Internet of Things terminal application software security system based on sandbox mechanism and communication security protocol

Abstract

The invention relates to an Internet of Things terminal application software security system based on a sandbox mechanism and a communication security protocol. The system comprises an extended sandbox environment and a basic sandbox environment. The basic sandbox environment and the extended sandbox environment are in a resource isolation state; the basic resource authority configured in the basic sandbox environment is higher than the extended resource authority configured in the extended sandbox environment; the extension application program in the extension sandbox environment responds to the to-be-processed request, schedules a first resource for the to-be-processed request in the extension sandbox environment, and sends a resource request to the data center program in the basic sandbox environment; the data center program responds to the resource request to obtain a second resource and transmits the second resource to the extended application program; and the extension application program obtains a second resource transmitted by the data center program, and processes the to-be-processed request through the first resource and the second resource. By adopting the system, the security of application request processing can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an Internet of Things terminal application software security system based on a sandbox mechanism and a communication security protocol. Background Art

[0002] With the development of the Internet of Things, signal transmission between objects can be realized through the Internet of Things. Therefore, as a bridge connecting the physical world and the digital network, the Internet of Things terminal plays a key role in acquiring and transmitting rich data. These terminal devices are widely used in power grids, industry, banking, transportation and other fields, and their stable operation and data security are crucial. Since the application software of the Internet of Things terminal directly involves key links such as data collection, communication transmission and local processing, its security is directly related to the credibility of the entire Internet of Things system. Therefore, comprehensive security protection of the application software of the Internet of Things terminal is a necessary measure to ensure the robust operation of the Internet of Things ecosystem and the privacy security of users.

[0003] At present, the communication between IoT terminals is based on the computer network transmission protocol, that is, one party sends a communication request, and the other party responds to the request based on the communication request. However, due to the diversity of applications in IoT terminals, that is, different applications have different program requirements, and different programs require different security processing environments. Therefore, how to process application requests according to the security requirements of different applications to ensure the security of application request processing is an urgent problem to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide an IoT terminal application software security system based on a sandbox mechanism and communication security protocol that can improve the security of application request processing in response to the above technical problems.

[0005] In a first aspect, an IoT terminal application software security system based on a sandbox mechanism and a communication security protocol includes an extended sandbox environment and a basic sandbox environment; the extended sandbox environment includes an extended application program, and the basic sandbox environment includes a data center program;

[0006] The basic sandbox environment and the extended sandbox environment are in a resource isolation state; the basic resource permissions configured in the basic sandbox environment are higher than the extended resource permissions configured in the extended sandbox environment;

[0007] The extended application program responds to the pending request, schedules a first resource for the pending request in the extended sandbox environment, and sends a resource request to the data center program, the resource request being used to request a second resource for the pending request;

[0008] The data center program obtains the second resource in response to the resource request and transmits the second resource to the extended application program;

[0009] The extended application obtains the second resource transmitted by the data center program, and processes the request to be processed through the first resource and the second resource.

[0010] In one of the embodiments, the data center program specifically encrypts the second resource using a symmetric key, and transmits the encrypted second resource to the extended application;

[0011] The extended application specifically decrypts the encrypted second resource using the symmetric key to obtain the second resource.

[0012] In one embodiment, the extended application generates a symmetric key, encrypts the symmetric key using a target public key, and sends a key interaction request to the data center program; the key interaction request includes the encrypted symmetric key;

[0013] The data center program extracts the encrypted symmetric key from the key interaction request, and uses the target private key to decrypt the encrypted symmetric key to obtain the symmetric key.

[0014] In one embodiment, the data center program sends a digital certificate to the extended application, the digital certificate including a target public key and certificate authority information;

[0015] The extended application extracts the certificate authorization information from the digital certificate and performs information verification on the certificate authorization information; when the certificate authorization information passes the information verification, the target public key is extracted from the digital certificate.

[0016] In one of the embodiments, when the extended application program decrypts the encrypted second resource using the symmetric key and the decryption fails and the second resource is not obtained, an abnormal event notification is fed back to the data center program.

[0017] In one of the embodiments, the resource request includes at least a service type, an object identifier, and an operation type;

[0018] When the data center program is unable to respond to a resource request, it feeds back an exception event notification to the extended application; or, the data center program performs permission verification on any one of the service type, object identifier, and operation type in the resource request, and feeds back an exception event notification to the extended application when the permission verification result indicates that there is no permission.

[0019] In one of the embodiments, the extended application communicates with the data center program via a target protocol version; encryption processing is performed based on an encryption suite in the target cipher suite, and decryption processing is performed based on a decryption suite in the target cipher suite.

[0020] In one embodiment, the extension application sends a handshake message to the data center program; the handshake message includes a protocol version supported by the extension application and a list of cipher suites;

[0021] The data center program extracts the protocol version and the cipher suite list from the handshake message, and determines the target protocol version from the protocol version, and determines the target cipher suite from the cipher suite list;

[0022] The data center program sends a handshake response message including a target protocol version and a target cipher suite to the extended application.

[0023] In one of the embodiments, resources are isolated between the basic sandbox environment and the extended sandbox environment through a network namespace; an interaction interface is provided between the extended sandbox environment and the basic sandbox environment, and the interaction interface is used for resource interaction between the basic sandbox environment and the extended sandbox environment.

[0024] In one embodiment, the basic sandbox environment also includes a basic monitoring program and an uplink communication agent program; the basic monitoring program is configured with a basic monitoring strategy, and the basic monitoring program is used to monitor the basic application program through the basic monitoring strategy; the uplink communication agent program is used to communicate and interact with an external device in the basic sandbox environment;

[0025] The extended sandbox environment also includes an extended monitoring program, in which an extended monitoring policy is configured. The extended monitoring program is used to monitor the extended application program through the extended monitoring policy.

[0026] The above-mentioned IoT terminal application software security system based on sandbox mechanism and communication security protocol specifically includes an extended sandbox environment and a basic sandbox environment, and the basic sandbox environment and the extended sandbox environment are in a resource isolation state. Based on this, the extended application in the extended sandbox environment responds to the pending request, and first schedules the first resource for the pending request in the extended sandbox environment. Since the basic resource authority configured by the basic sandbox environment is higher than the extended resource authority configured by the extended sandbox environment, that is, when the callable resources in the extended sandbox environment are less than the callable resources in the basic sandbox environment, that is, when the first resource cannot process the pending request, it is necessary to combine the callable resources in the basic sandbox environment to jointly process the request, that is, at this time, send a resource request to the data center program in the basic sandbox environment. At this time, the data center program responds to the resource request, obtains the second resource from the callable resources in the basic sandbox environment, and then transmits the second resource to the extended application, so that the extended application processes the pending request through the first resource and the second resource. Through resource isolation between the basic sandbox environment and the extended sandbox environment, the mixed use of resources between different sandbox environments is guaranteed, thereby ensuring the security and stability of the Internet of Things terminal application software security system based on the sandbox mechanism and communication security protocol. Secondly, considering that the resource permissions that need to be called in actual applications are in different sandbox environments, it is necessary to coordinate resource calls in different sandbox environments to ensure the balance of resource interactions between different sandbox environments, and also avoid requests being processed in only one sandbox environment, ensuring the stability of the Internet of Things terminal application software security system based on the sandbox mechanism and communication security protocol. As a result, the security and stability of application request processing under the Internet of Things terminal application software security system based on the sandbox mechanism and communication security protocol can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0028] FIG1 is an application environment diagram of an Internet of Things terminal application software security system based on a sandbox mechanism and a communication security protocol in one embodiment;

[0029] Figure 2 An architectural diagram of the overall architecture of deploying an application software security system in an IoT device in one embodiment;

[0030] Figure 3A schematic diagram of a process of processing an application request in an IoT terminal application software security system based on a sandbox mechanism and a communication security protocol in one embodiment;

[0031] Figure 4 A flowchart of building a sandbox environment in one embodiment;

[0032] Figure 5 It is a schematic diagram of a process of performing resource encryption processing in an Internet of Things terminal application software security system based on a sandbox mechanism and a communication security protocol in one embodiment;

[0033] Figure 6 A schematic diagram of a process for performing symmetric key interaction in an IoT terminal application software security system based on a sandbox mechanism and a communication security protocol in one embodiment;

[0034] Figure 7 A schematic diagram of a process for establishing communication between programs in different sandbox environments in one embodiment;

[0035] Figure 8 A schematic diagram of a process for establishing a communication connection between a data center program and an extended application program in one embodiment;

[0036] Fig. 9 A schematic diagram of a complete process of communication between a data center program and an extended application program and application request processing in one embodiment;

[0037] FIG. 10 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] Before introducing the embodiments of the present application, the technical terms involved are explained first:

[0040] 1. Sandbox.

[0041] Sandbox is a commonly used technical means in the field of computer security, which can isolate and limit the operating environment of applications or codes to prevent malicious software from damaging the system. Its advantages are providing security isolation, capturing malicious behavior, virtualization technology support, monitoring application behavior, and lightweight.

[0042] 2. DLMS / COSEM protocol

[0043] The DLMS / COSEM protocol is a standard protocol for communication between IoT devices. The DLMS / COSEM protocol defines a set of communication protocols and data models for remote management of smart devices, and the DLMS / COSEM protocol allows users to remotely obtain IoT usage data and monitor and manage devices.

[0044] 3. Successors: Transport Layer Security (TLS) and Secure Socket Layer (SSL)

[0045] TLS and SSL are both protocols used to protect network communication security. TLS and SSL provide security features such as encryption, authentication, and data integrity protection, and are used to establish a secure communication channel between the client and the server. TLS is the successor to SSL. TLS is commonly used to protect communications between browsers and servers on the World Wide Web (web), as well as secure communications for other network applications. TLS and SSL play a vital role in protecting data transmission, ensuring the confidentiality and security of communications.

[0046] Based on this, the IoT terminal application software security system based on the sandbox mechanism and the communication security protocol provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers.

[0047] Specifically, the deployment of the IoT terminal application software security system based on the sandbox mechanism and the communication security protocol in the terminal 102 is used as an example for explanation. The IoT terminal application software security system based on the sandbox mechanism and the communication security protocol deployed in the terminal 102 includes an extended sandbox environment and a basic sandbox environment. The aforementioned extended sandbox environment includes an extended application program, and the aforementioned basic sandbox environment includes a data center program; and the basic sandbox environment and the extended sandbox environment are in a resource isolation state; the basic resource permissions configured by the basic sandbox environment are higher than the extended resource permissions configured by the extended sandbox environment. Based on this, the extended application program in the extended sandbox environment responds to the pending request, schedules the first resource for the pending request in the extended sandbox environment, and sends a resource request to the data center program, and the resource request is used to request the second resource for the pending request. The data center program in the basic sandbox environment responds to the resource request to obtain the second resource, and transmits the second resource to the extended application program, thereby the extended application obtains the second resource transmitted by the data center program, and processes the pending request through the first resource and the second resource. In the aforementioned IoT terminal application software security system based on sandbox mechanism and communication security protocol, the resource isolation between the basic sandbox environment and the extended sandbox environment ensures the mixed use of resources between different sandbox environments, thereby ensuring the security and stability of the IoT terminal application software security system based on sandbox mechanism and communication security protocol. Secondly, the resource calls in different sandbox environments are coordinated to ensure the balance of resource interactions between different sandbox environments, and to avoid requests being processed in only one sandbox environment, thereby ensuring the stability of the IoT terminal application software security system based on sandbox mechanism and communication security protocol.

[0048] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server for cloud computing services.

[0049] Based on this, the following is a detailed introduction to the overall architecture of deploying application software security systems in IoT devices. Figure 2, the application software security system is divided into a basic sandbox environment 201 and an extended sandbox environment 202. The applications included in the basic sandbox environment 201 are all basic applications, and the applications included in the extended sandbox environment 202 are all extended applications 203. Based on this, the basic sandbox environment 201 at least includes: an uplink communication agent program 204, a message distribution program 205, a meter reading scheduling management program 205 and a local communication management program 206, an application management program 207 and a data center program 208.

[0050] Among them, the uplink communication agent 204 is a component of the IoT terminal application software, which is responsible for realizing the data transmission function between the IoT terminal and the server. The uplink communication agent 204 covers aspects such as data acquisition, transmission protocol and data security, ensuring reliable communication between the IoT terminal and the server. In the embodiment of the present application, the uplink communication agent 204 specifically communicates with the external device through the DLMS / COSEM protocol, and adds the identity authentication, encryption and other functions provided by the TLS / SSL protocol to further ensure communication security and data transmission security. The aforementioned external devices can be main station servers, monitoring equipment and other terminal devices.

[0051] The message distribution program 205 is also a component of the IoT terminal application software. The message distribution program 205 is mainly responsible for receiving, parsing and distributing the instructions and data messages sent from the central system. The message distribution program 205 involves functions such as message processing, distribution scheduling and task execution, ensuring that the IoT terminal responds to the central system in a timely and effective manner.

[0052] Secondly, the meter reading scheduling management program 205 is mainly used to manage and execute the reading operation of the lower-level data. This component involves the communication protocol, data collection and scheduling functions with the lower-level equipment to ensure the accurate collection and transmission of the Internet of Things data. The local communication management program 206 is used to manage and realize the communication between the Internet of Things terminals. This component covers the data exchange, communication protocol and local task scheduling between the functional modules in the terminal to ensure the collaborative work between the terminals. That is, the meter reading scheduling management program 205 and the local communication management program 206 can both perform secure data collection and interaction with the underlying metering equipment through the DLMS / COSEM protocol.

[0053] The application management program 207 is responsible for managing and controlling various applications running on the terminal. It includes functions such as application installation, update, uninstallation, and permission control to ensure the reasonable operation of the application and the stability of the system. The data center program 208 is used to process and manage data transmitted upstream from the IoT terminal. This component includes functions such as data storage, processing, analysis, and presentation to ensure that the data collected from the terminal is fully utilized in the central system. And when the basic application needs to call resources, an application will be submitted to the data center program 208 during the implementation of this application, and after approval, the data center program 208 will encrypt and transmit the required resources.

[0054] And the present application has the aforementioned basic application and extended application 203, then the secure communication and identity confirmation between the basic applications, between the basic applications and the extended application 203, and between the extended application 203 and the extended application 203 are all carried out through the TLS / SSL protocol. The aforementioned extended application 203 is an application designed to provide additional services, enhance user experience or meet specific needs in the terminal in addition to the above-mentioned basic application. The extended application 203 generally has more advanced functions, and the external environment and external devices communicate more closely. Compared with the basic application, the extended application 203 has a higher security risk. Therefore, the present application configures and deploys different sandbox environments for the basic application and the extended application 203 respectively to ensure system security.

[0055] The basic application is subject to a certain degree of permission restriction and behavior monitoring through the sandbox system (i.e., the basic sandbox environment in the embodiment of the present application) in the built-in terminal system (such as the Linux system), and after permission is granted, the data center program 208 and the message distribution program 205 schedule system resources.

[0056] The extended application 203 is subjected to permission restriction, behavior monitoring and application isolation by another sandbox system (i.e., the extended sandbox environment in the embodiment of the present application) in the built-in terminal system (such as the Linux system). The extended application 203 needs to schedule system resources through the data center program 208 after identity confirmation and permission. Compared with the basic sandbox environment, the extended sandbox environment has a higher level of permission restriction on the application software therein and stricter behavior monitoring, that is, it prevents the threat of hijacking of other vulnerable applications.

[0057] In the basic sandbox environment and the extended sandbox environment, the basic application and the extended application use the secure communication channel provided by the TLS / SSL protocol to achieve data transmission and resource interaction between software through identity authentication, data encryption, and key exchange.

[0058] It can be seen that in the embodiment of the present application, the TLS / SSL protocol is used to ensure the security of communication between applications installed on the same IoT terminal, especially the security of the communication process between different applications in different sandbox environments. By providing encryption, identity authentication and data integrity protection, the TLS / SSL protocol critically ensures the confidentiality of sensitive information, effectively prevents malicious attacks, and maintains the reliability and security of communications. The applied TLS / SSL protocol provides handshake protocols, record protocols, key exchange, digital certificates, certificate verification, encryption algorithms and other parts to ensure communication security. Therefore, the following is a detailed introduction to the IoT terminal application software security system based on the sandbox mechanism and communication security protocol deployed in the terminal 102 as an example:

[0059] In an exemplary embodiment, Figure 3 As shown, an Internet of Things terminal application software security system based on a sandbox mechanism and a communication security protocol is provided. Taking the Internet of Things terminal application software security system based on the sandbox mechanism and the communication security protocol deployed on the terminal 102 in Figure 1 as an example for explanation, the Internet of Things terminal application software security system based on the sandbox mechanism and the communication security protocol includes an extended sandbox environment and a basic sandbox environment. The extended sandbox environment includes an extended application program, and the basic sandbox environment includes a data center program; the basic sandbox environment and the extended sandbox environment are in a resource isolation state; the basic resource permissions configured by the basic sandbox environment are higher than the extended resource permissions configured by the extended sandbox environment.

[0060] Among them: the extended sandbox environment is a sandbox environment for running extended applications, so the extended sandbox environment includes extended applications. Similarly, the basic sandbox environment is a sandbox environment for running basic applications, and the basic application can specifically be any one of the uplink communication agent program, message distribution program, meter reading scheduling management program, local communication management program, application management program, and data center program introduced in the above embodiments.

[0061] Secondly, the basic sandbox environment and the extended sandbox environment are in a resource isolation state, and the basic resource permissions configured in the basic sandbox environment are higher than the extended resource permissions configured in the extended sandbox environment. That is, the basic application in the basic sandbox environment can call more resources, while the extended application in the extended sandbox environment can call fewer resources. Therefore, the specific configuration of permissions and resource restrictions for the basic sandbox environment is: using cgroups to limit the central processing unit (CPU) and memory resources, the resource permissions configured for the basic application in the basic sandbox environment can be freely allocated based on actual needs, and the basic application can generally call more resources, that is, the basic resource permissions configured for the basic application can meet the program function usage of the basic application. For example, configure basic resource permissions for the basic sandbox environment: resource reading and writing, playing network access, etc.

[0062] Similarly, it is also necessary to create an extended sandbox environment for the extended application, which is similar to the previous steps. At this time, it is necessary to use cgroups to configure more stringent resource restrictions. There are more restrictions on extended applications in the extended sandbox environment, that is, the resources that extended applications can call are generally fewer, and only after permission can they communicate with the data center program in the basic sandbox environment through the interface, thereby scheduling more related resources from the resources configured in the basic sandbox environment.

[0063] The following is a detailed description of the process of application request processing in the IoT terminal application software security system based on the sandbox mechanism and communication security protocol:

[0064] Step 302 , the extended application responds to the pending request, schedules a first resource for the pending request in the extended sandbox environment, and sends a resource request to the data center program, where the resource request is used to request a second resource for the pending request.

[0065] The pending request is a request initiated by the target object for the extended application. For example, if the extended application is a video playback application, the pending request can be a video playback request or a video download request. As described above, the extended sandbox environment is a sandbox environment for running the extended application, that is, the extended application belongs to the extended sandbox environment.

[0066] And because the basic resource permissions configured in the basic sandbox environment are higher than the extended resource permissions configured in the extended sandbox environment, that is, the resources that the extended application can call are generally fewer, and only after being allowed can it communicate with the data center program in the basic sandbox environment through the interface. Therefore, the resources required to process the pending request include the first resource that can be called in the extended sandbox environment, and the second resource that can be called in the basic sandbox environment. Therefore, the resource request is used to request the second resource for the pending request.

[0067] Specifically, if the target object needs to make a corresponding function request for the extended application, it can select the required function through the function selection operation and generate a pending request for the extended application. At this time, the extended application belonging to the extended sandbox environment responds to the pending request and determines the first resource that can be called in the extended sandbox environment through the extended resource permissions configured for the extended sandbox environment.

[0068] However, in the case where the resources required for processing the pending request also include a second resource that can be called only in the basic sandbox environment, it is necessary to communicate with the data center program in the basic sandbox environment to obtain the second resource that can be called in the basic sandbox environment. At this time, the extended application responds to the pending request and sends a resource request to the data center program to request the second resource for the pending request from the data center program.

[0069] From the foregoing introduction, it can be seen that since the basic sandbox environment and the extended sandbox environment are in a resource isolation state, the following will introduce how to ensure resource isolation between different sandbox environments: In an exemplary specific embodiment, resources are isolated between the basic sandbox environment and the extended sandbox environment through a network namespace; an interaction interface is set between the extended sandbox environment and the basic sandbox environment, and the interaction interface is used for resource interaction between the basic sandbox environment and the extended sandbox environment.

[0070] When creating a basic sandbox environment, an independent process isolation environment is created through the Proportion Integral Differential Namespace (PID Namespace), an independent network isolation environment is created through the Network Namespace, an independent user isolation environment is created through the User Namespace, and an independent file system isolation environment is created through the Mount Namespace. That is, the basic sandbox environment and the extended sandbox environment are specifically isolated through the network namespace for resource isolation (i.e., network isolation).

[0071] Based on this, there is resource isolation between the basic sandbox environment and the extended sandbox environment. So how to request resources from the extended sandbox environment to the basic sandbox environment? At this time, an interactive interface needs to be set up between the extended sandbox environment and the basic sandbox environment. The aforementioned interactive interface is used for resource interaction between the basic sandbox environment and the extended sandbox environment.

[0072] That is, in order to ensure the isolation between different sandbox environments, this application specifically uses network namespaces to achieve isolation between different sandboxes. At this time, a preset number of interactive interfaces need to be reserved so that different sandbox environments can call the system resources opened in the basic sandbox environment through the interactive interface. The aforementioned interactive interface can be the data center program exemplified in this embodiment, or it can be other interface programs for resource interaction, which should not be understood as a limitation of this application.

[0073] Step 304: The data center program obtains the second resource in response to the resource request, and transmits the second resource to the extended application.

[0074] Specifically, since the resource request is used to request a second resource for the pending request, the data center program responds to the resource request for requesting the second resource, queries and calls in the basic sandbox environment to obtain the second resource, and then transmits the second resource to the extended application.

[0075] It is understandable that in actual applications, considering the security of request responses and the reliability of resource calls, the data center program can first perform permission verification on the resource request before responding to the resource request to determine whether the aforementioned resource request can be responded to. This is introduced below:

[0076] In an exemplary optional embodiment, the resource request includes at least a service type, an object identifier, and an operation type.

[0077] Among them, the service type is used to characterize the request type corresponding to the pending request. For example, if the pending request is a video playback request, the service type is the video playback type. And if the pending request is a video download request, then the service type is the video download type. The object identifier is used to uniquely identify the target object, and the target object can carry the object type, such as normal objects and abnormal objects. The operation type is similar to the service type, and it also needs to correspond to the functional operation required to be called based on the pending request, which will not be repeated here.

[0078] For example, if the target object is a smart meter and the target object initiates a request for reading electric energy metering data, then the request for reading electric energy metering data is a pending request, the request type is reading electric energy metering data, and the operation type is reading "Get". At this time, the object identifier "0.1.1.8.0.255" may also be included to represent the total active electric energy.

[0079] Based on this, when the data center program is unable to respond to a resource request, it will feedback an exception event notification to the extended application; or, the data center program will perform permission verification on any of the service type, object identifier, and operation type in the resource request, and when the permission verification result indicates that there is no permission, it will feedback an exception event notification to the extended application.

[0080] Specifically, when the data center program cannot respond to the resource request, that is, when the data center program may have program problems such as program crash, the data center program will feedback an abnormal event notification (Event_Notification) to the extended application to indicate through the abnormal event notification that the extended application cannot respond to the resource request, that is, it cannot feedback the second resource.

[0081] Alternatively, the data center program performs permission verification on any one of the service type, object identifier, and operation type in the resource request. When the permission verification result indicates that there is no permission, an abnormal event notification is fed back to the extended application to indicate through the abnormal event notification that the extended application cannot respond to the resource request, that is, it cannot feed back the second resource.

[0082] The aforementioned permission verification for service types is specifically to verify whether the service type is a compliant service type, or whether it is a service type that can be serviced by the extended application, to avoid service responses to abnormal service types, and to avoid service responses that exceed the permission. At this time, the permission verification result indicates that the situation of no permission is an abnormal service type, or the extended application cannot provide the aforementioned service.

[0083] Similarly, the permission verification for the object identifier is specifically: verify whether the object identifier belongs to a serviceable object to avoid service response to abnormal objects. At this time, the permission verification result indicates that the situation of no permission is an object type exception. And the permission verification for the operation type is specifically: verify whether the operation type belongs to the operable type of the extended application. At this time, the permission verification result indicates that the operation type does not belong to the operable type of the extended application. For example, the download operation cannot be performed on the extended application, but the operation type is download, and the permission verification cannot be passed at this time.

[0084] In order to ensure systematic communication connections with external devices and behavior detection within the system, the system should also include a communication program for communicating with external devices, and a monitoring program for monitoring the internal behavior of the system. This is introduced in detail below: In an exemplary optional embodiment, the basic sandbox environment also includes a basic monitoring program and an uplink communication agent program; the basic monitoring program is configured with a basic monitoring strategy, and the basic monitoring program is used to monitor the basic application program through the basic monitoring strategy; the uplink communication agent program is used to communicate and interact with external devices in the basic sandbox environment.

[0085] Among them, the basic monitoring program is configured with a basic monitoring strategy, and the basic monitoring program is used to monitor the basic application through the basic monitoring strategy, that is, to monitor the program call behavior of the basic application. Specifically, a behavior monitoring tool is installed in the basic sandbox environment, such as: APPArmor or SELinux, and the aforementioned behavior monitoring tool is the basic monitoring program. When the abnormal behavior of the basic application in the basic sandbox environment is detected by the basic monitoring program, the abnormal behavior of the basic application is restricted by the basic monitoring program, and the abnormal behavior of the basic application is reported to ensure the program behavior security of the basic monitoring program.

[0086] Secondly, the uplink communication agent is used to communicate and interact with external devices in the basic sandbox environment. That is, as described in the aforementioned embodiment, the uplink communication agent is responsible for realizing the data transmission function between the IoT terminal and the server, and covers aspects such as data collection, transmission protocol and data security, to ensure reliable communication between the IoT terminal and the server. In the embodiment of the present application, the uplink communication agent specifically communicates with external devices through the DLMS / COSEM protocol, and adds the identity authentication, encryption and other functions provided by the TLS / SSL protocol to further ensure communication security and data transmission security. The aforementioned external devices can be master station servers, monitoring equipment and other terminal devices.

[0087] Similarly, the extended sandbox environment also includes an extended monitoring program, in which an extended monitoring policy is configured. The extended monitoring program is used to monitor the extended application program through the extended monitoring policy.

[0088] Among them, the extended monitoring program is configured with an extended monitoring policy, and the extended monitoring program is used to monitor the extended application through the extended monitoring policy, that is, to monitor the program call behavior of the extended application. Specifically, a behavior monitoring tool is installed in the extended sandbox environment, such as: APPArmor or SELinux, and the aforementioned behavior monitoring tool is the extended monitoring program. When the abnormal behavior of the extended application in the extended sandbox environment is detected by the extended monitoring program, the abnormal behavior of the extended application is limited by the extended monitoring program, and the abnormal behavior of the extended application is reported to ensure the program behavior security of the extended monitoring program.

[0089] Step 306 , the extended application obtains the second resource transmitted by the data center program, and processes the request to be processed through the first resource and the second resource.

[0090] Specifically, since the resources required to process the pending request also include a second resource that can be called only in the basic sandbox environment, the extended application obtains the second resource transmitted by the data center program, and processes the pending request through the first resource scheduled in the extended sandbox environment and the second resource obtained through communication interaction with the basic sandbox environment, thereby completing the application request processing for the pending request.

[0091] In the above-mentioned IoT terminal application software security system based on sandbox mechanism and communication security protocol, the extended application in the extended sandbox environment responds to the pending request, and first schedules the first resource for the pending request in the extended sandbox environment. Since the basic resource authority configured by the basic sandbox environment is higher than the extended resource authority configured by the extended sandbox environment, that is, when the callable resources in the extended sandbox environment are less than the callable resources in the basic sandbox environment, that is, when the first resource cannot process the pending request, it is necessary to combine the callable resources in the basic sandbox environment to jointly process the request, that is, at this time, send a resource request to the data center program in the basic sandbox environment. At this time, the data center program responds to the resource request, obtains the second resource from the callable resources in the basic sandbox environment, and then transmits the second resource to the extended application, so that the extended application processes the pending request through the first resource and the second resource. Through the resource isolation between the basic sandbox environment and the extended sandbox environment, the mixed use of resources between different sandbox environments is guaranteed, thereby ensuring the security and stability of the IoT terminal application software security system based on the sandbox mechanism and communication security protocol. Secondly, considering that the resource permissions that need to be called in actual applications are in different sandbox environments, it is necessary to coordinate resource calls in different sandbox environments to ensure the balance of resource interactions between different sandbox environments, and avoid processing requests in only one sandbox environment to ensure the stability of the IoT terminal application software security system based on the sandbox mechanism and communication security protocol. In this way, the security and stability of application request processing under the IoT terminal application software security system based on the sandbox mechanism and communication security protocol can be improved.

[0092] The following is a detailed introduction to the construction of different sandbox environments in combination with the above embodiments. Figure 4 The sandbox environment construction flow chart shown:

[0093] Step 401, create a basic sandbox environment: that is, as described in the previous embodiment, create an independent process isolation environment through PID Namespace, create an independent network isolation environment through Network Namespace, create an independent user isolation environment through UserNamespace, and create an independent file system isolation environment through Mount Namespace.

[0094] Step 402, configure permissions and resource restrictions for the basic sandbox environment: Use cgroups to limit CPU and memory resources. In the basic sandbox environment, the resource permissions configured for the basic application can be freely allocated based on actual needs. The basic application can generally call more resources, that is, the basic resource permissions configured for the basic application can meet the program function usage of the basic application. For example, configure basic resource permissions for the basic sandbox environment: resource reading and writing, playing network access, etc.

[0095] Step 403, creating an extended sandbox environment for the extended application: It is necessary to use cgroups to configure more stringent resource restrictions. There are more restrictions on the extended application in the extended sandbox environment, that is, the resources that the extended application can call are generally fewer, and only after permission can it communicate with the data center program in the basic sandbox environment through the interface, thereby scheduling more related resources from the resources configured in the basic sandbox environment.

[0096] Step 404, behavior monitoring: Install a behavior monitoring tool in the basic sandbox environment, such as APPArmor or SELinux. The aforementioned behavior monitoring tool is the basic monitoring program. When the basic monitoring program detects abnormal behavior of the basic application in the basic sandbox environment, the basic monitoring program limits the abnormal behavior of the basic application and reports the abnormal behavior of the basic application to ensure the program behavior security of the basic monitoring program. A similar method is used for behavior monitoring in the extended sandbox environment, which will not be repeated here.

[0097] Step 405, network isolation: The basic sandbox environment and the extended sandbox environment are specifically isolated from each other through a network namespace (ie, network isolation). An interaction interface is provided between the extended sandbox environment and the basic sandbox environment, and the interaction interface is used for resource interaction between the basic sandbox environment and the extended sandbox environment.

[0098] It can be seen from the above embodiments that since resources need to be interacted in different sandbox environments, in order to ensure the security of resource interaction between different sandbox environments, the interacted resources need to be encrypted. The following is an introduction to resource encryption methods:

[0099] In an exemplary embodiment, Figure 5 As shown, step 304 specifically includes step 502, and step 306 specifically includes step 504. Among them:

[0100] Step 502: The data center program obtains a second resource in response to the resource request, encrypts the second resource using a symmetric key, and transmits the encrypted second resource to the extended application.

[0101] The symmetric key is a key preset when the data center program and the extended application establish a communication connection. Specifically, the data center program responds to the resource request for requesting the second resource and queries and calls in the basic sandbox environment to obtain the second resource. At this time, the data center program encrypts the second resource using the symmetric key and transmits the encrypted second resource to the extended application.

[0102] Step 504, the extended application obtains the encrypted second resource transmitted by the data center program, decrypts the encrypted second resource using the symmetric key to obtain the second resource; and processes the request to be processed using the first resource and the second resource.

[0103] Specifically, since the resources required for processing the pending request also include a second resource that can be called only in the basic sandbox environment, the extended application obtains the encrypted second resource transmitted by the data center program, and since the symmetric key is a key preset when the data center program and the extended application establish a communication connection, the extended application decrypts the encrypted second resource through the symmetric key to obtain the second resource, and then processes the pending request through the first resource and the second resource, thereby completing the application request processing for the pending request.

[0104] In actual applications, there may be problems with the symmetric key determined when the data center program and the extended application establish a communication connection. That is, the symmetric key may be tampered with or data may be lost during the transmission of the symmetric key sent by the extended application to the data center program. In other words, the decryption process fails. The following is a detailed description of this situation:

[0105] In an exemplary optional embodiment, when the extended application performs decryption processing on the encrypted second resource using the symmetric key and the decryption processing fails and the second resource is not obtained, an abnormal event notification is fed back to the data center program.

[0106] Specifically, the extended application obtains the encrypted second resource transmitted by the data center program. In the process of decrypting the encrypted second resource using the symmetric key, if the decryption fails and the second resource is not obtained, it means that there is a problem with the symmetric key. At this time, the extended application feeds back an abnormal event notification to the data center program, so that the extended application determines that the transmission of the second resource has failed. Based on this, the communication connection between the extended application and the data center program can be re-established, and the symmetric key can be re-generated to ensure the reliability of resource transmission.

[0107] In this embodiment, the second resource is encrypted by a symmetric key, and the encrypted second resource is decrypted to ensure that in the process of resource interaction in different sandbox environments, the interacted resources are not tampered with or abnormal operations are performed, further ensuring the security of resource interaction between different sandbox environments, so as to improve the stability of the Internet of Things terminal application software security system based on the sandbox mechanism and the communication security protocol, thereby improving the security and stability of application request processing under the Internet of Things terminal application software security system based on the sandbox mechanism and the communication security protocol.

[0108] Since the interacted resources need to be encrypted by symmetric keys, that is, the symmetric keys also need to be transmitted between different sandbox environments, that is, considering the security of symmetric key transmission, the symmetric keys also need to be encrypted. The following introduces the way to encrypt symmetric keys:

[0109] In an exemplary embodiment, Figure 6 As shown, the application request processing in the IoT terminal application software security system based on the sandbox mechanism and the communication security protocol also includes steps 602 to 608. Among them:

[0110] Step 602: The data center program sends a digital certificate to the extended application program, where the digital certificate includes a target public key and certificate authority information.

[0111] Among them, a digital certificate refers to a digital certification that marks the identity information of the communicating parties in Internet communications, so a digital certificate is also called a digital identification. A digital certificate ensures the integrity and security of information and data of network users in the form of encryption or decryption. That is, the digital certificate in the embodiment of the present application is a digital certification used to mark a data center program. Secondly, the digital certificate includes a target public key and certificate authorization information. The aforementioned target public key is the public key of the data center program, and the certificate authorization information is the signature of the Certificate Authority (CA) of the certificate authority for the data center program.

[0112] Specifically, the data center program sends a digital certificate including a target public key and certificate authority information to the extended application program. Exemplarily, the data center program provides an X.509 digital certificate to the extended application program.

[0113] Step 604: The extended application extracts the certificate authorization information from the digital certificate and performs information verification on the certificate authorization information; if the certificate authorization information passes the information verification, the target public key is extracted from the digital certificate.

[0114] Specifically, the extended application extracts the certificate authorization information from the digital certificate and performs information verification on the certificate authorization information. The information verification is specifically used to verify the legitimacy of the information, that is, the extended application verifies the legitimacy of the certificate authorization information and checks whether the CA signature is legal. Based on this, if the certificate authorization information passes the information verification, that is, if the certificate authorization information passes the legitimacy verification (that is, the CA signature is legal), the target public key is extracted from the digital certificate.

[0115] The above steps introduce the steps of exchanging the target public key between the extended application and the data center program. The target public key is specifically used to encrypt the symmetric key when the symmetric key is exchanged between the extended application and the data center program. This is introduced in detail below.

[0116] Step 606, the extended application generates a symmetric key, encrypts the symmetric key using the target public key, and sends a key interaction request to the data center program; the key interaction request includes the encrypted symmetric key.

[0117] Among them, the symmetric key is randomly generated by the extended application, and the key interaction request is specifically a ClientKey Exchange message. Specifically, the extended application generates a randomly obtained symmetric key, and encrypts the symmetric key with the target public key obtained by the aforementioned interaction to obtain an encrypted symmetric key. Then, a key interaction request including the encrypted symmetric key is sent to the data center program.

[0118] Step 608: The data center program extracts the encrypted symmetric key from the key exchange request, and uses the target private key to decrypt the encrypted symmetric key to obtain the symmetric key.

[0119] Specifically, the data center program receives the key interaction request sent by the extended application, extracts the encrypted symmetric key from the key interaction request, and then uses the target private key to decrypt the encrypted symmetric key to obtain the symmetric key.

[0120] In this embodiment, since the symmetric key also needs to be transmitted between different sandbox environments, the transmitted symmetric key is encrypted by the target key between the data center program and the extended application, thereby ensuring the reliability and security of the transmitted symmetric key. Then, when the data center program needs to feedback the required resources to the extended application, the resources can be encrypted by the symmetric key, thereby ensuring the reliability and security of resource transmission, thereby improving the security and stability of application request processing.

[0121] In an exemplary embodiment, Figure 7 As shown, the application request processing in the IoT terminal application software security system based on the sandbox mechanism and the communication security protocol also includes steps 702 to 706. Among them: the extended application and the data center program communicate through the target protocol version; the encryption processing is based on the encryption suite in the target cryptographic suite, and the decryption processing is based on the decryption suite in the target cryptographic suite.

[0122] The target protocol version is a protocol version used to enable the extended application to communicate with the data center program, for example, the target protocol version is protocol version number v2.0. The target cipher suite is specifically an algorithm used for encryption and decryption processing, for example, the target cipher suite is Advanced Encryption Standard (AES)-128.

[0123] Based on this, it is necessary to create a communication interaction between the data center program and the extended application to determine the protocol version for communication between the data center program and the extended application, as well as the specific encryption suite for encryption during resource transmission. This is described in detail below:

[0124] Step 702: The extended application sends a handshake message to the data center program; the handshake message includes the protocol version supported by the extended application and a cipher suite list.

[0125] The supported protocol version may be a single protocol version, such as protocol version v2.0, or multiple protocol versions, such as protocol version v2.0 and protocol version v3.0. Similarly, the cipher suite list may include a single cipher suite, such as only AES-128, or multiple cipher suites, such as Triple Data Encryption Standard (3DES) and AES-128.

[0126] Specifically, the extended application first determines the protocol version supported by the extended application, and forms a cipher suite list through the supported cipher suites. Then the extended application generates a handshake message (Client Hello message) based on the supported protocol version and the cipher suite list, and sends the handshake message to the data center program. The handshake message is used to interact with the data center program to determine the protocol and encryption method for network interactive communication.

[0127] In step 704, the data center program extracts the protocol version and the cipher suite list from the handshake message, and determines the target protocol version from the protocol version, and determines the target cipher suite from the cipher suite list.

[0128] Specifically, the data center program receives the handshake message sent by the extended application, extracts the protocol version and the cipher suite list from the handshake message, and then determines the target protocol version from the protocol version and the target cipher suite from the cipher suite list based on the communication requirements. For example, the target protocol version is the protocol version number v2.0, and the target cipher suite is AES-128.

[0129] Step 706: The data center program sends a handshake response message including a target protocol version and a target cipher suite to the extended application.

[0130] Specifically, the data center program generates a handshake response message (Server Hello message) including the target protocol version and the target cipher suite through the determined target protocol version and the target cipher suite, and sends the handshake response message to the extended application, so that the extended application and the data center program communicate through the target protocol version. The data center program encrypts the second resource based on the encryption suite in the target cipher suite through the symmetric key, and the extended application decrypts the encrypted second resource based on the decryption suite in the target cipher suite through the symmetric key.

[0131] And in actual applications, after the data center program and the extended application complete the required communication interaction, the extended application can actively or the target object can select to terminate the connection with the data center program to release communication interaction resources. The above steps are achieved by the extended application sending a termination message to the data center program, or the data center program closing the data connection with the data center program.

[0132] In this embodiment, the target protocol version for communication can be determined through handshake messages and handshake response messages to ensure the reliability of communication interactions between different programs in different sandbox environments, and the cryptographic suite for encryption processing can be determined to ensure the security of encryption processing, thereby improving the security of application request processing.

[0133] In conjunction with the above-mentioned embodiments, the process of establishing a communication connection between the data center program and the extended application program is described in detail below. Figure 8 The flow chart for establishing a communication connection between the data center program and the extended application is shown:

[0134] Step 801, initializing the connection. At the beginning of the communication, the data center program establishes a connection with the extended application program. Exemplarily, the communication can be performed through a serial port (RS-485).

[0135] Step 802, initialize the session. The data center program and the extended application establish a session by exchanging initialization messages. That is, the extended application sends a handshake message including the protocol version supported by the extended application and a list of cipher suites to the data center program, and the data center program sends a handshake response message including the target protocol version and the target cipher suite to the extended application, ensuring that the data center program and the extended application can comply with the same communication specifications. Exemplarily, the extended application sends the protocol version number v2.0 and supports the encryption algorithm AES-128.

[0136] Step 803: Identity authentication. After completing the initialization session, identity authentication is required. This can be achieved through mechanisms such as key exchange or certificate verification. For example, the data center program is confirmed through the Authenticate_Request identity authentication request and the Meter-001 device identifier.

[0137] Step 804, request and response. The extended application initiates a request to the data center program (i.e., the resource request in the aforementioned embodiment) to request a specific data service or data resource from the data center program, and the resource request contains at least the requested service type, object identifier, and operation type. After receiving the resource request, the data center program performs corresponding processing and returns a response. Exemplarily, the electric energy meter initiates a request Get_Request to read the electric energy metering data, including the object identifier 0.1.1.8.0.255 indicating the total active electric energy, and the operation type Get.

[0138] Step 805: Event notification. When the permission verification fails or a request processing exception occurs, the data center program may send an event notification to the extended application. For example, an abnormal event Event_Notification occurs.

[0139] Step 806: Error handling. During the communication process, both the extended application and the data center program need to handle possible errors, including detecting and correcting errors, to ensure the stability and reliability of communication. Exemplarily, the server sends an error response message Error_Response, including an error code Object_Unknown and detailed error information.

[0140] Step 807: Data transmission: Based on the request and response, actual resource transmission is performed, which may include operations such as reading or writing device parameters and obtaining electric energy metering data.

[0141] Step 808: Terminate the connection. After the data center program and the extended application complete the required communication interaction, the data center program and the extended application may choose to terminate the connection and release resources. Specifically, the extended application sends a termination message to the data center program, or the data center program closes the data connection with the data center program.

[0142] It can be seen from the above embodiments that the TLS / SSL protocol ensures the security of communication between IoT terminal application software and communication between different applications in different sandboxes in the same terminal device. By providing encryption, identity authentication and data integrity protection, the TLS / SSL protocol can critically ensure the confidentiality of sensitive information, effectively prevent malicious attacks, and maintain the reliability and security of communications. The applied TLS / SSL protocol provides handshake protocols, record protocols, key exchange, digital certificates, certificate verification, encryption algorithms and other parts to ensure communication security. In order to facilitate understanding of the specific application methods of different applications between different sandboxes in actual applications.

[0143] For example, Fig. 9 As shown in the figure, the data center program and the extended application implement the communication process under the TLS / SSL protocol as follows:

[0144] Step 901, handshake protocol phase. In the handshake protocol phase, the extension application sends a Client Hello message, which includes the protocol version supported by the extension application and a list of cipher suites. The data center program selects a target protocol version and a target cipher suite, and replies with a Server Hello message including the target protocol version and the target cipher suite. For example, the TLS / SSL protocol version number sent by the extension application is TLS 1.2, and the cipher suite list is TLS_RSA_WITH_AES_128_CBC_SHA256.

[0145] Step 902: Identity verification. The data center program provides a digital certificate, which contains the data center program including the target public key and certificate authorization information. Exemplarily, the data center program can provide an X.509 digital certificate. The extended application then verifies the certificate authorization information, and extracts the target public key from the digital certificate if the certificate authorization information passes the information verification.

[0146] Step 903: Symmetric key exchange. The extended application generates a symmetric key, encrypts the symmetric key using the target public key, and sends a Client Key Exchange message to the data center program. The data center program uses the target private key to decrypt the encrypted symmetric key to obtain the symmetric key.

[0147] Step 904: Establish an encrypted channel. The data center program and the extended application use the negotiated symmetric key to encrypt and decrypt the resources that need to communicate in the actual application. The encryption and decryption of the ciphertext data are specifically encrypted and protected by the encryption algorithm indicated by the negotiated target cipher suite. Exemplarily, both parties use the AES-128 encryption algorithm for encryption and decryption.

[0148] Step 905: Encrypted transmission: The extended application and the data center program transmit the encrypted resources.

[0149] Step 906: The communication connection is terminated. After the communication ends, the data center program and the extended application program may choose to close the communication connection, specifically by sending a Close Notify notification message to close the communication connection.

[0150] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0151] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG10. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, a near field communication (NFC) or other technologies. When the computer program is executed by the processor, an Internet of Things terminal application software security system based on a sandbox mechanism and a communication security protocol is implemented. The display unit of the computer device is used to form a visually visible picture, and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball, or touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse, etc.

[0152] Those skilled in the art will understand that the structure shown in FIG. 10 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0153] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0154] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0155] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0156] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An IoT terminal application software security system based on sandbox mechanism and communication security protocol, characterized in that: The IoT terminal application software security system based on the sandbox mechanism and the communication security protocol includes an extended sandbox environment and a basic sandbox environment; the extended sandbox environment includes an extended application program, and the basic sandbox environment includes a data center program; The basic sandbox environment and the extended sandbox environment are in a resource isolation state; the basic resource permissions configured in the basic sandbox environment are higher than the extended resource permissions configured in the extended sandbox environment; The extended application program responds to the pending request, schedules a first resource for the pending request in the extended sandbox environment, and sends a resource request to the data center program, the resource request being used to request a second resource for the pending request; The data center program obtains the second resource in response to the resource request, and transmits the second resource to the extended application; The extended application obtains the second resource transmitted by the data center program, and processes the pending request through the first resource and the second resource.

2. The system according to claim 1, characterized in that The data center program specifically encrypts the second resource using a symmetric key, and transmits the encrypted second resource to the extended application; The extended application specifically decrypts the encrypted second resource using the symmetric key to obtain the second resource.

3. The system according to claim 2, characterized in that The extended application generates a symmetric key, encrypts the symmetric key using a target public key, and sends a key interaction request to the data center program; the key interaction request includes the encrypted symmetric key; The data center program extracts the encrypted symmetric key from the key interaction request, and uses the target private key to decrypt the encrypted symmetric key to obtain the symmetric key.

4. The system according to claim 3, characterized in that The data center program sends a digital certificate to the extended application, wherein the digital certificate includes the target public key and certificate authority information; The extended application extracts the certificate authorization information from the digital certificate and performs information verification on the certificate authorization information; In a case where the certificate authorization information passes the information verification, the target public key is extracted from the digital certificate.

5. The system according to claim 2, characterized in that When the extended application program decrypts the encrypted second resource using the symmetric key and the decryption fails and the second resource is not obtained, the extended application program feeds back an abnormal event notification to the data center program.

6. The system according to claim 1, characterized in that The resource request includes at least a service type, an object identifier, and an operation type; When the data center program is unable to respond to the resource request, the data center program feeds back an abnormal event notification to the extended application program; Alternatively, the data center program performs permission verification on any one of the service type, the object identifier, and the operation type in the resource request, and when the permission verification result indicates that there is no permission, an abnormal event notification is fed back to the extended application.

7. The system according to any one of claims 2 to 6, characterized in that: The extended application communicates with the data center program via a target protocol version; encryption processing is performed based on an encryption suite in a target cipher suite, and decryption processing is performed based on a decryption suite in a target cipher suite.

8. The system according to claim 7, characterized in that The extended application sends a handshake message to the data center program; the handshake message includes a protocol version supported by the extended application and a list of cipher suites; The data center program extracts the protocol version and the cipher suite list from the handshake message, and determines the target protocol version from the protocol version, and determines the target cipher suite from the cipher suite list; The data center program sends a handshake response message including the target protocol version and the target cipher suite to the extended application.

9. The system according to any one of claims 1 to 6, characterized in that: The basic sandbox environment and the extended sandbox environment are isolated from each other through a network namespace. An interaction interface is provided between the extended sandbox environment and the basic sandbox environment, and the interaction interface is used for resource interaction between the basic sandbox environment and the extended sandbox environment.

10. The system according to any one of claims 1 to 6, characterized in that: The basic sandbox environment also includes a basic monitoring program and an uplink communication agent program; The basic monitoring program is configured with a basic monitoring strategy, and the basic monitoring program is used to monitor the basic application program through the basic monitoring strategy; the uplink communication agent program is used to communicate and interact with external devices in the basic sandbox environment; The extended sandbox environment also includes an extended monitoring program, in which an extended monitoring policy is configured. The extended monitoring program is used to monitor the extended application program through the extended monitoring policy.

Images