Application hot update processing method, terminal equipment and readable storage medium

Abstract

The invention discloses an application hot update processing method, terminal equipment and a readable storage medium. The method comprises the following steps: in response to a detected hot update behavior of a target application, pausing the hot update behavior, and uploading a corresponding patch file identifier and an original file identifier to an application store cloud for security detection result query; and receiving a query result fed back by the application store cloud, and performing corresponding processing according to the query result. In this way, the detection efficiency is improved.

Description

Technical Field

[0001] The present application relates to the technical field of application update, and in particular to a processing method, a terminal device and a readable storage medium for application hot update. Background Art

[0002] With the intelligence of terminal devices, terminal devices can install various types of applications to provide convenience for users. Most applications use the application hot update solution to achieve the purpose of application fault repair, or update code modules and resources. The current mainstream hot update method is that the application will actively download the corresponding patch file when it is running, and then merge the original file with the patch file on the terminal device, or place a new patch file in the directory for subsequent new function calls.

[0003] In this process, malicious applications can use hot update technology to successfully bypass the security detection of application software before it is put on the shelves in the application store of the terminal device. After reaching the terminal device, it can download and run malicious code modules with the help of hot update behavior, endangering the data and property security of the terminal device. Summary of the invention

[0004] The present application provides a processing method for application hot update, a terminal device and a readable storage medium, which can improve detection efficiency.

[0005] In a first aspect, the present application provides a method for processing application hot updates, the method comprising: in response to detecting a hot update behavior of a target application, pausing the hot update behavior, and uploading the corresponding patch file identifier and the original file identifier to the application store cloud for security detection result query; receiving the query results fed back by the application store cloud, and performing corresponding processing based on the query results.

[0006] In a second aspect, the present application provides a terminal device, which includes a processor and a memory and a communication module coupled to the processor, the communication module being used to communicate with an application store cloud; wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the method provided in the first aspect.

[0007] In a third aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method provided in the first aspect.

[0008] The beneficial effects of the present application are as follows: different from the prior art, the application hot update processing method, terminal device and readable storage medium provided by the present application, in response to detecting the hot update behavior of the target application, suspend the hot update behavior, and upload the corresponding patch file identifier and the original file identifier to the application store cloud for security detection result query; receive the query results fed back by the application store cloud, and perform corresponding processing according to the query results, and can query the application store cloud for the security detection record of the current hot update of the application, so as to reduce the computational complexity of the terminal device for the security detection of the hot update application, and utilize the computing power of the application store cloud and a more accurate security model to improve the detection efficiency without reducing security. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] in:

[0011] Figure 1 It is a flowchart of an embodiment of a method for processing application hot update provided by the present application;

[0012] Figure 2 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0013] Figure 3 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0014] Figure 4 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0015] Figure 5 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0016] Figure 6 It is a structural diagram of an embodiment of a terminal device provided by the present application;

[0017] Figure 7 It is a structural schematic diagram of an embodiment of an electronic device provided by the present application;

[0018] Figure 8 It is a structural schematic diagram of an embodiment of a computer-readable storage medium provided by the present application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It will be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only some but not all structures related to the present application are shown in the drawings. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0020] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0021] With the intelligence of terminal devices, terminal devices can install various types of applications to provide convenience for users. Most applications use the application hot update solution to achieve the purpose of application fault repair, or update code modules and resources. The current mainstream hot update method is that the application will actively download the corresponding patch file when it is running, and then merge the original file with the patch file on the terminal device, or place a new patch file in the directory for subsequent new function calls.

[0022] In this process, malicious applications can use hot update technology to successfully bypass the security detection of application software before it is put on the shelves in the application store of the terminal device. After reaching the terminal device, it can download and run malicious code modules with the help of hot update behavior, endangering the data and property security of the terminal device.

[0023] Most of the current terminal equipment manufacturers do not conduct targeted detection or restrictions on application hot update behavior. The security detection of hot update applications mainly relies on the unified detection of applications by system security software such as the device manager in the terminal device.

[0024] The unified detection of applications by security software is usually executed by users actively clicking, or triggered by predefined key sensitive behaviors of applications (such as payment), or executed regularly or when the device is idle according to a predetermined strategy. Currently, the security software of most devices generally does not include application hot update behavior in the scope of trigger detection indicators.

[0025] App stores mainly rely on manual discovery of patch files to trigger security checks on hot-update apps. This detection mechanism has low application coverage and detection efficiency.

[0026] Based on this, this application proposes to query the security detection record of the hot update of the application from the application store cloud, so as to reduce the computing amount of the terminal device for the security detection of the hot update application, and to improve the detection efficiency without reducing the security by using the computing power of the application store cloud and a more accurate security model. Please refer to any of the following technical solutions for details.

[0027] See also Figure 1 , Figure 1 1 is a flow chart of an embodiment of a method for processing application hot update provided by the present application. The method includes:

[0028] Step 11: In response to detecting the hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query.

[0029] In some embodiments, each patch file and original file has a unique identifier, so the patch file identifier and the original file identifier can be used to query the security detection results in the application store cloud.

[0030] In some embodiments, the patch file identifier and the original file identifier can be obtained by performing hash processing on the patch file and the original file, such as using the hash value corresponding to the patch file as the patch file identifier and using the hash value corresponding to the original file as the original file identifier.

[0031] In some embodiments, in response to detecting the hot update behavior of the target application, the terminal device first suspends the hot update behavior, calculates the patch file identifier corresponding to the patch file and the original file identifier corresponding to the original file, and uploads the patch file identifier and the original file identifier to the application store cloud for security detection result query. The original file may refer to the file before the target application is hot updated.

[0032] The App Store cloud can store the security test results of multiple patch files, and the patch file identifier can be used as a query condition. By storing the security test results of multiple patch files in the App Store cloud as a query basis, the number of security tests in the App Store cloud can be reduced, and the feedback efficiency of security test results can be improved.

[0033] Step 12: Receive the query results fed back by the app store cloud, and perform corresponding processing based on the query results.

[0034] In some embodiments, if the received query result indicates that the patch file corresponds to malicious behavior, the hot update behavior of the target application is intercepted.

[0035] In some embodiments, if the received query result indicates that the patch file corresponds to malicious behavior, the hot update behavior of the target application is intercepted.

[0036] In some embodiments, if the received query result indicates that the patch file corresponds to non-malicious behavior, a hot update of the application is performed.

[0037] In this embodiment, in response to detecting the hot update behavior of the target application, the hot update behavior is paused, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query; the query results fed back by the application store cloud are received, and corresponding processing is performed according to the query results. By querying the application store cloud for the security detection record of the hot update of the application, it is possible to reduce the computational complexity of the terminal device for the security detection of the hot update application, and utilize the computing power of the application store cloud and a more accurate security model to improve the detection efficiency without reducing security.

[0038] See also Figure 2 , Figure 2 1 is a flow chart of an embodiment of a method for processing application hot update provided by the present application. The method includes:

[0039] Step 21: In response to detecting the hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query.

[0040] Step 21 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0041] Step 22: Receive the query result fed back by the application store cloud, and in response to the query result indicating that there is a security check, and the security check result indicating that the hot update behavior is a malicious behavior, intercept the hot update behavior of the target application.

[0042] The query result indicates that there is a security check, and the security check result indicates that the hot update behavior is a malicious behavior, which means that the patch file of this hot update has been security checked and there is malicious code in the patch file. Therefore, the hot update behavior corresponding to the patch file is determined to be a malicious behavior.

[0043] The terminal device determines that the hot update behavior is a malicious behavior and intercepts the hot update behavior of the target application.

[0044] In this embodiment, in response to detecting the hot update behavior of the target application, the hot update behavior is paused, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query; the query results fed back by the application store cloud are received, and corresponding processing is performed according to the query results. By querying the application store cloud for the security detection record of the hot update of the application, it is possible to reduce the computational complexity of the terminal device for the security detection of the hot update application, and utilize the computing power of the application store cloud and a more accurate security model to improve the detection efficiency without reducing security.

[0045] See also Figure 3 , Figure 3 1 is a flow chart of an embodiment of a method for processing application hot update provided by the present application. The method includes:

[0046] Step 31: In response to detecting a hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query.

[0047] Step 32: Receive the query result fed back by the application store cloud, and in response to the query result indicating that there is a security check, and the security check result indicating that the hot update behavior is a malicious behavior, intercept the hot update behavior of the target application.

[0048] Step 31 to step 32 have the same or similar technical solutions as any embodiment of the present application, and will not be repeated here.

[0049] Receive the query result fed back by the application store cloud, and in response to the query result indicating that there is a security check, and the security check result indicating that the hot update behavior is a non-malicious behavior, perform the hot update behavior of the target application.

[0050] Step 33: providing operation options, the operation options including at least one of uninstalling the target application, prohibiting hot update behavior, allowing hot update behavior and performing whole-machine safety detection after the update.

[0051] In some embodiments, the operation selection may be provided on the display screen of the terminal device, and the operation selection may include at least one of uninstalling the target application, prohibiting the hot update behavior, allowing the hot update behavior and performing a whole device safety check after the update.

[0052] In response to the uninstall target application being selected, the target application is uninstalled.

[0053] In response to the selection of prohibiting the hot update behavior, the hot update behavior is prohibited and the corresponding patch file is deleted. Further, a hot update switch can be set and the hot update switch can be turned off. When the hot update switch is turned off, the application cannot be hot updated and the patch file cannot be downloaded.

[0054] In response to the selection of allowing hot update and performing whole machine safety check after update, hot update is allowed and whole machine safety check is performed after update, so as to determine whether to uninstall the target application according to the result of whole machine safety check. For example, if the result of whole machine safety check indicates that the security level is low, the target application is uninstalled.

[0055] In this embodiment, in response to detecting the hot update behavior of the target application, the hot update behavior is paused, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query; the query results fed back by the application store cloud are received, and corresponding processing is performed according to the query results. By querying the application store cloud for the security detection record of the hot update of the application, it is possible to reduce the computational complexity of the terminal device for the security detection of the hot update application, and utilize the computing power of the application store cloud and a more accurate security model to improve the detection efficiency without reducing security.

[0056] See also Figure 4 , Figure 4 1 is a flow chart of an embodiment of a method for processing application hot update provided by the present application. The method includes:

[0057] Step 41: In response to detecting the hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query.

[0058] Step 42: receiving the query result fed back by the application store cloud, and in response to the query result indicating that there is no security detection, uploading the patch file corresponding to the patch file identifier to the application store cloud for cloud security detection.

[0059] The query result indicates that there is no security check, which means that the patch file appears for the first time and has not undergone security check. Therefore, the terminal device uploads the patch file corresponding to the patch file identifier to the application store cloud for cloud security check. In some embodiments, after the application store cloud receives the patch file, the application store cloud can perform a static code check on the patch file. Or the application store cloud uses the patch file and the corresponding original file to simulate the hot update of the application, and performs a security check on the simulated application after the hot update. Further, the application store cloud can combine the static code test results and the security test results to obtain the final security test results.

[0060] After obtaining the security test results, the app store cloud uses the relationship between the patch file identifier and the security test results to store them for subsequent queries.

[0061] In some embodiments, in response to the query result indicating that there is no security check and the application development end authorizes the upload, the patch file corresponding to the patch file identifier is uploaded to the application store cloud for cloud security check.

[0062] Because the patch file is developed by the developer of the application development end, the patch file does not exist in the application store cloud. Therefore, before uploading the patch file to the application store cloud for cloud security testing, it is necessary to obtain the authorization of the application development end before uploading it. Specifically, the authorization of the application development end can be obtained in advance or in real time. If the query result indicates that there is no security test, an authorization request is sent to the application development end. After receiving the authorization license, the patch file corresponding to the patch file identifier is uploaded to the application store cloud for cloud security testing.

[0063] In some embodiments, in response to the query result indicating that there is no security check and the application development end does not authorize the upload, the application development end is notified to upload the patch file corresponding to the patch file identifier to the application store cloud for cloud security check.

[0064] Because the patch file is developed by the developer of the application development end, the patch file does not exist in the application store cloud. Therefore, before uploading the patch file to the application store cloud for cloud security testing, it is necessary to obtain authorization from the application development end before uploading it. Specifically, if the application development end does not grant authorization, it is necessary to remind the application development end to upload the patch file corresponding to the patch file identifier to the application store cloud. If the query result indicates that there is no security test, an authorization request is sent to the application development end. After receiving the unauthorized message, the application development end is notified to upload the patch file corresponding to the patch file identifier to the application store cloud for cloud security testing.

[0065] It can be understood that if the cloud security detection result corresponding to the patch file uploaded by the application development end is non-malicious behavior, the application store cloud can send the patch file uploaded by the application development end to the terminal device, so that the terminal device can delete the current patch file and use the patch file uploaded by the application development end to perform hot update of the application.

[0066] Step 43: Receive the cloud security detection result fed back by the application store cloud, and perform corresponding processing according to the cloud security detection result.

[0067] In response to the security detection result indicating that the hot update behavior is a malicious behavior, it is indicated that malicious code exists in the patch file, and the hot update behavior of the target application is intercepted.

[0068] In response to the security detection result indicating that the hot update behavior is a non-malicious behavior, the hot update behavior of the target application is executed.

[0069] In this embodiment, in response to detecting the hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query; the query result fed back by the application store cloud is received, and corresponding processing is performed according to the query result. By querying the application store cloud for the security detection record of this hot update of the application, it is convenient to reduce the calculation amount of the terminal device for the hot update application security detection, and use the computing power of the application store cloud and a more accurate security model to improve the detection efficiency without reducing security. And by first transmitting the file identifier query, and then transmitting the patch file when the query has no result, the transmission efficiency can be improved.

[0070] See also Figure 5 , Figure 5 1 is a flow chart of another embodiment of a method for processing application hot update provided by the present application. The method includes:

[0071] Step 51: In response to detecting a hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query.

[0072] Step 51 has the same or similar technical solution as any embodiment of the present application, and will not be described in detail here.

[0073] Step 52: In response to not receiving the query result within the first preset time, hot-update the target application using the patch file.

[0074] In this embodiment, considering the network delay problem, if the application store cloud fails to feedback the query result, the target application can be hot-updated using the patch file first, and then step 53 is executed.

[0075] In some embodiments, if during the hot update of the target application using the patch file, a query result is received from the application store cloud, and the query result indicates that the hot update behavior is malicious, the hot update is stopped, the target application is uninstalled, the patch file is deleted, and the target application is downloaded again from the application store. If the query result indicates that the hot update behavior is not malicious, the hot update is continued.

[0076] Step 53: Perform terminal security detection on the target application after the hot update, and in response to the terminal security detection result indicating that the target application after the hot update is a malicious application, limit the resource access scope of the target application and / or remind to uninstall the target application.

[0077] In some embodiments, in response to the terminal security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted and / or a reminder is given to uninstall the target application and a whole-device security detection is performed on the terminal device.

[0078] For example, in response to the terminal security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted, such as restricting the target application from accessing security data, user data, and sensitive resources such as finance and privacy in the terminal device.

[0079] For example, in response to the terminal security detection result indicating that the target application after hot update is a malicious application, a reminder to uninstall the target application and perform a whole-machine security detection on the terminal device. Because it is detected that the application is a malicious application after hot update, the terminal device can remind the user to uninstall the target application. Furthermore, since the application has been hot updated at this time, the malicious code has problems that affect other applications or systems in the terminal device, so a whole-machine security detection is performed on the terminal device. And corresponding processing is performed according to the whole-machine security detection result. For example, if the whole-machine security detection result indicates that there are other applications that are malicious applications, the remaining applications are deleted, and the user is prompted to download the remaining deleted applications from the application store again.

[0080] In some embodiments, in response to the terminal security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted, a reminder to uninstall the target application is given, and a whole-device security detection is performed on the terminal device.

[0081] In some embodiments, in response to the terminal security detection result indicating that the target application after the hot update is a non-malicious application, security monitoring of the target application is continuously performed within a second preset time.

[0082] Considering that malicious code is highly hidden, a single security check may not be able to detect it. Therefore, when the security check result indicates that the target application after the hot update is a non-malicious application, it is necessary to continuously monitor the security of the target application within the second preset time.

[0083] In some embodiments, if the query result received from the application store cloud after the hot update indicates that the hot update behavior is malicious, the hot update is stopped, the target application is uninstalled, the patch file is deleted, and the target application is downloaded again from the application store. If the query result indicates that the hot update behavior is non-malicious, the security detection result of the terminal device is mainly used for subsequent operations.

[0084] In some embodiments, after step 53, the terminal security detection result, the patch file identifier, the original file identifier, and the updated application file identifier are uploaded to the application store cloud.

[0085] By uploading the terminal security detection results, patch file identifiers, original file identifiers, and updated application file identifiers to the application store cloud, on the one hand, if the application store cloud does not have the cloud security detection results corresponding to the patch file identifier, the results can be stored in the application store cloud, reducing the security detection of the patch file by the application store cloud.

[0086] On the other hand, if the application store cloud has cloud security detection results corresponding to the patch file identifier, but they are not fed back in time due to network problems, the application store cloud can combine the cloud security detection results and the terminal security detection results to comprehensively determine whether the hot update behavior of the target application is malicious behavior, and use this as the basis for subsequent queries.

[0087] Specifically, if the app store cloud cannot provide timely feedback due to network problems and receives terminal security detection results of patch files sent by multiple terminal devices, it can combine multiple terminal security detection results and cloud security detection results for comprehensive evaluation. If the security detection results are presented in percentages, the weighted sum of multiple percentages can be used as the final cloud security detection result.

[0088] In one application scenario, for an application that performs hot updates by merging or adding patch files, the present application proposes security software on a terminal device. Once the security software detects that the application starts to perform hot update behavior, the security software records the relevant information of this hot update.

[0089] The security software uses {application package name, hash value of the patch file, hash value of the original application file before hot update} as the identifier of the hot update behavior of the application, and queries the application store cloud to see whether there is a security detection record associated with the hot update of the application.

[0090] If the app store cloud already has a security check record for this app hot update, the security software will decide whether to allow this app hot update based on the query test results.

[0091] If the app store cloud has no security check record for this app hot update, the security software will upload the patch file to be used for this app hot update to the app store cloud for security check and obtain the security check result, after obtaining the user's consent and the app store has obtained the consent (authorization) of the app developer in advance.

[0092] In the event that the cloud security test results are not obtained due to network delays and other factors, the security software will perform terminal security tests on the application after the hot update, and report the terminal security test results and the recorded relevant information of this hot update to the application store cloud.

[0093] The cloud uses statistical analysis and other methods to comprehensively analyze the results reported by the terminal devices and the number of terminal devices reporting different results, comprehensively adopts the detection results of this application hot update reported by the terminal devices, and uses them for subsequent feedback to other terminal devices.

[0094] Specifically, first, the app store cloud communicates with the app developer to confirm whether the app developer agrees that the security software on the terminal device will upload the patch file used for the app hot update to the app store cloud for application security testing when the app is hot updated.

[0095] Next, once the security software on the terminal device detects that the application (denoted as APP1) starts to perform hot update behavior (detection method such as identifying key initial behavior of application hot update, etc.), the security software suspends APP1's hot update and triggers security detection.

[0096] The security software records the relevant information of this hot update, including: the package name of the application performing the hot update (recorded as packageName), the hash value of the patch file used for this hot update (recorded as fixDexHash), and the hash value of the original file of the application before performing the hot update (recorded as OriginDexHash).

[0097] The security software uses {packageName, fixDexHash, OriginDexHash} as the identifier of APP1's hot update behavior, and queries whether there is a security detection result corresponding to APP1's hot update behavior.

[0098] If so, the security software will decide whether to allow APP1 to perform this hot update based on the queried detection results.

[0099] If it is found that the hot update behavior of APP1 is malicious, the security software will intercept the hot update behavior of APP1, inform the user, and provide the user with subsequent operation options (such as prohibiting APP1 from hot updating, uninstalling APP1, allowing APP1 to hot update and then perform a whole-machine security check, etc.).

[0100] If it is found that the hot update behavior of APP1 is normal (non-malicious), the security software allows APP1 to perform the hot update and informs the user of the query result.

[0101] If there is no security detection result corresponding to the hot update behavior of APP1 in the cloud query of the application store, and the security detection result corresponding to the hot update behavior of APP1 has been agreed to by the application developer in advance, the security software will ask the user whether he agrees to upload the patch file used for this hot update of APP1 to the cloud of the application store for security detection through a pop-up window or other means.

[0102] If the user agrees, the security software will upload the patch file and {packageName, fixDexHash, OriginDexHash} to the app store cloud.

[0103] If the user disagrees, the user will be provided with subsequent operation options (such as prohibiting APP1 from hot updating, uninstalling APP1, allowing APP1 to perform a safety check on the entire device after the hot update, etc.).

[0104] If the App Store cloud query does not have the security detection result corresponding to the current hot update behavior of APP1, and the application developer of APP1 opposes the terminal device to actively upload the patch file, the security software will upload {packageName, fixDexHash, OriginDexHash} to the App Store cloud. The App Store cloud notifies the application developer to actively and promptly upload the patch file corresponding to fixDexHash to the App Store cloud.

[0105] Furthermore, when the terminal device fails to receive the queried cloud detection results in time due to network delays or other reasons, the security software allows APP1 to be hot-updated, and temporarily restricts APP1's access to sensitive resources after the APP hot-update, and performs code security detection on APP1 in time.

[0106] The security software then takes corresponding actions based on the detection results (if it is normal, APP1 is allowed to execute normally; if it is malicious, APP1's access to sensitive resources is restricted and the user is asked whether to uninstall it).

[0107] The security software reports the detection result, the hash value of the patch file after the hot update of APP1 (recorded as fixedDexHash), and the above-mentioned {packageName, fixDexHash, OriginDexHash} to the application store cloud.

[0108] The application store cloud can conduct statistical analysis on the detection results reported by different terminal devices for the same APP1, comprehensively evaluate and analyze the detection results of the hot update of the APP1 application reported by each terminal, and decide whether to trust the received reported results.

[0109] The application store cloud can combine the terminal monitoring results to assist the application store cloud in judging the maliciousness of the patch file and the hot-updated APP1. The application store cloud's judgment results on the maliciousness of the patch file and the hot-updated APP1 are used for subsequent query requests fed back by the application store cloud to other terminal devices.

[0110] See also Figure 6The terminal device 60 includes a processor 61, a memory 62 and a communication module 63 coupled to the processor 61, and the communication module 63 is used to communicate with the server;

[0111] The memory is used to store the computer program, and the processor is used to execute the computer program to implement the following method:

[0112] In response to detecting a hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query; the query result fed back by the application store cloud is received, and corresponding processing is performed according to the query result.

[0113] It can be understood that the processor 61 is used to execute a computer program to implement the method of any of the above embodiments.

[0114] See also Figure 7 , Figure 7 1 is a schematic diagram of the structure of another embodiment of the electronic device provided by the present application. The electronic device 110 may be, for example, the terminal device mentioned above. The electronic device 110 may include: a memory 112, a processor (Central Processing Unit, CPU) 111, a circuit board (not shown in the figure), a power circuit and a microphone 123. The circuit board is placed inside the space surrounded by the shell; the processor 111 and the memory 112 are arranged on the circuit board; the power circuit is used to supply power to various circuits or devices of the electronic device; the memory 112 is used to store executable program code; the processor 111 runs the computer program corresponding to the executable program code by reading the executable program code stored in the memory 112, so as to implement the method of any of the above embodiments.

[0115] The electronic device may also include: a peripheral interface 114, an RF (Radio Frequency) circuit 116, an audio circuit 117, a speaker 122, a power management chip 119, an input / output (I / O) subsystem 120, other input / control devices 121, a display 113 and an external port 115. These components communicate through one or more communication buses or signal lines 118.

[0116] The memory 112 can be accessed by the processor 111, the peripheral interface 114, etc. The memory 112 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more disk storage devices, flash memory devices, or other volatile solid-state storage devices. The peripheral interface 114 can connect the input and output peripherals of the device to the processor 111 and the memory 112.

[0117] The I / O subsystem 120 can connect the input and output peripherals on the device, such as the display 113 and other input / control devices 121, to the peripheral interface 114. The I / O subsystem 120 may include a display controller 1201 and one or more input controllers 1202 for controlling other input / control devices 121. Among them, the one or more input controllers 1202 receive electrical signals from other input / control devices 121 or send electrical signals to other input / control devices 121. Other input / control devices 121 may include physical buttons (press buttons, rocker buttons, etc.), dials, slide switches, joysticks, and click wheels. It is worth noting that the input controller 1202 can be connected to any of the following: a keyboard, an infrared port, a USB interface, and a pointing device such as a mouse.

[0118] The display 113 is an input interface and an output interface between the user electronic device and the user, and displays visual output to the user. The visual output may include graphics, text, icons, videos, etc.

[0119] The display controller 1201 in the I / O subsystem 120 receives an electrical signal from the display 113 or sends an electrical signal to the display 113. The display 113 detects contact on the touch screen, and the display controller 1201 converts the detected contact into interaction with a user interface object displayed on the display 113, that is, realizes human-computer interaction. The user interface object displayed on the display 113 may be an icon for running a game, an icon for connecting to a corresponding network, etc.

[0120] The RF circuit 116 is mainly used to establish communication between the mobile phone and the wireless network (i.e., the network side) to realize data reception and transmission between the mobile phone and the wireless network. For example, sending and receiving short messages, emails, etc. Specifically, the RF circuit 116 receives and sends RF signals, which are also called electromagnetic signals. The RF circuit 116 converts electrical signals into electromagnetic signals or converts electromagnetic signals into electrical signals, and communicates with the communication network and other devices through the electromagnetic signals. The RF circuit 116 may include known circuits for performing these functions, including but not limited to antenna systems, RF transceivers, one or more amplifiers, tuners, one or more oscillators, digital signal processors, CODEC (COder-DECoder, codec) chipsets, Subscriber Identity Module (SIM), etc.

[0121] The audio circuit 117 is mainly used to receive audio data from the peripheral interface 114, convert the audio data into an electrical signal, and send the electrical signal to the speaker 122. The speaker 122 is used to restore the voice signal received by the mobile phone from the wireless network through the RF circuit 116 to sound and play the sound to the user. The power management chip 119 is used to provide power supply and power management for the processor 111, the I / O subsystem 120 and the hardware connected to the peripheral interface 114.

[0122] The electronic device 110 mentioned above may be a mobile terminal, such as a smart phone, a tablet or other mobile device, or a terminal device, such as a personal computer, or a corresponding server, such as a log server.

[0123] See also Figure 8 , Figure 8 1 is a schematic diagram of a computer readable storage medium according to an embodiment of the present application. The computer readable storage medium 150 stores a computer program 151. When the computer program 151 is executed by a processor, the following method is implemented:

[0124] In response to detecting a hot update behavior of the target application, the hot update behavior is suspended, and the corresponding patch file identifier and the original file identifier are uploaded to the application store cloud for security detection result query; the query result fed back by the application store cloud is received, and corresponding processing is performed according to the query result.

[0125] It can be understood that when the computer program 151 is executed by a processor, it can also implement the method of any of the above embodiments.

[0126] To summarize, the application hot update processing method, terminal device and readable storage medium provided in the present application, in response to detecting the hot update behavior of the target application, suspend the hot update behavior, and upload the corresponding patch file identifier and the original file identifier to the application store cloud for security detection result query; receive the query results fed back by the application store cloud, and perform corresponding processing according to the query results, and can query the application store cloud for the security detection record of the current hot update of the application, so as to reduce the computational amount of the terminal device for the security detection of the hot update application, and utilize the computing power of the application store cloud and a more accurate security model to improve the detection efficiency without reducing security.

[0127] Furthermore, when the application hot update starts, the terminal device of the present application promptly suspends the hot update and performs a safety check on the hot update, thereby improving the security of the solution.

[0128] Furthermore, the application store cloud of the present application can obtain patch files for application hot updates in a timely manner by uploading them through terminal devices or actively uploading patch files by the application development end, thereby improving the coverage and efficiency of security detection of application hot update behavior by the application store cloud, facilitating timely detection of malicious hot updates of applications and timely feedback to terminal devices, thereby improving the security of the solution.

[0129] Furthermore, the application store cloud of the present application receives application hot update detection results reported by terminal devices, and conducts comprehensive analysis based on the reported results from a large number of terminal devices, to assist in the judgment of the hot update behavior of the same application, thereby improving the accuracy of the identification results and the security of the solution.

[0130] Furthermore, since the application store cloud corresponds to multiple terminal devices, hot updates of applications using the same patch file are triggered on multiple terminal devices. The above method can reduce the waste of security detection computing power of terminal devices and the application store cloud.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only illustrative, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0132] If the integrated units in the above other embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program codes.

[0133] The above description is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for processing application hot update, characterized in that: The method comprises: In response to detecting a hot update behavior of the target application, pausing the hot update behavior, and uploading the corresponding patch file identifier and the original file identifier to the application store cloud for security detection result query; Receive the query result fed back by the application store cloud, and perform corresponding processing according to the query result.

2. The method according to claim 1, characterized in that The performing corresponding processing according to the query result includes: In response to the query result indicating that there is a security check, and the security check result indicating that the hot update behavior is a malicious behavior, the hot update behavior of the target application is intercepted.

3. The method according to claim 2, characterized in that After intercepting the hot update behavior of the target application, the method further comprises: Operation options are provided, and the operation options include at least one of uninstalling the target application, prohibiting the hot update behavior, allowing the hot update behavior and performing a whole-machine safety check after the update.

4. The method according to claim 1, characterized in that The performing corresponding processing according to the query result includes: In response to the query result indicating that no security check exists, uploading the patch file corresponding to the patch file identifier to the application store cloud for cloud security check; Receive the cloud security detection result fed back by the application store cloud, and perform corresponding processing according to the cloud security detection result.

5. The method according to claim 4, characterized in that In response to the query result indicating that there is no security detection, uploading the patch file corresponding to the patch file identifier to the application store cloud for cloud security detection, including: In response to the query result indicating that there is no security check and the application development end authorizes the upload, uploading the patch file corresponding to the patch file identifier to the application store cloud for cloud security check; In response to the query result indicating that there is no security check and the application development end does not authorize the upload, the application development end is notified to upload the patch file corresponding to the patch file identifier to the application store cloud for cloud security check.

6. The method according to claim 1, characterized in that The method further comprises: In response to not receiving the query result within a first preset time, hot updating the target application using the patch file; Perform terminal security detection on the target application after the hot update, and in response to the terminal security detection result indicating that the target application after the hot update is a malicious application, limit the resource access scope of the target application and / or remind to uninstall the target application.

7. The method according to claim 6, characterized in that After performing terminal security detection on the target application after hot update, the method includes: The terminal security detection result, the patch file identifier, the original file identifier, and the updated application file identifier are uploaded to the application store cloud.

8. The method according to claim 6, characterized in that Uploading the terminal security detection result, the patch file identifier, the original file identifier, and the updated application file identifier to the application store cloud, including: The terminal security detection result, the patch file identifier, the original file identifier, and the updated application file identifier are uploaded to the application store cloud, so that the application store cloud can comprehensively judge the hot update behavior of the target application based on the cloud security detection result and the terminal security detection result.

9. A terminal device, characterized in that: The terminal device includes a processor, a memory and a communication module coupled to the processor, and the communication module is used to communicate with an application store cloud server; The memory is used to store a computer program, and the processor is used to execute the computer program to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 8.

Images