to call a target hook function, which in turn calls a target application to obtain the application-related files of the target application; and calculates a first verification value based on the application-related files.

[0208] The second calculation module 320 is used to call the target hook function, which calls the target application to obtain the application-related files of the target application; and calculates the second verification value based on the application-related files.

[0209] Furthermore, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the application monitoring method described in the above method embodiments.

[0210] The computer program product of the application monitoring method provided in this application embodiment includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the steps of the application monitoring method described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0211] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0212] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0213] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. It should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0214] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0215] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An application monitoring method characterized by, The method is applied to an electronic device that runs an application monitoring service, the application monitoring service being used to execute a process for monitoring a target application; the method includes: The target cryptographic card is initialized to generate a signature verification key pair and an encryption key pair; The application monitoring service is initialized using the signature verification key pair and the encryption key pair to obtain a calculation key and a calculation key identifier corresponding to the calculation key; wherein, the calculation key is used as the key required to calculate the second image verification value, and the calculation key identifier is used to determine the calculation key; At the beginning of the target application's execution, a first verification value is calculated based on the application-related files of the target application, including: at the beginning of the target application's execution, a first application verification value is calculated based on the target application file of the target application; and a first image verification value is calculated based on the target memory image of the target application. During the execution of the target application, a second verification value is calculated based on the application-related files of the target application, including: calculating a second application verification value based on the target application file of the target application during the execution of the target application; and calculating a second image verification value based on the target memory image of the target application. Comparing the first verification value with the second verification value to determine the verification result of the target application includes: comparing the first application verification value with the second application verification value, and comparing the first image verification value with the second image verification value to determine the verification result of the target application. Based on the verification results and the monitoring policy corresponding to the target application, a monitoring action is determined; wherein, the monitoring action includes one or more of the following: alarm notification, application exit, and application status marking.

2. The method of claim 1, wherein, The step of calculating the second application verification value based on the target application file of the target application includes: Using the first hash algorithm, a second application verification value is calculated based on the target application file of the target application. The step of calculating the second image verification value based on the target memory image of the target application includes: Using a second hash algorithm, a second image verification value is calculated based on the target memory image of the target application, wherein the first hash algorithm and the second hash algorithm are the same algorithm, or the first hash algorithm and the second hash algorithm are different algorithms.

3. The method of claim 2, wherein, The first hash algorithm is a hash algorithm; the second hash algorithm is a hash operation message authentication code algorithm.

4. The method of claim 3, wherein, The step of using a second hash algorithm to calculate a second image verification value based on the target memory image of the target application includes: Using a second hash algorithm, a second image verification value is calculated based on the target memory image of the target application and the pre-stored computation key.

5. The method according to claim 4, characterized in that, The second hash algorithm is used to calculate the second image verification value based on the target memory image of the target application and the pre-stored computing key, including: The target cryptographic card is invoked, and the second hash algorithm provided by the target cryptographic card is used to calculate the second image verification value based on the target memory image and the pre-stored computing key.

6. The method according to claim 5, characterized in that, The process of calling the target cryptographic card involves using the second hash algorithm provided by the target cryptographic card to calculate a second image verification value based on the target memory image and the pre-stored computation key, including: The target cryptographic card is invoked, and the target memory image and the calculation key identifier are obtained through the second hash algorithm interface provided by the target cryptographic card; The computation key is determined based on the computation key identifier; Using the second hash algorithm provided by the second hash algorithm interface, a second image verification value is calculated based on the target memory image and the computation key.

7. The method according to claim 2, characterized in that, The step of using the first hash algorithm to calculate the second application verification value based on the target application file of the target application includes: The target cryptographic card is invoked, and a second application verification value is calculated based on the target application file of the target application using the first hash algorithm provided by the target cryptographic card.

8. The method according to claim 1, characterized in that, The initialization process of the application monitoring service using the signature verification key pair and the encryption key pair to obtain the calculation key and the corresponding calculation key identifier includes: The application monitoring service calls the generation interface of the target password card to generate a calculation key and a calculation key identifier corresponding to the calculation key; The calculation key is signed using the signature key in the verification key pair to generate a key signature value; The key signature value is encrypted using the encryption key in the encryption key pair to generate the signature ciphertext; The application monitoring service calls the verification interface of the target password card and uses the decryption key corresponding to the encryption key to decrypt the signature ciphertext to obtain the decrypted signature value. The decrypted signature value is verified using the verification key in the verification key pair; If the decrypted signature value is verified, the initialization of the application monitoring service is complete.

9. The method according to claim 7, characterized in that, The method further includes: If the application monitoring service fails to call the generation interface of the target password card, or if the application monitoring service fails to call the verification interface of the target password card, the target password card will return an interface call exception message to the application monitoring service.

10. The method according to claim 1, characterized in that, The method further includes: Start the application monitoring service and read the configuration file of the application monitoring service, which includes a list of applications to be monitored; Determine if any currently running applications belong to the list of applications to be monitored; If no application currently running is included in the list of applications to be monitored, an alarm message will be output.

11. The method according to claim 1, characterized in that, The step of calculating the first verification value based on the application-related files of the target application includes: The target hook function is invoked, and the target application is invoked through the target hook function to obtain the application-related files of the target application; Calculate the first verification value based on the application-related documents; The step of calculating the second verification value based on the application-related files of the target application includes: The target hook function is invoked, and the target application is invoked through the target hook function to obtain the application-related files of the target application; The second verification value is calculated based on the application-related documents.

12. An application monitoring device, characterized in that, An apparatus is used in an electronic device that runs an application monitoring service, the application monitoring service being used to execute a process of monitoring a target application; the apparatus includes: The first initialization module is used to initialize the target cryptographic card to generate a signature verification key pair and an encryption key pair. The second initialization module is used to initialize the application monitoring service using the signature verification key pair and the encryption key pair to obtain a calculation key and a calculation key identifier corresponding to the calculation key; wherein, the calculation key is used as the key required to calculate the second image verification value, and the calculation key identifier is used to determine the calculation key; The first calculation module is used to calculate the first verification value based on the application-related files of the target application at the beginning of the target application's operation. The second calculation module is used to calculate the second verification value based on the application-related files of the target application during the operation of the target application. The comparison module is used to compare the first verification value with the second verification value to determine the verification result of the target application; The first determining module is used to determine a monitoring action based on the verification result and the monitoring policy corresponding to the target application; wherein the monitoring action includes one or more of the following: alarm prompt, application exit, and application status marking; The first calculation module is used to calculate a first application verification value based on the target application file of the target application at the beginning of the target application's operation; and to calculate a first image verification value based on the target memory image of the target application. The second calculation module is used to calculate a second application verification value based on the target application file of the target application during the execution of the target application; and to calculate a second image verification value based on the target memory image of the target application. The comparison module is used to compare the first application verification value with the second application verification value, and to compare the first image verification value with the second image verification value, so as to determine the verification result of the target application.

13. An electronic device, characterized in that, include: The processor and memory, wherein the memory stores machine-readable instructions executable by the processor, wherein when the electronic device is running, the machine-readable instructions are executed by the processor to perform the steps of the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 11.

Images