Process communication method and apparatus, computer, storage medium, and program product

Abstract

Embodiments of the application disclose a process communication method and device, a computer, a storage medium and a program product, relate to data transmission technology in the cloud technology field, and the method comprises the following steps: receiving a service call request sent by a request process, obtaining a target security access policy of a target process interface for the request process called by the service call request; obtaining first policy request information of the request process based on the target security access policy; when the request process is verified based on the target security access policy and the first policy request information, obtaining a key access mode between the request process and the target process interface; converting and processing a response result corresponding to the service call request based on the key access mode to obtain business response data, and sending the business response data to the request process; and the key access mode is used to represent an encryption mode of the response result. By adopting the application, the security and flexibility of inter-process communication can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a process communication method, apparatus, computer, storage medium and program product. Background Technology

[0002] Inter-process communication frequently occurs during data transmission. Generally, data leakage can occur when different processes communicate. Currently, inter-process communication is typically secured using fixed keys. This method involves pre-setting a key within the module of the service-providing process. A one-way hash function is used to generate a hash value based on the shared key and its parameters, which serves as the network access credential for inter-process calls. However, since almost all cryptographic hash functions may have hash length extension vulnerabilities, this can lead to low security in inter-process communication. Furthermore, updating the shared key can only be done by updating the version, resulting in poor flexibility in inter-process communication. Summary of the Invention

[0003] This application provides a process communication method, apparatus, computer, storage medium, and program product, which can improve the security and flexibility of process communication.

[0004] One embodiment of this application provides a process communication method, the method comprising: Receive the service call request sent by the requesting process, and obtain the target security access policy of the target process interface called by the service call request for the requesting process; Based on the target security access policy, obtain the first policy request information of the requesting process. When the verification of the requesting process is successful based on the target security access policy and the first policy request information, obtain the key access method between the interface of the requesting process and the target process. The response result corresponding to the service call request is transformed based on the key access method to obtain the business response data, and the business response data is sent to the requesting process; the key access method is used to indicate the encryption method of the response result.

[0005] The process of obtaining the first dynamic key between the requesting process and the target process interface includes: Retrieve the first dynamic key between the requesting process and the target process interface from the requesting process's request process cache; If the first dynamic key between the target process interface and the target process interface is not found, a key acquisition request is sent to the target process interface, and the first dynamic key sent by the target process interface is obtained based on the key acquisition request.

[0006] The method also includes: When the verification of the requesting process fails based on the target security access policy and the first policy request information, the service provider process sends a response error message to the requesting process; the service provider process includes the target process interface.

[0007] One embodiment of this application provides a process communication method, the method comprising: The system obtains the target security access policy and the first policy request information sent by the service provider process, and detects the first policy request information based on the target security access policy to obtain the detection result. The target security access policy refers to the policy of the target process interface invoked by the service call request for the requesting process. The service call request is generated by the requesting process. The service provider process includes the target process interface. The first policy request information is the information of the requesting process obtained based on the target security access policy. The detection result is sent to the service provider process, so that when the detection result indicates that the verification of the requesting process has passed, the service provider process sends business response data to the requesting process. The business response data is obtained by transforming the response result corresponding to the service call request according to the key access method between the interface between the requesting process and the target process.

[0008] The effectiveness of the target security access policy is detected, including: Obtain the effective period of the target security access policy and the system network time. If the system network time falls within the effective period, the target security access policy is determined to be valid; otherwise, it is determined to be invalid. Obtain the effective policy reuse count and historical policy reuse count of the target security access policy. If the historical policy reuse count is less than the effective policy reuse count, the target security access policy is determined to be a valid policy. If the historical policy reuse count is greater than or equal to the effective policy reuse count, the target security access policy is determined to be an invalid policy; or... Obtain the first security access policy of the target process interface for the requesting process. If the target security access policy is consistent with the first security access policy, the target security access policy is determined to be a valid policy. If the target security access policy is inconsistent with the first security access policy, the target security access policy is determined to be an invalid policy. The first security access policy refers to the security access policy with the longest storage time among the security access policies associated with the target process interface and the requesting process.

[0009] One embodiment of this application provides a process communication device, the device comprising: The request receiving module is used to receive service call requests sent by the requesting process; The policy acquisition module is used to obtain the target security access policy of the target process interface invoked by the service call request for the requesting process; The information acquisition module is used to acquire the first policy request information of the requesting process based on the target security access policy; The access determination module is used to obtain the key access method between the interface between the requesting process and the target process when the verification of the requesting process is successful based on the target security access policy and the first policy request information. The data conversion module is used to convert the response results corresponding to service call requests based on the key access method to obtain business response data; The response sending module is used to send business response data to the requesting process; the key access method is used to indicate the encryption method of the response result.

[0010] The request receiving module includes: The request method determination unit is used to obtain the process request method of the target process interface through the requesting process; the process request method is negotiated between the requesting process and the target process interface. The dynamic acquisition unit is used to acquire the first dynamic key between the interface between the requesting process and the target process if the process request method is a dynamic key request method. The dynamic request unit is used to encrypt the call parameters using a first dynamic key to obtain dynamically encrypted parameters, and send a service call request carrying the dynamically encrypted parameters to the service provider process. The service provider process receives the service call request sent by the requesting process. The service provider process includes the target process interface. The static request unit is used to obtain the service fixed key corresponding to the service provider process if the process request method is static key request method, encrypt the call parameters with the service fixed key to obtain static encrypted parameters, send a service call request carrying the static encrypted parameters to the service provider process, and receive the service call request sent by the requesting process through the service provider process. The plaintext request unit is used to send a service call request carrying call parameters to the service provider process through the requesting process if the process request method is plaintext request method, and to receive the service call request sent by the requesting process through the service provider process.

[0011] The dynamic acquisition unit includes: The key acquisition subunit is used to obtain the first dynamic key between the requesting process and the target process interface from the requesting process's requesting process cache; The key request subunit is used to send a key acquisition request to the target process interface if no first dynamic key is found with the target process interface, and to acquire the first dynamic key sent by the target process interface based on the key acquisition request.

[0012] The strategy acquisition module includes: The file acquisition unit is used to acquire the request storage path corresponding to the requesting process, and to acquire the first file modification time corresponding to the requesting process from the request storage path; the first file modification time refers to the largest file modification time among the file modification times corresponding to the requesting process. The identifier generation unit is used to generate a process identifier corresponding to the requesting process based on the requested storage path and the modification time of the first file. The identification determination unit is used to obtain the target security access policy of the target process interface invoked by the service invocation request for the requesting process based on the process identifier; the service providing process includes the target process interface.

[0013] The strategy acquisition module includes: The type acquisition unit is used to acquire the request process information corresponding to the request process, parse the request process information, and obtain the process type of the request process. The type determination unit is used to obtain the target security access policy for the process type of the target process interface invoked by the service call request.

[0014] Specifically, this information acquisition module is used for: Obtain the access parameter type from the target security access policy, obtain the parameter data of the requesting process under the access parameter type, and determine the parameter data as the first policy request information of the requesting process. The device also includes: The detection request module is used to send the first policy request information and the target security access policy to the service management device corresponding to the service providing process, so that the service management device can detect the first policy request information based on the target security access policy, and determine that the verification of the requesting process is successful when the first policy request information meets the process access conditions of the target security access policy.

[0015] The access determination module includes: The access method determination unit is used to obtain the key access method between the requesting process and the target process interface from the target security access policy; or, The access method determination unit is also used to obtain the interface data associated with the target process interface, parse the interface data to obtain the data sensitivity of the interface data, and determine the encryption method corresponding to the data sensitivity as the key access method between the requesting process and the target process interface.

[0016] The data conversion module includes: The dynamic response unit is used to obtain the first dynamic key between the interface between the requesting process and the target process if the key access method is dynamic key access method, and to encrypt the response result corresponding to the service call request using the first dynamic key to obtain the business response data. The static response unit is used to obtain the request fixed key corresponding to the requesting process if the key access method is static key access method, and to encrypt the response result using the request fixed key to obtain the business response data; The plaintext response unit is used to determine the response result as business response data if the key access method is plaintext access.

[0017] The device also includes: The error message module is used to send a response error message to the requesting process based on the service provider process when the verification of the requesting process fails based on the target security access policy and the first policy request information; the service provider process includes the target process interface.

[0018] The device also includes: The parameter acquisition module is used to acquire the first random parameter sent by the service management device when a key update message is received, and to generate the second random parameter through the service provider process; the service provider process includes the target process interface; The key generation module is used to generate a second dynamic key between the requesting process and the target process interface based on the first random parameter and the second random parameter. The key feedback module is used to send the second dynamic key to the requesting process and receive the service call request resent by the requesting process based on the second dynamic key.

[0019] The device also includes: The association management module is used to obtain the key hash value of the second dynamic key and send the key hash value, the association relationship between the requesting process and the target process interface to the service management device. The association relationship is used by the service management device to detect the service call request when the key access method between the requesting process and the target process interface is the dynamic key access method.

[0020] The service call request carries encrypted parameters; the device also includes: The parameter decryption module is used to obtain the first service key for the encrypted parameters and to decrypt the encrypted parameters using the first service key. The response acquisition module is used to obtain the response result corresponding to the service call request based on the call parameters obtained from the decryption of the encrypted parameters if the encryption parameters are successfully decrypted, and to perform the conversion processing of the response result corresponding to the service call request based on the key access method to obtain the business response data. The key reset module is used to send a key reset command to the requesting process if decryption of the encrypted parameters fails. The requesting process generates a random key pair and sends the random public key from the random key pair to the service provider process. In the service provider process, the second service key is encrypted using the random public key to obtain encrypted key data, which is then sent to the requesting process. In the requesting process, the encrypted key data is decrypted using the random private key from the random key pair to obtain the second service key. The call parameters are then re-encrypted using the second service key to obtain updated encrypted parameters. Based on the updated encrypted parameters, the service call request is resent to the service provider process. The service provider process includes a target process interface; the first service key and the second service key form a key pair.

[0021] One embodiment of this application provides a process communication device, the device comprising: The data receiving module is used to acquire the target security access policy and the first policy request information sent by the service providing process; The data detection module is used to detect the first policy request information based on the target security access policy and obtain the detection result; the target security access policy refers to the policy of the target process interface called by the service call request for the requesting process; the service call request is generated by the requesting process; the service providing process includes the target process interface; the first policy request information is the information of the requesting process obtained based on the target security access policy; The detection feedback module is used to send the detection results to the service provider process, so that when the detection results indicate that the verification of the requesting process has passed, the service provider process sends business response data to the requesting process. The business response data is obtained by transforming the response result corresponding to the service call request according to the key access method between the interface between the requesting process and the target process.

[0022] The data detection module includes: The policy detection unit is used to detect the effectiveness of the target security access policy; The policy update unit is used to obtain the first security access policy of the target process interface for the requesting process if the target security access policy is invalid, and send the first security access policy to the service provider process so that the service provider process can obtain the second policy request information of the requesting process based on the first security access policy. The information detection unit is used to obtain the second policy request information sent by the service provider process, detect the second policy request information based on the first security access policy, and obtain the detection result.

[0023] The strategy detection unit includes: The time detection subunit is used to obtain the effective time period of the target security access policy and the system network time. If the system network time falls within the effective time period, the target security access policy is determined to be valid; otherwise, the target security access policy is determined to be invalid. The reuse detection subunit is used to obtain the number of valid policy reuses and the number of historical policy reuses of the target security access policy. If the number of historical policy reuses is less than the number of valid policy reuses, the target security access policy is determined to be a valid policy; if the number of historical policy reuses is greater than or equal to the number of valid policy reuses, the target security access policy is determined to be an invalid policy; or... The policy matching subunit is used to obtain the first security access policy of the target process interface for the requesting process. If the target security access policy is consistent with the first security access policy, the target security access policy is determined to be a valid policy. If the target security access policy is inconsistent with the first security access policy, the target security access policy is determined to be an invalid policy. The first security access policy refers to the security access policy with the longest storage time among the security access policies associated with the target process interface and the requesting process.

[0024] The target security access policy includes a security access path, and the first policy request information includes the request storage path of the requesting process. This data detection module includes: The first detection unit is used to determine the detection result of the requesting process as the detection result if the requested storage path belongs to a secure access path. The second detection unit is used to determine the detection failure result as the detection result for the requesting process if the requested storage path is not a secure access path.

[0025] The target security access policy includes security access characteristics; the data detection module includes: The feature acquisition unit is used to acquire request process features associated with secure access features from the first policy request information; The first detection unit is also used to determine the detection result of the requesting process as the detection result if the characteristics of the requesting process match the characteristics of secure access. The second detection unit is also used to determine the detection failure result as the detection result for the requesting process if the characteristics of the requesting process do not conform to the characteristics of secure access.

[0026] The device also includes: The key detection module is used to obtain the first dynamic key between the interface between the requesting process and the target process if the detection result is a successful result, and to detect the validity of the first dynamic key. The invalid update module is used to send a key update message to the service provider process if the first dynamic key is invalid. The key update message includes a first random parameter, so that the service provider process generates a second dynamic key between the interface between the requesting process and the target process based on the first random parameter and the generated second random parameter. The second dynamic key is used for communication between the interface between the requesting process and the target process. The sending trigger module is used to execute the process of sending the detection result to the service provider process if the first dynamic key is a valid key.

[0027] One embodiment of this application provides a computer device, including a processor, a memory, and an input / output interface; The processor is connected to a memory and an input / output interface, respectively. The input / output interface is used to receive and output data, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device containing the processor executes the process communication method in one aspect of the embodiments of this application.

[0028] One aspect of this application provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor, so that a computer device having the processor performs the inter-process communication method of one aspect of this application.

[0029] One aspect of this application provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional embodiments of this application. In other words, when the computer instructions are executed by the processor, they implement the methods provided in various optional embodiments of this application.

[0030] Implementing the embodiments of this application will have the following beneficial effects: In this embodiment, the service device can receive a service call request sent by a requesting process, obtain the target security access policy of the target process interface called by the service call request for the requesting process, obtain the first policy request information of the requesting process based on the target security access policy, and when the requesting process is verified successfully based on the target security access policy and the first policy request information, obtain the key access method between the requesting process and the target process interface; convert the response result corresponding to the service call request based on the key access method to obtain service response data, and send the service response data to the requesting process; the key access method is used to represent the encryption method of the response result. Through the above process, a secure access policy for inter-process communication is deployed. This secure access policy is used to represent the communication requirements between various processes. When communication is required between the requesting process and the target process interface, the security of the communication between the requesting process and the target process interface can be detected based on the target security access policy between them to improve the security of process communication. At the same time, the requesting process and the target process interface negotiate a key access method, which allows different key access methods to be used in different process communications based on requirements. This allows for flexible management of the encryption method of inter-process communication, improving the flexibility of inter-process communication while ensuring the security of process communication. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1a This is a network interaction architecture diagram for process communication provided in an embodiment of this application; Figure 1b This is another network interaction architecture diagram for process communication provided in the embodiments of this application; Figure 2 This is a schematic diagram of a process communication scenario provided in an embodiment of this application; Figure 3 This is a flowchart of a process communication method provided in an embodiment of this application; Figure 4 This is a flowchart of another process communication method provided in an embodiment of this application; Figure 5 This is a schematic diagram of a strategy configuration scenario provided in an embodiment of this application; Figure 6 This is a schematic diagram of a process communication interaction flow provided in an embodiment of this application; Figure 7 This is a schematic diagram of a process communication device provided in an embodiment of this application; Figure 8 This is a schematic diagram of another process communication device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0033] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0034] If this application requires the collection of object data (such as user data), a prompt interface or pop-up window will be displayed before and during the collection process. This prompt interface or pop-up window is used to inform the user that data A is currently being collected. The data acquisition steps will only begin after the user confirms the prompt interface or pop-up window; otherwise, the process will end. Furthermore, the acquired user data will be used in reasonable and legal scenarios or for legitimate purposes. Optionally, in scenarios where user data needs to be used but user authorization has not been obtained, authorization can be requested from the user, and the user data can only be used after authorization is granted.

[0035] Optionally, this application may employ technologies such as data transmission in the field of big data to achieve inter-process communication.

[0036] Big data refers to data sets that cannot be captured, managed, and processed within a certain timeframe using conventional software tools. It represents massive, rapidly growing, and diverse information assets that require new processing models to achieve stronger decision-making, insightful discovery, and process optimization capabilities. With the advent of the cloud era, big data has attracted increasing attention. Big data requires specialized technologies to effectively process large amounts of data within a tolerable timeframe. Technologies suitable for big data include massively parallel processing databases, data mining, distributed file systems, distributed databases, cloud computing platforms, the internet, and scalable storage systems.

[0037] Optionally, this application can also be applied to the field of cloud security, etc. Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior detection. Through a large number of clients in a mesh network, it monitors abnormal software behavior in the network, obtains the latest information on Trojans and malicious programs on the Internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0038] The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0039] In the embodiments of this application, please refer to Figure 1a , Figure 1a This is a network interaction architecture diagram for inter-process communication provided in an embodiment of this application. The inter-process communication implemented in this application can be inter-process communication within the same device, such as... Figure 1a As shown, service device 101 can send a service call request to the service provider process through the requesting process, and obtain the target security access policy of the target process interface called by the service call request for the requesting process through the service provider process. A process can include one or at least two process interfaces, and the service provider process includes the target process interface. That is, in service device 101, the requesting process can send a service call request to the service provider process, and the service provider process can obtain the target security access policy of the target process interface called by the service call request for the requesting process. Further, service device 101 can obtain the service management device corresponding to the service provider process, and send an access detection request for the requesting process to the service management device. The service management device can detect the requesting process based on the target security access policy and send the detection result to service device 101. Service device 101 can determine the subsequent response process to the service call request based on the detection result. Figure 1a As shown, service device 101 can be associated with one or at least two service management devices, such as... Figure 1aThe service management devices 102a, 102b, and 102c shown can each be used to manage data related to one or more processes (such as process data and process services). For example, assuming that the service providing process corresponds to service management device 102b, when the service device 101 sends an access detection request for the requesting process to the service management device, it can specifically send an access detection request for the requesting process to service management device 102b.

[0040] Optional, please see Figure 1b , Figure 1b This is a network interaction architecture diagram for inter-process communication provided in an embodiment of this application. The inter-process communication implemented in this application can be inter-process communication between different devices, such as... Figure 1b As shown, assume that business device 103 sends a service call request to the service provider process through the requesting process, specifically to the business device 104 where the service provider process resides. The business device 103 where the requesting process resides and the business device 104 where the service provider process resides can interact with each other. Optionally, business device 104 receives the service call request through the service provider process and obtains the target security access policy for the requesting process of the target process interface invoked by the service call request. Business device 104 can obtain the service management device corresponding to the service provider process and send an access detection request for the requesting process to the service management device. The service management device can detect the requesting process based on the target security access policy and send the detection result to business device 104. Business device 104 can determine the subsequent response process to the service call request based on the detection result. Figure 1b As shown, service device 103 or service device 104 can be associated with one or at least two service management devices, such as... Figure 1b The service management devices 105a, 105b, and 105c shown can each be used to manage data related to one or more processes (such as process data and process services).

[0041] Different processes can request services from each other. For example, assuming there is a first process and a second process, when the first process requests services or data from the second process, the first process can be considered the requesting process, and the second process can be considered the service providing process; conversely, when the second process requests services or data from the first process, the second process can be considered the requesting process, and the first process can be considered the service providing process, and so on. Each process can include one or more process interfaces.

[0042] For details, please see Figure 2 , Figure 2This is a schematic diagram of a process communication scenario provided in an embodiment of this application. For example... Figure 2 As shown, taking inter-process communication within the same device as an example, in the business device 201, the requesting process 202 can send a service call request to the service providing process 203. The service providing process 203 can obtain the target security access policy 204 of the target process interface called by the service call request for the requesting process. Based on the target security access policy, the service providing process 203 can obtain the first policy request information of the requesting process 202, obtain the service management device 205 corresponding to the service providing process 203, and send an access detection request to the service management device 205. The service management device 205 can detect the requesting process 202 based on the target security access policy and send the detection result to the business device 201, specifically to the service providing process 203. When the detection result indicates that the verification of the requesting process 202 is successful, the service providing process 203 obtains the response result corresponding to the service call request, performs conversion processing on the response result based on the key access method between the requesting process 202 and the target process interface, obtains business response data, and sends the business response data to the requesting process 202 through the service providing process 203. Secure access policies can be used to perform secure verification of inter-process communication between the requesting process and the service-providing process, thereby ensuring the security of inter-process communication. At the same time, processes can negotiate key access methods and conduct inter-process communication based on the negotiated key access methods. This allows different processes to use different key access methods, thereby improving the security and flexibility of inter-process communication.

[0043] It is understood that the business equipment or service management equipment mentioned in the embodiments of this application can be a computer device, and the computer device in the embodiments of this application includes, but is not limited to, terminal devices or servers. In other words, the computer device can be a server or a terminal device, or a system composed of servers and terminal devices. Among them, the terminal device mentioned above can be an electronic device, including but not limited to mobile phones, tablets, desktop computers, laptops, handheld computers, in-vehicle devices, augmented reality / virtual reality (AR / VR) devices, head-mounted displays, smart TVs, wearable devices, smart speakers, digital cameras, webcams and other mobile internet devices (MID) with network access capabilities, or terminal devices in scenarios such as trains, ships, and flights. Among them, the server mentioned above can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, vehicle-to-everything (V2X) services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0044] Optionally, the data involved in the embodiments of this application may be stored in a computer device, or may be stored based on cloud storage technology or blockchain network, etc., without limitation.

[0045] Further, please see Figure 3 , Figure 3 This is a flowchart illustrating a process communication method provided in an embodiment of this application. Figure 3 As shown, the process communication procedure includes the following steps: Step S301: Receive the service call request sent by the requesting process and obtain the target security access policy of the target process interface called by the service call request for the requesting process.

[0046] In this embodiment, the service device can receive a service call request sent by a requesting process. The target process interface invoked by the service call request belongs to a service providing process. The requesting process and the service providing process can be processes located on the same device or processes on different devices. For example, the service device can send a service call request to the service providing process through the requesting process, and receive the service call request through the service providing process; or, the requesting device can send a service call request to the service device through the requesting process, and the service device can receive the service call request through the service providing process. The requesting device can refer to the service device where the requesting process resides, and the service device where the service providing process resides can be referred to as a service device, etc. Optionally, the service call request can be sent by the requesting process or its requesting process interface. The service call request may or may not include call parameters.

[0047] Optionally, if the service call request includes call parameters, the process request method of the target process interface can be obtained through the requesting process, and a service call request can be sent to the service providing process based on this process request method. Specifically, the process request method of the target process interface can be obtained through the requesting process; the process request method is negotiated between the requesting process and the target process interface; this process request method is used to indicate the encryption method when sending the service call request; further, the service call request is sent to the service providing process through this process request method. Specifically, if the process request method is a dynamic key request method, the first dynamic key between the requesting process and the target process interface is obtained, the call parameters are encrypted using the first dynamic key to obtain dynamically encrypted parameters, and a service call request carrying the dynamically encrypted parameters is sent to the service providing process, which receives the service call request sent by the requesting process; the service providing process includes the target process interface. Here, the first dynamic key may refer to the dynamic key cached by the requesting process between itself and the target process interface. If the process request method is a static key request, the service provider process obtains its corresponding service key, encrypts the call parameters using this key to obtain static encrypted parameters, and sends a service call request carrying these parameters to the service provider process. The service provider process then receives the service call request from the requesting process. If the process request method is a plaintext request, the requesting process sends a service call request carrying the call parameters to the service provider process, which then receives the request. The related processes implemented by the requesting process can be implemented by the requesting device, which can be the same device as the service device (i.e., the requesting process and the service provider process reside on the same device) or a different device (i.e., the requesting process and the service provider process reside on different devices).

[0048] Optionally, when the process request method is a dynamic key request method, a first dynamic key between the requesting process and the target process interface can be obtained from the requesting process's request process cache. If the first dynamic key between the requesting process and the target process interface is not found, a key retrieval request is sent to the target process interface (specifically, the requesting process sends a key retrieval request to the target process interface), and the first dynamic key sent by the target process interface is obtained based on the key retrieval request. Optionally, the service device obtains the first dynamic key between itself and the requesting process through the target process interface. If it is not found, the service device can generate the first dynamic key between itself and the requesting process through the target process interface and send the first dynamic key to the requesting process. Optionally, when the service device generates the first dynamic key between itself and the requesting process through the target process interface, it can obtain a third random parameter from the service management device corresponding to the service providing process, generate a fourth random parameter through the service providing process, and generate the first dynamic key between the requesting process and the target process interface based on the third and fourth random parameters. By introducing multiple random parameters, the randomness of the first dynamic key is improved, thereby improving the security of the first dynamic key and thus improving the security of inter-process communication. Optionally, when the service device sends the first dynamic key to the requesting process, it can generate a first key pair through the requesting process and send the first public key from the first key pair to the service providing process. Within the service device, the service providing process encrypts the first dynamic key using the first public key to obtain first dynamically encrypted data, which it then sends to the requesting process. Within the service device, the requesting process decrypts the first dynamically encrypted data using the first private key from the first key pair to obtain the first dynamic key. It then uses a temporarily generated first key pair to encrypt and decrypt the transmission of the first dynamic key. Due to the temporary and random nature of the first key pair, the security of the encryption and decryption process of the first dynamic key is improved, thereby enhancing the security of the first dynamic key and, consequently, the security of process communication. Alternatively, the service device can obtain the request fixed key from the requesting process through the service providing process, encrypt the first dynamic key using the request fixed key to obtain second dynamically encrypted data, and send the second dynamically encrypted data to the requesting process. Within the service device, the requesting process uses the request fixed private key corresponding to the request fixed key to decrypt the second dynamically encrypted data to obtain the first dynamic key, and so on. The requested fixed key can be considered as the fixed public key of the requesting process. Optionally, the service device can send the association relationship between the first dynamic key, the requesting process, and the target process interface to the service management device corresponding to the service providing process through the service providing process. The service management device can store the association relationship between the first dynamic key, the requesting process, and the target process interface for subsequent detection of communication between the requesting process and the target process interface.Specifically, the service device can generate a first key hash of the first dynamic key through the service providing process, and send the first key hash, the requesting process, and the target process interface to the service management device. The service management device can associate and store the first key hash, the requesting process, and the target process interface.

[0049] Furthermore, the business device can obtain the target security access policy for the requesting process through the service provider process. Specifically, the business device can obtain the process identifier corresponding to the requesting process, and based on the process identifier, obtain the target security access policy for the requesting process through the target process interface called by the service call request. Specifically, the business device can obtain the request storage path corresponding to the requesting process through the service provider process, and obtain the first file modification time corresponding to the requesting process from the request storage path; the first file modification time refers to the largest file modification time among the file modification times corresponding to the requesting process; based on the request storage path and the first file modification time, a process identifier corresponding to the requesting process is generated; based on the process identifier, the target security access policy for the requesting process through the target process interface called by the service call request is obtained; the service provider process includes the target process interface.

[0050] The request storage path corresponding to the requesting process can represent the absolute path of the executable file corresponding to the requesting process, and optionally, it can also include the name of the requesting process. Since the same storage path may not uniquely identify a specific file, it may be misused by other files under a different name, or the storage path may remain unchanged even if the requesting process itself is updated, while the executable file itself changes. By using the request storage path and the modification time of the first file, the same file can be identified more accurately. Therefore, the process identifier obtained in this way can be used to uniquely indicate the requesting process, improving the accuracy of process lookup. Therefore, optionally, when the executable file corresponding to the requesting process changes, the file change information of the executable file corresponding to the requesting process can be sent to the associated process of the requesting process. The file change information may include the change time and storage path of the requesting process, etc. The associated process refers to a process that is related to the requesting process, such as a process that includes a security access policy related to the requesting process. In this embodiment of the application, the associated process includes a service providing process, so that the associated process and the service management device corresponding to the associated process can update the association relationship between the requesting process and the security access policy in a timely manner. This association relationship can be called a policy mapping relationship. For example, suppose the service provider process includes a policy mapping relationship of "path A time A - security access policy 1", where path A and time A refer to the requesting process. When the executable file corresponding to the requesting process changes, the file change information is sent to the service provider process. Suppose that the file change information includes "path A time B", then the service provider process can update the policy mapping relationship associated with the requesting process based on the file change information, that is, update "path A time A - security access policy 1" to "path A time B - security access policy 1", so that the service provider process can subsequently find the security access policy related to the requesting process.

[0051] Alternatively, the business device can obtain the request process information corresponding to the request process, parse the request process information, and obtain the process type of the request process. Specifically, the business device can parse the request process information to determine the business data type corresponding to the request process information and obtain the process type corresponding to the business data type; or, it can input the request process information into a process parsing model for parsing to obtain the process type of the request process. The request process information may include, but is not limited to, the process name, process version number, process version information, and signature of the request process, and may also include process service data. The process type may include, but is not limited to, collective session type (such as enterprise member session type), collective office type (such as enterprise office type), or game running type, etc. The business device can obtain the target security access policy for the process type of the target process interface called by the service call request. For example, assuming the process type of the request process is collective office type, the business device can determine the target security access policy for the collective office type of the target process interface as the target security access policy for the request process. Security access policies can be configured for a class of processes by process type, reducing the amount of data required for policy configuration. For example, if a service provider process is used to provide enterprise office data, it can grant permissions to processes within the same enterprise that are classified as "collective office type". This means a policy mapping relationship can exist: "XX collective office type - security access policy (open access permission)". "XX" can refer to the collective to which the service provider process resides. When the process type of the requesting process is "XX collective office type", the security access policy "open access permission" can be set as the target security access policy for that requesting process.

[0052] Optionally, multiple strategies can be used simultaneously to obtain the target security access policy of the target process interface for the requesting process. For example, by using both the "process identifier" and "process type" acquisition methods to determine the target security access policy, the security access policy of the target process interface for the process identifier of the requesting process, and the security access policy of the target process interface for the process type of the requesting process, can be determined as the target security access policy of the target process interface for the requesting process.

[0053] Optionally, when obtaining the target security access policy of the target process interface invoked by the service call request for the requesting process, the target security access policy of the target process interface for the requesting process can be obtained from the service process cache corresponding to the service provider process. Specifically, in this step, the business device receives the service call request sent by the requesting process through the service provider process and obtains the target security access policy of the target process interface invoked by the service call request for the requesting process from the service process cache corresponding to the service provider process.

[0054] Optionally, the service provider process may include one or more security access policies, where each security access policy can be for a process or for an interface under the process. Specifically, the business device can obtain the target process interface invoked by the service call request, and the service provider process to which the target process interface belongs. It can then determine the security access policy of the target process interface for the requesting process, and the security access policy of the service provider process for the requesting process, as the target security access policy for that target process interface for the requesting process. The security access policy required to access the service provider process must also be met when accessing the process interfaces included in the service provider process (including the target process interface). For example, if only processes satisfying security access policy 1 can access the service provider process, then accessing the process interfaces included in the service provider process must also satisfy security access policy 1. By flexibly configuring security access policies for processes and their process interfaces, access security management for the entire process and the individual process interfaces under a process can be achieved, improving the flexibility of inter-process access.

[0055] Step S302: Obtain the first policy request information of the requesting process based on the target security access policy. When the requesting process is verified based on the target security access policy and the first policy request information, obtain the key access method between the interface of the requesting process and the target process.

[0056] In this embodiment, the service device can obtain the access parameter type from the target security access policy, obtain the parameter data of the requesting process under the access parameter type, and determine the parameter data as the first policy request information of the requesting process. For example, if the access parameter type in the target security access policy includes a path type, then the parameter data of the requesting process under the access parameter type is obtained, which is the parameter data of the requesting process under the path type, i.e., the request storage path of the requesting process. The first policy request information and the target security access policy are sent to the service management device corresponding to the service providing process, so that the service management device can detect the first policy request information based on the target security access policy. When the first policy request information meets the process access conditions of the target security access policy, the verification of the requesting process is determined to be successful. Specifically, the service management device can detect the requesting process based on the first policy request information and the target security access policy, obtain the detection result, and send the detection result to the service providing process. The service device can receive the detection result through the service providing process and can execute subsequent processes based on the detection result. For example, suppose the target security access policy states that "application processes in a specific directory can access the service provider process," and suppose that specific directory is the installation directory of the zero-trust security management system. Then, the business device can obtain the access parameter type, i.e., the "path type," from the target security access policy through the service provider process, and obtain the request storage path of the requesting process (i.e., the first policy request information) through the service provider process. The service management device can then detect the first policy request information based on the target security access policy. If the request storage path belongs to the installation directory of the zero-trust security management system, meaning the first policy request information meets the process access conditions of the target security access policy (i.e., stored in a specific directory), then the verification of the requesting process can be considered successful.

[0057] Furthermore, when the requesting process is verified successfully based on the target security access policy and the first policy request information, the service device can obtain the key access method between the requesting process and the target process interface. In other words, when the detection result indicates that the requesting process has passed verification, the service device can obtain the key access method between the requesting process and the target process interface. Specifically, the key access method between the requesting process and the target process interface can be obtained from the target security access policy. For example, if the target security access policy does not include access method configuration information, the default access method can be determined as the key access method between the requesting process and the target process interface. This default access method can be a plaintext access method or a static key access method. Alternatively, the interface data associated with the target process interface can be obtained, the interface data can be parsed to obtain the data sensitivity of the interface data, and the encryption method corresponding to the data sensitivity can be determined as the key access method between the requesting process and the target process interface. For example, interface data can be input into a sensitivity detection model for detection to obtain the data sensitivity of the interface data, obtain the sensitive segment to which the data sensitivity belongs, and determine the encryption method corresponding to the sensitive segment as the key access method between the requesting process and the target process interface; or, the data type of the interface data can be obtained, the data sensitivity corresponding to the data type can be obtained, and the encryption method corresponding to the data sensitivity can be determined as the key access method between the requesting process and the target process interface. Here, the data type includes, but is not limited to, publicly available data types (such as data types published on the Internet), internal data types (such as the type of service or data provided to a group), and semi-public data types (such as the type of data or service provided to a group forum), etc. Generally, the sensitivity of publicly available data types is lower than that of semi-public data types, and the sensitivity of semi-public data types is lower than that of internal data types, etc. Of course, the classification of data types can be added, deleted, or modified as needed. Optionally, the business device can obtain the degree of association between the requesting process and the service providing process. Based on this degree of association, it can determine the key access method between the interface of the requesting process and the target process. The higher the degree of association, the higher the degree of association between the requesting process and the service providing process, the higher the possibility and degree of data interaction, and the higher the security of the interaction between the two processes. The key access method can be determined by this degree of association. For example, if the requesting process and the service providing process are both processes running on the same application for a group, the degree of association between the requesting process and the service providing process can be obtained, and the key access method between the interface of the requesting process and the target process can be determined to be a static key access method.

[0058] Optionally, the process request method and key access method between the requesting process and the target process interface can be the same or different.

[0059] Optionally, the service call request carries encrypted parameters. The generation process of these encrypted parameters can be found in step S301, which describes the encryption process for the call parameters. A first service key for the encrypted parameters is obtained, and the encrypted parameters are decrypted using this first service key. The first service key is the key used to decrypt the encrypted parameters. If the encrypted parameters are dynamically encrypted, the first service key is the dynamic private key cached by the service providing process; if the encrypted parameters are statically encrypted, the first service key is the service fixed private key corresponding to the service fixed key, which is the latest fixed private key cached by the service providing process. Further, if the encrypted parameters are successfully decrypted, the response result corresponding to the service call request is obtained based on the call parameters obtained from the decryption. Step S303, which converts the response result corresponding to the service call request based on the key access method, is then executed to obtain the business response data. Of course, the execution order between the decryption process of the encrypted parameters and the process of obtaining the key access method between the requesting process and the target process interface can be interchanged. If decryption of the encrypted parameters fails, a key reset command is sent to the requesting process. The requesting process generates a random key pair and sends the random public key from the random key pair to the service provider process. In the service provider process, the second service key is encrypted using the random public key to obtain encrypted key data, which is then sent to the requesting process. In the requesting process, the encrypted key data is decrypted using the random private key from the random key pair to obtain the second service key. The call parameters are then re-encrypted using the second service key to obtain updated encrypted parameters. Based on the updated encrypted parameters, the service call request is resent to the service provider process. The service provider process includes a target process interface. The first service key and the second service key form a key pair. When the first service key refers to a dynamic private key cached by the service provider process, the first service key and the second service key can be considered the same, forming a symmetric key pair.

[0060] Wherein, if the encryption parameter is a dynamic encryption parameter, then the second service key refers to the latest dynamic key cached by the service providing process; if the encryption parameter is a static encryption parameter, then the second service key refers to a fixed key built into the service providing process, etc. This process primarily addresses situations where changes occur in the service provider's process, such as version changes. These changes might alter the fixed key embedded within the service provider's process. If the requesting process fails to obtain the updated fixed key in time, it might use an expired fixed key to encrypt the call parameters when using a static key request method, leading to anomalies in the encryption and decryption process of inter-process communication. Alternatively, if the service provider generates a new dynamic key and the requesting process fails to obtain it in time, it might use an expired dynamic key between the service provider and the requesting process to encrypt the call parameters, also causing anomalies in the encryption and decryption process of inter-process communication. By addressing these issues, the service provider can use the latest cached private key to decrypt the encrypted parameters, ensuring that the requesting and service providers can use the latest keys for encryption and decryption, thus improving the security of inter-process communication.

[0061] Optionally, when the verification of the requesting process fails based on the target security access policy and the first policy request information, a response error message is sent to the requesting process based on the service provider process; the service provider process includes the target process interface.

[0062] Step S303: Based on the key access method, the response result corresponding to the service call request is converted to obtain business response data, and the business response data is sent to the request process.

[0063] In this embodiment, the service device can obtain the response result corresponding to the service call request based on the service providing process. Optionally, if call parameters are obtained, the service call request's response result for the call parameters is obtained based on the service providing process. Further, if the key access method is dynamic key access, the first dynamic key between the requesting process and the target process interface is obtained, and the response result corresponding to the service call request is encrypted using the first dynamic key to obtain service response data; wherein, the first dynamic key pair generated by the service providing process can be considered as a symmetric key pair, the first dynamic key pair including the first dynamic key, which can be used by the requesting process to encrypt the call parameters or by the service providing process to encrypt the response result. If the key access method is static key access, the request fixed key corresponding to the requesting process is obtained, and the response result is encrypted using the request fixed key to obtain service response data; if the key access method is plaintext access, the response result is determined as service response data.

[0064] Optionally, upon receiving a key update message, the service device can obtain the first random parameter sent by the service management device and generate a second random parameter through the service provider process; the service provider process includes a target process interface. Based on the first and second random parameters, a second dynamic key is generated between the requesting process and the target process interface. Specifically, a symmetric key generation method can be used to process the first and second random parameters to generate a second dynamic key pair between the requesting process and the target process interface. This second dynamic key pair includes a second dynamic key. The second dynamic key is sent to the requesting process, and the service call request resent by the requesting process based on the second dynamic key is received. Since the dynamic key pair is generated by the service provider process and used for communication with the requesting process, to achieve encryption and decryption of data during process communication, the requesting process needs to decrypt using its private key, and the service provider process needs to encrypt using its public key. Therefore, a symmetric key generation method can be directly used to generate the dynamic key pair to improve the efficiency of dynamic key generation and transmission. Optionally, the key hash value of the second dynamic key is obtained, and the association between the key hash value, the requesting process, and the target process interface is sent to the service management device. The association is used by the service management device to detect the service call request when the key access method between the requesting process and the target process interface is the dynamic key access method.

[0065] In this embodiment, the service device can receive a service call request sent by a requesting process, obtain the target security access policy of the target process interface called by the service call request for the requesting process, obtain the first policy request information of the requesting process based on the target security access policy, and when the requesting process is verified successfully based on the target security access policy and the first policy request information, obtain the key access method between the requesting process and the target process interface; convert the response result corresponding to the service call request based on the key access method to obtain service response data, and send the service response data to the requesting process; the key access method is used to represent the encryption method of the response result. Through the above process, a secure access policy for inter-process communication is deployed. This secure access policy is used to represent the communication requirements between various processes. When communication is required between the requesting process and the target process interface, the security of the communication between the requesting process and the target process interface can be detected based on the target security access policy between them to improve the security of process communication. At the same time, the requesting process and the target process interface negotiate a key access method, which allows different key access methods to be used in different process communications based on requirements. This allows for flexible management of the encryption method of inter-process communication, improving the flexibility of inter-process communication while ensuring the security of process communication.

[0066] Further, see Figure 4 , Figure 4 This is a flowchart of another process communication method provided in an embodiment of this application. Figure 4 As shown, this inter-process communication process can be considered to be implemented by the service management device, and the inter-process communication process may include the following steps: Step S401: Obtain the target security access policy and the first policy request information sent by the service provider process; detect the first policy request information based on the target security access policy; and obtain the detection result.

[0067] In this embodiment, the target security access policy refers to the policy of the target process interface invoked by the service invocation request for the requesting process; the service invocation request is generated by the requesting process; the service providing process includes the target process interface; and the first policy request information is the information of the requesting process obtained based on the target security access policy. The process of obtaining the target security access policy and the first policy request information can be found in [reference needed]. Figure 3 The relevant descriptions shown in steps S301 to S302 are as follows.

[0068] Furthermore, the service management device can detect the validity of the target security access policy. If the target security access policy is invalid, it obtains the first security access policy of the target process interface for the requesting process and sends the first security access policy to the service provider process, so that the service provider process can obtain the second policy request information of the requesting process based on the first security access policy. The service management device obtains the second policy request information sent by the service provider process, detects the second policy request information based on the first security access policy, and obtains the detection result. If the target security access policy is valid, it detects the first policy request information based on the target security access policy and obtains the detection result.

[0069] In detecting the validity of a target security access policy, the service management device can employ N policy detection methods, where N is a positive integer. If the target security access policy meets the validity conditions corresponding to each of the N policy detection methods, it is determined to be a valid policy. If any of the N policy detection methods fails to meet the validity conditions, the target security access policy is determined to be invalid. Specifically, under one policy detection method, the service management device can obtain the policy validity period of the target security access policy and the system network time. If the system network time falls within the policy validity period, the target security access policy is determined to be valid; otherwise, it is determined to be invalid. Alternatively, under another policy detection method, the device can obtain the number of valid policy reuses and the number of historical policy reuses of the target security access policy. If the number of historical policy reuses is less than the number of valid policy reuses, the target security access policy is determined to be valid; if the number of historical policy reuses is greater than or equal to the number of valid policy reuses, the target security access policy is determined to be invalid. Alternatively, in one policy detection method, the first security access policy of the target process interface for the requesting process can be obtained. If the target security access policy is consistent with the first security access policy, the target security access policy is determined to be a valid policy; if the target security access policy is inconsistent with the first security access policy, the target security access policy is determined to be an invalid policy. The first security access policy refers to the security access policy with the longest storage time among the security access policies associated with the target process interface and the requesting process. Optionally, policy detection methods can be added, deleted, or updated as needed. For example, taking multiple policy detection methods as an example, such as policy validity period and consistency detection, the service management device can obtain the policy validity period of the target security access policy, obtain the system network time, and obtain the first security access policy of the target process interface for the requesting process. If the system network time belongs to the policy validity period and the target security access policy is consistent with the first security access policy, the target security access policy is determined to be a valid policy; if the system network time does not belong to the policy validity period or the target security access policy is inconsistent with the first security access policy, the target security access policy is determined to be an invalid policy, etc.

[0070] Furthermore, in one possible strategy, the target security access policy includes a secure access path, and the first policy request information includes the request storage path of the requesting process. When detecting the first policy request information based on the target security access policy and obtaining the detection result, the request storage path can be compared with the secure access path. If the request storage path belongs to the secure access path, the detection success result is determined as the detection result for the requesting process; if the request storage path does not belong to the secure access path, the detection failure result is determined as the detection result for the requesting process. For example, assuming the secure access path is the installation directory of the zero-trust security management system, if the request storage path is located in the installation directory of the zero-trust security management system, the detection success result is determined as the detection result for the requesting process; if the request storage path is not located in the installation directory of the zero-trust security management system, the detection failure result is determined as the detection result for the requesting process.

[0071] In one possible strategy, the target security access policy includes security access features. When detecting the first policy request information based on the target security access policy and obtaining the detection result, the service management device can obtain the request process features associated with the security access features from the first policy request information. If the request process features match the security access features, the detection success result is determined as the detection result for the request process; if the request process features do not match the security access features, the detection failure result is determined as the detection result for the request process. For example, if the security access features include a specific digital signature and a version threshold, the request digital signature of the request process and the file version number of the executable file corresponding to the request process can be obtained from the first policy request information. If the request digital signature matches the specific digital signature and the file version number is greater than or equal to the version threshold, the detection success result is determined as the detection result for the request process; if the request digital signature does not match the specific digital signature, or the file version number is less than the version threshold, the detection failure result is determined as the detection result for the request process.

[0072] Optionally, the number of target security access policies can be M, where M is a positive integer. If the first policy request information meets the process access conditions of the M target security access policies, then the detection success result is determined as the detection result of the requesting process; if there is a target security access policy among the M target security access policies where the first policy request information does not meet the process access conditions, then the detection failure result is determined as the detection result of the requesting process.

[0073] Optionally, if the detection result is successful, the service management device can obtain the first dynamic key between the requesting process and the target process interface and check the validity of the first dynamic key. For example, it can obtain the effective key reuse count and the historical key reuse count of the first dynamic key. If the historical key reuse count is greater than or equal to the effective key reuse count, the first dynamic key is determined to be an invalid key; if the historical key reuse count is less than the effective key reuse count, the first dynamic key is determined to be a valid key. Further, if the first dynamic key is invalid, a key update message is sent to the service providing process. The key update message includes a first random parameter, enabling the service providing process to generate a second dynamic key between the requesting process and the target process interface based on the first random parameter and a generated second random parameter. The second dynamic key is used for communication between the requesting process and the target process interface. If the first dynamic key is valid, step S402 is executed, and the detection result is sent to the service providing process.

[0074] Step S402: Send the detection result to the service provider process so that the service provider process sends business response data to the requesting process when the detection result indicates that the verification of the requesting process has passed.

[0075] In this embodiment, the business response data is obtained by transforming the response result corresponding to the service call request based on the key access method between the requesting process and the target process interface. Specifically, the service management device can send the detection result to the service provider process. When the detection result indicates that the verification of the requesting process has passed, the business device can obtain the response result corresponding to the service call request through the service provider process, transform the response result using the key access method to obtain the business response data, and then send the business response data to the requesting process.

[0076] Further options can be found in Figure 5 , Figure 5 This is a schematic diagram of a strategy configuration scenario provided in an embodiment of this application. For example... Figure 5As shown, the policy configuration device can display a policy configuration page 501, obtain policy configuration information based on this page, and generate a secure access policy based on this information. This policy configuration information may include the policy name and process access conditions, as well as key access methods. For example, the policy configuration device can obtain the policy name from the name input area of ​​the policy configuration page 501, obtain process configuration parameters from the parameter configuration area 5011, and obtain the access type from the access type configuration area 5012. This access type may include, but is not limited to, allowed access types and prohibited access types. Optionally, allowed access types can be further divided into dynamic access types (corresponding to dynamic key access methods), static access types (corresponding to static key access methods), and plaintext access types (corresponding to plaintext access methods). The device can also obtain the process interface corresponding to the aforementioned process configuration parameters and access types from the interface configuration area 5013. The policy configuration device can determine process access conditions based on the process configuration parameters, access types, and process interfaces, and generate a secure access policy based on the policy name and process access conditions. For example, assuming the process configuration parameter is "path A", the access type is "dynamic access type", the process interface is "process interface 1 under process 1", and the policy name is "secure access policy 1", then the secure access policy is "secure access policy 1: processes under path A need to use dynamic key access and access process interface 1 under process 1". Optionally, the policy configuration device can respond to a trigger operation on the key access configuration component, display the key access configuration page 502, obtain the third process from the process configuration area 5021 of the key access configuration page 502, obtain the key access method from the key access method configuration area 5022, obtain the configured process interface from the interface configuration area 5023, and generate a secure access policy based on the third process, the key access method, and the configured process interface. For example, if the third process is "Process 1", the key access method is "Dynamic Key Access", and the configured process interface is "Process Interface 1 under Process 2", then the security access policy is "Process 1 needs to use Dynamic Key Access to access Process Interface 1 under Process 2". For example, assuming the target process interface is Process Interface 1 under Process 2 and the requesting process is Process 1, then the target security access policy for the requesting process interface includes "Process 1 needs to use Dynamic Key Access to access Process Interface 1 under Process 2", and the key access method between the requesting process and the target process interface is Dynamic Key Access.

[0077] Optionally, the policy configuration device can obtain policy configuration instructions and generate a secure access policy based on those instructions.

[0078] The policy configuration device can be the aforementioned requesting device or service device, or it can be the service management device of the process to which the configured security access policy applies, or it can be a device used for policy configuration. For example, assuming a security access policy is configured for application A, the policy configuration device can be the service management device corresponding to application A, and can be used to configure security access policies for all processes of application A. Further optionally, the policy configuration device can send the generated security access policy to the device where the service providing process involved in the security access policy resides, or it can send the security access policy to the service management device of the service providing process involved in the security access policy.

[0079] Further, see Figure 6 , Figure 6 This is a schematic diagram of a process communication interaction flow provided in an embodiment of this application. For example... Figure 6 As shown, the process may include the following steps: Step S601: Send a service call request.

[0080] In this embodiment of the application, the requesting process can send a service invocation request to the service providing process. For details, please refer to... Figure 3 The relevant description shown in step S301. Specifically, if no calling parameters exist, the requesting process can directly send a service call request to the service providing process; if calling parameters exist, a service call request can be sent to the service providing process based on the process request method. This plaintext request method can be considered as having no confidentiality requirements for the target process interface called by the service call request.

[0081] Step S602: Obtain the first strategy request information.

[0082] In this embodiment, the service providing process can obtain the target security access policy of the target process interface invoked by the service call request for the requesting process. Furthermore, it can obtain the access parameter type from the target security access policy, obtain the parameter data of the requesting process under the access parameter type, and determine this parameter data as the first policy request information of the requesting process. For details, please refer to... Figure 3 The relevant descriptions of steps S301 to S302 are as follows. For example, if the access parameter type includes signature type, name type, version type, and version information type, then the parameter data of the requesting process under the access parameter type can be obtained, that is, the process signature, process name, process version number, and process version information of the requesting process can be obtained. Optionally, if no security access policy for the target process interface is found for the requesting process, the response data of the service call request can be obtained and sent to the requesting process.

[0083] Step S603: Send the target security access policy and the first policy request information.

[0084] In this embodiment, the service providing process can send a target security access policy and a first policy request information to the service management device. Optionally, it can obtain the target policy identifier of the target security access policy and send the target policy identifier and the first policy request information to the service management device. The target policy identifier can be used to indicate the corresponding security access policy and its policy version. Optionally, the service providing process can obtain the key hash value of a second service key and send it to the service management device. The second service key refers to the latest public key cached by the service providing process. If the key access method is dynamic key access, the second service key refers to the latest dynamic public key cached by the service providing process; if the key access method is static key access, the second service key refers to the latest fixed public key cached by the service providing process.

[0085] Step S604: Detect the effectiveness of the strategy.

[0086] In this embodiment, the service management device can detect the validity of the target security access policy, as detailed in the following example. Figure 4 The relevant description is shown in step S401. Further, if the target security access policy is invalid, then step S606 is executed; if the target security access policy is valid, then the first security access policy of the target process interface for the requesting process is obtained, and step S605 is executed. The first security access policy refers to the latest security access policy of the target process interface managed by the service management device for the requesting process.

[0087] Step S605: Send the first security access policy.

[0088] In this embodiment, the service management device sends a first security access policy to the service provider process, which can then add the first security access policy to its cache. Further, the service provider process can obtain the second policy request information of the requesting process based on the first security access policy, and send both the first security access policy and the second policy request information to the service management device, executing step S606.

[0089] Step S606: Detect the requesting process.

[0090] In this embodiment, when called in step S604, the service management device can detect the first policy request information based on the target security access policy to obtain the detection result of the requesting process; when called in step S605, the service management device can detect the second policy request information based on the first security access policy to obtain the detection result of the requesting process. For the specific detection process, please refer to... Figure 4 Following the relevant description in step S401, proceed to step S608. Optionally, step S607 may be further performed to check the validity of the key.

[0091] Step S607: Detect the validity of the key.

[0092] In this embodiment of the application, if the detection result is a successful detection result, the first dynamic key between the interface between the requesting process and the target process can be obtained, and the validity of the first dynamic key can be detected. If the first dynamic key is an invalid key, step S609 is executed; if the first dynamic key is a valid key, step S608 is executed.

[0093] Step S608: Send the detection results.

[0094] In this embodiment, the service management device sends the detection result to the service provider process, which can then execute subsequent processes based on the detection result. Specifically, when the detection result indicates that the request process has passed verification, the response result corresponding to the service call request is converted based on the key access method between the request process and the target process interface to obtain business response data, which is then sent to the request process. See [link to details] for further information. Figure 3 The relevant description shown in step S303: When the detection result indicates that the verification of the requesting process has failed, a response error message is sent to the requesting process based on the service providing process.

[0095] Step S609: Send a key update message.

[0096] In this embodiment, the service management device sends a key update message to the service providing process. Optionally, the key update message may include a first random parameter, which may include, but is not limited to, the key bit length, the symmetric key generation method, and the dynamic key caching time period, etc. For details, please refer to [link to relevant documentation]. Figure 3 According to the relevant description, the service provider process can generate a second random parameter, and based on the first random parameter and the second random parameter, generate a second dynamic key between the interface between the requesting process and the target process. Specifically, it can generate a second dynamic key pair, which includes a second dynamic key. The second dynamic key pair adopts a symmetric key generation method. Generating a second dynamic key pair can also be considered as generating a second dynamic key.

[0097] Step S610: Reset the key.

[0098] In this embodiment of the application, the service providing process sends a key reset instruction to the requesting process.

[0099] Step S611: Generate the first key pair.

[0100] In this embodiment of the application, the requesting process can generate a first key pair based on the key reset instruction. The first key pair can be considered as a random key pair, which includes a first random public key and a first random private key.

[0101] Step S612: Send the public key from the first key pair.

[0102] In this embodiment of the application, the requesting process sends the public key of the first key pair, i.e., the first random public key, to the service providing process.

[0103] Step S613: Store the mapping relationship between the second dynamic key and the requesting process.

[0104] In this embodiment, the service providing process can store the mapping relationship between the second dynamic key and the requesting process. Specifically, it can obtain the key hash value of the second dynamic key and store the mapping relationship between the key hash value of the second dynamic key and the requesting process in the service process cache of the service providing process. Steps S614 and S616 are then executed.

[0105] Step S614: Send the mapping relationship between the second dynamic key and the requesting process.

[0106] In this embodiment, the service providing process sends the mapping relationship between the second dynamic key and the requesting process to the service management device.

[0107] Step S615: Store the mapping relationship between the second dynamic key and the requesting process.

[0108] In this embodiment of the application, the service management device may store the mapping relationship between the second dynamic key and the requesting process.

[0109] Step S616: Send the second dynamic key.

[0110] In this embodiment, the service provider process sends a second dynamic key to the requesting process. Specifically, the service provider process encrypts the second dynamic key using a first random public key to obtain third dynamically encrypted data, and sends the third dynamically encrypted data to the requesting process. The requesting process decrypts the third dynamically encrypted data using a first random private key to obtain the second dynamic key.

[0111] Step S617: Send a service call request.

[0112] In this embodiment of the application, the requesting process can resend the service call request to the service providing process based on the second dynamic key.

[0113] Step S618: Obtain the response result and convert the response result into business response data.

[0114] In this embodiment, the service call request carries encrypted parameters. The service providing process can obtain a first service key for the encrypted parameters and use the first service key to decrypt the encrypted parameters. If the decryption of the encrypted parameters is successful, the response result corresponding to the service call request is obtained based on the call parameters obtained from the decryption of the encrypted parameters. The response result is then encrypted based on the key access method to obtain the business response data. If the decryption of the encrypted parameters fails, a key reset instruction is sent to the requesting process. For details, please refer to the key reset process shown in steps S610 to S618.

[0115] Step S619: Send service response data.

[0116] In this embodiment, the service provider process sends business response data to the requesting process.

[0117] Step S620: Obtain the response result.

[0118] In this embodiment, the requesting process can decrypt the business response data to obtain the response result. The requesting process can obtain the latest cached key and use it to decrypt the business response data to obtain the response result. For example, if the business response data is obtained by encrypting the response result corresponding to the service call request using a first dynamic key, the requesting process can use the first dynamic key to decrypt the business response data to obtain the response result; that is, the latest key is the first dynamic key. Alternatively, if the business response data is obtained by encrypting the response result corresponding to the service call request using a fixed request key, the requesting process can use the fixed request private key to decrypt the business response data to obtain the response result; that is, the latest key is the fixed request key. Similarly, if the business response data is obtained by encrypting the response result corresponding to the service call request using a second dynamic key, the requesting process can use the second dynamic key to decrypt the business response data to obtain the response result; that is, the latest key is the second dynamic key, and so on.

[0119] In this context, a fixed key refers to a key that can be used to encrypt and decrypt communication data when the hash value of the executable file of the corresponding process remains unchanged (e.g., without updating the version). A dynamic key refers to a key that can be dynamically negotiated and changed with other processes to encrypt and decrypt communication data, even when the hash value of the executable file of the corresponding process remains unchanged, based on the security access policy. If the service provider process and the requesting process belong to the same application, they can embed the same fixed key. Optionally, a software protection system (virtual machine protect, vmprotect) can be used to protect this fixed key. If the service provider process and the requesting process do not belong to the same application, the service provider process can send the fixed key to the requesting process.

[0120] in, Figure 6 The process implemented by the requesting process shown can be considered as being implemented by the requesting device where the requesting process resides, and the process implemented by the service providing process can be considered as being implemented by the service device where the service providing process resides. The requesting device and the service device can be the same device or different devices. This application focuses on the communication process between processes. When the requesting device and the service device are different devices, the communication method between the two devices can adopt any device communication method. This application can achieve secure communication between processes based on device communication methods.

[0121] Further, please see Figure 7 , Figure 7 This is a schematic diagram of a process communication device provided in an embodiment of this application. The process communication device can be a computer program (including program code, etc.) running on a computer device; for example, the process communication device can be an application software. The device can be used to execute corresponding steps in the methods provided in the embodiments of this application. Figure 7 As shown, the process communication device 700 can be used for Figure 3 Specifically, the computer device in the corresponding embodiment may include: a request receiving module 11, a policy acquisition module 12, an information acquisition module 13, an access determination module 14, a data conversion module 15, and a response sending module 16.

[0122] Request receiving module 11 is used to receive service call requests sent by the requesting process; The policy acquisition module 12 is used to acquire the target security access policy of the target process interface called by the service call request for the requesting process; Information acquisition module 13 is used to acquire the first policy request information of the requesting process based on the target security access policy; The access determination module 14 is used to obtain the key access method between the interface between the requesting process and the target process when the verification of the requesting process is successful based on the target security access policy and the first policy request information. Data conversion module 15 is used to convert the response result corresponding to the service call request based on the key access method to obtain business response data; The response sending module 16 is used to send business response data to the requesting process; the key access method is used to indicate the encryption method of the response result.

[0123] The request receiving module 11 includes: The request method determination unit 111 is used to obtain the process request method of the target process interface through the requesting process; the process request method is negotiated between the requesting process and the target process interface. The dynamic acquisition unit 112 is used to acquire the first dynamic key between the interface between the requesting process and the target process if the process request method is a dynamic key request method. The dynamic request unit 113 is used to encrypt the call parameters using a first dynamic key to obtain dynamically encrypted parameters, send a service call request carrying the dynamically encrypted parameters to the service provider process, and receive the service call request sent by the requesting process through the service provider process; the service provider process includes a target process interface; The static request unit 114 is used to obtain the service fixed key corresponding to the service provider process if the process request method is the static key request method, encrypt the call parameters using the service fixed key to obtain static encrypted parameters, send a service call request carrying the static encrypted parameters to the service provider process, and receive the service call request sent by the requesting process through the service provider process. The plaintext request unit 115 is used to send a service call request carrying call parameters to the service provider process through the requesting process if the process request mode is plaintext request mode, and to receive the service call request sent by the requesting process through the service provider process.

[0124] The dynamic acquisition unit 112 includes: The key acquisition subunit 1121 is used to obtain the first dynamic key between the requesting process and the target process interface from the requesting process's requesting process cache; The key request subunit 1122 is used to send a key acquisition request to the target process interface if the first dynamic key between the target process interface and the target process interface is not found, and to acquire the first dynamic key sent by the target process interface based on the key acquisition request.

[0125] The strategy acquisition module 12 includes: The file acquisition unit 121 is used to acquire the request storage path corresponding to the requesting process, and to acquire the first file modification time corresponding to the requesting process from the request storage path; the first file modification time refers to the largest file modification time among the file modification times corresponding to the requesting process. The identifier generation unit 122 is used to generate a process identifier corresponding to the requesting process based on the requested storage path and the modification time of the first file; The identifier determination unit 123 is used to obtain the target security access policy of the target process interface invoked by the service invocation request for the requesting process based on the process identifier; the service providing process includes the target process interface.

[0126] The strategy acquisition module 12 includes: The type acquisition unit 124 is used to acquire the request process information corresponding to the request process, parse the request process information, and obtain the process type of the request process. The type determination unit 125 is used to obtain the target security access policy of the target process interface called by the service call request for the process type.

[0127] Specifically, the information acquisition module 13 is used for: Obtain the access parameter type from the target security access policy, obtain the parameter data of the requesting process under the access parameter type, and determine the parameter data as the first policy request information of the requesting process. The device 700 also includes: The detection request module 17 is used to send the first policy request information and the target security access policy to the service management device corresponding to the service providing process, so that the service management device can detect the first policy request information based on the target security access policy, and determine that the verification of the requesting process is successful when the first policy request information meets the process access conditions of the target security access policy.

[0128] The access determination module 14 includes: Access method determination unit 141 is used to obtain the key access method between the requesting process and the target process interface from the target security access policy; or, The access method determination unit 141 is also used to obtain the interface data associated with the target process interface, parse the interface data, obtain the data sensitivity of the interface data, and determine the encryption method corresponding to the data sensitivity as the key access method between the requesting process and the target process interface.

[0129] The data conversion module 15 includes: The dynamic response unit 151 is used to obtain the first dynamic key between the interface between the requesting process and the target process if the key access method is dynamic key access method, and to encrypt the response result corresponding to the service call request using the first dynamic key to obtain business response data. The static response unit 152 is used to obtain the request fixed key corresponding to the request process if the key access method is static key access method, and to encrypt the response result using the request fixed key to obtain business response data. Plaintext response unit 153 is used to determine the response result as business response data if the key access method is plaintext access method.

[0130] The device 700 also includes: Error message module 18 is used to send a response error message to the requesting process based on the service provider process when the verification of the requesting process fails based on the target security access policy and the first policy request information; the service provider process includes the target process interface.

[0131] The device 700 also includes: The parameter acquisition module 19 is used to acquire the first random parameter sent by the service management device when a key update message is received, and generate the second random parameter through the service provider process; the service provider process includes the target process interface; The key generation module 20 is used to generate a second dynamic key between the interface between the requesting process and the target process based on the first random parameter and the second random parameter. The key feedback module 21 is used to send the second dynamic key to the requesting process and receive the service call request resent by the requesting process based on the second dynamic key.

[0132] The device 700 also includes: The association management module 22 is used to obtain the key hash value of the second dynamic key and send the key hash value, the association relationship between the requesting process and the target process interface to the service management device. The association relationship is used by the service management device to detect the service call request when the key access method between the requesting process and the target process interface is the dynamic key access method.

[0133] The service call request carries encrypted parameters; the device 700 also includes: The parameter decryption module 23 is used to obtain the first service key for the encrypted parameters and use the first service key to decrypt the encrypted parameters. The response acquisition module 24 is used to obtain the response result corresponding to the service call request based on the call parameters obtained by decrypting the encrypted parameters if the encryption parameters are successfully decrypted, and to perform the conversion processing of the response result corresponding to the service call request based on the key access method to obtain the business response data. The key reset module 25 is used to send a key reset command to the requesting process if decryption of the encrypted parameters fails. The requesting process generates a random key pair and sends the random public key from the random key pair to the service provider process. In the service provider process, the second service key is encrypted using the random public key to obtain encrypted key data, which is then sent to the requesting process. In the requesting process, the encrypted key data is decrypted using the random private key from the random key pair to obtain the second service key. The call parameters are then re-encrypted using the second service key to obtain updated encrypted parameters. Based on the updated encrypted parameters, the service call request is resent to the service provider process. The service provider process includes a target process interface; the first service key and the second service key form a key pair.

[0134] Further, please see Figure 8 , Figure 8 This is a schematic diagram of another process communication device provided in an embodiment of this application. The process communication device can be a computer program (including program code, etc.) running on a computer device; for example, the process communication device can be an application software. This device can be used to execute corresponding steps in the methods provided in the embodiments of this application. Figure 8 As shown, the process communication device 800 can be used for Figure 4 Specifically, the computer device in the corresponding embodiment may include: a data receiving module 31, a data detection module 32, and a detection feedback module 33.

[0135] Data receiving module 31 is used to obtain the target security access policy and first policy request information sent by the service providing process; Data detection module 32 is used to detect the first policy request information based on the target security access policy and obtain the detection result; the target security access policy refers to the policy of the target process interface called by the service call request for the requesting process; the service call request is generated by the requesting process; the service providing process includes the target process interface; the first policy request information is the information of the requesting process obtained based on the target security access policy; The detection feedback module 33 is used to send the detection result to the service provider process, so that when the detection result indicates that the verification of the request process is successful, the service provider process sends business response data to the request process. The business response data is obtained by converting the response result corresponding to the service call request according to the key access method between the interface between the request process and the target process.

[0136] The data detection module 32 includes: The policy detection unit 321 is used to detect the policy validity of the target security access policy; The policy update unit 322 is used to obtain the first security access policy of the target process interface for the requesting process if the target security access policy is invalid, and send the first security access policy to the service provider process so that the service provider process can obtain the second policy request information of the requesting process based on the first security access policy. The information detection unit 323 is used to obtain the second policy request information sent by the service provider process, detect the second policy request information based on the first security access policy, and obtain the detection result.

[0137] The strategy detection unit 321 includes: The time detection subunit 3211 is used to obtain the effective time period of the target security access policy and the system network time. If the system network time falls within the effective time period, the target security access policy is determined to be a valid policy; if the system network time does not fall within the effective time period, the target security access policy is determined to be an invalid policy. Or... The reuse detection subunit 3212 is used to obtain the effective policy reuse count and historical policy reuse count of the target security access policy. If the historical policy reuse count is less than the effective policy reuse count, the target security access policy is determined to be a valid policy; if the historical policy reuse count is greater than or equal to the effective policy reuse count, the target security access policy is determined to be an invalid policy; or... The policy matching subunit 3213 is used to obtain the first security access policy of the target process interface for the requesting process. If the target security access policy is consistent with the first security access policy, the target security access policy is determined to be a valid policy. If the target security access policy is inconsistent with the first security access policy, the target security access policy is determined to be an invalid policy. The first security access policy refers to the security access policy with the longest storage time among the security access policies associated with the target process interface and the requesting process.

[0138] The target security access policy includes a security access path, and the first policy request information includes the request storage path of the requesting process. The data detection module 32 includes: The first detection unit 324 is used to determine the detection result of the requesting process as the detection result if the requested storage path belongs to a secure access path. The second detection unit 325 is used to determine the detection failure result as the detection result for the requesting process if the requested storage path does not belong to the secure access path.

[0139] The target security access policy includes security access characteristics; the data detection module 32 includes: The feature acquisition unit 326 is used to acquire request process features associated with secure access features from the first policy request information; The first detection unit 324 is also used to determine the detection success result as the detection result of the requesting process if the characteristics of the requesting process match the characteristics of secure access. The second detection unit 325 is also used to determine the detection failure result as the detection result for the requesting process if the characteristics of the requesting process do not conform to the secure access characteristics.

[0140] The device 800 also includes: The key detection module 34 is used to obtain the first dynamic key between the interface between the requesting process and the target process if the detection result is a successful result, and to detect the validity of the first dynamic key. The invalid update module 35 is used to send a key update message to the service provider process if the first dynamic key is invalid. The key update message includes a first random parameter, so that the service provider process generates a second dynamic key between the requesting process and the target process interface based on the first random parameter and the generated second random parameter. The second dynamic key is used for communication between the requesting process and the target process interface. The sending trigger module 36 is used to execute the process of sending the detection result to the service provider process if the first dynamic key is a valid key.

[0141] This application provides a process communication device that can receive a service call request sent by a requesting process, obtain the target security access policy of the target process interface called by the service call request for the requesting process, obtain the first policy request information of the requesting process based on the target security access policy, and when the requesting process is verified successfully based on the target security access policy and the first policy request information, obtain the key access method between the requesting process and the target process interface, convert the response result corresponding to the service call request based on the key access method to obtain business response data, and send the business response data to the requesting process; the key access method is used to represent the encryption method of the response result. Through the above process, a secure access policy for inter-process communication (IPC) is deployed. This secure access policy represents the communication requirements between various processes. When communication is required between the requesting process and the target process interface, the security of the communication between them can be checked based on the target secure access policy, thereby improving the security of inter-process communication. Simultaneously, the requesting process and the target process interface negotiate a key access method, allowing different key access methods to be used in different inter-process communications based on requirements. This enables flexible management of encryption methods for inter-process communication, improving the flexibility of inter-process communication while ensuring its security. This application, through a secure access policy, configures key access methods for different processes and their sub-process interfaces, realizing access management for different processes or process interfaces and improving the security of inter-process communication.

[0142] See Figure 9 , Figure 9 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 9 As shown, the computer device in this embodiment may include one or more processors 901, a memory 902, and an input / output interface 903. The processor 901, memory 902, and input / output interface 903 are connected via a bus 904. The memory 902 stores a computer program, which includes program instructions. The input / output interface 903 receives and outputs data, such as for data interaction between a requesting process and a service providing process, or for data interaction between a service providing process and a service management device. The processor 901 executes the program instructions stored in the memory 902.

[0143] The processor 901, located in the service device, can perform the following operations: Receive the service call request sent by the requesting process, and obtain the target security access policy of the target process interface called by the service call request for the requesting process; Based on the target security access policy, obtain the first policy request information of the requesting process. When the verification of the requesting process is successful based on the target security access policy and the first policy request information, obtain the key access method between the interface of the requesting process and the target process. The response result corresponding to the service call request is transformed based on the key access method to obtain the business response data, and the business response data is sent to the requesting process; the key access method is used to indicate the encryption method of the response result.

[0144] Alternatively, the processor 901, located in the service management device, can perform the following operations: The system obtains the target security access policy and the first policy request information sent by the service provider process, and detects the first policy request information based on the target security access policy to obtain the detection result. The target security access policy refers to the policy of the target process interface invoked by the service call request for the requesting process. The service call request is generated by the requesting process. The service provider process includes the target process interface. The first policy request information is the information of the requesting process obtained based on the target security access policy. The detection result is sent to the service provider process, so that when the detection result indicates that the verification of the requesting process has passed, the service provider process sends business response data to the requesting process. The business response data is obtained by transforming the response result corresponding to the service call request according to the key access method between the interface between the requesting process and the target process.

[0145] In some feasible implementations, the processor 901 may be a central processing unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0146] The memory 902 may include read-only memory and random access memory, and provides instructions and data to the processor 901 and the input / output interface 903. A portion of the memory 902 may also include non-volatile random access memory. For example, the memory 902 may also store device type information.

[0147] In practice, the computer device can perform actions such as these through its built-in functional modules. Figure 3 or Figure 4 For details on the implementation methods provided for each step, please refer to [the relevant documentation / document / etc.]. Figure 3 or Figure 4 The implementation methods provided for each step are not elaborated here.

[0148] This application provides a computer device including a processor, an input / output interface, and a memory. The processor retrieves a computer program from the memory and executes it. Figure 3 Each step of the method shown involves inter-process communication operations. This embodiment of the application enables a service device to receive service call requests sent by a requesting process, obtain the target security access policy of the target process interface called by the service call request for the requesting process; obtain the first policy request information of the requesting process based on the target security access policy; when the requesting process is verified successfully based on the target security access policy and the first policy request information, obtain the key access method between the requesting process and the target process interface; convert the response result corresponding to the service call request based on the key access method to obtain service response data, and send the service response data to the requesting process; the key access method is used to represent the encryption method of the response result. Through the above process, a secure access policy for inter-process communication is deployed. This secure access policy represents the communication requirements between various processes. When communication is required between the requesting process and the target process interface, the security of the communication between the requesting process and the target process interface can be detected based on the target secure access policy between the two processes to improve the security of inter-process communication. At the same time, the requesting process and the target process interface negotiate a key access method, which allows different key access methods to be used in different inter-process communications based on requirements. This enables flexible management of the encryption method of inter-process communication, thereby improving the flexibility of inter-process communication while ensuring its security.

[0149] This application also provides a computer-readable storage medium storing a computer program adapted to be loaded and executed by a processor. Figure 3 or Figure 4 For details on the inter-process communication methods provided in each step, please refer to the [link / document / document / etc.]. Figure 3 or Figure 4 The implementation methods provided for each step are not repeated here. Furthermore, the beneficial effects of using the same method are also not repeated. For technical details not disclosed in the computer-readable storage medium embodiments involved in this application, please refer to the description of the method embodiments of this application. As an example, a computer program may be deployed to execute on a single computer device, or on multiple computer devices located in one location, or on multiple computer devices distributed across multiple locations and interconnected via a communication network.

[0150] The computer-readable storage medium can be a process communication device provided in any of the foregoing embodiments or an internal storage unit of the computer device, such as a hard disk or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0151] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform... Figure 3 or Figure 4 The methods provided in the various optional approaches implement a secure access policy for inter-process communication. This secure access policy represents the communication requirements between various processes. When communication is required between the requesting process and the target process interface, the security of the communication between the requesting process and the target process interface can be detected based on the target secure access policy between the two processes to improve the security of inter-process communication. At the same time, the requesting process and the target process interface negotiate a key access method, which allows different key access methods to be used in different inter-process communications based on requirements. This enables flexible management of the encryption method of inter-process communication, thereby improving the flexibility of inter-process communication while ensuring its security.

[0152] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0153] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0154] The methods and related apparatus provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowcharts and / or structural diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable process communication device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable process communication device, create means for implementing the functions specified in one or more blocks of the flowcharts and / or one or more blocks of the structural diagrams. These computer program instructions can also be stored in a computer-readable storage medium capable of directing a computer or other programmable process communication device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more blocks of the flowcharts and / or one or more blocks of the structural diagrams. These computer program instructions may also be loaded onto a computer or other programmable process communication device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable device, provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the structure diagram.

[0155] The steps in the method of this application embodiment can be adjusted, combined, or deleted according to actual needs.

[0156] The modules in the device of this application embodiment can be merged, divided, and deleted according to actual needs.

[0157] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A process communication method, characterized in that, The method includes: Receive a service call request sent by a requesting process, and obtain the target security access policy of the target process interface called by the service call request for the requesting process; Based on the target security access policy, the first policy request information of the requesting process is obtained. When the requesting process is verified successfully based on the target security access policy and the first policy request information, the key access method between the requesting process and the target process interface is obtained. The response result corresponding to the service call request is transformed based on the key access method to obtain business response data, and the business response data is sent to the request process; the key access method is used to represent the encryption method of the response result.

2. The method as described in claim 1, characterized in that, The service call request sent by the receiving process includes: The process request method is obtained by requesting the process to access the target process interface; the process request method is negotiated between the requesting process and the target process interface. If the process request method is a dynamic key request method, then the first dynamic key between the requesting process and the target process interface is obtained, the call parameters are encrypted using the first dynamic key to obtain dynamically encrypted parameters, a service call request carrying the dynamically encrypted parameters is sent to the service provider process, and the service call request sent by the requesting process is received by the service provider process; the service provider process includes the target process interface; If the process request method is a static key request method, then the service fixed key corresponding to the service providing process is obtained, the call parameters are encrypted using the service fixed key to obtain static encrypted parameters, and a service call request carrying the static encrypted parameters is sent to the service providing process. The service call request sent by the requesting process is received by the service providing process. If the process request method is a plaintext request method, then the requesting process sends a service call request carrying the call parameters to the service providing process, and the service providing process receives the service call request sent by the requesting process.

3. The method as described in claim 1, characterized in that, The step of obtaining the target security access policy for the requesting process of the target process interface invoked by the service invocation request includes: Obtain the request storage path corresponding to the request process, and obtain the first file modification time corresponding to the request process from the request storage path; the first file modification time refers to the largest file modification time among the file modification times corresponding to the request process. Based on the requested storage path and the modification time of the first file, a process identifier corresponding to the request process is generated; Based on the process identifier, the target security access policy of the target process interface invoked by the service invocation request for the requesting process is obtained; the service providing process includes the target process interface; the service providing process refers to the process that receives the service invocation request.

4. The method as described in claim 1, characterized in that, The step of obtaining the target security access policy for the requesting process of the target process interface invoked by the service invocation request includes: Obtain the request process information corresponding to the request process, parse the request process information, and obtain the process type of the request process; Obtain the target security access policy for the process type of the target process interface invoked by the service call request.

5. The method as described in claim 1, characterized in that, The step of obtaining the first policy request information of the requesting process based on the target security access policy includes: Obtain the access parameter type from the target security access policy, obtain the parameter data of the requesting process under the access parameter type, and determine the parameter data as the first policy request information of the requesting process; The method further includes: The first policy request information and the target security access policy are sent to the service management device corresponding to the service providing process, so that the service management device can detect the first policy request information based on the target security access policy, and determine that the requesting process has been verified when the first policy request information meets the process access conditions of the target security access policy.

6. The method as described in claim 1, characterized in that, The method for obtaining the key access between the requesting process and the target process interface includes: Obtain the key access method between the requesting process and the target process interface from the target security access policy; or... Obtain the interface data associated with the target process interface, parse the interface data to obtain the data sensitivity of the interface data, and determine the encryption method corresponding to the data sensitivity as the key access method between the requesting process and the target process interface.

7. The method as described in claim 1, characterized in that, The process of converting the response result corresponding to the service call request based on the key access method to obtain business response data includes: If the key access method is a dynamic key access method, then the first dynamic key between the requesting process and the target process interface is obtained, and the response result corresponding to the service call request is encrypted using the first dynamic key to obtain the business response data; If the key access method is static key access method, then obtain the request fixed key corresponding to the request process, and use the request fixed key to encrypt the response result to obtain business response data; If the key access method is plaintext access, then the response result will be determined as business response data.

8. The method as described in claim 1, characterized in that, The method further includes: When a key update message is received, the first random parameter sent by the service management device is obtained, and the second random parameter is generated through the service provider process; the service provider process includes the target process interface; Based on the first random parameter and the second random parameter, a second dynamic key is generated between the interface of the requesting process and the target process. The second dynamic key is sent to the requesting process, and the service call request is resent by the requesting process based on the second dynamic key.

9. The method as described in claim 8, characterized in that, The method further includes: Obtain the key hash value of the second dynamic key, and send the key hash value, the association between the requesting process and the target process interface to the service management device; the association is used by the service management device to detect the service call request when the key access method between the requesting process and the target process interface is the dynamic key access method.

10. The method as described in claim 1, characterized in that, The service call request carries encrypted parameters; the method further includes: Obtain a first service key for the encrypted parameters, and use the first service key to decrypt the encrypted parameters; If the encryption parameters are successfully decrypted, the response result corresponding to the service call request is obtained based on the call parameters obtained from the decryption of the encryption parameters, and the process of converting the response result corresponding to the service call request based on the key access method is executed to obtain the business response data. If decryption of the encrypted parameters fails, a key reset command is sent to the requesting process. The requesting process generates a random key pair and sends the random public key from the random key pair to the service providing process. In the service providing process, the second service key is encrypted using the random public key to obtain encrypted key data, which is then sent to the requesting process. In the requesting process, the encrypted key data is decrypted using the random private key from the random key pair to obtain the second service key. The call parameters are then re-encrypted using the second service key to obtain updated encrypted parameters. Based on the updated encrypted parameters, the service call request is resent to the service providing process. The service providing process includes the target process interface. The first service key and the second service key form a key pair.

11. A process communication method, characterized in that, The method includes: The system acquires the target security access policy and the first policy request information sent by the service provider process, and detects the first policy request information based on the target security access policy to obtain a detection result. The target security access policy refers to the policy of the target process interface invoked by the service call request for the requesting process. The service call request is generated by the requesting process. The service provider process includes the target process interface. The first policy request information is the information of the requesting process obtained based on the target security access policy. The detection result is sent to the service provider process, so that when the detection result indicates that the verification of the requesting process is successful, the service provider process sends business response data to the requesting process; the business response data is obtained by converting the response result corresponding to the service call request according to the key access method between the interface between the requesting process and the target process.

12. The method as described in claim 11, characterized in that, The step of detecting the first policy request information based on the target security access policy to obtain the detection result includes: The validity of the target security access policy is detected. If the target security access policy is invalid, the first security access policy of the target process interface for the requesting process is obtained, and the first security access policy is sent to the service provider process so that the service provider process can obtain the second policy request information of the requesting process based on the first security access policy. Obtain the second policy request information sent by the service provider process, and detect the second policy request information based on the first security access policy to obtain the detection result.

13. The method as described in claim 11, characterized in that, The target security access policy includes a security access path, and the first policy request information includes the request storage path of the requesting process; The step of detecting the first policy request information based on the target security access policy to obtain the detection result includes: If the requested storage path belongs to the secure access path, then the successful detection result is determined as the detection result for the request process; If the requested storage path does not belong to the secure access path, then the detection failure result is determined as the detection result for the request process.

14. The method as described in claim 11, characterized in that, The target security access policy includes security access features; the step of detecting the first policy request information based on the target security access policy to obtain a detection result includes: Obtain the request process characteristics associated with the secure access characteristics from the first policy request information; If the characteristics of the requesting process match the characteristics of the secure access, then the successful detection result is determined as the detection result for the requesting process; If the characteristics of the requesting process do not conform to the secure access characteristics, then the detection failure result is determined as the detection result for the requesting process.

15. The method as described in claim 11, characterized in that, The method further includes: If the detection result is a successful detection result, then obtain the first dynamic key between the interface between the requesting process and the target process, and detect the validity of the first dynamic key; If the first dynamic key is invalid, a key update message is sent to the service provider process. The key update message includes a first random parameter, which enables the service provider process to generate a second dynamic key between the requesting process and the target process interface based on the first random parameter and a generated second random parameter. The second dynamic key is used for communication between the requesting process and the target process interface. If the first dynamic key is a valid key, then the process of sending the detection result to the service provider process is executed.

16. A process communication device, characterized in that, The device includes: The request receiving module is used to receive service call requests sent by the requesting process; The policy acquisition module is used to acquire the target security access policy of the target process interface invoked by the service call request for the requesting process; The information acquisition module is used to acquire the first policy request information of the requesting process based on the target security access policy; The access determination module is used to obtain the key access method between the request process and the target process interface when the verification of the request process is successful based on the target security access policy and the first policy request information. The data conversion module is used to convert the response result corresponding to the service call request based on the key access method to obtain business response data; The response sending module is used to send the business response data to the requesting process; the key access method is used to indicate the encryption method of the response result.

17. A process communication device, characterized in that, The device includes: The data receiving module is used to acquire the target security access policy and the first policy request information sent by the service providing process; The data detection module is used to detect the first policy request information based on the target security access policy and obtain the detection result; the target security access policy refers to the policy of the target process interface called by the service call request for the requesting process; the service call request is generated by the requesting process; the service providing process includes the target process interface; the first policy request information is the information of the requesting process obtained based on the target security access policy; The detection feedback module is used to send the detection result to the service providing process, so that when the detection result indicates that the verification of the requesting process is successful, the service providing process sends business response data to the requesting process; the business response data is obtained by converting the response result corresponding to the service call request according to the key access method between the interface between the requesting process and the target process.

18. A computer device, characterized in that, Includes processor, memory, and input / output interfaces; The processor is connected to the memory and the input / output interface respectively, wherein the input / output interface is used to receive data and output data, the memory is used to store computer programs, and the processor is used to call the computer programs so that the computer device executes the method according to any one of claims 1-10, or executes the method according to any one of claims 11-15.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded and executed by a processor to cause a computer device having the processor to perform the method of any one of claims 1-10, or to perform the method of any one of claims 11-15.

20. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method according to any one of claims 1-10, or the method according to any one of claims 11-15.

Images