Necessary application compliance detection method, device, equipment and medium

Abstract

The invention relates to the technical field of internet security, in particular to a compliance detection method, device and equipment for a necessary application and a medium, which are used for ensuring that the necessary application normally runs as a security expectation and preventing an attacker from injecting a malicious module or damaging a file in a running process. The method comprises the steps that when it is detected that necessary applications in the installation process exist, basic feature information of an installation file under an installation directory is obtained, and version information is obtained; when it is determined that the basic feature information of the installation file is consistent with the reference feature information associated with the version information, it is determined that the installation process of the necessary application is compliant; when it is detected that the necessary application in the running process exists, dynamic running information generated by the necessary application in the running process is obtained; when it is determined that the dynamic operation information is consistent with the reference operation information associated with the version information, it is determined that the operation process of the necessary application is compliant; and determining that the installation process and the operation process of the necessary application are compliant, and determining that the necessary application is compliant.

Description

Technical Field

[0001] The present application relates to the field of Internet security technology, and in particular to a compliance detection method, device, equipment and medium for essential applications. Background Art

[0002] With the development of the Internet, more and more companies are starting to build intranets and share corporate resources in them. For security reasons, accessing an intranet usually requires the installation of several essential applications on the client.

[0003] In actual applications, when the object uses the client to log in to the enterprise intranet, the detection application in the client will detect whether the required application is installed in the client and whether the required application is in a running state. If the client used does not have the required application installed, the detection application determines that the client detection is abnormal. Of course, if the required application installed in the client is not running, the detection application will also determine that the client detection is abnormal, thereby prohibiting the client from accessing the enterprise intranet.

[0004] In the related art, when the detection application detects whether the essential application is installed in the client, it is mainly through the following two methods: Method 1, scanning whether the list of installed applications in the client hits the list of essential applications. If the list of installed applications in the client hits the list of essential applications, it is determined that the essential application detection is compliant, otherwise it is determined that the essential application detection is abnormal; Method 2, based on clear installation feature information, identifying whether there is installation feature information of the essential application in the client. If the installation feature information of the essential application exists in the client, it is determined that the essential application detection is compliant, otherwise it is determined that the essential application detection is abnormal.

[0005] On the other hand, when detecting whether the essential applications installed in the client are running, the detection application uses the following two methods: First, based on the identification of the specific application runtime, some application processes will use mutexes to avoid multiple processes running at the same time when they are started. The existence of the application process can be determined by checking the mutex. If the existence of the application process of the essential application is determined by checking the above mutex, it is determined that the essential application is in a running state, and the essential application detection is determined to be compliant, otherwise the essential application detection is determined to be abnormal; Second, periodically scan the process list in the client task manager, and based on the process feature information corresponding to the essential application and the runtime features, determine whether the application process of the essential application is in a running state. If the application process of the essential application is in a running state, the essential application detection is determined to be compliant, otherwise the essential application detection is determined to be abnormal.

[0006] It can be seen that under the relevant technology, when the above-mentioned method is used to detect the installation and operation of essential applications, the detection granularity is too coarse, and it is insufficient to detect whether the essential applications are running normally as expected. Attackers may bypass specific application logic and destroy the integrity of essential applications by injecting malicious modules or destroying application-related files. If the integrity of essential applications is destroyed, specific functions may operate abnormally, thereby causing security risks during operation.

[0007] Therefore, a compliance detection method for essential applications needs to be redesigned to overcome the above-mentioned defects. Summary of the invention

[0008] The embodiments of the present application provide a compliance detection method, device, electronic device and storage medium for essential applications, which are used to deeply detect the integrity of the installation and operation of essential applications to ensure that the essential applications operate normally as expected.

[0009] In a first aspect, an embodiment of the present application provides a compliance detection method for an essential application, including:

[0010] When detecting that there is a required application in the process of being installed, obtaining basic feature information of the installation file in the installation directory corresponding to the required application, and obtaining current version information of the required application;

[0011] When it is determined that the basic characteristic information of the installation file is consistent with the baseline characteristic information associated with the version information, determining that the installation process of the essential application is compliant;

[0012] When detecting that there is a required application in the running process, obtaining dynamic running information generated by the required application in the running process;

[0013] When it is determined that the dynamic operation information is consistent with the benchmark operation information associated with the version information, determining that the operation process of the essential application is compliant;

[0014] When it is determined that both the installation process and the running process of the essential application are compliant, it is determined that the essential application is compliant.

[0015] In a second aspect, an embodiment of the present application provides a compliance detection device for an essential application, including:

[0016] A first acquisition unit is used to, when detecting that there is a required application in the process of being installed, acquire basic feature information of an installation file in an installation directory corresponding to the required application, and acquire current version information of the required application;

[0017] A first processing unit, configured to determine that the installation process of the essential application is compliant when determining that the basic feature information of the installation file is consistent with the baseline feature information associated with the version information;

[0018] A second acquisition unit is used to acquire dynamic operation information generated by the essential application during the operation process when detecting that there is an essential application in the operation process;

[0019] A second processing unit is configured to determine that the operation process of the essential application is compliant when it is determined that the dynamic operation information is consistent with the benchmark operation information associated with the version information;

[0020] The compliance detection unit is used to determine that the essential application is compliant when it is determined that the installation process and the operation process of the essential application are both compliant.

[0021] Optionally, the device further comprises:

[0022] a transceiver unit, configured to receive a connection request for establishing inter-process communication sent by the essential application, wherein the connection request is used to request the detection application to perform compliance detection on the essential application;

[0023] A third acquisition unit, configured to acquire basic feature information of an executable file corresponding to the essential application;

[0024] A communication unit, configured to establish a communication connection with the essential application when it is determined that the essential application is compliant based on the basic characteristic information;

[0025] A self-checking unit, configured to perform compliance check on the detection application, obtain dynamic operation information of the essential application when compliance is determined, and apply for a certificate from the detection server through the transceiver unit based on the dynamic operation information;

[0026] The transceiver unit is further used to receive the certificate issued by the detection server and send the certificate to the essential application, wherein the certificate is used to perform security authentication on the essential application when the essential application communicates with the business server corresponding to the essential application.

[0027] Optionally, the communication unit is specifically used to:

[0028] Sending the basic feature information to the detection server, requesting the detection server to perform compliance detection on the essential application;

[0029] Upon receiving a response message sent by the detection server indicating that the essential application is compliant, the essential application is determined to be compliant and a communication connection is established with the essential application, wherein the response message is generated by the detection server upon determining that the basic feature information is consistent with the baseline feature information associated with the version information.

[0030] Optionally, the self-checking unit is specifically used to: perform compliance check on the detection application in at least one of the following ways:

[0031] Check whether the target module is loaded;

[0032] Check whether you are logged in;

[0033] Check whether a heartbeat connection is maintained with the detection server.

[0034] Optionally, the dynamic running information generated during the running of the essential application includes: application process information of the essential application and basic information of function modules loaded when the essential application is running;

[0035] The second processing unit is specifically used to: determine that the application process information is consistent with the benchmark application process information in the benchmark running information associated with the version information, and based on the basic information of the functional module, determine that the functional module loaded when the essential application is running is compliant, and determine that the running process of the essential application is compliant.

[0036] Optionally, the second processing unit is specifically configured to: determine, based on the basic information of the functional module, that the functional module loaded when the essential application is running satisfies at least one of the following conditions, that the functional module loaded when the essential application is running is compliant:

[0037] The functional module is a module under the essential application installation directory, and the basic information of the functional module is consistent with the benchmark information associated with the version information;

[0038] The function module is a module under the client system directory, and the feature information corresponding to the function module is in a pre-specified policy whitelist;

[0039] The functional modules are modules in directories other than the system directory in the client, and the functional modules are modules in a pre-specified whitelist of loadable modules;

[0040] The functional modules are modules in directories other than the system directory in the client, and the functional modules are determined to be compliant by the detection server.

[0041] Optionally, the first acquiring unit is specifically configured to:

[0042] Detecting the process started in the client through a kernel driver component, and when detecting that the process of the target application is started, comparing the process information of the target application with the executable installation file information or executable upgrade file information corresponding to the essential application;

[0043] When the process information of the target application is determined to be consistent with the executable installation file information or executable upgrade file information corresponding to the essential application, the target application is determined to be an essential application and the essential application is in the installation process, and basic feature information of the installation file in the installation directory corresponding to the essential application is obtained.

[0044] Optionally, the second acquiring unit is specifically configured to:

[0045] Detecting the process started in the client through a kernel driver component, and when detecting the start of the process of the target application, comparing the process information of the target application with the process information of the essential application;

[0046] When it is determined that the process information of the target application is consistent with the process information of the essential application, it is determined that the target application is an essential application and the essential application is in the running process, and dynamic running information generated by the essential application is obtained.

[0047] Optionally, the second acquiring unit is specifically configured to:

[0048] When a network access request sent by the essential application is detected through the access proxy component, it is determined that the essential application is in the running process, and the dynamic running information generated by the essential application is obtained.

[0049] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the compliance detection method for essential applications provided in the first aspect above.

[0050] In a fourth aspect, an embodiment of the present application provides a computer program product or a computer program, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps of the compliance detection method for essential applications provided in the first aspect above.

[0051] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium comprising a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the compliance detection method for essential applications provided in the first aspect above.

[0052] The beneficial effects of this application are as follows:

[0053] In an embodiment of the present application, during the installation process of the essential application, by comparing the basic feature information of the installation file of the essential application with the baseline feature information associated with the version information of the current version of the essential application, it is possible to detect whether the installation file of the essential application is abnormal or has been tampered with by a third party, thereby ensuring that the installation process of the essential application is compliant. Furthermore, during the operation of the essential application, by comparing the dynamic operation information generated during the operation of the essential application with the baseline operation feature information associated with the version information of the current version of the essential application, it is possible to ensure that the essential application runs normally as expected by security, avoid malicious modules being injected by attackers or files being destroyed during the operation, and ensure that the operation process of the essential application is compliant. By performing compliance detection on the installation process and the operation process of the essential application, the integrity of the installation and operation of the essential application is deeply detected, thereby ensuring that the essential application runs normally as expected by security.

[0054] Other features and advantages of the application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the application. The purpose and other advantages of the application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0056] Figure 1 A schematic diagram of an object accessing enterprise resources in an enterprise intranet in a related technology;

[0057] Figure 2 A schematic diagram of the architecture of an access processing system for a zero-trust network in the related art;

[0058] Figure 3 A schematic diagram of an interface for detecting an office environment of a client for a detection application in a related technology;

[0059] Figure 4 A schematic diagram of an interface in which a client fails compliance testing in the related art;

[0060] Figure 5 An optional schematic diagram of an application scenario in an embodiment of the present application;

[0061] Figure 6 A flowchart of a compliance detection method that is an essential application in an embodiment of the present application;

[0062] Figure 7 This is a schematic diagram of determining that a required application is in the installation process according to process information in an embodiment of the present application;

[0063] Figure 8 This is a schematic diagram of determining that a required application is in the upgrade process according to process information in an embodiment of the present application;

[0064] Fig. 9 This is a schematic diagram of determining that a required application is in the running process according to process information in an embodiment of the present application;

[0065] Fig.10 A schematic diagram of a process for applying for a certificate for a required application in an embodiment of the present application;

[0066] Fig.11 A logical diagram of determining whether a required application is compliant in an embodiment of the present application;

[0067] Fig.12 A schematic diagram of an interaction process between a required application and a detection application in an embodiment of the present application;

[0068] Fig.13 Another logic diagram for determining whether a required application is compliant in an embodiment of the present application;

[0069] Fig.14 A schematic diagram of the interaction process between another essential application, a detection application, and a detection server in an embodiment of the present application;

[0070] Fig.15 A schematic diagram of the interaction process between another essential application, a detection application, and a detection server in an embodiment of the present application;

[0071] Fig.16 A logical diagram of applying for credentials from a detection server after determining that a required application is compliant in an embodiment of the present application;

[0072] Fig.17 A schematic diagram of the interaction process between another essential application, a detection application, and a detection server in an embodiment of the present application;

[0073] Fig.18 A schematic diagram of the interaction process between another essential application, a detection application, and a detection server in an embodiment of the present application;

[0074] Fig.19 A schematic diagram of the interaction process between another essential application, a detection application, and a detection server in an embodiment of the present application;

[0075] Fig. 20 This is a schematic diagram of the structure of a compliance detection device that is an essential application in an embodiment of the present application;

[0076] Fig.21A schematic diagram of the structure of a first electronic device using an embodiment of the present application;

[0077] Fig. 22 It is a schematic diagram of the structure of a second electronic device in the embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0079] The following is an introduction to some concepts involved in the embodiments of the present application.

[0080] Zero Trust Network: A communication architecture used between access subjects and access objects. It is based on identity authentication and has the capabilities of business security access, continuous trust assessment, and dynamic access control. The functions of zero trust network are used through zero trust network clients (such as Intelligent Office Automation (IOA) clients).

[0081] Access subject: The party that initiates access in the network. For example, it can be a person, device or application that accesses intranet business resources. It is a digital entity composed of a single person, device, application and other factors or a combination of them.

[0082] Access object: The party being accessed in the network, that is, the enterprise's intranet business resources, including applications, systems (development and testing environment, operation and maintenance environment, production environment, etc.), data, interfaces, and functions.

[0083] Access agent: The terminal access agent is a terminal agent deployed on the controlled device to initiate secure access. It is responsible for initiating requests for trusted identity authentication of the access subject. Once the identity is verified to be trustworthy, an encrypted access connection can be established with the access gateway. It is also the policy enforcement point for access control.

[0084] Credentials: The authorization information issued by the detection server for a single network request, which is used to identify the authorization status of the network request.

[0085] Direct access: In a zero-trust network access architecture, an application initiates a network access request to a site. After the full-flow proxy hijacks the traffic, it initiates network access to the target site through the full-flow proxy, that is, initiates direct connection access. The full-flow proxy sends the network response of the target site to the application. This access mode is called direct access.

[0086] The following is a brief introduction to the design concept of the embodiment of the present application:

[0087] With the development of the Internet, more and more companies are starting to build intranets and share corporate resources in them. For security reasons, access to the intranet usually requires the installation of several essential applications on the client. The access of objects to corporate resources in the intranet can usually be achieved through zero-trust networks. The following is a brief introduction to zero-trust networks.

[0088] like Figure 1 As shown, the IOA client and server act as zero-trust network security service providers, and provide a unified access portal for access subjects (object 10 shown in the figure below, which may also include system 11 or applications in system 11) to access the resources of the object (enterprise intranet 12) through network requests through the data plane composed of zero-trust access agents and access gateways. The IOA client and server provide traffic monitoring and authentication operations for the unified access portal based on the access control policy. Only network traffic that passes the traffic authentication can be forwarded by the zero-trust access agent to the access gateway, and the access request for enterprise resources is forwarded to the corresponding back-end service in the enterprise intranet 12 through the access gateway to complete the overall access process.

[0089] The data flow is composed of terminal access proxy and intelligent gateway, forming a unified policy execution point. The IOA client and server jointly constitute a unified policy decision point. The session traffic initiated by the access subject is authenticated based on the access control policy engine, and the environment status in the device is security tested. Through the joint action of data flow and control flow, explicit dynamic trust is given to the authentication object in the trusted client and the specific session that accesses the enterprise resources through the trusted application. Only through this link (or unified access entrance) can the enterprise resources be successfully accessed, and other untrusted traffic will fail to access.

[0090] Figure 2 The figure shows the complete zero-trust system processing process of an object using an application to initiate network access to an enterprise business server. Figure 2As shown in the architecture diagram of the access processing system of the zero-trust network, the core modules of the access processing system of the zero-trust network mainly include: zero-trust network client (such as IOA client), zero-trust network server (such as IOA server), zero-trust network agent (such as full-flow agent) and zero-trust network gateway (such as intelligent gateway), which are explained respectively below.

[0091] The IOA client is a security agent installed on the work device of the access object (such as a company employee). It is responsible for verifying the trusted identity of the object on the device, verifying whether the device is trustworthy, and verifying whether the application is trustworthy. At the same time, it is also used to apply for unknown processes to the IOA server for process inspection.

[0092] The zero-trust network proxy is mainly used to hijack device traffic (such as access requests sent by applications) through the TUN / TAP virtual network card. After being authenticated by the IOA client, it is responsible for forwarding the network requests sent by the application to the smart gateway. If the authentication fails, a direct connection is made or the connection is interrupted.

[0093] The intelligent gateway is deployed at the entrance of application programs and data resources, and is responsible for authenticating, authorizing and forwarding each session request to access enterprise resources.

[0094] The IOA server is mainly used to schedule business traffic securely through the policy control engine, and to authorize according to the granularity of people-devices-business systems-applications. The IOA server includes an identity authentication module to verify the identity of the access object; a trusted module to verify the hardware information and security information of the client; and an application detection module to detect whether the application process is safe, such as whether there are vulnerabilities, viruses, Trojans, etc. In addition, the IOA server will regularly send files to the threat intelligence cloud check service or antivirus engine (such as the TAV antivirus engine) for inspection. When a malicious process is identified, an asynchronous blocking operation will be performed through the client.

[0095] The overall process is as follows:

[0096] Step 1: When the access subject initiates a network access request for the access object through the application, the IOA client first hijacks the network access request initiated by the application through the zero-trust network proxy.

[0097] Step 2: The zero-trust network agent initiates an authentication request to the IOA client (i.e., the zero-trust network agent applies to the IOA client for the credentials for this network access request), where the request parameters include the source Internet Protocol (IP) address or domain name, source port, destination IP address or domain name, destination port, and the process identifier (PID) corresponding to the application.

[0098] Step 3: The IOA client obtains process characteristics.

[0099] Step 4: The IOA client collects the MD5, process path, last modification time, copyright information, and signature information of the process through the PID sent by the zero-trust network agent, together with the source IP address or domain name, source port, destination IP address or domain name, and destination port carried in the network access request sent by the zero-trust network agent, and applies to the IOA server for ticket replacement.

[0100] Step 5: The IOA client sends the process characteristics to the IOA server for process inspection. If the ticket application is successful, proceed to step 6.

[0101] In step 6, the IOA client returns the ticket, the maximum number of times the ticket is used, and the validity period of the ticket to the zero trust network agent as a response.

[0102] In step 7, the zero-trust network agent can initiate an HTTPS request to the intelligent gateway, and the authorization header field of the request carries the network request credentials (i.e., ticket) returned by the IOA client.

[0103] Step 8: After receiving the Https request sent by the zero-trust network agent, the intelligent gateway parses the ticket in the header field and requests the IOA server to verify the ticket. If the verification is successful, execute step 9.

[0104] Step 9: A connection is successfully established between the smart gateway and the zero-trust network agent. The smart gateway receives the verification result returned by the IOA server. Then the zero-trust network agent can send the network access request initiated by the hijacked application to the smart gateway.

[0105] Step 10: The intelligent gateway forwards the request to the corresponding business server (business server A, business server B or business server C) and acts as a proxy for actual application network access.

[0106] Step 11: The service server returns a response result to the intelligent gateway.

[0107] Step 12: The intelligent gateway returns a response result to the zero trust network agent.

[0108] Step 13: The zero trust network agent returns a response result to the application.

[0109] It should be noted that if the IOA server fails to verify the ticket, the connection between the zero-trust network agent and the intelligent gateway will be interrupted. For traffic from applications outside the access control policy to access specific sites, a network access request will be initiated to the target business server through the zero-trust network agent to achieve direct access.

[0110] During the complete zero-trust system processing in which the above-mentioned object uses an application to initiate network access to the enterprise business server, the application detection module in the IOA client is used to detect whether the application process is safe, such as whether there are vulnerabilities, whether there are viruses or Trojans, etc. It is also used to detect whether several essential applications are installed in the client used by the object.

[0111] In actual applications, when an object uses a client to log in to the enterprise intranet, the detection application in the client (for example, the IOA client) will detect whether the required application is installed in the client and whether the required application is in a running state. Figure 3 As shown, the IOA client is detecting the office environment of the client used by the object. If the client used does not have the required application installed, the detection application determines that the client detection is abnormal. Of course, if the required application installed in the client is not running, the detection application will also determine that the client detection is abnormal, thereby prohibiting the client from accessing the enterprise intranet. Figure 4 As shown, the client has not passed the compliance test and cannot access intranet resources temporarily.

[0112] In the related art, when the detection application detects whether the essential application is installed in the client, it is mainly through the following two methods: Method 1, scanning whether the list of installed applications in the client hits the list of essential applications. If the list of installed applications in the client hits the list of essential applications, it is determined that the essential application detection is compliant, otherwise it is determined that the essential application detection is abnormal; Method 2, based on clear installation feature information, identifying whether there is installation feature information of the essential application in the client. If the installation feature information of the essential application exists in the client, it is determined that the essential application detection is compliant, otherwise it is determined that the essential application detection is abnormal.

[0113] On the other hand, when detecting whether the essential applications installed in the client are running, the detection application uses the following two methods: First, based on the identification of the specific application runtime, some application processes will use mutexes to avoid multiple processes running at the same time when they are started. The existence of the application process can be determined by checking the mutex. If the existence of the application process of the essential application is determined by checking the above mutex, it is determined that the essential application is in a running state, and the essential application detection is determined to be compliant, otherwise the essential application detection is determined to be abnormal; Second, periodically scan the process list in the client task manager, and based on the process feature information corresponding to the essential application and the runtime features, determine whether the application process of the essential application is in a running state. If the application process of the essential application is in a running state, the essential application detection is determined to be compliant, otherwise the essential application detection is determined to be abnormal.

[0114] It can be seen that under the relevant technology, when the above-mentioned method is used to detect the installation and operation of essential applications, the detection granularity is too coarse, and it is insufficient to detect whether the essential applications are running normally as expected. Attackers may bypass specific application logic and destroy the integrity of essential applications by injecting malicious modules or destroying application-related files. If the integrity of essential applications is destroyed, specific functions may operate abnormally, thereby causing security risks during operation.

[0115] In view of this, the embodiments of the present application provide a compliance detection method, device, electronic device and storage medium for essential applications. During the installation process of essential applications, by comparing the basic feature information of the installation file of the essential application with the baseline feature information associated with the version information of the current version of the essential application, it is possible to detect whether the installation file of the essential application is abnormal and whether it has been tampered with by a third party, thereby ensuring that the installation process of the essential application is compliant. Furthermore, during the operation of the essential application, by comparing the dynamic operation information generated during the operation of the essential application with the baseline operation feature information associated with the version information of the current version of the essential application, it is possible to ensure that the essential application operates normally as expected by security, avoid malicious modules being injected by attackers or files being destroyed during the operation, ensure that the operation process of the essential application is compliant, and through compliance detection of the installation process and operation process of the essential application, the integrity of the installation and operation of the essential application is deeply detected, thereby ensuring that the essential application operates normally as expected by security.

[0116] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0117] like Figure 5As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. It is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes a client 510, a detection server 520 corresponding to the detection application, and an intranet business server 530. The client 510 and the detection server 520, and the client 510 and the business server 530 can communicate through a communication network. A variety of applications can be installed in the client 510, for example, a detection application for detecting whether the client 510 is safe, some other necessary applications (such as applications for accessing the intranet), browser applications, video applications, etc.

[0118] When the object uses the client 510 to log in to the enterprise intranet to obtain enterprise resources, the installation process and operation process of the essential applications in the client 510 can be checked for compliance through the detection application in the client 510 and the detection server 520, so as to ensure that the essential applications in the client 510 are compliant and run as expected, and the client 510 is allowed to communicate with the business server 530.

[0119] For some customized essential applications, such essential applications can also establish inter-process communication with the detection application in certain key business scenarios (for example, login services, download services, etc.), and actively request the detection application to perform compliance testing on them. After successfully passing the verification of the detection application, such essential applications will obtain the network request credentials issued by the detection application, and can only continue with subsequent business processes based on this network request credentials.

[0120] The application involved in the embodiments of the present application can be software or a client such as a web page or a mini program, and the backend server is a backend server corresponding to the software or web page, mini program, etc., without limiting the specific type of the client.

[0121] In an optional implementation, the communication network is a wired network or a wireless network. The client 510, the detection server 520 and the service server 530 may be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0122] In the embodiment of the present application, the client 510 is an electronic device, which may be a personal computer, a mobile phone, a tablet computer, a notebook, an e-book reader, a smart home, or other computer device with certain computing capabilities and running a detection application.

[0123] The detection server 520 and the business server 530 can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers. They can also be cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0124] The following describes the compliance detection method for essential applications provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0125] Before formally introducing the embodiments of the present application, a brief description is first given of the operating logic of the detection application in the embodiments of the present application in detecting whether the required applications in the client are compliant.

[0126] The list of essential applications, detection rules and thresholds in the detection application are all controlled by the policy sent by the detection server. The policy content includes the disabling and enabling of the function of the feature switch control function, the detection rules and the relevant parameter values. The process of sending the policy from the detection server to the detection application is that the detection application (such as the IOA client) first configures the signaling of the pull switch configuration. The policy can be obtained from the detection server when the detection application is started, or it can be obtained from the detection server periodically. The detection server can also send a specified command through the heartbeat (the heartbeat of the detection application and the detection server to maintain a long connection) to trigger the detection application to pull the updated version of the policy content. After the policy is sent to the client, it is encrypted and stored, and the detection application on the client is responsible for execution. During the execution process, the detection application reports the policy execution status, execution results and operation data to the detection server. If the policy content needs to be changed, the detection server sends different policy versions to the detection application at different times. After the detection application receives the policy, it sets the previous policy to invalid and takes effect on the currently received policy.

[0127] The detection server can issue different policies to different clients based on the client's identity and the user logged in to the detection application, specifying different required application information. For example, the detection server can specify that client A must install and run 10 required applications, and specify that client B must install and run 8 required applications. Finally, the detection application is also one of the required applications. If the detection application is not installed in the client or the running logic of the detection application is abnormal, the client will not be able to establish a connection with the enterprise intranet to obtain enterprise resources.

[0128] In the embodiment of the present application, the detection server can pre-collect the baseline feature information and baseline operation information of different versions of each essential application. When the detection application performs compliance detection on the installation process and operation process of the essential application in the client, the baseline feature information and baseline operation information of different versions of the essential application can be obtained from the detection server in advance.

[0129] In actual applications, the policy sent by the detection server contains the essential application information that the detection application needs to detect, including the executable file information corresponding to the installation program corresponding to the essential application. The detection application detects the startup of the process in the client through the kernel driver component. For example, when detecting the startup and exit of the process in the client in the Windows system, PsSetCreateProcessNotifyRoutineEx can be used to create a callback function for the process startup. When a process is started in the client, the callback function will be triggered and executed. In the callback function, the process information can be compared with the executable file information of the essential application to see if they are consistent, including the process name, the hash and signature information of the file corresponding to the process.

[0130] If the match is successful, the detection application continues to detect the files released by the installer to the specified directory through the kernel driver component, that is, to detect the installation files in the installation directory, and to count the basic feature information of the installation files, including copyright information, file version information, file hash, digital signature information, etc., to form a correspondence between the basic feature information of the installer of the corresponding version of the required application and the installation file.

[0131] In the next step, the detection application reports this basic feature information to the detection server. The detection server classifies the essential applications according to the name and version information based on the correspondence between the installers of the essential applications automatically reported by each client and the basic feature information of the installation files, and merges and removes duplicates the basic feature information of the installation files reported by each client to form baseline feature information for different versions of each essential application.

[0132] If the union of essential applications sent by the detection server to each client is S = {S1, S2, S3...Sn}, n is a natural number greater than 1, the detection application on each client detects the basic feature information of the installation files started and released by the process of each installation program, and forms a set of feature information of the installation files released by the specified essential applications {Di|1≤i≤n}. After reporting to the detection server, the detection server generates mapping data f: S->D according to the different versions of each essential application and the list of installation file feature information, and for any Sk (a specific version of a certain essential application) ∈ S (1≤k≤n), there is a uniquely determined Di (the baseline feature information of the installation files released by a specific version of a certain essential application) corresponding to it, where 1≤i≤n, and Di∈D (a set composed of the basic feature information of the installation files released during the installation of each essential application).

[0133] The mapping data f: S->D stored in the detection server can be pulled by the detection application through the interface and cached in the detection application process cache. In an example, if the required application sets specified by the policy sent to device Dev1 and device Dev2 are E and F respectively, both of which are subsets of S, the detection applications of the two devices can pull the baseline feature information corresponding to all the required applications at one time, that is, the detection application of device Dev1 pulls the baseline feature information corresponding to different versions of the required applications corresponding to all elements in E (a subset of set D), and the detection application of device Dev2 pulls the baseline feature information corresponding to different versions of the required applications corresponding to all elements in F; it can also pull the baseline feature information corresponding to a single required application based on a specific required application (including version information). Regardless of which method is used, after the pull is completed, it is cached in the detection application as benchmark data to avoid repeated pulling.

[0134] See also Figure 6 As shown, it is an implementation flow chart of a compliance detection method for a required application provided in an embodiment of the present application, which is applied to the detection application installed in the client. The specific implementation process of the method is as follows:

[0135] S61, when it is detected that there is a required application in the process of being installed, basic feature information of the installation file in the installation directory corresponding to the required application is obtained, and current version information of the required application is obtained.

[0136] Among them, the basic characteristic information of the installation file mentioned in the embodiments of the present application may include but is not limited to: copyright information, file hash, digital signature information, etc.

[0137] It should be noted that the essential applications in the installation process mentioned in the embodiments of the present application include: essential applications in the installation process when the essential applications are installed using a program installation package, and essential applications in the upgrade process when the essential applications are upgraded using a program upgrade package.

[0138] In specific implementation, the detection application detects the process started in the client through the kernel driver component. When the process startup of the target application is detected, the process information of the target application is compared with the executable installation file information or executable upgrade file information corresponding to the essential application.

[0139] When the process information of the target application is determined to be consistent with the executable installation file information corresponding to the essential application, the target application is determined to be an essential application and the essential application is in the installation process; when the process information of the target application is determined to be consistent with the executable upgrade file information, the target application is determined to be an essential application and the essential application is in the upgrade process. Regardless of whether it is the installation process or the upgrade process of the essential application, the files under the installation directory of the essential application will change. Therefore, in order to prevent the installation files from being missing or tampered with during the installation process of the essential application, the embodiment of the present application obtains the basic feature information of the installation files under the installation directory corresponding to the essential application to perform compliance detection on the installation process of the essential application.

[0140] In an example, assuming that the installation program corresponding to the essential application ABC is ABC-setup.exe, and the upgrade program corresponding to the essential application ABC is ABC-update.exe, then Figure 7 As shown in FIG. 1 , when it is determined that the process information started in the client is ABC-setup.exe, it can be determined that the essential application ABC is in the installation process. Figure 8 As shown, when the process information started in the client is ABC-update.exe, it can be determined that the essential application ABC is in the upgrade process.

[0141] Of course, since the installation files in the installation directory may be different during the installation process of different versions of essential applications, when it is detected that the essential application is in the installation process and the basic feature information of the installation files in the installation directory of the essential application is obtained, it is also necessary to obtain the current version information of the essential application. This version information can be obtained directly from the essential application installation file.

[0142] S62, when it is determined that the basic characteristic information of the installation file is consistent with the baseline characteristic information associated with the version information, it is determined that the installation process of the essential application is compliant.

[0143] During specific implementation, the detection application may obtain the baseline feature information corresponding to different versions of all essential applications from the detection server in advance and store it in the process cache. Alternatively, after determining that the essential application is in the installation process and obtaining the current version information of the essential application, the detection application may obtain the baseline feature information corresponding to the current version information of the essential application from the detection server and store it in the process cache. The embodiments of the present application do not limit this.

[0144] In this way, after the detection application obtains the basic feature information of the installation files in the installation directory of the essential application in the process of installation, it can compare the basic feature information of the installation files obtained with the baseline feature information associated with the version information stored in the cache to detect whether there is an abnormal situation of missing files or replacement by malicious software. When it is determined that the basic feature information of the installation files obtained is consistent with the baseline feature information associated with the current version information of the essential application stored in the cache, it is determined that the installation process of the essential application is compliant.

[0145] S63, when it is detected that there is an essential application in the running process, dynamic running information generated by the essential application in the running process is obtained.

[0146] It should be noted that the detection of the essential application being in the running process can be achieved by detecting process information, or by detecting the access proxy component in the application to detect the network access request of the essential application.

[0147] In one embodiment, the detection application detects the process started in the client through the kernel driver component. When it is detected that the process of the target application is started, the process information of the target application is compared with the process information of the essential application. When it is determined that the process information of the target application is consistent with the process information of the essential application, it is determined that the target application is the essential application and the essential application is in the running process.

[0148] In one example, it is still assumed that the required application is ABC, such as Fig. 9 As shown, when it is determined that the process information started in the client is ABC.exe, it can be determined that the essential application ABC is in the running process.

[0149] In another embodiment, under normal circumstances, the detection application installed in the client, wherein the access proxy component can detect network access requests for all process information in the client, and can obtain information such as the process identifier, request protocol, target IP address, port source address, etc. that initiates the network access request. Therefore, when the detection application detects a network access request through the access proxy component, it can determine through the process identifier whether the network access request is initiated by the essential application. If it is determined that the essential application initiates the network access request, it is determined that the essential application is in the running process.

[0150] In specific implementation, when it is detected that there is an essential application in the running process, dynamic running information generated by the essential application in the running process is obtained, and the dynamic running information includes: application process information of the essential application and basic information of functional modules loaded when the essential application is running.

[0151] In an example, when the essential application Sj (1≤j≤n) is in the running process, the detection application performs silent detection on the essential application Sj according to the cycle set in the policy sent by the detection server, collects process information such as the basic information of the executable file corresponding to the essential application Sj application process, command line information, and startup account information, and obtains the basic information of the functional modules loaded by the executable file.

[0152] S64, when it is determined that the dynamic operation information is consistent with the benchmark operation information associated with the version information, it is determined that the operation process of the essential application is compliant.

[0153] In actual applications, dynamic operation information includes application process information of essential applications and basic information of functional modules loaded when essential applications are running. Therefore, to determine whether the dynamic operation information of essential applications is consistent with the baseline operation information associated with the version information, on the one hand, it is necessary to determine whether the application process information is consistent with the baseline application process information in the baseline operation information associated with the version information, and on the other hand, it is necessary to determine whether the functional modules loaded when the essential applications are running are compliant based on the basic information of the functional modules.

[0154] In specific implementation, taking the essential application Sj as an example, to determine whether the application process information is consistent with the benchmark application process information in the benchmark running information associated with the version information, it is only necessary to compare the basic information of the executable file corresponding to the collected essential application Sj, command line information, startup account information, etc. with the benchmark application process information in the benchmark running information associated with the version information in the detection application cache (obtained in advance from the detection server).

[0155] It should be noted that the benchmark operation information can be determined by the detection server based on data reported by multiple clients using the method provided in the embodiment of the present application, or it can be provided by the application developer of the essential application, or it can be collected in a trusted environment.

[0156] In specific implementation, based on the basic information of the functional modules, when determining whether the functional modules loaded during the runtime of the essential application are compliant, the following situations can be classified according to the types of functional modules:

[0157] Case 1: The function module is a module under the required application installation directory, and the basic information of the function module is consistent with the baseline information associated with the version information.

[0158] Case 2: The function module is a module under the client system directory, and the feature information corresponding to the function module is in the pre-specified policy whitelist. This policy whitelist can be set in the detection server based on experience, and sent by the detection server to the detection application for execution. In the embodiment of the present application, the feature information can be digital signature information, hash value, etc.

[0159] Case 3: The function module is a module in a directory other than the system directory in the client, and the function module is a module in a pre-specified loadable module whitelist. This loadable module whitelist can be set in the detection server based on experience, and sent from the detection server to the detection application for execution.

[0160] Case 4: The functional module is a module in a directory other than the system directory in the client, and the detection server determines that the functional module is compliant.

[0161] It should be noted that for situation 4, the functional module is a module in a directory other than the system directory in the client, and the functional module is not a module in the pre-specified whitelist of loadable modules. At this time, the detection application can send the basic information of the functional module to the detection server, and the detection server will send the basic information of the functional module to the threat intelligence cloud service for analysis. When it is determined that the functional module has no abnormal file information based on the analysis results, the detection server determines that the functional module is compliant.

[0162] The above cases 1, 2, 3, and 4 constitute all types of functional modules that may be loaded by the essential application Sj. Case 1 indicates that the functional module in the installation directory is actively loaded by the application process. By comparing with the baseline information of the same version, it is detected whether there is any tampering and whether it is a compliant functional module. Case 2 indicates that the existing applications generally load system-level functional modules, such as ntdll.dll, etc. As long as they meet the characteristic information specified in the policy whitelist, all behaviors of loading system functional modules are considered compliant. Cases 3 and 4 indicate that essential applications are actively loaded because of business logic needs, or are passively loaded by other third-party software through module injection, and are objects that need special attention. Case 3 indicates that as long as the module whitelist allowed to be loaded in the policy is hit, it is considered compliant. Case 4 indicates that after inspection by the threat intelligence cloud service, as long as no abnormal information is returned, it is considered compliant.

[0163] Taking into account that process injection is relatively common, some input method programs execute related business logic or security applications execute security monitoring functions, and most of the applications in the client have the behavior of loading non-self-functional modules and non-system type files. Therefore, the embodiment of the present application performs comprehensive security detection on the functional modules loaded during the runtime of essential applications by detecting whether the basic information of the functional modules in the installation directory is consistent with the benchmark information associated with the version information, detecting whether the basic information of the functional modules is in the policy whitelist, detecting whether the functional modules are loadable third-party modules in the whitelist, and checking whether the functional modules are abnormal through the threat intelligence cloud check service.

[0164] In addition, in actual applications, since the functional modules loaded by application processes of different essential applications may be the same, after detecting the basic information of the application collection functional modules, the basic information of the functional modules can be added to the cache (for example, the cache is first built in the memory, and it can be written locally and loaded into the memory cache when the process starts). In this way, the basic information of the same functional module does not need to be calculated multiple times, thereby speeding up the efficiency of information collection and information comparison.

[0165] S65: When it is determined that both the installation process and the operation process of the essential application are compliant, determine that the essential application is compliant.

[0166] In specific implementation, the detection application detects each essential application in the essential application list issued by the detection server, and when it is determined that the installation process and the operation process of the essential application are both compliant, the essential application is determined to be compliant.

[0167] In actual applications, when the detection application is detecting whether there is an abnormality in the essential applications in the client, if according to the policy sent by the detection server, there are N essential applications that need to be installed in the client, and N is a natural number greater than or equal to 1, then when the detection application determines that the installation and operation processes of the N essential applications in the client are compliant, it can be determined that there is no abnormality in the security detection of the essential applications on the client.

[0168] In actual applications, on the one hand, for conventional essential applications or essential applications provided by third parties, compliance checks on the installation and operation processes can ensure that the essential applications run as expected. However, for customizable essential applications, because there are customizable parts in their business logic, in some customized business scenarios, in addition to the need to use conventional methods to perform compliance checks on the installation and operation processes, it is also necessary to prevent them from bypassing key logic and detect whether they have loaded the necessary module information.

[0169] On the other hand, periodic detection during operation or detection when essential applications access the network may not cover the time period when the essential applications perform critical business. Moreover, at the detection time point of periodic detection or the detection time point during network access, there may be larger or smaller differences between the functional modules loaded by the application process of the essential application and the functional modules loaded when it performs critical business.

[0170] Therefore, for customizable essential applications, in key business scenarios, they can interact with the detection application, request the detection application to perform compliance testing on their operation in key business scenarios, and after verification by the detection application and the detection server, obtain the credentials (or tickets) issued by the detection server, and then continue with subsequent business processes.

[0171] When implementing it, Fig.10As shown, the process of establishing inter-process communication between the customizable required application and the detection application and obtaining the credential (or ticket) includes:

[0172] S1001, receiving a connection request for establishing inter-process communication sent by a required application, where the connection request is used to request a detection application to perform compliance detection on the required application.

[0173] In specific implementation, after the detection application initializes and starts the service, it attempts to start the Https service using the agreed default port. If the port binding fails, it attempts to bind other ports within the set interval. After the service is successfully started, the port information is written into the configuration file in the fixed path for encrypted storage. When any essential application needs to perform key business (for example, execute login business), in addition to sending the agreed request parameters to the server corresponding to its own application, it also needs to send a single credential generated by the detection server. To obtain the credential, it first needs to initiate an inter-process communication connection request to the fixed port of the detection application in the client (read the encrypted configuration file written by the detection application, and perform the decryption operation according to the agreed key to obtain the target port), requesting the detection application to perform compliance detection on the essential application.

[0174] It should be noted that the timing of sending the connection request for the inter-process communication is determined by the time point when each essential application executes a key service, and the connection request for the inter-process communication is automatically triggered when the essential application actively initiates a key service.

[0175] S1002, obtaining basic characteristic information of an executable file corresponding to the essential application, and establishing a communication connection with the essential application when determining that the essential application is compliant based on the basic characteristic information.

[0176] After the detection application receives the inter-process communication connection request sent by the essential application, it obtains the absolute path of the executable file through the PID of the essential application, and then obtains basic feature information such as the digital signature of the executable file of the essential application. When the essential application is determined to be compliant based on this basic feature information, a communication connection is established with the essential application. When the essential application is determined to be non-compliant based on this basic feature information, an error code and related information are sent to the essential application, and the connection with the essential application is disconnected. In this case, the essential application fails to obtain the credentials, the business logic is interrupted, and business processing cannot continue.

[0177] In specific implementation, the detection application determines whether the essential application is compliant based on the basic feature information of the essential application. This can be done locally in the detection application. The detection application can obtain the baseline feature information of the essential application from the detection server in advance and store it in encrypted form in the cache. After obtaining the basic feature information of the essential application, the basic feature information of the essential application is compared with the baseline feature information associated with the version information. If the comparison is consistent, a communication connection is established with the essential application. If the comparison is inconsistent, an error code and related information are sent to the essential application, and the connection with the essential application is disconnected.

[0178] Specifically, Fig.11 As shown, determining whether the essential application S1 is compliant may include the following steps when the application is detected locally:

[0179] Step 1101 , the essential application S1 sends a connection request to the detection application, where the connection request is used to request to establish inter-process communication with the detection application, and to request the detection application to perform compliance detection on the essential application S1 .

[0180] Step 1102 , the detection application obtains the absolute path of the executable file of the essential application S1 according to the PID of the essential application S1 , and then obtains the basic feature information of the executable file of the essential application S1 .

[0181] Step 1103 , the detection application compares the acquired basic feature information of the essential application S1 with the benchmark feature information associated with the version information of the essential application S1 in the cache.

[0182] Step 1104, if the comparison result is consistent, the detection application determines that the essential application S1 is compliant, then the detection application establishes an inter-process communication connection with the essential application S1; if the comparison result is inconsistent, the detection application determines that the essential application S1 is not compliant, then the detection application sends an error code and related information to the essential application S1, and disconnects from the essential application S1.

[0183] In one example, if Fig.12 As shown, the interaction process between the essential application S1 and the detection application includes: step 1, the detection application initializes and starts the service, and writes the bound port information into the configuration file in a fixed path for encrypted storage; step 2, the essential application S1 initiates a connection request for inter-process communication to the detection application through the port bound to the detection application; step 3, the detection application verifies whether the essential application is compliant based on the basic feature information of the executable file of the essential application S1; step 4, the detection application determines that the essential application S1 is not compliant, sends an error code and related information to the essential application S1, and disconnects from the essential application S1.

[0184] In specific implementation, when the detection application determines whether the essential application is compliant based on the basic feature information of the essential application, the basic feature information of the essential application can also be reported to the detection server, and the detection server compares the basic feature information of the essential application with the benchmark feature information to detect whether the essential application is a compliant essential application. When the detection server determines that the basic feature information of the essential application is consistent with the benchmark feature information associated with the version information, it generates a response message indicating that the essential application is compliant and sends it to the detection application. The detection application determines that the essential application is compliant based on this response message and establishes a communication connection with the essential application.

[0185] Of course, when the detection server determines that the basic feature information of the essential application is inconsistent with the baseline feature information associated with the version information, it generates a response message characterizing the non-compliance of the essential application and sends it to the detection application. The detection application determines that the essential application is non-compliant based on this response message, sends an error code and related information to the essential application, and disconnects from the essential application.

[0186] In other embodiments of the present application, when the detection server sends a response message indicating that the essential application is compliant to the detection application, in addition to considering whether the essential application is compliant, it may also consider the trustworthiness of the current client. If the current client is not trustworthy, then even if the essential application is compliant, the detection server may also send a response message to the detection application indicating that the essential application is non-compliant.

[0187] In actual applications, in order to safely compare the basic feature information of the essential applications with the benchmark feature information, the basic feature information of the essential applications may be sent to a detection server for comparison.

[0188] Specifically, Fig.13 As shown, determining whether the essential application S1 is compliant, when performed in the detection server, may include the following steps:

[0189] Step 1301 , the essential application S1 sends a connection request to the detection application, where the connection request is used to request to establish inter-process communication with the detection application, and to request the detection application to perform compliance detection on the essential application S1 .

[0190] Step 1302 , the detection application obtains the absolute path of the executable file of the essential application S1 according to the PID of the essential application S1 , and then obtains the basic feature information of the executable file of the essential application S1 .

[0191] Step 1303: The detection application forwards the acquired basic feature information of the essential application S1 to the detection server.

[0192] Step 1304 , the detection server compares the basic feature information of the essential application S1 with the benchmark feature information associated with the version information of the essential application S1 in the database.

[0193] Step 1305: The detection server generates a response message according to the comparison result, and sends the response message to the detection application.

[0194] Step 1306, if the detection application determines that the essential application S1 is compliant based on the response message, the detection application establishes an inter-process communication connection with the essential application S1; if the detection application determines that the essential application S1 is not compliant based on the response message, the detection application sends an error code and related information to the essential application S1 and disconnects from the essential application S1.

[0195] In another example, if Fig.14 As shown, the interaction process between the essential application S1, the detection application and the detection server includes: step 1, the detection application initializes and starts the service, and writes the bound port information into the configuration file in a fixed path for encrypted storage; step 2, the essential application S1 initiates a connection request for inter-process communication to the detection application through the port bound to the detection application; step 3, the detection application sends the acquired basic feature information of the essential application S1 to the detection server; step 4, the detection server verifies whether the essential application S1 is compliant based on the basic feature information of the executable file of the essential application S1; step 5, the detection server determines through verification that the essential application S1 is not compliant or the current client is not trustworthy, and sends a response message to the detection application indicating that the essential application S1 is not compliant; step 6, the detection application determines that the essential application S1 is not compliant, sends an error code and related information to the essential application S1, and disconnects from the essential application S1.

[0196] In another example, Fig.15 As shown, the interaction process between the essential application S1, the detection application and the detection server includes: step 1, the detection application initializes and starts the service, and writes the bound port information into the configuration file in a fixed path for encrypted storage; step 2, the essential application S1 initiates a connection request for inter-process communication to the detection application through the port bound to the detection application; step 3, the detection application sends the acquired basic feature information of the essential application S1 to the detection server; step 4, the detection server verifies whether the essential application S1 is compliant based on the basic feature information of the executable file of the essential application S1; step 5, the detection server determines that the essential application S1 is compliant and the current client is trustworthy through verification, and sends a response message to the detection application indicating that the essential application S1 is compliant; step 6, the detection application determines that the essential application S1 is compliant, and establishes an inter-process communication connection with the essential application S1.

[0197] S1003, performing compliance testing on the detection application, and when compliance is determined, obtaining dynamic operation information of the essential application, and applying for credentials from the detection server based on the dynamic operation information.

[0198] In specific implementation, if the detection application successfully establishes an inter-process communication connection with the essential application, then since the detection application is also an essential application, the detection application needs to detect its own status. If there is an abnormality in itself, it cannot apply for credentials for the essential application.

[0199] In actual applications, the detection application can detect whether there is an abnormality in itself by at least one of the following methods: detecting whether the target module is loaded; detecting whether it is in a logged-in state; and detecting whether a heartbeat connection is maintained with the detection server.

[0200] It should be noted that if the detection application randomly selects one of the three methods to detect whether it has an abnormality, for example, taking the detection of whether the target module is loaded as an example, then when the target module is loaded, the detection application determines that it has no abnormality, and if the target module is not loaded, the detection application determines that it has an abnormality. If the detection application randomly selects two of the three methods to detect whether it has an abnormality, for example, taking the detection of whether the target module is loaded and the detection of whether it is in the logged-in state as examples, then when the target module is loaded and in the logged-in state, the detection application determines that it has no abnormality, and if the target module is not loaded or not in the logged-in state, the detection application determines that it has an abnormality. If the detection application uses a combination of the above three methods to detect whether it has an abnormality, then when the target module is loaded, the detection application is in the logged-in state, and the detection application maintains a heartbeat connection with the detection server, the detection application determines that it has no abnormality, otherwise, the detection application determines that it has an abnormality.

[0201] In actual applications, if the detection application detects no abnormalities itself, it will collect the dynamic operation information of the essential application (including the basic information of the loaded functional modules) and apply for credentials from the detection server. Otherwise, it will send an error code and related information to the essential application.

[0202] Specifically, Fig.16 As shown, the detection application determines that the required application S1 is compliant and applies for a certificate from the detection server, which may include the following steps:

[0203] Step 1601 , the essential application S1 sends a connection request to the detection application. The connection request is used to request to establish inter-process communication with the detection application, and request the detection application to perform compliance detection on the essential application S1 .

[0204] Step 1602 , the detection application obtains the absolute path of the executable file of the essential application S1 according to the PID of the essential application S1 , and then obtains the basic feature information of the executable file of the essential application S1 .

[0205] Step 1603: The detection application forwards the acquired basic feature information of the essential application S1 to the detection server.

[0206] Step 1604 , the detection server compares the basic feature information of the essential application S1 with the benchmark feature information associated with the version information of the essential application S1 in the database.

[0207] Step 1605: The detection server generates a response message according to the comparison result, and sends the response message to the detection application.

[0208] Step 1606: If the detection application determines that the essential application S1 is compliant according to the response message, the detection application establishes an inter-process communication connection with the essential application S1.

[0209] Step 1607, the detection application performs a self-check.

[0210] Step 1608, if the detection application self-check has an abnormality, the detection application sends an error code and related information to the essential application S1 and disconnects from the essential application S1; if the detection application self-check passes and there is no abnormality in the detection application, the detection application obtains the dynamic operation information of the essential application S1.

[0211] Step 1609 , the detection application sends the dynamic operation information of the essential application S1 to the detection server, and applies for a certificate for the essential application S1 .

[0212] In another example, Fig.17 As shown, the interaction process between the essential application S1, the detection application and the detection server includes: step 1, the detection application initializes and starts the service, and writes the bound port information into the configuration file in the fixed path for encrypted storage; step 2, the essential application S2 initiates a connection request for inter-process communication to the detection application through the port bound to the detection application; step 3, the detection application sends the acquired basic feature information of the essential application S2 to the detection server; step 4, the detection server verifies whether the essential application S2 is compliant based on the basic feature information of the executable file of the essential application S2; in step 5, the detection server determines through verification that the essential application S2 is compliant and the current client is trustworthy, and sends a response message to the detection application indicating that the essential application S2 is compliant; step 6, the detection application determines that the essential application S2 is compliant, and establishes an inter-process communication connection with the essential application S2; step 7, the detection application performs self-test; step 8, the detection application self-test is abnormal, and an error code and related information are sent to the essential application S2, and the connection with the essential application S2 is disconnected.

[0213] In another example, Fig.18As shown, the interaction process between the essential application S1, the detection application and the detection server includes: step 1, the detection application initializes and starts the service, and writes the bound port information into the configuration file in the fixed path for encrypted storage; step 2, the essential application S2 initiates a connection request for inter-process communication to the detection application through the port bound to the detection application; step 3, the detection application sends the acquired basic feature information of the essential application S2 to the detection server; step 4, the detection server verifies whether the essential application S2 is compliant based on the basic feature information of the executable file of the essential application S2; step 5, the detection server determines that the essential application S2 is compliant and the current client is trustworthy through verification, and sends a response message to the detection application indicating that the essential application S2 is compliant; step 6, the detection application determines that the essential application S2 is compliant, and establishes an inter-process communication connection with the essential application S2; step 7, the detection application performs self-inspection; step 8, the detection application self-inspects and there is no abnormality, collects the dynamic operation information of the essential application (including the basic information of the loaded functional modules) and applies for credentials from the detection server.

[0214] S1004, receiving the certificate issued by the detection server, and sending the certificate to the essential application, the certificate is used to perform security authentication on the essential application when the essential application communicates with the business server corresponding to the essential application.

[0215] In specific implementation, the detection server compares the dynamic operation information of the essential application with the benchmark operation information, and decides whether to respond to the credential application based on the comparison result. If the detection server responds to the credential application, the detection server sends the credential to the detection application, and the detection application forwards the credential to the essential application (or the application process corresponding to the detection application), and the credential application process ends.

[0216] The essential application can only carry out subsequent key business processes after receiving the credentials. If the essential application fails to apply for the credentials, that is, the essential application does not obtain the credentials, then in the embodiment of the present application, the essential application cannot carry out subsequent key business processes. For example, the essential application itself cannot perform key business processing, and the essential application cannot initiate operations such as login requests to its own server.

[0217] After receiving the credentials sent by the detection application, the essential application can send the credentials and other agreed request parameters to its corresponding server. In addition to verifying the business request parameters, the server corresponding to the essential application will also send the credentials to the detection server for credential verification. Only after the credential verification passes and the business request parameter verification succeeds, the key business process of the essential application can be completed.

[0218] In another example, Fig.19As shown, the interaction process between the essential application S1, the detection application and the detection server includes: step 1, the detection application initializes and starts the service, and writes the bound port information into the configuration file in the fixed path for encrypted storage; step 2, the essential application S3 initiates a connection request for inter-process communication to the detection application through the port bound to the detection application; step 3, the detection application sends the acquired basic feature information of the essential application S3 to the detection server; step 4, the detection server verifies whether the essential application S3 is compliant based on the basic feature information of the executable file of the essential application S3; step 5, the detection server determines that the essential application S3 is compliant and the current client is trustworthy through verification, and sends a response message to the detection application indicating that the essential application S3 is compliant; step 6, the detection application determines that the essential application S3 is compliant, and establishes an inter-process communication connection with the essential application S3; step 7 , the detection application performs self-inspection; step 8, the detection application self-inspection is normal, the dynamic operation information of the essential application (including the basic information of the loaded functional modules) is collected to apply for credentials from the detection server; step 9, the detection server responds to the credential application, and sends the generated credential to the detection application; step 10, the detection application forwards the credential to the essential application S3; step 11, the essential application S3 sends the credential and other agreed request parameters as a business request to the server of the essential application S3; step 12, the server of the essential application S3 sends a credential verification request to the detection server; step 13, the detection server verifies the credential; step 14, the detection server returns the credential verification result to the server of the essential application S3. If the credential verification passes and the business request parameter verification succeeds, the server of the essential application S3 responds to the business request of the essential application S3.

[0219] The compliance detection method for essential applications provided in the embodiment of the present application, on the one hand, adopts a unified detection method for each essential application, and performs a unified installation file integrity check, a unified runtime dynamic operation information check, and a unified detection and protection of the loading information of the functional modules in the key business scenarios of the customizable essential applications through the detection server delivery policy; on the other hand, it supports in-depth detection of the installation and operation integrity of the essential applications, and whether the application process runs normally as expected. Furthermore, for customizable essential applications, in addition to periodic detection during operation and detection during network access, it also supports security protection scenarios covering key business scenarios.

[0220] Based on the same inventive concept, the present application embodiment also provides a compliance detection device for essential applications. Fig. 20 As shown, it is a schematic diagram of the structure of a compliance detection device 2000 for essential applications, which may include:

[0221] The first acquisition unit 2001 is used to acquire basic feature information of installation files in the installation directory corresponding to the essential application and acquire current version information of the essential application when detecting that there is an essential application in the installation process;

[0222] The first processing unit 2002 is used to determine that the installation process of the essential application is compliant when it is determined that the basic characteristic information of the installation file is consistent with the baseline characteristic information associated with the version information;

[0223] The second acquisition unit 2003 is used to acquire dynamic operation information generated by the essential application during the operation process when detecting that there is an essential application in the operation process;

[0224] The second processing unit 2004 is used to determine that the operation process of the essential application is compliant when the dynamic operation information is determined to be consistent with the benchmark operation information associated with the version information;

[0225] The compliance detection unit 2005 is used to determine that the essential application is compliant when it is determined that the installation process and the running process of the essential application are both compliant.

[0226] Optionally, the device further comprises:

[0227] The transceiver unit 2006 is used to receive a connection request for establishing inter-process communication sent by the essential application, where the connection request is used to request the detection application to perform compliance detection on the essential application;

[0228] The third acquisition unit 2007 is used to acquire basic feature information of the executable file corresponding to the essential application;

[0229] The communication unit 2008 is used to establish a communication connection with the essential application when the essential application is determined to be compliant based on the basic characteristic information;

[0230] The self-checking unit 2009 is used to perform compliance check on the detection application, obtain dynamic operation information of the essential application when compliance is determined, and apply for a certificate from the detection server through the transceiver unit 2006 based on the dynamic operation information;

[0231] The transceiver unit 2006 is further used to receive the certificate issued by the detection server, and send the certificate to the essential application. The certificate is used to perform security authentication on the essential application when the essential application communicates with the business server corresponding to the essential application.

[0232] Optionally, the communication unit 2008 is specifically configured to:

[0233] Send the basic feature information to the detection server and request the detection server to perform compliance detection on the required applications;

[0234] When a response message indicating compliance of the required application is received from the detection server, the required application is determined to be compliant and a communication connection is established with the required application, wherein the response message is generated by the detection server when it is determined that the basic feature information is consistent with the baseline feature information associated with the version information.

[0235] Optionally, the self-check unit 2009 is specifically configured to: perform compliance check on the detection application in at least one of the following ways:

[0236] Check whether the target module is loaded;

[0237] Check whether you are logged in;

[0238] Check whether the heartbeat connection with the detection server is maintained.

[0239] Optionally, the dynamic running information generated by the essential application during its running process includes: application process information of the essential application and basic information of function modules loaded when the essential application is running;

[0240] The second processing unit 2004 is specifically used to: determine that the baseline application process information in the baseline running information associated with the application process information and version information is consistent, and based on the basic information of the functional module, determine that the functional module loaded when the essential application is running is compliant, and determine that the running process of the essential application is compliant.

[0241] Optionally, the second processing unit 2004 is specifically configured to: determine, based on the basic information of the function module, that the function module loaded when the essential application is running satisfies at least one of the following conditions, that the function module loaded when the essential application is running is compliant:

[0242] The function module is a module under the installation directory of the required application, and the basic information of the function module is consistent with the baseline information associated with the version information;

[0243] The function module is a module under the client system directory, and the feature information corresponding to the function module is in a pre-specified policy whitelist;

[0244] Functional modules are modules in directories other than the system directory in the client, and are modules in a pre-specified whitelist of loadable modules;

[0245] Functional modules are modules in directories other than the system directory in the client, and the functional modules are determined to be compliant by the detection server.

[0246] Optionally, the first acquisition unit 2001 is specifically configured to:

[0247] Detecting the process started in the client through the kernel driver component, and when detecting the process start of the target application, comparing the process information of the target application with the executable installation file information or executable upgrade file information corresponding to the essential application;

[0248] When the process information of the target application is determined to be consistent with the executable installation file information or executable upgrade file information corresponding to the essential application, the target application is determined to be the essential application and the essential application is in the installation process, and basic feature information of the installation file in the installation directory corresponding to the essential application is obtained.

[0249] Optionally, the second obtaining unit 2003 is specifically configured to:

[0250] The kernel driver component detects the process started in the client, and when the process start of the target application is detected, the process information of the target application is compared with the process information of the essential application;

[0251] When the process information of the target application is determined to be consistent with the process information of the essential application, the target application is determined to be the essential application, and the essential application is in the running process, and dynamic running information generated by the essential application is obtained.

[0252] Optionally, the second obtaining unit 2003 is specifically configured to:

[0253] When a network access request sent by a required application is detected by accessing the proxy component, it is determined that the required application is in the running process, and dynamic running information generated by the required application is obtained.

[0254] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. The electronic device can be used for compliance detection of essential applications. In one embodiment, the electronic device can be a server, such as Figure 5 The detection server 520 shown in FIG. 1 is a schematic diagram of a detection server 520. In this embodiment, the structure of the electronic device can be as follows: Fig.21 As shown, it includes a memory 2101 , a communication module 2103 and one or more processors 2102 .

[0255] The memory 2101 is used to store computer programs executed by the processor 2102. The memory 2101 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0256] The memory 2101 may be a volatile memory, such as a random-access memory (RAM); the memory 2101 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 2101 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2101 may be a combination of the above memories.

[0257] The processor 2102 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 2102 is configured to implement the compliance detection method of the above-mentioned essential application when calling the computer program stored in the memory 2101 .

[0258] The communication module 2103 is used to communicate with terminal devices and other servers.

[0259] The specific connection medium between the memory 2101, the communication module 2103 and the processor 2102 is not limited in the embodiment of the present application. Fig.21 In the embodiment, the memory 2101 and the processor 2102 are connected via a bus 2104. The bus 2104 is connected to the processor 2102 via a bus 2104. Fig.21 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. Bus 2104 can be divided into address bus, data bus, control bus, etc. For ease of representation, Fig.21 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0260] The memory 2101 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the compliance detection method of the essential application of the embodiment of the present application. The processor 2102 is used to execute the above-mentioned compliance detection method of the essential application, such as Fig.10 shown.

[0261] In another embodiment, the electronic device may also be other electronic devices, such as Figure 5 In this embodiment, the structure of the electronic device can be as follows: Fig. 22As shown, it includes: a communication component 2210, a memory 2220, a display unit 2230, a camera 2240, a sensor 2250, an audio circuit 2260, a Bluetooth module 2270, a processor 2280 and other components.

[0262] The communication component 2210 is used to communicate with the server. In some embodiments, a circuit wireless fidelity (Wireless Fidelity, WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help users send and receive information through the WiFi module.

[0263] The memory 2220 can be used to store software programs and data. The processor 2280 executes various functions and data processing of the client 510 by running the software programs or data stored in the memory 2220. The memory 2220 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The memory 2220 stores an operating system that enables the client 510 to run. In the present application, the memory 2220 can store an operating system and various application programs, and can also store the code for executing the compliance detection method that is required to be applied in the embodiment of the present application.

[0264] The display unit 2230 can also be used to display information input by the user or information provided to the user and a graphical user interface (GUI) of various menus of the client 510. Specifically, the display unit 2230 may include a display screen 2232 disposed on the front of the client 510. The display screen 2232 may be configured in the form of a liquid crystal display, a light emitting diode, etc. The display unit 2230 may be used to present a detection interface of a detection application in an embodiment of the present application.

[0265] The display unit 2230 can also be used to receive input digital or character information and generate signal input related to the user settings and function control of the client 510. Specifically, the display unit 2230 may include a touch screen 2231 arranged on the front of the client 510, which can collect user touch operations on or near it, such as clicking a button, dragging a scroll box, etc.

[0266] The touch screen 2231 can be covered on the display screen 2232, or the touch screen 2231 and the display screen 2232 can be integrated to realize the input and output functions of the client 510. The integrated touch screen can be referred to as a touch display screen. In this application, the display unit 2230 can display the application and the corresponding operation steps.

[0267] Camera 2240 can be used to capture static images, and the user can send the image taken by camera 2240 to the user of the other chat partner through the client. Camera 2240 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the processor 2280 to convert it into a digital image signal.

[0268] The client 510 may further include at least one sensor 2250, such as an acceleration sensor 2251, a distance sensor 2252, a fingerprint sensor 2253, and a temperature sensor 2254. The client 510 may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0269] The audio circuit 2260, the speaker 2261, and the microphone 2262 can provide an audio interface between the user and the client 510. The audio circuit 2260 can transmit the electrical signal converted from the received audio data to the speaker 2261, which is converted into a sound signal for output. The client 510 can also be configured with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 2262 converts the collected sound signal into an electrical signal, which is received by the audio circuit 2260 and converted into audio data, and then the audio data is output to the communication component 2210 to be sent to, for example, another client 510, or the audio data is output to the memory 2220 for further processing.

[0270] The Bluetooth module 2270 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the client 510 can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 2270 to exchange data.

[0271] The processor 2280 is the control center of the client 510. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the client 510 and processes data by running or executing software programs stored in the memory 2220 and calling data stored in the memory 2220. In some embodiments, the processor 2280 may include one or more processing units; the processor 2280 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes an operating system, a user interface, and an application program, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 2280. In the present application, the processor 2280 can run an operating system, an application program, a user interface display and a touch response, as well as a compliance detection method for a necessary application in an embodiment of the present application. In addition, the processor 2280 is coupled to the display unit 2230.

[0272] In some possible implementations, various aspects of the compliance detection method for essential applications provided in the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of the compliance detection method for essential applications according to various exemplary implementations of the present application described above in this specification. For example, the computer device may execute the following steps: Figure 6 Follow the steps shown in .

[0273] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0274] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a computing device. However, the program product of the present application is not limited thereto. In the embodiment of the present application, the readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with a command execution system, device or device.

[0275] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0276] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0277] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user equipment, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0278] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0279] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0280] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0281] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0282] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0283] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0284] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0285] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A compliance detection method for essential applications, applied to detection applications installed in a client, characterized in that: include: When detecting that there is a required application in the process of being installed, obtaining basic feature information of the installation file in the installation directory corresponding to the required application, and obtaining current version information of the required application; When it is determined that the basic characteristic information of the installation file is consistent with the baseline characteristic information associated with the version information, determining that the installation process of the essential application is compliant; When detecting that there is a required application in the running process, obtaining dynamic running information generated by the required application in the running process; When it is determined that the dynamic operation information is consistent with the benchmark operation information associated with the version information, determining that the operation process of the essential application is compliant; When it is determined that both the installation process and the running process of the essential application are compliant, it is determined that the essential application is compliant.

2. The method according to claim 1, characterized in that The method further comprises: receiving a connection request for establishing inter-process communication sent by the essential application, wherein the connection request is used to request the detection application to perform compliance detection on the essential application; Acquiring basic feature information of an executable file corresponding to the essential application, and establishing a communication connection with the essential application when determining that the essential application is compliant based on the basic feature information; Performing compliance testing on the detection application, and when compliance is determined, obtaining dynamic operation information of the essential application, and applying for a credential from a detection server based on the dynamic operation information; The credential sent by the detection server is received, and the credential is sent to the essential application, where the credential is used to perform security authentication on the essential application when the essential application communicates with a business server corresponding to the essential application.

3. The method according to claim 2, characterized in that When determining that the essential application is compliant based on the basic feature information, establishing a communication connection with the essential application includes: Sending the basic feature information to the detection server, requesting the detection server to perform compliance detection on the essential application; Upon receiving a response message sent by the detection server indicating that the essential application is compliant, the essential application is determined to be compliant and a communication connection is established with the essential application, wherein the response message is generated by the detection server upon determining that the basic feature information is consistent with the baseline feature information associated with the version information.

4. The method according to claim 2, characterized in that: The compliance detection of the detection application includes at least one of the following: Check whether the target module is loaded; Check whether you are logged in; Check whether a heartbeat connection is maintained with the detection server.

5. The method according to claim 1, characterized in that The dynamic operation information generated during the operation of the essential application includes: application process information of the essential application and basic information of function modules loaded when the essential application is running; When determining that the dynamic operation information is consistent with the benchmark operation information associated with the version information, determining that the operation process of the essential application is compliant includes: When it is determined that the application process information is consistent with the benchmark application process information in the benchmark running information associated with the version information, and when it is determined based on the basic information of the functional modules that the functional modules loaded when the essential application is running are compliant, it is determined that the running process of the essential application is compliant.

6. The method according to claim 5, characterized in that When it is determined based on the basic information of the functional module that the functional module loaded when the essential application is running satisfies at least one of the following conditions, it is determined that the functional module loaded when the essential application is running is compliant: The functional module is a module under the essential application installation directory, and the basic information of the functional module is consistent with the benchmark information associated with the version information; The function module is a module under the client system directory, and the feature information corresponding to the function module is in a pre-specified policy whitelist; The functional modules are modules in directories other than the system directory in the client, and the functional modules are modules in a pre-specified whitelist of loadable modules; The functional modules are modules in directories other than the system directory in the client, and the functional modules are determined to be compliant by the detection server.

7. The method according to any one of claims 1 to 6, characterized in that When the essential application in the installation process is detected, basic feature information of the installation file in the installation directory corresponding to the essential application is obtained, including: Detecting the process started in the client through a kernel driver component, and when detecting that the process of the target application is started, comparing the process information of the target application with the executable installation file information or executable upgrade file information corresponding to the essential application; When the process information of the target application is determined to be consistent with the executable installation file information or executable upgrade file information corresponding to the essential application, the target application is determined to be an essential application and the essential application is in the installation process, and basic feature information of the installation file in the installation directory corresponding to the essential application is obtained.

8. The method according to any one of claims 1 to 6, characterized in that When the essential application is detected to be in operation, obtaining dynamic operation information generated by the essential application during the operation includes: Detecting the process started in the client through a kernel driver component, and when detecting that the process of the target application is started, comparing the process information of the target application with the process information of the essential application; When it is determined that the process information of the target application is consistent with the process information of the essential application, it is determined that the target application is an essential application and the essential application is in the running process, and dynamic running information generated by the essential application is obtained.

9. The method according to any one of claims 1 to 6, characterized in that: When the essential application is detected to be in operation, obtaining dynamic operation information generated by the essential application during the operation includes: When a network access request sent by the essential application is detected through the access proxy component, it is determined that the essential application is in the running process, and the dynamic running information generated by the essential application is obtained.

10. A compliance detection device for an essential application, characterized in that: include: A first acquisition unit is used to, when detecting that there is a required application in the process of being installed, acquire basic feature information of an installation file in an installation directory corresponding to the required application, and acquire current version information of the required application; A first processing unit, configured to determine that the installation process of the essential application is compliant when determining that the basic feature information of the installation file is consistent with the baseline feature information associated with the version information; A second acquisition unit is used to acquire dynamic operation information generated by the essential application during the operation process when detecting that there is an essential application in the operation process; A second processing unit is configured to determine that the operation process of the essential application is compliant when it is determined that the dynamic operation information is consistent with the benchmark operation information associated with the version information; The compliance detection unit is used to determine that the essential application is compliant when it is determined that the installation process and the operation process of the essential application are both compliant.

11. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of any one of the methods in claims 1 to 9.

12. A computer-readable storage medium, characterized in that: It includes program codes. When the program product is run on an electronic device, the program codes are used to enable the electronic device to execute the steps of any method described in claims 1 to 9.

Images