Application behavior management method, terminal equipment and storage medium

Abstract

The embodiment of the invention provides an application behavior management method, terminal equipment and a storage medium, and the method comprises the steps that an application management platform receives a resource access request of a first application, and the resource access request is used for requesting to access a first resource; under the condition that the first application has the access permission of the first resource, the application management platform transmits the identifier of the first application and the resource access request to a resource providing module corresponding to the first resource; a resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to a security management module; the security management module identifies a resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application. According to the embodiment of the invention, the resource access behavior of the application can be managed and controlled.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to an application behavior management method, a terminal device, and a storage medium. Background Art

[0002] At present, there are three application (APP) development modes on mobile phones, tablet computers and other terminal devices, namely native APP, web application (WEB APP) and hybrid APP. Among them, WEB APP can be used without installation, and is mainly interpreted and executed in the JS engine on the mobile phone in the form of javascript (JS) code, such as quick applications launched by mobile phone manufacturers and mini programs launched by WeChat.

[0003] When a WEB APP is running, the security mechanisms such as the mobile phone manager detect the application management platform rather than the WEB APP. It is unable to distinguish the access of different WEB APPs to mobile phone resources, and therefore is unable to control the resource access behavior of the WEB APP. Summary of the invention

[0004] The embodiments of the present application provide an application behavior management method, a terminal device, and a storage medium, which can control the resource access behavior of an application.

[0005] A first aspect of an embodiment of the present application provides an application behavior management method, the method being applied to a terminal device, the terminal device comprising an application management platform, a security management module, and a resource provision module, the method comprising:

[0006] The application management platform receives a resource access request from a first application, where the resource access request is used to request access to a first resource;

[0007] In the case where the first application has access rights to the first resource, the application management platform transmits the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource;

[0008] The resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to the security management module;

[0009] The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0010] A second aspect of an embodiment of the present application provides a terminal device, including an application management platform, a security management module and a resource provision module;

[0011] The application management platform is used to receive a resource access request from a first application, where the resource access request is used to request access to a first resource;

[0012] The application management platform is further configured to transmit the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource when the first application has access rights to the first resource;

[0013] The resource providing module corresponding to the first resource is used to transmit the identifier of the first application and the access behavior information of the first application to the security management module;

[0014] The security management module is used to identify the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0015] A third aspect of an embodiment of the present application provides a terminal device, including a processor and a memory, the memory being used to store a computer program, the computer program including program instructions, and the processor being configured to call the program instructions to execute the step instructions in the first aspect of the embodiment of the present application.

[0016] The fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the above-mentioned computer-readable storage medium stores a computer program for electronic data exchange, and the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the step instructions in the first aspect of the embodiment of the present application.

[0017] The fifth aspect of the embodiments of the present application provides a computer program product, wherein the above-mentioned computer program product includes a computer program, and the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the step instructions in the first aspect of the embodiments of the present application.

[0018] In the application behavior management method of the embodiment of the present application, the application management platform receives a resource access request of the first application, and the resource access request is used to request access to the first resource; when the first application has access rights to the first resource, the application management platform passes the identification of the first application and the resource access request to the resource provision module corresponding to the first resource; the resource provision module corresponding to the first resource passes the identification of the first application and the access behavior information of the first application to the security management module; the security management module identifies the resource access behavior of the first application based on the identification of the first application and the access behavior information of the first application. In the embodiment of the present application, for the resource access request of the first application, the identification of the first application and the access behavior information of the first application can be passed to the security management module, and the security management module identifies the resource access behavior of the first application based on the identification of the first application and the access behavior information of the first application, and can identify the resource access behavior of different applications, distinguish the resource access of different applications to the terminal device, and can manage and control the resource access behavior of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a schematic diagram of the software architecture of a terminal device provided in an embodiment of the present application;

[0021] Figure 2 It is a flowchart of an application behavior management method provided by an embodiment of the present application;

[0022] Figure 3 It is a flowchart of another application behavior management method provided by an embodiment of the present application;

[0023] Figure 4 It is a flowchart of another application behavior management method provided by an embodiment of the present application;

[0024] Figure 5 It is a flowchart of another application behavior management method provided by an embodiment of the present application;

[0025] Figure 6 It is a structural diagram of a terminal device provided in an embodiment of the present application;

[0026] Figure 7 It is a structural diagram of another terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0029] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0030] The terminal devices involved in the embodiments of the present application may include portable computers (such as mobile phones), tablet computers, laptop computers, personal computers (PCs), wearable electronic devices (such as smart watches), augmented reality (AR) and virtual reality (VR) devices, in-vehicle computers, etc. The embodiments of the present application do not limit the specific form of the terminal devices.

[0031] In the embodiment of the present application, for a resource access request of a first application, the identifier of the first application and the access behavior information of the first application can be passed to the security management module. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application, and can identify the resource access behaviors of different applications, distinguish the resource access of different applications to the terminal device, and manage the resource access behaviors of the applications. The following is a specific explanation.

[0032] Web applications (WEB APP) refer to web-based systems and applications that publish a set of complex content and functions to a wide range of end users. For example, web applications can include quick applications launched by mobile phone manufacturers and mini-programs launched by WeChat.

[0033] The following uses quick apps as an example. The quick app platform launched by mobile phone manufacturers is used to provide a running environment for quick apps (hereinafter referred to as web apps). The quick app platform is one of the existing mobile phone manufacturers' quick app platform technology solutions in the industry. The summary is as follows:

[0034] The first part is to pre-install the application management platform before the mobile phone leaves the factory.

[0035] In the mobile phone system, an application management platform (denoted as webapp_platform) is preset at the factory for the execution of webapp.

[0036] In the second part, the web app is started and run when the phone is running.

[0037] During the operation of the mobile phone, webapp_platform is always running in the mobile phone system to respond to the user's web app startup in a timely manner. When the user triggers a web app (referred to as webapp1) by clicking or associating startup, webapp_platform creates an independent process (referred to as process1). Process process1 contains a JS engine for executing the JS code of the web app, a webapp permission management module, and other necessary auxiliary modules for supporting the operation of the web app. Process1 obtains the JS code of webapp1 from the web app application store. The JS engine in process1 interprets and executes the JS code of webapp1 and communicates remotely with the background server of webapp1.

[0038] The third part is that Webapp can indirectly access mobile phone system resources.

[0039] When webapp1 needs to access certain system resources on the mobile phone (that is, call certain APIs of the mobile phone system, such as the mobile phone microphone, camera, photo album, etc.), webapp1 calls the relevant interface of the JS engine. The JS engine queries the webapp permission management module to see whether webapp1 has the corresponding permissions to access the mobile phone system resources. (Note: the webapp permissions can be manually configured by the user, or there are certain permission policies in the webapp_platform). If webapp1 has the corresponding permissions, the JS engine calls the mobile phone system API to help webapp1 indirectly access the mobile phone system resources. If webapp1 does not have the corresponding permissions, the JS engine does not respond to webapp1's interface call to the JS engine and waits for the next web app resource access request.

[0040] The process of webapp_platform directly accesses the mobile phone system resources. Therefore, when the existing security mechanisms in the mobile phone operating system (such as mobile phone managers) verify the identity of system resource callers and audit access behaviors, the audited object is webapp_platform. Existing security mechanisms such as software managers cannot distinguish the access of different web apps to mobile phone resources, so they cannot specifically control resource access, conduct behavioral security detection, and conduct targeted behavioral retrospective audits on web apps. At the same time, webapp_platform may affect the detection effect of existing security mechanisms. Therefore, the security mechanisms on mobile phones have limited effects on the control of web app resource access behavior and the detection of malicious behavior, and there are potential security risks such as data leakage.

[0041] Since the object of detection by mechanisms such as mobile phone housekeeper is webapp_platform rather than web app, on the one hand, mobile phone housekeeper may judge that webapp_platform belongs to the whitelist application, and the frequency of detecting the behavior of webapp_platform is relatively low, and it may not be able to detect the attack behavior of malicious web app running in the webapp_platform process in time. On the other hand, as a host program, webapp_platform itself may mask the malicious behavior of web app. For example, when the normal behavior of webapp_platform (such as accessing the album) is mixed with the malicious behavior of web app (such as illegal access to the album), both behaviors belong to the webapp_platform process, and mobile phone housekeeper may not be able to detect the malicious behavior. The inspection of the code security of web app itself mainly depends on the review of webapp by the app store when the web app is listed on the app store. webapp_platform helps web app to indirectly access mobile phone resources, but the control of permissions mainly determines whether the user has authorized the web app, without checking the legitimacy of the purpose of web app behavior or additional control mechanism for web app behavior. If a malicious web app is successfully listed on the app store, it can reach the user's phone and run successfully; then it can deceive the user to obtain authorization and successfully access the phone's system resources, bringing the risk of user data privacy leakage. For example, a chess and card quick app originally did not have permission to access the photo album, but the quick app accessed the photo album, and the mobile manager did not know that it was the chess and card quick app that accessed the photo album, but thought it was the webapp_platform that accessed the photo album, and could not detect the risk of privacy leakage in time.

[0042] See also Figure 1 , Figure 1 Schematic diagram of the software architecture of a terminal device provided in an embodiment of the present application. Figure 1 As shown, the software architecture includes an application management platform, a security management module and a resource provision module.

[0043] The application management platform is used to receive a first application (for example, Figure 1 The resource access request of the webapp1) shown is used to request access to the first resource;

[0044] The application management platform is further configured to transmit the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource when the first application has access rights to the first resource;

[0045] The resource providing module corresponding to the first resource (for example, Figure 1 The resource providing module 1) shown is used to transmit the identification of the first application and the access behavior information of the first application to the security management module;

[0046] The security management module is used to identify the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0047] The application management platform may be a webapp_platform, which is used to manage multiple network applications (webapps), which may also be referred to as web applications.

[0048] like Figure 1 As shown, webapp cannot directly access the resource provider module. For example, if webapp1 wants to access resource provider module 1, webapp1 calls the relevant interface of the JS engine of the application management platform, and the JS engine calls the relevant interface of resource provider module 1 to help webapp1 indirectly access resource provider module 1.

[0049] The identifier of the first application can be used to identify the first application. After receiving the identifier of webapp1 and the resource access request transmitted by the application management platform, the resource providing module 1 considers that the resource access request is initiated by webapp1.

[0050] The access behavior information of the first application may be determined according to the resource access request. The access behavior information of the first application may include at least one of the access frequency, access resource type, and access time of the first application.

[0051] The resource providing module can provide various system resources of the mobile phone. For example, the resource providing module can be a software module for providing camera use, a software module for providing microphone use, a software module for providing photo album use, and so on.

[0052] The security management module can record the identification and access behavior information of each application, and can establish a corresponding relationship table between the identification of the application and the access behavior information of the application, so as to record the resource access behavior of different applications. The security management module can analyze the access behavior of each application to determine whether the application has malicious behavior.

[0053] The security management module obtains the identifier of the first application and the access behavior information of the first application transmitted by the resource provision module, and can know that the access behavior information of the first application belongs to the first application. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application, can identify the resource access behavior of different applications, distinguish the resource access of different applications to the terminal device, and can control the resource access behavior of the application.

[0054] See also Figure 2 , Figure 2 It is a flow chart of an application behavior management method provided in an embodiment of the present application. Figure 2 The method can be based on Figure 1 The network architecture, such as Figure 2 As shown, the method may include the following steps.

[0055] 201. An application management platform receives a resource access request from a first application, where the resource access request is used to request access to a first resource.

[0056] In the embodiment of the present application, the first resource may include one or at least two resources. The resource may be a resource that the terminal device can provide, such as a microphone, an album, a camera, a file, location information, a call log, a text message, an address book, a phone call, a calendar, an audio file, a video, a sensor, version information, etc.

[0057] Resources can be divided into sensitive resources and non-sensitive resources according to their types. For example, microphones, photo albums, cameras, files, call logs, text messages, and address books can be sensitive resources. Sensors and version information can be non-sensitive resources.

[0058] The first application is any one of the multiple applications managed by the application management platform. For example, if the application management platform manages N applications, the first application is any one of the N applications.

[0059] 202. When the first application has access rights to the first resource, the application management platform transmits the identifier of the first application and the resource access request to a resource providing module corresponding to the first resource.

[0060] In an embodiment of the present application, the application management platform may store access rights for each application it manages. The permissions of the first application may be manually configured by the user, and / or the application management platform may have certain permission policies. For example, the access rights for sensitive resources may be manually configured by the user, and the access rights for non-sensitive resources may be directly configured by the application management platform.

[0061] After receiving the resource access request of the first application, the application management platform can store the access rights of the first application to various resources. For example, the access rights of the first application to each resource can be "allow access" or "forbid access". If the access right of the first application to the first resource is "allow access", the first application has the access right to the first resource; if the access right of the first application to the first resource is "forbid access", the first application does not have the access right to the first resource.

[0062] The identifier of the first application can be generated by the application management platform for the first application. The identifiers of multiple applications managed by the application management platform are different from each other.

[0063] The resource providing module corresponding to the first resource is a resource providing module that can provide the first resource.

[0064] In the case that the first application does not have access rights to the first resource, the application management platform does not respond to the resource access request of the first application, and waits for the next resource access request of the first application.

[0065] 203. The resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to the security management module.

[0066] In an embodiment of the present application, the resource provision module corresponding to the first resource can obtain the access behavior information of the first application according to the resource access request of the first application. For example, the resource access request of the first application is used to request access to the first resource at XX time. Then the access behavior information of the first application can include: the resource type of the first resource accessed and the time of accessing the first resource.

[0067] After obtaining the access behavior information of the first application, the resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to the security management module.

[0068] Optionally, the access behavior information of the first application includes at least one of access frequency, access resource type, and access time.

[0069] Access frequency refers to the number of accesses per unit time, access resource type refers to the resource type of the accessed resource, and access time refers to the time point or time period of the access.

[0070] 204. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0071] When the security management module receives the identifier of the first application and the access behavior information of the first application, it can be known that the access behavior information is the access behavior information of the first application.

[0072] The security management module can record the identification of each application and the corresponding access behavior information, and can establish a corresponding relationship table between the identification of the application and the access behavior information of the application, so as to record the resource access behavior of different applications. The security management module can analyze the access behavior of each application to determine whether the application has malicious behavior.

[0073] In an embodiment of the present application, for a resource access request of a first application, the identifier of the first application and the access behavior information of the first application can be passed to a security management module. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application. It can identify the resource access behavior of different applications, distinguish the resource access of different applications to the terminal device, and manage the resource access behavior of the application.

[0074] See also Figure 3 , Figure 3 It is a flowchart of another application behavior management method provided in an embodiment of the present application. Figure 3 The method can be based on Figure 1 The network architecture, such as Figure 3 As shown, the method may include the following steps.

[0075] 301. An application management platform receives a resource access request from a first application, where the resource access request is used to request access to a first resource.

[0076] The specific implementation of step 301 may refer to the relevant description of step 201 above, which will not be repeated here.

[0077] 302. When the first application has access rights to the first resource and the first resource is a non-sensitive resource, the application management platform transmits the identifier of the first application and the resource access request to a resource providing module corresponding to the first resource.

[0078] In an embodiment of the present application, the application management platform may store a range of sensitive resources. The range of sensitive resources may be agreed upon in advance by the manufacturer of the terminal device and the application management platform, or the manufacturer of the terminal device may confirm the range of sensitive resources. For example, microphone, photo album, camera, file, call log, text message, and address book may be the range of sensitive resources. If the first resource does not fall within the range of the above-mentioned sensitive resources, the first resource is a non-sensitive resource.

[0079] 303. The resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to the security management module.

[0080] 304. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0081] 305. The resource providing module corresponding to the first resource allows the resource access request.

[0082] In an embodiment of the present application, when the first application has access rights to the first resource and the first resource is a non-sensitive resource, the resource provision module corresponding to the first resource allows the resource access request, and the resource provision module corresponding to the first resource allows the first application to access the first resource.

[0083] The specific implementation of step 303 to step 304 can refer to the relevant description of the above-mentioned step 203 to step 204, which will not be repeated here.

[0084] In an embodiment of the present application, when the first application has access rights to a first resource and the first resource is a non-sensitive resource, the resource provision module corresponding to the first resource allows the first application to access the first resource, thereby ensuring the first application's rapid access to the non-sensitive resource to which it has access rights, thereby improving the first application's access speed to the non-sensitive resource to which it has access rights.

[0085] See also Figure 4 , Figure 4 It is a flowchart of another application behavior management method provided in an embodiment of the present application. Figure 4 The method can be based on Figure 1 The network architecture, such as Figure 4 As shown, the method may include the following steps.

[0086] 401. An application management platform receives a resource access request from a first application, where the resource access request is used to request access to a first resource.

[0087] The specific implementation of step 401 can refer to the relevant description of step 201 above, which will not be repeated here.

[0088] 402. When the first application has access rights to the first resource and the first resource is a sensitive resource, the application management platform signs the resource access request and generates a signature value. The application management platform passes the first application identifier, the resource access request and the signature value to the resource provision module corresponding to the first resource.

[0089] In an embodiment of the present application, the application management platform may store a range of sensitive resources. The range of sensitive resources may be agreed upon in advance by the manufacturer of the terminal device and the application management platform, or the manufacturer of the terminal device may confirm the range of sensitive resources. For example, microphones, photo albums, cameras, files, call records, text messages, and address books may be the range of sensitive resources. If the first resource falls within the range of the above-mentioned sensitive resources, the first resource is a sensitive resource.

[0090] The application management platform can use a private key to sign resource access requests.

[0091] Optionally, the application management platform signs the resource access request and generates a signature value, including:

[0092] The application management platform can use the private key of the first application to sign the resource access request and generate a signature value.

[0093] The private key of the first application is generated based on the identifier of the first application and the platform private key of the application management platform. Specifically, the application management platform can use the BIP32 protocol to generate the private key of the first application based on the identifier of the first application (which can be a seed in the BIP32 protocol) and the platform private key of the application management platform. The application management platform can use the BIP32 protocol to generate the identifier of the first application.

[0094] The signature algorithm for signing the resource access request can be flexibly selected, for example, the international standard elliptic curve digital signature algorithm (ECDSA) can be used.

[0095] Among them, the application management platform can hold a key pair, namely, a platform private key and a platform public key.

[0096] 403, the resource providing module corresponding to the first resource transmits the identifier of the first application, the signature value and the access behavior information of the first application to the security management module.

[0097] 404. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0098] The specific implementation of step 404 may refer to the related description of step 204, which will not be repeated here.

[0099] 405. The security management module verifies the signature value based on the identifier of the first application, and feeds back the verification result to the resource provision module corresponding to the first resource.

[0100] 406. When the signature verification result is passed, the resource provision module corresponding to the first resource allows the resource access request.

[0101] 407: When the signature verification result is failure, the resource providing module corresponding to the first resource rejects the resource access request.

[0102] The security management module may verify the signature value based on the public key of the first application. The public key of the first application and the private key of the first application are a key pair. The public key of the first application and the private key of the first application are obtained using the same key generation algorithm, which may be a BIP32 key derivation algorithm.

[0103] Optionally, the security management module verifies the signature value based on the identifier of the first application, including:

[0104] The security management module determines the public key of the first application based on the identifier of the first application, and verifies the signature value based on the public key of the first application.

[0105] In the embodiment of the present application, the security management module may store the corresponding relationship between the identification of the application and the public key of the application. For example, the corresponding relationship between the identification of the first application and the public key of the first application may be stored.

[0106] The public key of the first application corresponding to the identifier of the first application may be determined according to the correspondence between the identifier of the application and the public key of the application, and the signature value may be verified based on the public key of the first application.

[0107] In the embodiment of the present application, for access to sensitive resources, the application management platform uses the private key of the first application to sign the resource access request and generate a signature value. The security management module uses the public key of the first application to verify the signature value. Through signing and verifying, the security audit of access to sensitive resources is increased, thereby improving the security of application access to sensitive resources.

[0108] See also Figure 5 , Figure 5 It is a flowchart of another application behavior management method provided in an embodiment of the present application. Figure 5 The method can be based on Figure 1 The network architecture, such as Figure 5 As shown, the method may include the following steps.

[0109] 501, when the first application is started and run for the first time, the application management platform allocates the first application identifier to the first application, and generates the first application public key based on the first application identifier and the platform private key of the application management platform.

[0110] In the embodiment of the present application, when each application is started for the first time, an identifier and a public key can be assigned to it. For example, the application management platform manages N applications, and the identifiers of any two applications in the N applications are different, and the public keys of any two applications in the N applications are different.

[0111] The application management platform may use a key generation algorithm to assign an identifier (identifier of the first application) to the first application. The application management platform may use a key generation algorithm to generate a public key of the first application based on the identifier of the first application and a platform private key of the application management platform. The key generation algorithm may be a BIP32 key derivation algorithm.

[0112] 502, the application management platform sends the identity information of the first application to the security management module, where the identity information of the first application includes at least one of a public key of the first application, an identifier of the first application, an application name of the first application, and a package name of the first application.

[0113] In the embodiment of the present application, when the first application is started for the first time, the application management platform assigns the first application an identifier for the first application and generates a public key for the first application. The identifier of the first application and the public key of the first application may be the identity information of the first application. The identity information of the first application may also include the application name of the first application and the package name of the first application.

[0114] 503. The application management platform receives a resource access request from the first application, where the resource access request is used to request access to a first resource.

[0115] 504, when the first application has access rights to the first resource, the application management platform transmits the identifier of the first application and the resource access request to the resource providing module corresponding to the first resource.

[0116] 505. The resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to the security management module.

[0117] 506. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0118] The specific implementation of steps 503 to 506 may refer to the above steps 201 to 204, which will not be described again here.

[0119] 507 , the security management module queries the expected access capability information of the first application based on the identity information of the first application, and detects whether the first application has malicious behavior based on the expected access capability information of the first application and the access behavior information of the first application.

[0120] 508. When the security management module detects malicious behavior in the first application, the security management module notifies the application management platform, and the application management platform disables the permissions and network data transmission of the first application.

[0121] In the embodiment of the present application, the expected access capability information of the first application refers to the capability information that the first application itself is allowed to access, which is the expected access behavior of the first application. The access behavior information of the first application refers to the existing access behavior of the first application. If the existing access behavior of the first application does not match the expected access behavior of the first application, malicious behavior may exist.

[0122] The security management module uses a security detection model to detect whether the first application has malicious behavior based on the expected access capability information of the first application and the access behavior information of the first application. For example, a chess and card game application will not access the photo album. The expected access capability information of the application does not include the ability to access the photo album. If the application accesses the photo album, it is considered that the application has malicious behavior.

[0123] When the security management module detects that the first application has malicious behavior, it can notify the application management platform that the first application has malicious behavior. At this time, the application management platform can disable the first application's permissions (which can be all permissions or permissions only for access to sensitive resources) and network data transmission.

[0124] When the security management module detects that the first application does not have any malicious behavior, the security management module does not perform any processing.

[0125] Wherein, step 507 and step 508 may be executed periodically, or may be executed after the security management module receives the access behavior information of the first application.

[0126] In an embodiment of the present application, the security management module can query the expected access capability information of the first application based on the identity information of the first application, and detect whether the first application has malicious behavior based on the expected access capability information of the first application and the access behavior information of the first application. When malicious behavior is detected in the first application, the security management module notifies the application management platform, and the application management platform disables the permissions and network data transmission of the first application, which can improve the security of application management and avoid the leakage of privacy data.

[0127] Optionally, when the security management module detects malicious behavior in the first application, the signature verification from the first application fails by default, which can further improve the security of application management and avoid leakage of private data.

[0128] The following uses quick apps as an example to illustrate the behavior control method of mobile quick apps.

[0129] The present application embodiment proposes a method for controlling mobile phone quick application behavior based on key derivation, the summary of which is as follows:

[0130] The application management platform (denoted as webapp_platform) holds a key pair (the public key is denoted as m_PK and the private key is denoted as m_SK), and adopts the BIP32 scheme to assign an index value i to each web app, and derive a public key (denoted as c_i_PK) based on i and m_SK as the identity of the web app.

[0131] When a web app requests to access system resources, i is passed along with the access request to the resource provider module of the mobile phone system to identify the source web app of the access request.

[0132] webapp_platform synchronizes the web app's c_i_PK, i, application name, and application registration to the security management module on the mobile phone (such as the mobile phone manager, recorded as sec_manager). sec_manager identifies and detects the behaviors of different web apps based on c_i_PK.

[0133] webapp_platform uses the BIP32 scheme to derive the private key corresponding to c_i_PK (referred to as c_i_SK), and then uses c_i_SK to sign the web app's request to access sensitive system resources. sec_manager uses c_i_PK to verify the access request. Only when the verification is passed can the web app access sensitive system resources.

[0134] When sec_manager detects malicious behavior in a web app, it notifies webapp_platform, which then disables all permissions and network transmissions of the web app and takes subsequent actions such as informing the user.

[0135] The technical solution of the embodiment of the present application is summarized as follows:

[0136] The first part is to pre-install the application management platform before the mobile phone leaves the factory.

[0137] In the mobile phone system, an application management platform (referred to as webapp_platform) is pre-installed at the factory for the execution of webapp. webapp_platform is an application pre-installed at the factory on the mobile phone.

[0138] Among them, webapp_platform holds a key pair (the public key is recorded as m_PK and the private key is recorded as m_SK).

[0139] In the second part, when the mobile phone is running, the web app is started and run. The web app startup and run may include the following steps (11) to (13).

[0140] (11) During the operation of the mobile phone, webapp_platform is always running in the mobile phone system to respond to the user's web app startup in a timely manner. When the user triggers a web app (referred to as webapp1) by clicking or associating startup, webapp_platform creates an independent process (referred to as process1). Process process1 contains the JS engine for executing the JS code of the webapp, the webapp permission control module, and other necessary auxiliary modules for supporting the operation of the web app. Process1 obtains the JS code of webapp1 from the web app application store.

[0141] The necessary auxiliary module is a software module, which is subject to business development. Process1 can obtain the js code of webapp1 from the web app application store, or can obtain the js code of webapp1 locally, which is not limited in the embodiment of the present application.

[0142] (12)webapp_platform adopts the BIP32 scheme to assign a randomly generated index value i to webapp1 and each subsequent web app (the index value of webapp1 is recorded as i_1), and derives a public key (recorded as c_i_PK) based on i and m_SK as the identity of the web app (the public key of webapp1 is recorded as c_i_PK1). webapp_platform maintains the association information between each web app and each i. Among them, the index value i_1 of the first application (webapp1) can be an example of the identification of the above-mentioned first application (webapp1). The public key c_i_PK1 of the first application (webapp1) can be an example of the public key of the above-mentioned first application (webapp1).

[0143] webapp_platform only assigns an index value to a webapp when it is started for the first time.

[0144] (13) The JS engine in process1 interprets and executes the JS code of webapp1 and remotely communicates with the background server of webapp1.

[0145] The third part, webapp_platform can synchronize information with the mobile phone security detection module. The webapp_platform can synchronize information with the mobile phone security detection module and can include the following steps (21) to (22). The mobile phone security detection module can be an example of the above-mentioned security management module.

[0146] (21) After each web app is started, webapp_platform sends the web app identity information (referred to as web_app_Inform) corresponding to the running web app, such as c_i_PK, i, web app name, and web app name, to the security detection module in the mobile phone operating system (e.g., mobile phone manager, referred to as sec_manager).

[0147] (22) sec_manager maintains the received web app identity information and maintains the association between c_i_PK, i, and webapp name contained in the web app identity information.

[0148] Among them, webapp_platform keeps information synchronized with sec_manager during operation.

[0149] Part 4: Webapp indirectly accesses mobile phone system resources. Webapp indirectly accesses mobile phone system resources, which may include the following steps (31) to (39).

[0150] (31) When webapp1 needs to access certain system resources on the mobile phone (i.e., call certain APIs of the mobile phone system, such as the mobile phone microphone, camera, photo album, etc.), webapp1 calls the relevant interface of the JS engine.

[0151] webapp1 calls the relevant interfaces of the JS engine, which are protected by permissions. By default, JS knows what permissions this interface requires, and the permissions of each interface are known.

[0152] When webapp1 calls the relevant interface of the JS engine, it actually calls the interface of webapp_platform, but this interface is not the API of the system resources. It is equivalent to adding a layer of webapp_platform between webapp and the system resources of the mobile phone. The relationship between webapp and the system resources of the mobile phone is not a direct call, but an indirect call. For example, webapp1 calls the relevant interface of the JS engine, and the relevant interface of the JS engine calls the interface of the mobile phone system resources. All requests received by the provider are sent through webapp_platform, not directly by webapp.

[0153] (32) The JS engine queries the webapp permission control module to see whether webapp1 has the corresponding permission to access the mobile phone system resources.

[0154] Among them, the permissions of webapp are manually configured by users, or webapp_platform has certain permission policies. For example, some permissions are ordinary permissions and do not need to be configured by users, while some permissions require users to configure.

[0155] (33) If webapp1 does not have the corresponding permissions, the JS engine will not respond to webapp1's interface call to the JS engine and will wait for the next resource access request from the web app.

[0156] (34) If webapp1 has the corresponding permissions, the JS engine determines whether the access requested by webapp1 is to sensitive system resources.

[0157] Whether it is a sensitive system resource can be agreed upon in advance by the mobile phone manufacturer and webapp_platform, or the mobile phone manufacturer can confirm the scope of sensitive resources. The mobile phone manufacturer can be the original equipment manufacturer (OEM) of the mobile phone.

[0158] (35) If webapp1 requests to access non-sensitive resources, the JS engine calls the API of the corresponding resource provider module (referred to as provider) in the system, and passes i_1 to the provider along with the access request to identify the source of the access request, webapp1. Then, step (37) is executed.

[0159] Among them, the resource provider module can be the above-mentioned resource providing module.

[0160] (36) If webapp1 requests to access sensitive resources, the JS engine calls the corresponding API of webapp_platform and asks webapp_platform to sign the resource access request of the web app. The JS engine calls the provider's API and passes i_1 and signature to the sensitive resource provider along with the access request. Then execute step (38).

[0161] Specifically, webapp_platform derives the private key corresponding to c_i_PK1 (denoted as c_i_SK1) based on m_SK and i_1, and then uses c_i_SK1 to sign the resource access request of the web app (the generated signature value is denoted as signature).

[0162] The resource access request of the web app will carry some information, such as which resource the web app wants to access and when to access it.

[0163] (37) If the provider is a non-sensitive resource provider, the provider passes i_1 and related information about the web app's access behavior to sec_manager, and then the provider allows the JS engine's resource request.

[0164] Information about web app access behavior can include access frequency, access resource type, access time, etc. Provider will pass every access request of webapp to sec_manager. sec_manager will regularly analyze all the information.

[0165] (38) If the provider is a sensitive resource provider, the provider of sensitive resources passes i, relevant information of the web app access behavior, and signature to sec_manager, requests sec_manager to verify the signature, and executes step (39).

[0166] Among them, the sensitive resource provider does not accept unsigned calls from the JS engine by default.

[0167] (39) sec_manager uses c_i_PK1 corresponding to i_1 to verify the signature and feeds the verification result back to the sensitive resource provider.

[0168] If the signature verification succeeds, the sensitive resource provider allows the JS engine's resource request.

[0169] If the signature verification fails, the provider denies webapp1 access to this resource.

[0170] Part 5: sec_manager monitors web app behavior. sec_manager monitors web app behavior and may include the following steps (41) to (44).

[0171] (41) sec_manager identifies and distinguishes the system resource access behaviors of different web apps based on i passed by the provider and relevant information about the web app's access behaviors (such as access frequency, access resource type, access time, etc.).

[0172] Step (41) can record and distinguish the behavior of each webapp, and can distinguish which app the behavior belongs to.

[0173] (42) During the operation of webapp_platform, sec_manager determines whether the web app behavior is malicious based on its existing behavioral security detection model and combined with the expected information about the web app (such as functions, uses, etc.) queried from the application store according to web_app_Inform. sec_manager continuously monitors the behavior of the webapp during the operation of webapp_platform.

[0174] Among them, the input data of the behavioral security detection model consists of two parts: one is the relevant information of the web app access behavior, and the other is the existing information of the webapp (that is, the behavior that the application itself may have, which is the expected behavior).

[0175] (43) When sec_manager detects malicious behavior of a web app, sec_manager will default to failing the signature verification of the access request to the web app, and will promptly synchronize the information of the malicious web app to webapp_platform.

[0176] (44)webapp_platform will disable all permissions and network data transmission of the web app and take subsequent actions.

[0177] For example, webapp_platform informs the user of the malicious web app through a pop-up window.

[0178] Among them, sec_manager monitors the behavior of the web app, which can be monitored periodically or after the behavior of the web app is updated.

[0179] In the embodiment of the present application, the BIP32 solution is adopted. Not only will there be a public-private key pair, but also an index value. The public key can be given to the webapp for independent use, and the private key is held by the webapp_platform itself, which can improve the convenience of management. If a public-private key pair is assigned to each webapp, then all private keys are stored by the webapp_platform, and the association relationship between the private key and which webapp is associated needs to be maintained. If a public-private key pair is assigned to each webapp, the index value assigned to the webapp has nothing to do with the generation of the public key. In the embodiment of the present application, i is passed to the system resource provider, and it can be directly derived using cryptographic methods, which can be verified, and the verification is simpler.

[0180] In the embodiment of the present application, sec_manager can identify and detect the behavior of different web apps based on c_i_PK, which is convenient for targeted resource access behavior control, behavior security detection, and retrospective security audit of web apps. The security detection effect of web apps is improved, and the security of the solution is improved. In the embodiment of the present application, the system call behavior of web app and its host webapp_platform is distinguished, which is convenient for alleviating the negative impact of webapp_platform behavior on the malicious detection effect of web app. In the embodiment of the present application, in addition to the user's authorization of the web app, additional control of the web app's sensitive data access behavior is added (webapp_platform signature, sec_manager signature verification), which improves the control strength of the web app, and in the case of the risk of malicious web apps deceiving user authorization and illegally obtaining authorization, the success rate of malicious behavior interception can be improved. The embodiment of the present application has good scalability, which can be used not only for web app platforms launched by mobile phone OEM manufacturers, but also for web app platforms built by third-party application software (such as WeChat applets).

[0181] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that in order to realize the above functions, the terminal device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment provided in this article, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0182] The embodiment of the present application can divide the terminal device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0183] See also Figure 6 , Figure 66 is a schematic diagram of a terminal device provided in an embodiment of the present application. The terminal device 600 may include an application management platform 601, a security management module 602 and a resource provision module 603, wherein:

[0184] The application management platform 601 is used to receive a resource access request from a first application, where the resource access request is used to request access to a first resource;

[0185] The application management platform 601 is further configured to transmit the identifier of the first application and the resource access request to the resource provision module 603 corresponding to the first resource when the first application has access rights to the first resource;

[0186] The resource providing module 603 corresponding to the first resource is used to transmit the identification of the first application and the access behavior information of the first application to the security management module 602;

[0187] The security management module 602 is used to identify the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

[0188] Optionally, the application management platform 601 is further configured to, when the first application has access rights to the first resource and the first resource is a non-sensitive resource, pass the identifier of the first application and the resource access request to a resource provision module 603 corresponding to the first resource;

[0189] The resource providing module 603 corresponding to the first resource is further configured to allow the resource access request.

[0190] Optionally, the application management platform 601 is further used to sign the resource access request and generate a signature value;

[0191] The application management platform is further configured to, when the first application has access rights to the first resource and the first resource is a sensitive resource, pass the identifier of the first application, the resource access request and the signature value to a resource provision module 603 corresponding to the first resource;

[0192] The resource providing module 603 corresponding to the first resource is further used to transmit the identifier of the first application, the signature value and the access behavior information of the first application to the security management module 602;

[0193] The security management module 602 is further configured to verify the signature value based on the identifier of the first application, and feed back the verification result to the resource provision module 603 corresponding to the first resource;

[0194] The resource providing module 603 corresponding to the first resource is further configured to allow the resource access request if the signature verification result is a passed signature verification;

[0195] The resource providing module 603 corresponding to the first resource is further configured to reject the resource access request if the signature verification result is signature verification failure.

[0196] Optionally, the application management platform 601 is further used to allocate a first application identifier to the first application when the first application is started and run for the first time, and to generate a public key of the first application based on the identifier of the first application and a platform private key of the application management platform;

[0197] The application management platform 601 is further used to send the identity information of the first application to the security management module 602, where the identity information of the first application includes at least one of the public key of the first application, the identifier of the first application, the application name of the first application, and the package name of the first application.

[0198] Optionally, the security management module 602 is further configured to query the expected access capability information of the first application based on the identity information of the first application, and detect whether the first application has malicious behavior based on the expected access capability information of the first application and the access behavior information of the first application;

[0199] The security management module 602 is further configured to notify the application management platform when malicious behavior is detected in the first application, and the application management platform disables the permissions and network data transmission of the first application.

[0200] Optionally, the application management platform is further used to generate a private key of the first application based on the identifier of the first application and a platform private key of the application management platform;

[0201] The application management platform 601 is further used to sign the resource access request using the private key of the first application to generate a signature value;

[0202] The security management module 602 is further used to determine the public key of the first application based on the identifier of the first application, and verify the signature value based on the public key of the first application.

[0203] Optionally, the access behavior information of the first application includes at least one of access frequency, access resource type, and access time.

[0204] Optionally, the security management module 602 is further configured to default failure of the signature verification from the first application when malicious behavior is detected in the first application.

[0205] Among them, the application management platform 601, the security management module 602 and the resource provision module 603 in the embodiment of the present application can be processors in the terminal device.

[0206] Figure 6 The specific implementation of the terminal device 600 shown can be found in Figures 2 to 5 The method embodiment shown will not be described in detail here.

[0207] In an embodiment of the present application, for a resource access request of a first application, the identifier of the first application and the access behavior information of the first application can be passed to a security management module. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application. It can identify the resource access behavior of different applications, distinguish the resource access of different applications to the terminal device, and manage the resource access behavior of the application.

[0208] See also Figure 7 , Figure 7 is a schematic diagram of the structure of another terminal device provided in an embodiment of the present application, such as Figure 7 As shown, the terminal device 700 includes a processor 701 and a memory 702, and the processor 701 and the memory 702 can be connected to each other via a communication bus 703. The communication bus 703 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 703 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 The memory 702 is used to store computer programs, which include program instructions. The processor 701 is configured to call the program instructions. The program includes instructions for executing Figures 2 to 5 Some or all of the steps in the method shown.

[0209] The memory 702 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0210] The terminal device 700 may further include a communication module, which may include a communication chip, a radio frequency transceiver, a radio frequency front-end module, an antenna, and the like.

[0211] The terminal device 700 may also include a display module.

[0212] In an embodiment of the present application, for a resource access request of a first application, the identifier of the first application and the access behavior information of the first application can be passed to a security management module. The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application. It can identify the resource access behavior of different applications, distinguish the resource access of different applications to the terminal device, and manage the resource access behavior of the application.

[0213] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any application behavior management method recorded in the above method embodiments.

[0214] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0215] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0216] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be electrical or other forms.

[0217] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0218] In addition, the functional units in the various embodiments of the application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software program modules.

[0219] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, terminal device or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program codes.

[0220] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc.

[0221] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An application behavior management method, characterized in that: The method is applied to a terminal device, the terminal device includes an application management platform, a security management module and a resource provision module, and the method includes: The application management platform receives a resource access request from a first application, where the resource access request is used to request access to a first resource; In the case where the first application has access rights to the first resource, the application management platform transmits the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource; The resource providing module corresponding to the first resource transmits the identifier of the first application and the access behavior information of the first application to the security management module; The security management module identifies the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

2. The method according to claim 1, characterized in that In the case where the first application has access rights to the first resource, the application management platform transmits the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource, including: In a case where the first application has access rights to the first resource and the first resource is a non-sensitive resource, the application management platform transmits the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource; The method further comprises: The resource providing module corresponding to the first resource allows the resource access request.

3. The method according to claim 1, characterized in that The method further comprises: The application management platform signs the resource access request and generates a signature value; In the case where the first application has access rights to the first resource, the application management platform transmits the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource, including: In a case where the first application has access rights to the first resource and the first resource is a sensitive resource, the application management platform transmits the identifier of the first application, the resource access request and the signature value to a resource provision module corresponding to the first resource; The method further comprises: The resource providing module corresponding to the first resource transmits the identifier of the first application, the signature value and the access behavior information of the first application to the security management module; The security management module verifies the signature value based on the identifier of the first application, and feeds back the verification result to the resource provision module corresponding to the first resource; When the signature verification result is that the signature verification is passed, the resource provision module corresponding to the first resource allows the resource access request; When the signature verification result is that the signature verification fails, the resource provision module corresponding to the first resource rejects the resource access request.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: When the first application is started and run for the first time, the application management platform allocates a first application identifier to the first application, and generates a public key of the first application based on the first application identifier and a platform private key of the application management platform; The application management platform sends the identity information of the first application to the security management module, where the identity information of the first application includes at least one of a public key of the first application, an identifier of the first application, an application name of the first application, and a package name of the first application.

5. The method according to claim 4, characterized in that After the application management platform sends the identity information of the first application to the security management module, the method further includes: The security management module queries the expected access capability information of the first application based on the identity information of the first application, and detects whether the first application has malicious behavior based on the expected access capability information of the first application and the access behavior information of the first application; When the security management module detects malicious behavior in the first application, the security management module notifies the application management platform, and the application management platform disables the permissions and network data transmission of the first application.

6. The method according to claim 3, characterized in that The method further comprises: The application management platform generates a private key of the first application based on the identifier of the first application and a platform private key of the application management platform; The application management platform signs the resource access request and generates a signature value, including: Sign the resource access request using the private key of the first application to generate a signature value; The security management module verifies the signature value based on the identifier of the first application, including: The security management module determines the public key of the first application based on the identifier of the first application, and verifies the signature value based on the public key of the first application.

7. The method according to any one of claims 1 to 6, characterized in that: The access behavior information of the first application includes at least one of access frequency, access resource type, and access time.

8. A terminal device, characterized in that: Includes application management platform, security management module and resource provision module; The application management platform is used to receive a resource access request from a first application, where the resource access request is used to request access to a first resource; The application management platform is further configured to transmit the identifier of the first application and the resource access request to a resource provision module corresponding to the first resource when the first application has access rights to the first resource; The resource providing module corresponding to the first resource is used to transmit the identifier of the first application and the access behavior information of the first application to the security management module; The security management module is used to identify the resource access behavior of the first application based on the identifier of the first application and the access behavior information of the first application.

9. A terminal device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is enabled to perform the method according to any one of claims 1 to 7.

Images