Method, device and storage medium for detecting invocation of trusted execution environment by android application

Abstract

Embodiments of the present specification provide a method, device and storage medium for detecting invocation of a trusted execution environment (TEE) by an Android application. The method comprises: obtaining a data packet of a software to be detected; obtaining an identifiable file from the data packet based on a reverse engineering algorithm; identifying whether the software to be detected invokes a TEE function based on a preset TEE function vector set and the identifiable file, the TEE function vector set containing vectors representing general functions / interfaces, indirect invocation functions / interfaces or specific TEE functions / interfaces; obtaining a function vector of the invoked TEE function, text data and logical structure data of a module in the software to be detected that invokes the TEE function from the identifiable file when the software to be detected invokes the TEE function; and determining a functional module to which the invoked TEE function belongs based on the function vector of the invoked TEE function, the text data and the logical structure data. The technical solution provided by the present application solves the problem of insufficient precision in detecting TEE in the prior art.

Description

TECHNICAL FIELD

[0001] The present document relates to the field of software security detection, and particularly relates to a detection method and device for Android application calling a trusted execution environment and a storage medium. BACKGROUND

[0002] A trusted execution environment (TEE) provides a "infrastructure" to protect the security of code and data. In recent years, major mobile platform / software providers have begun to establish their own TEE systems. Due to the important role of TEE, how to detect the use of TEE has become the focus of attention.

[0003] Existing methods are usually based on a TEE database and use dynamic analysis, that is, function calls of a given App are dynamically captured through techniques such as instrumentation, and then it is judged whether it is a TEE operation.

[0004] However, the granularity of the above results is coarse, and it is obviously inaccurate to classify most TEE functions as "security modules", which leads to insufficient precision in detecting TEE. SUMMARY

[0005] In view of the above technical problems, the present application aims to provide a detection method, device and storage medium for Android application calling a trusted execution environment, so as to improve the precision of detecting TEE.

[0006] In a first aspect, one or more embodiments of the present specification provide a detection method for Android application calling a trusted execution environment, comprising:

[0007] obtaining a data packet of a software to be detected;

[0008] based on a reverse engineering algorithm, obtaining an identifiable file according to the data packet;

[0009] According to a preset TEE function vector set and the identifiable file, identifying whether the software to be detected calls a TEE function, the TEE function vector set containing vectors for representing general functions / interfaces, indirect calling functions / interfaces or specific TEE functions / interfaces;

[0010] When it is determined that the software to be detected calls a TEE function, obtaining a function vector of a called TEE function, text data and logical structure data of a module in the software to be detected that calls a TEE function from the identifiable file;

[0011] According to the function vector of the called TEE function, the text data and the logical structure data, determining a function module to which the called TEE function belongs.

[0012] Further, the method further comprises:

[0013] Obtaining the official white paper / technical document of the TEE system, the Android platform-specific TEE document and the description information and annotation information in the Android system source code;

[0014] According to the description information and annotation information in the official white paper / technical document of the TEE system, the Android platform-specific TEE document and the Android system source code, the TEE function vector set is constructed.

[0015] Further, the identifiable file includes: a smali file;

[0016] According to the preset TEE function vector set and the identifiable file, whether the to-be-detected software calls the TEE function is identified, including:

[0017] The smali file is statically analyzed to determine whether the smali file has the function call point;

[0018] When it is determined that the function call point exists, a to-be-identified function vector is extracted from the smali file; and the to-be-identified function vector is compared with the function vector corresponding to the indirect call function / interface to identify whether the to-be-detected software calls the TEE function.

[0019] Further, the identifiable file includes: an i64 file;

[0020] According to the preset TEE function vector set and the identifiable file, whether the to-be-detected software calls the TEE function is identified, including:

[0021] A function list is extracted from the i64 file;

[0022] The function list is compared with the function vector corresponding to the general function / interface and the specific TEE function / interface to identify whether the to-be-detected software calls the TEE function.

[0023] Further, according to the function vector of the called TEE function, the text data and the logical structure data, the function module to which the called TEE function belongs is determined, including:

[0024] According to the function vector of the called TEE function, a first function module is determined;

[0025] According to the text data, a text feature vector of the module calling the TEE function is determined;

[0026] Based on a preset first classification model, the text feature vector is input to output a second function module;

[0027] According to the logical structure data, a logical feature vector of the module calling the TEE function is determined;

[0028] outputting, based on a preset second classification model, a third function module according to the logical feature vector as input;

[0029] determining, based on a voting algorithm, the function module to which the called TEE function belongs according to the first function module, the second function module and the third function module.

[0030] In a second aspect, one or more embodiments of the present specification provide a detection device for calling a trusted execution environment by an Android application, comprising: an acquisition module, an identification module and a data processing module;

[0031] The acquisition module is configured to acquire a data packet of a software to be detected.

[0032] The identification module is configured to obtain an identifiable file based on a reverse engineering algorithm according to the data packet, and identify whether the software to be detected calls a TEE function according to a preset TEE function vector set and the identifiable file, the TEE function vector set containing vectors for representing general functions / interfaces, indirect calling functions / interfaces or specific TEE functions / interfaces.

[0033] The data processing module is configured to determine, when the software to be detected calls a TEE function, a function vector of a called TEE function, text data and logical structure data of a module calling a TEE function in the software to be detected from the identifiable file, and determine the function module to which the called TEE function belongs according to the function vector of the called TEE function, the text data and the logical structure data.

[0034] Further, the identifiable file comprises a smali file.

[0035] The identification module is configured to statically analyze the smali file to determine whether a function calling point exists in the smali file, extract a to-be-identified function vector from the smali file when the function calling point exists, and compare the to-be-identified function vector with a function vector corresponding to the indirect calling function / interface to identify whether the software to be detected calls a TEE function.

[0036] Further, the identifiable file comprises an i64 file.

[0037] The identification module is configured to extract a function list from the i64 file, compare the function list with a function vector corresponding to the general function / interface and the specific TEE function / interface, and identify whether the software to be detected calls a TEE function.

[0038] Further, the data processing module is configured to determine a first function module according to a function vector of the called TEE function; determine a text feature vector of the module calling the TEE function according to the text data; output a second function module based on a preset first classification model and taking the text feature vector as input; determine a logic feature vector of the module calling the TEE function according to the logic structure data; output a third function module based on a preset second classification model and taking the logic feature vector as input; and determine the function module to which the called TEE function belongs based on a voting algorithm and according to the first function module, the second function module and the third function module.

[0039] In a third aspect, one or more embodiments of the present specification provide a storage medium comprising:

[0040] computer-executable instructions that, when executed, implement the method of any one of the first aspect.

[0041] Compared with the prior art, the present application can at least achieve the following technical effects:

[0042] The present application establishes a relatively complete TEE function / interface library and its standardized vector set, covering three categories of functions / interfaces (i.e., general functions / interfaces, indirectly called functions / interfaces, and specific TEE functions / interfaces), laying a foundation for accurate detection of TEE functions. At the same time, the function module to which the called TEE function belongs is determined from three dimensions (the function vector of the called TEE function, the text data and the logic structure data of the module calling the TEE function in the software to be detected), so as to avoid determining most of the called TEE functions as "safe modules", thereby improving the accuracy of detecting TEE. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present specification or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0044] Figure 1 A flowchart of an Android application calling a trusted execution environment detection method provided by one or more embodiments of the present specification;

[0045] Figure 2 A schematic diagram of a TEE function interface list provided by one or more embodiments of the present specification;

[0046] Figure 3A container combination flowchart is provided for one or more embodiments of the present specification. DETAILED DESCRIPTION

[0047] In order for those skilled in the art to better understand the technical solutions in one or more embodiments of the present specification, the technical solutions in one or more embodiments of the present specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of the present specification. Obviously, the described embodiments are only part of the embodiments of the present specification, rather than all the embodiments. Based on one or more embodiments of the present specification, all other embodiments obtained by those skilled in the art without creative labor should fall within the protection scope of the present document.

[0048] In the prior art, the detection of TEE functions has the following problems:

[0049] Problem one, how to accurately determine whether the App calls the TEE function.

[0050] Specifically, first, there are direct and indirect calls of TEE function calls, which cannot be judged by a unified method, which is not conducive to accurately determining whether the App calls the TEE function.

[0051] Secondly, there are many overloaded functions (i.e. those functions with the same name but different parameter lists or return values) in the indirect call of TEE. Because the names of the overloaded functions are the same, they cannot be directly judged by name comparison, and the differences in function parameters and return values also need to be considered, which increases the difficulty of determining whether the TEE function is called.

[0052] Thirdly, in the indirect call of TEE, some functions have some special uses and need to be distinguished. For example, in the KeyStore class, some methods will only indirectly call TEE after setting the AndroidKeyStore parameter. Therefore, the judgment of such functions depends not only on the simple TEE function and interface determination.

[0053] Finally, the existing method usually uses dynamic analysis, that is, by means of patching and other technologies to dynamically capture the function calls of a given App, and then determine whether it is a TEE operation. However, this method needs to modify and patch the App code, which cannot guarantee its original behavior. At the same time, this method has false negatives, that is, it cannot guarantee that all functions are called during a single actual run.

[0054] Problem two, how to accurately analyze the functional modules to which the TEE function belongs

[0055] Specifically, first, App codes are different, and the same function can also be implemented in different forms. Simply using a predefined "pattern" to match the function will inevitably produce a large number of false negative results.

[0056] Second, since most Android Apps are closed source codes, the reverse engineering method is inevitably used in the detection process. However, the result of reverse engineering often causes loss of some text information (such as comments). In addition, after obfuscated code, the variable name, function name and other important reference information that help understand the function will be lost after reverse engineering, which is not conducive to analyzing the function module to which the TEE function belongs.

[0057] Finally, although TEE is necessarily related to "security", different modules have different definitions of security and different needs for security. Therefore, the function module to which the TEE function belongs cannot be simply determined as a security module.

[0058] To solve the above problems, the embodiment of the present application provides a detection method for Android application calling trusted execution environment, as shown in Figure 1 The method comprises the following steps:

[0059] Step 1, obtaining a data packet of the software to be detected.

[0060] In the embodiment of the present application, the data packet is a commonly used data format of App, such as an apk format data.

[0061] Step 2, based on a reverse engineering algorithm, obtaining identifiable files according to the data packet.

[0062] In the embodiment of the present application, the identifiable files include smali files and i64 files. The TEE function call exists in two ways: direct and indirect calls. Direct call is an explicit function call, usually a direct Native layer call; while indirect call involves triggering function call through intermediate links or variables, usually a Java layer call, that is, indirectly calling the TEE function of the Native layer through the Java function. The smali file corresponds to the Java layer call, and the i64 file corresponds to the Native layer call. The process of reverse engineering is: the Java layer uses Apktool to decompile the apk file to obtain the smali file. The Native layer first finds the so file, and uses the IDA tool (ida64) to decompile the so file to obtain the i64 file.

[0063] Step 3, identifying whether the software to be detected calls the TEE function according to a preset TEE function vector set and the identifiable files.

[0064] In the embodiment of the present application, whether the software to be detected calls the TEE function is identified for the smali file and the i64 file respectively.

[0065] Specifically, for smali files, static analysis is performed on smali files,

[0066] determining whether a function call point exists in the smali file; extracting a to-be-identified function vector from the smali file when the function call point exists; and comparing the to-be-identified function vector with a function vector corresponding to the indirect call function / interface, to identify whether the to-be-detected software calls a TEE function.

[0067] Preferably, to improve the efficiency of the comparison step, coarse-grained matching is first performed, for example, to determine whether the function name of the to-be-identified function vector matches the function name of a vector in the TEE function vector set. Then, fine-grained matching is performed, for example, to exclude the to-be-identified function vectors that do not match the function name, and to determine whether the remaining to-be-identified function vectors match all other information of the vectors in the TEE function vector set.

[0068] For example, first, static analysis of function call points: static analysis of smali code is performed to determine function call points, and if a function call exists, the key information of the main / called function is extracted and standardized into a vector: "class where the keyword is located, keyword name, parameter list, return parameter".

[0069] Second, coarse-grained matching: based on the TEE indirect call function vector set, first-round matching (coarse-grained matching) is performed, and only the function name is matched with the above function vector.

[0070] Finally, fine-grained matching: based on the results of the previous round of matching, fine-grained matching is performed. That is, not only the function name is matched, but also the parameter list and return parameter are determined to accurately distinguish various overloaded functions. In particular, for functions with special usage, the context needs to be analyzed to find out whether the specific parameters passed in the function call conform to the TEE usage. For example, for the Keystore module, it needs to be determined whether AndroidKeyStore exists in the parameters.

[0071] For i64 files, a function list is extracted from the i64 file; the function list is compared with a function vector corresponding to the general function / interface and the special TEE function / interface, to identify whether the to-be-detected software calls a TEE function.

[0072] For example, function extraction: an IDC script is written to automatically extract functions (i.e., functions called in so files) in i64 files, to generate a Native function list. Function matching: compared with indirect calls, the function relationship of TEE direct calls is relatively simple, so the corresponding functions are directly matched according to the function name, return value, and parameter. It is determined whether there is a direct call of a TEE function and interface.

[0073] In the embodiments of the present application, the TEE function vector set includes vectors for representing general functions / interfaces, indirectly invoked functions / interfaces, or specific TEE functions / interfaces. In order to cover more TEE function types, the embodiments of the present application obtain the description information and annotation information in the official white paper / technical document of the TEE system, the Android platform specific TEE document, and the Android system source code. The TEE function vector set is constructed according to the description information and annotation information in the official white paper / technical document of the TEE system, the Android platform specific TEE document, and the Android system source code. The logical relationship of the TEE function vector set is as shown in FIG. 3. Figure 2

[0074] Specifically, the TEE function vector set covers three categories of functions / interfaces (i.e., general functions / interfaces, indirectly invoked functions / interfaces, and specific TEE functions / interfaces), and the data sources cover 24 official white papers / technical documents of existing TEE systems, 8 Android platform specific TEE documents, and the description and annotation parts in the source code of the entire Android system.

[0075] Step 4, when the software to be detected calls a TEE function, the function vector of the called TEE function, the text data of the module in the software to be detected that calls the TEE function, and the logical structure data of the module in the software to be detected that calls the TEE function are obtained from the identifiable file.

[0076] In the embodiments of the present application, the function type of the function is considered from three dimensions, which are the function dimension, the text dimension, and the logical relationship dimension. Among them, the function dimension corresponds to the function vector of the called TEE function, the text dimension corresponds to the text data, and the logical relationship dimension corresponds to the logical structure data.

[0077] Specifically, the function dimension refers to the function that the function has in the TEE application scenario described in the original data such as official documents, white papers, and source code annotations. The text dimension includes one or more of the directory name, the file name, the class name, the function name, the variable name, and the parameter name. The logical relationship dimension can represent the operation process of the function. For example, function A calls function B, and function A and function B have a calling and being called relationship, or the calculation result of function B is the independent variable or input of function A.

[0078] Step 5, according to the function vector of the called TEE function, the text data, and the logical structure data, the function module to which the called TEE function belongs is determined.

[0079] ​In the embodiments of the present application, the first function module is determined according to the function vector of the called TEE function; the text feature vector of the called TEE function is determined according to the identifier; the second function module is output based on a preset first classification model and the text feature vector as input; the logic feature vector of the called TEE function is determined according to the logic structure; the third function module is output based on a preset second classification model and the logic feature vector as input; and the function module to which the called TEE function belongs is determined based on a voting algorithm and the first function module, the second function module and the third function module.

[0080] For a part of TEE functions, the function module to which the TEE function belongs can be determined only by relying on the function type of the TEE function. For this case, the function matching model is constructed. The determination process of the function matching model is taken as an example of the smali file: first, a TEE function type dictionary is established: the TEE application scenarios described in the original materials such as official documents, white papers, source code annotations, etc. are deeply analyzed to establish a fine-grained TEE function type list. Second, the preset TEE function vector set is mapped to the TEE function type dictionary. By comparing the function vector of the called TEE function with the TEE function type dictionary, the function type of the function vector of the called TEE function is determined, that is, the first function module is determined.

[0081] For many TEE functions, the function module to which the TEE function belongs can be determined only by relying on the text data of the module to which the TEE function belongs, such as directory name, file name, etc. For this case, the first classification model is constructed. The determination process of the first classification model is taken as an example of the smali file: first, the smali file is preprocessed, that is, the functions of a sufficient number of smali files are manually annotated. Then, the directory structure and the text vector (including directory name, file name, class name, function name, variable name, parameter name, etc.) of the given smali file are extracted and integrated into a text feature vector. Finally, the model is trained by a supervised deep learning method to obtain the first classification model.

[0082] There are also some TEE functions, the function module to which the TEE function belongs can be determined according to the logic relationship contained in the module to which the TEE function belongs. Among them, the logic relationship data can represent the operation process of the function, including input, output, calculation rule. For this kind of function, the second classification model is constructed. The determination process of the second classification model is taken as an example of the smali file: first, the smali file is preprocessed, that is, the functions of a sufficient number of smali files are manually annotated. Then, the logic structure (such as control flow) of the given smali code is taken and converted into a logic structure vector. Then the logic structure classification model is trained by a supervised deep learning method.

[0083] After obtaining the first function module, the second function module and the third function module, the function module to which the called function belongs is determined based on a voting algorithm. For example, the first function module is A module, the second function module is B module and the third function module is A module, the number of votes of A module is 2, and the number of votes of B module is 1, so A module is the function module to which the called function belongs.

[0084] It should be noted that the i64 file also has its own first classification model and second classification model, and the determination process is the same as that of the smali file. The difference between the two is only in the process of extracting features.

[0085] Specifically, for the smali file: using the code conversion tool smali2java, the given smali code is converted into the corresponding Java code, and the astminer tool is used to extract the structure of the above-mentioned Java code. And pass this code structure as input to the code2vec tool, and finally convert it into a vector through the tool.

[0086] For i64 files: use the IDA tool to get the same decompiled code as the source code function, and use ANTLR4 to cooperate with the astminer tool to extract the structure of the above-mentioned code. And pass this code structure as input to the code2vec tool, and finally convert it into a vector through the tool.

[0087] The embodiment of the application provides a kind of detection device of Android application calling trusted execution environment, it is characterized in that, comprising: acquisition module, identification module and data processing module;

[0088] The acquisition module is used to acquire the data packet of the software to be detected;

[0089] The identification module is used to obtain identifiable files based on a reverse engineering algorithm according to the data packet;According to the preset TEE function vector set and the identifiable file, whether the software to be detected calls TEE function is identified, the TEE function vector set contains the vector for representing general function / interface, indirect call function / interface or specific TEE function / interface;

[0090] The data processing module is used to determine the function vector of the called TEE function, the text data and the logic structure data of the module calling TEE function in the software to be detected when the software to be detected calls TEE function, from the identifiable file;According to the function vector of the called TEE function, the text data and the logic structure data, the function module to which the called TEE function belongs is determined.

[0091] In the embodiments of the present application, the identifiable file comprises a smali file; the identification module is configured to perform static analysis on the smali file to determine whether a function call point exists in the smali file; when it is determined that the function call point exists, extract a to-be-identified function vector from the smali file; and compare the to-be-identified function vector with a function vector corresponding to the indirect call function / interface pair to identify whether the to-be-detected software calls a TEE function.

[0092] In the embodiments of the present application, the identifiable file comprises an i64 file; the identification module is configured to extract a function list from the i64 file; compare the function list with a function vector corresponding to the general function / interface and the special TEE function / interface to identify whether the to-be-detected software calls a TEE function.

[0093] In the embodiments of the present application, the data processing module is configured to determine a first function module according to the function vector of the called TEE function; determine a text feature vector of the module calling the TEE function according to the text data; output a second function module based on a preset first classification model and taking the text feature vector as input; determine a logic feature vector of the module calling the TEE function according to the logic structure data; output a third function module based on a preset second classification model and taking the logic feature vector as input; and determine the function module to which the called TEE function belongs based on a voting algorithm and according to the first function module, the second function module and the third function module.

[0094] Further, in the embodiments of the present application, a module integration function is provided. The above modules are integrated, and a function interface is exposed to be called by an external application. That is, different module functions are executed on demand, and a given App calling a TEE is detected from top to bottom to improve detection accuracy.

[0095] The integrated module is combined with a Docker container.

[0096] Specifically, first, a Dockerfile is written, a Docker image is generated using the Dockerfile, and a required Docker container is generated using the Docker image, as shown in Figure 3 .

[0097] a) Write a Dockerfile.

[0098] a1 Set the base image (Ubuntu) to be used, and the specific instruction is as follows: FROM ubuntu:latest.

[0099] a2 Use the RUN instruction to install the dependencies of the framework.

[0100] a3 Use the RUN instruction to install Apktool and ida64 into the container.

[0101] a4 Use the COPY instruction to place the IDC script in the corresponding position.

[0102] a5 Set the working directory of the Docker container. WORKDIR / app

[0103] a6 Use the COPY instruction to copy the integrated detection framework into the working directory of the container.

[0104] a7 Use the CMD instruction to specify the detection framework entry to be executed when the container starts.

[0105] b) Use the Dockerfile to generate the Docker image.

[0106] c) Generate the required Docker container through the Docker image.

[0107] d) The user needs to change the values in the configuration file and then pass the TEE-related document (used to generate the TEE function list) into the Docker container. The instructions that can be used are as follows:

[0108] Enter the docker container: docker exec-it<container name or ID> / bin / bash, open the file to be modified: vi[file path], and modify the parameter values in the file according to the needs, save and exit the file.

[0109] docker cp / local / path_file<container name or ID>: / container / path_file (where / local / path_file is the path of the local file, and / container / path_file is the path of the file in the container).

[0110] e) Run the Docker container, and the analysis will automatically start.

[0111] docker start<container name or ID>.

[0112] f) Publish to the user, and the user can directly use without additional installation of the detection framework module and environment, thereby increasing the ease of use of the application.

[0113] In the embodiments of the application, the TEE functions are detected by reading the function list and apk information, that is, the read operation is much more than the write operation. Therefore, the cold storage device is selected for data persistence. Specifically, the container interacts with the cold storage device to realize the storage and backup of data:

[0114] a) Connect the container with the cold storage device, use the data volume provided by Docker, mount the cold storage device as the data volume of the Docker container, so that the container can directly store various data in the result_files path into the cold storage device for long-term storage.

[0115] Specific instructions: docker run-v / cold_storage_path: / container_mount_point_path, wherein / cold_storage_path is the path of the cold storage device, and / container_mount_point_path is the path of the internal mounting point of the container.

[0116] b) Data backup and archiving:

[0117] Backup frequency: Make a backup plan to ensure that the key data of the container calculation can be backed up in time.

[0118] Data retention period: According to the capacity of the cold storage device, set the retention period of the backup data to ensure that enough historical data is saved for future analysis.

[0119] The embodiment of the application provides a storage medium, comprising:

[0120] Computer executable instructions for storing computer executable instructions, which when executed realize the method described in any of the above embodiments.

[0121] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be executed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or can be advantageous.

[0122] In the 1930s, it was clear to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structure of diodes, transistors, switches, etc.) or in software (e.g., improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by a hardware entity module. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital method is "integrated" on a PLD by the designer programming it himself, without having to ask a chip manufacturer to design and manufacture a special integrated circuit chip. Moreover, instead of manually manufacturing an integrated circuit chip, this programming is now mostly implemented using "logic compiler" software, which is similar to the software compiler used when developing a program, and the original code before compilation must also be written in a specific programming language, called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in one of the above hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0123] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented to perform the same functions using logic gates, switches, an application specific integrated programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, while the means comprised therein for performing the various functions can also be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0124] The methods, devices, modules or units illustrated by the above embodiments can be implemented by a computer chip or entity, or by a product with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0125] For the sake of description, the above device is described in various units by function. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware when implementing the embodiments of the present specification.

[0126] Those skilled in the art will appreciate that one or more embodiments of the specification can be provided as a method or a computer program product. Therefore, one or more embodiments of the specification can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] The specification is presented with reference to flow diagrams and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus (system), and computer program product according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus (system), and computer program product according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks.

[0128] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus (system), and computer program product according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus (system), and computer program product according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks.

[0129] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus (system), and computer program product according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 The flow diagrams and / or block diagrams in the specification can present a method, apparatus (system), and computer program product according to embodiments of the specification. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks.

[0130] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0131] The memory can include non-persistent memory, Random Access Memory (RAM), and / or non-volatile memory, such as Read Only Memory (ROM) or Flash memory, among others. The memory is an example of computer-readable media.

[0132] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0133] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that processes, methods, articles or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device that includes the element.

[0134] One or more embodiments of the present specification can be described in the general context of computer-executable instructions being executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media, including storage devices.

[0135] Each embodiment in the present specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, for method embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0136] The above merely provides the example of the present document and is not intended to limit the present document. For those skilled in the art, the present document can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present document shall be included in the scope of claims of the present document.

Claims

1. A method for detecting Android applications calling a trusted execution environment, characterized in that, The method comprises: obtaining a data packet of a software to be detected; obtaining an identifiable file from the data packet based on a reverse engineering algorithm; identifying whether the software to be detected calls a TEE function based on a preset TEE function vector set and the identifiable file, the TEE function vector set containing vectors representing general functions / interfaces, indirect call functions / interfaces or specific TEE functions / interfaces; when it is determined that the software to be detected calls a TEE function, obtaining a function vector of the called TEE function, text data and logical structure data of a module calling the TEE function in the software to be detected from the identifiable file; determining a functional module to which the called TEE function belongs based on the function vector of the called TEE function, the text data and the logical structure data; The method further comprises: obtaining description information and annotation information in an official white paper / technical document of a TEE system, an Android platform specific TEE document and an Android system source code; constructing the TEE function vector set based on the description information and the annotation information in the official white paper / technical document of the TEE system, the Android platform specific TEE document and the Android system source code; The method of determining a functional module to which the called TEE function belongs based on the function vector of the called TEE function, the text data and the logical structure data comprises: determining a first functional module based on the function vector of the called TEE function; determining a text feature vector of the module calling the TEE function based on the text data; outputting a second functional module based on a preset first classification model and taking the text feature vector as input; determining a logical feature vector of the module calling the TEE function based on the logical structure data; outputting a third functional module based on a preset second classification model and taking the logical feature vector as input; determining a functional module to which the called TEE function belongs based on a voting algorithm and based on the first functional module, the second functional module and the third functional module.

2. The method of claim 1, wherein: the identifiable file comprises a smali file; the method of identifying whether the software to be detected calls a TEE function based on a preset TEE function vector set and the identifiable file comprises: statically analyzing the smali file to determine whether there is a function call point in the smali file; when it is determined that there is the function call point, extracting a to-be-identified function vector from the smali file; comparing the to-be-identified function vector with a function vector corresponding to the indirect call function / interface to identify whether the software to be detected calls a TEE function.

3. The method of claim 1, wherein: the identifiable file comprises an i64 file; the method of identifying whether the software to be detected calls a TEE function based on a preset TEE function vector set and the identifiable file comprises: extracting a function list from the i64 file; Comparing the function list with the function vectors corresponding to the general function / interface and the specific TEE function / interface, to identify whether the software to be detected calls a TEE function.

4. A detection device for Android applications calling a trusted execution environment, characterized in that, Comprise: An acquisition module, an identification module and a data processing module; The acquisition module is configured to acquire a data packet of the software to be detected; The identification module is configured to, based on a reverse engineering algorithm, obtain an identifiable file according to the data packet, identify whether the software to be detected calls a TEE function according to a preset TEE function vector set and the identifiable file, and the TEE function vector set contains vectors for representing general functions / interfaces, indirect call functions / interfaces or specific TEE functions / interfaces; The construction method of the TEE function vector set comprises: Obtaining the description information and the annotation information in the official white paper / technical document of the TEE system, the Android platform specific TEE document and the Android system source code; According to the description information and the annotation information in the official white paper / technical document of the TEE system, the Android platform specific TEE document and the Android system source code, the TEE function vector set is constructed; The data processing module is configured to, when the software to be detected calls a TEE function, acquire a function vector of the called TEE function, text data and logical structure data of a module calling the TEE function in the software to be detected from the identifiable file, and determine a function module to which the called TEE function belongs according to the function vector of the called TEE function, the text data and the logical structure data. The data processing module is configured to determine a first function module according to the function vector of the called TEE function, determine a text feature vector of the module calling the TEE function according to the text data, output a second function module based on a preset first classification model and taking the text feature vector as input, and determine a logical feature vector of the module calling the TEE function according to the logical structure data. Output a third function module based on a preset second classification model and taking the logical feature vector as input, and determine the function module to which the called TEE function belongs based on a voting algorithm and according to the first function module, the second function module and the third function module.

5. The apparatus of claim 4, wherein The identifiable file comprises a smali file; The identification module is configured to statically analyze the smali file to determine whether a function call point exists in the smali file, extract a to-be-identified function vector from the smali file when the function call point exists, and compare the to-be-identified function vector with a function vector corresponding to the indirect call function / interface to identify whether the software to be detected calls a TEE function.

6. The apparatus of claim 4, wherein The identifiable file comprises an i64 file; The identification module is configured to extract a function list from the i64 file; compare the function list with a function vector corresponding to the general function / interface and the specific TEE function / interface, and identify whether the to-be-detected software calls a TEE function.

7. A storage medium characterized by comprising: Comprise: Computer executable instructions for storing, the computer executable instructions are implemented when the method of any one of claims 1-3 is executed.

Images