Application behavior control method, resource-constrained device, server and medium

Abstract

The invention discloses an application behavior control method, a resource-constrained device, a server and a medium, and the method comprises the steps: detecting an application behavior associated with a business application through an operating system, and transmitting the application behavior to a control application through a system interface; querying a record table item corresponding to the application behavior in the application behavior record table by controlling the application, and comparing the current recording frequency of the application behavior in the record table item with the maximum allowable frequency; feeding back a control result corresponding to the application behavior to the operating system according to the comparison result by controlling the application; wherein behavior types, current recording times and maximum allowable times corresponding to different application behaviors are recorded in the application behavior record table. According to the technical scheme of the embodiment of the invention, a mode of auditing and managing the application behaviors by the operating system in the actual operation process of the service application is provided, and the safety of the operating system in the resource-constrained equipment is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an application behavior control method, resource-constrained equipment, a server and a medium. Background Art

[0002] At present, in the scenario where the embedded operating system supports multiple applications in resource-constrained devices, the issuer and the business partner usually agree on the behavior of the application through authorization management before the product (i.e., the operating system) is released, such as allowing or prohibiting application download behavior. However, in the actual operation process, the current operating system can only control the application behavior according to the pre-agreed method, and cannot identify the application behavior with potential risks.

[0003] For example, in the communication field, in the scenario of supporting "SIM-SWP" mobile phone NFC near-field payment, the partner can manage the application "over the air" through the mobile phone. As the operator of the card issuer, after the agreement that allows the partner to load the application by itself takes effect, the partner can download and delete the business application according to business needs. However, if there is a problem with the partner's business system, resulting in high-frequency repeated application deletion and installation, it will cause the service life of the embedded hardware persistent memory to decrease, and then affect the normal use of other applications in the operating system. The operating system cannot identify such behavior; on the other hand, when a business dispute occurs, the issuer cannot audit the behavior record of the partner's application. When it can only rely on the business party's back-end business system to provide relevant data, it cannot obtain relevant data from the operating system, which is not conducive to the analysis and handling of the problem.

[0004] Therefore, existing embedded operating systems lack a way to audit and manage the behaviors generated during the actual operation of business applications, which has a certain impact on the normal use of the operating system. Summary of the invention

[0005] The present invention provides an application behavior control method, resource-constrained device, server and medium, and provides a way for an operating system to audit and manage application behavior during the actual operation of a business application, thereby improving the security of the operating system in the resource-constrained device.

[0006] According to one aspect of the present invention, there is provided an application behavior control method, the method being applied to a resource-constrained device supporting multiple applications; the method comprising:

[0007] After detecting the application behavior associated with the business application through the operating system, the application behavior is transmitted to the control application through the system interface;

[0008] By means of the control application, querying the record entry corresponding to the application behavior in the application behavior record table, and comparing the current record count of the application behavior in the record count with the maximum allowed count;

[0009] Feedback the control result corresponding to the application behavior to the operating system according to the comparison result through the control application;

[0010] The application behavior record table records the behavior types, current record times, and maximum allowed times corresponding to different application behaviors.

[0011] According to another aspect of the present invention, there is provided an application behavior control method, which is applied to a backend system of an issuer, and comprises:

[0012] receiving an application behavior transmitted by a control application, and counting the occurrence frequency of the application behavior within a preset time period according to a historical transmission record corresponding to the application behavior;

[0013] According to the occurrence frequency, the risk coefficient corresponding to the operating system is evaluated, and if the risk coefficient is greater than a preset threshold, the control strategy corresponding to the application behavior is updated;

[0014] The updated control strategy corresponding to the application behavior is transmitted to the control application, so that the control application updates the application behavior record table according to the updated control strategy.

[0015] According to another aspect of the present invention, a resource-constrained device is provided, the resource-constrained device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application behavior control method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a server is provided, the server comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application behavior control method provided by any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application behavior control method described in any embodiment of the present invention when executed.

[0024] The technical solution provided by the embodiment of the present invention is that after the operating system detects the application behavior associated with the business application, the application behavior is transmitted to the control application through the system interface, the record table item corresponding to the application behavior is queried by the control application, and the current record number of the application behavior in the record table item is compared with the maximum allowed number; the control result corresponding to the application behavior is fed back to the operating system through the control application according to the comparison result; wherein the application behavior record table records the behavior type, current record number and maximum allowed number of technical means corresponding to different application behaviors, and provides a way for the operating system to audit and manage the application behavior during the actual operation of the business application, thereby avoiding the application behavior with potential risks from affecting the normal operation of the operating system and improving the security of the operating system in the resource-constrained device; secondly, by designing an independent control application, the execution logic that originally needs to be implemented by the operating system is handed over to a dedicated application for maintenance, which can reduce the burden of the operating system, facilitate the upgrading and maintenance of the audit function, and improve the flexibility of the application behavior control method; finally, the operating system distribution background can directly obtain the relevant data of the operating system from the control application, which is more conducive to the resource-constrained device to carry out related business activities and improve the scalability of the resource-constrained device.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flow chart of an application behavior control method provided according to an embodiment of the present invention;

[0028] Figure 2a is a flow chart of another application behavior control method provided according to an embodiment of the present invention;

[0029] Figure 2b is a schematic diagram of a function flag bit provided according to an embodiment of the present invention;

[0030] Figure 3a is a flow chart of another application behavior control method provided according to an embodiment of the present invention;

[0031] Figure 3b is a schematic diagram of a scenario applicable to an application behavior control method provided according to an embodiment of the present invention;

[0032] Figure 4 is a flow chart of another application behavior control method provided according to an embodiment of the present invention;

[0033] Figure 5 It is a structural diagram of a resource-constrained device or server that implements the application behavior control method of an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] Figure 1 This is a flow chart of an application behavior control method provided by an embodiment of the present invention. This embodiment can be applied to the case of controlling application behavior in a resource-constrained device supporting multiple applications. The method can be executed by the resource-constrained device. The method includes:

[0037] Step 110: After detecting the application behavior associated with the business application through the operating system, the application behavior is transmitted to the control application through the system interface.

[0038] In this embodiment, the business application is an application in a resource-constrained device. The operating system can be understood as a manager of the application in the resource-constrained device. After detecting that any business application in the device has a related system behavior (such as downloading, selecting or sharing call, etc.), the system behavior (i.e., application behavior) of the business application can be transmitted to the control application through the system interface.

[0039] The control application is a privileged application that is pre-made or later downloaded to the resource-constrained device and can directly obtain operating system-related data. The system interface can be a behavior notification interface pre-configured in the operating system, which is used to transmit application behaviors and related data detected by the operating system to the control application.

[0040] Step 120: query the application behavior record table for a record entry corresponding to the application behavior through the control application, and compare the current record count of the application behavior in the record entry with the maximum allowed count.

[0041] In this embodiment, the application behavior record table can be prepared in real time by the operating system release backend according to specific business scenarios before the operating system is released or during actual use.

[0042] The application behavior record table records the behavior types, current record times, and maximum allowed times corresponding to different application behaviors. Optionally, the different application behavior types may include application selection behavior, application download behavior, and application sharing call behavior. In the application, the application control strategy can be implemented based on the current record times and the maximum allowed times of the behavior.

[0043] Among them, the application selection behavior refers to the behavior of a business application in the operating system being set as the currently activated application; the application download behavior refers to the behavior of an external business application being downloaded to the operating system; and the application sharing and calling behavior refers to the behavior of a business application being legally shared and called by other applications.

[0044] In this step, after the control application obtains the application behavior, it can first traverse the application behavior record table to query whether there is a record table entry corresponding to the application behavior in the application behavior record table. If it exists, the current number of application behavior records in the application behavior record table is compared with the maximum allowed number of times to determine whether the application behavior is allowed. For example, if the current number of application behavior records is less than or equal to the maximum allowed number of times, the application behavior is allowed to execute; otherwise, the application behavior is not allowed to execute.

[0045] Step 130: Feedback the control result corresponding to the application behavior to the operating system through the control application according to the comparison result.

[0046] Finally, the comparison result is fed back to the operating system as the control result corresponding to the application behavior. Specifically, if the result fed back by the control application to the operating system is 1, it indicates that the application behavior is allowed to execute, and the operating system can continue to execute the code corresponding to the application behavior; if the result fed back by the control application to the operating system is 0, it indicates that the application behavior is prohibited from executing, and the operating system can terminate the application behavior and return an error code to the external entity corresponding to the application behavior.

[0047] The technical solution provided by the embodiment of the present invention detects the application behavior associated with the business application through the operating system, transmits the application behavior to the control application through the system interface, queries the record table item corresponding to the application behavior in the application behavior record table through the control application, and compares the current record number of the application behavior in the record table item with the maximum allowed number; through the control application, a technical means is used to feed back the control result corresponding to the application behavior to the operating system according to the comparison result, thereby providing a method for the operating system to audit and manage the application behavior during the actual operation of the business application, thereby preventing the application behavior with potential risks from affecting the normal operation of the operating system and improving the security of the operating system in resource-constrained devices; secondly, by designing an independent control application, the execution logic that originally needs to be implemented by the operating system is handed over to a dedicated application for maintenance, which can reduce the burden on the operating system, facilitate the upgrade and maintenance of the audit function, and improve the flexibility of the application behavior control method; finally, the operating system distribution background can directly obtain relevant data of the operating system from the control application, which is more conducive to the resource-constrained device to carry out related business activities and improves the scalability of the resource-constrained device.

[0048] Figure 2a A flowchart of another application behavior control method provided by an embodiment of the present invention is shown in FIG. Figure 2a As shown, the method includes:

[0049] Step 210: After the application behavior associated with the business application is detected through the operating system, the audit function is triggered.

[0050] Step 220 , traverse the pre-built application registry through the operating system to determine whether there is a control application in the application registry, if so, execute steps 230 - 250 , if not, execute step 260 .

[0051] In this embodiment, optionally, the application registration table records application programs that have been downloaded and are running normally in the resource-constrained device.

[0052] Step 230: Through the operating system, the application behavior is transmitted to the control application through the system interface.

[0053] In one implementation of this embodiment, the application behavior is transmitted to the control application through the system interface, including: the behavior type corresponding to the application behavior (such as downloading, selection or sharing call, etc.) and application identifier (Application Identifier, AID) information are transmitted to the control application through the system interface.

[0054] Step 240: query the application behavior record table for a record entry corresponding to the application behavior through the control application, and compare the current record count of the application behavior in the record entry with the maximum allowed count.

[0055] In one implementation of the present embodiment, the record entry corresponding to the application behavior in the application behavior record table is queried through the control application, including: querying a pre-configured function flag bit through the control application to obtain a function query result; if it is determined according to the function query result that the audit function matching the application behavior is in an enabled state, then querying the record entry corresponding to the application behavior in the application behavior record table according to the behavior type corresponding to the application behavior and the application identification information.

[0056] Among them, the function flag bit is mainly used by the operating system to identify whether the audit function matching the application behavior is in an enabled state. If it is enabled, the control application determines the legality of the application behavior; if it is disabled, the operating system directly allows the application behavior to execute.

[0057] Specifically, Figure 2b It can be a schematic diagram of a function mark bit in this embodiment, such as Figure 2b As shown, the function flag bit storage structure is a 1-byte bit table, in which bit b8 represents the working status of the overall audit function of the operating system, and bit b3, b2, and b1 represent the working status of some audit functions corresponding to different application behavior types respectively.

[0058] In one implementation of this embodiment, querying the pre-configured function flag bit through the control application includes:

[0059] Step 241, querying whether the overall audit function in the function flag bit is in an enabled state through the control application, if so, executing step 242, if not, executing step 243;

[0060] Step 242: According to the behavior type corresponding to the application behavior, query whether some audit functions matching the behavior type in the function flag bit are in an enabled state; if so, query the record entry corresponding to the application behavior in the application behavior record table by controlling the application, and compare the current number of application behavior records in the record entry with the maximum allowed number; based on the comparison result, feed back the control result corresponding to the application behavior to the operating system; if not, feed back the execution permission result to the operating system by controlling the application.

[0061] Step 243: Feedback the execution result to the operating system through the control application.

[0062] The advantage of this setting is that by pre-configuring the function flag bit, the audit requirements of the operating system for different application behaviors can be met, thereby improving the flexibility of the application behavior control method.

[0063] In a specific embodiment, the execution logic of the control application can be registered in the operating system callback function table during the installation phase, and the prototype of the execution logic is defined as: unsigned char notify(char type, aidtype aid); wherein type represents the audit function type, and aid represents the application identifier of the application or loading module that currently triggers this type of event.

[0064] Step 250: Feedback the control result corresponding to the application behavior to the operating system through the control application according to the comparison result.

[0065] Step 260: Exit the audit function through the operating system and execute the code corresponding to the application behavior.

[0066] In this embodiment, if there is no control application in the application registration table, that is, the operating system does not need to audit the application behavior, the operating system can exit the audit function and then execute the code corresponding to the application behavior normally.

[0067] The technical solution provided by the embodiment of the present invention triggers the audit function after the operating system detects the application behavior associated with the business application, traverses the pre-built application registry, and determines whether there is a control application in the application registry. If so, the application behavior is transmitted to the control application through the system interface through the operating system, and the record item corresponding to the application behavior in the application behavior record table is queried through the control application, and the current number of application behavior records in the record item is compared with the maximum allowed number; the control result corresponding to the application behavior is fed back to the operating system through the control application according to the comparison result; if not, the audit function is exited by the operating system, and the technical means corresponding to the code of the application behavior is executed. A method for the operating system to audit and manage application behavior during the actual operation of the business application is provided, thereby improving the security of the operating system in resource-constrained devices.

[0068] Figure 3a A flowchart of another application behavior control method provided by an embodiment of the present invention is shown in FIG. Figure 3a As shown, the method includes:

[0069] Step 301: After detecting application behaviors associated with business applications through the operating system, the behavior type and application identification information corresponding to the application behaviors are transmitted to the control application through the system interface.

[0070] Step 302: query the pre-configured function flag bit through the control application. If it is determined according to the query result that the audit function matching the application behavior is in an enabled state, query the record entry corresponding to the application behavior in the application behavior record table according to the behavior type corresponding to the application behavior and the application identification information.

[0071] Step 303 , through the control application, according to the query result, determine whether there is a record entry corresponding to the application behavior in the application behavior record table, if so, execute step 304 , if not, execute step 309 .

[0072] In a specific embodiment, the format of the application behavior record table may be as shown in Table 1:

[0073] Table 1

[0074]

[0075] Among them, the record type in Table 1 is used to indicate the application behavior type to which the record table item belongs. When recording specifically, the record type can be a code, and the application behavior type can be represented by the code. For example, the record type is 01, indicating that the application behavior type is application selection behavior; the record type is 02, indicating that the application behavior type is application sharing call behavior; the record type is 03, indicating that the application behavior type is application download behavior. The AID length indicates the application identification length of the application or loading module associated with the current application behavior; the AID content indicates the specific AID value; the current record count indicates the number of times the current application behavior has occurred; the maximum allowed number indicates the maximum number of times the operating system allows the current application behavior to occur.

[0076] Step 304, obtain the maximum allowed number of times set in the record entry, and determine whether the maximum allowed number of times is zero, if so, execute step 305, if not, execute step 306.

[0077] Step 305: increase the current record count recorded in the record entry by one, and then feed back the execution permission result to the operating system.

[0078] In this embodiment, if the maximum number of times set for a certain application behavior in the record table entry is zero, it can be considered that the operating system has no control strategy for the application behavior. In this case, the control application can increase the current number of records recorded in the record table entry by one, and then feed back the execution result to the operating system.

[0079] Step 306 , determine whether the current record count in the record entry plus one is greater than the maximum allowed count, if so, execute step 307 , if not, execute step 308 .

[0080] Step 307: Feedback the prohibition execution result to the operating system.

[0081] Step 308: increase the current record count recorded in the record entry by one, and then feed back the execution permission result to the operating system.

[0082] Step 309: Add a record entry corresponding to the application behavior in the application behavior record table according to the behavior type corresponding to the application behavior and the application identification information.

[0083] Step 310: In the added record entry, the maximum allowed number of times is set to zero, the current number of times of records is set to one, and then the execution permission result is fed back to the operating system.

[0084] The advantage of this setting is that by constructing an application behavior record table, the control application can feed back the control result to the operating system based on the traversal result of the application behavior record table, which can save the processing time of the application behavior and improve the control efficiency of the application behavior.

[0085] The technical solution provided by the embodiment of the present invention detects the application behavior associated with the business application through the operating system, transmits the behavior type corresponding to the application behavior and the application identification information to the control application through the system interface, queries the pre-configured function flag bit through the control application, and if the audit function matched by the application behavior is in an enabled state, queries the record entry corresponding to the application behavior in the application behavior record table, and judges whether there is a record entry corresponding to the application behavior in the application behavior record table according to the query result; if so, obtains the maximum allowed number of times set in the record entry, and if the maximum allowed number of times is zero, increases the current number recorded in the record entry by one, and then feeds back the allowed execution result to the operating system, and if the maximum number of times is not zero and the current number of times in the record entry is greater than the maximum number after being increased by one, feeds back the prohibited execution result to the operating system; if not, constructs the record entry corresponding to the application behavior, sets the maximum number of times to zero, sets the current number of times to one, and then feeds back the allowed execution result to the operating system. The technical means provides a way for the operating system to audit and manage the application behavior during the actual operation of the business application, thereby improving the security of the operating system in resource-constrained devices.

[0086] Based on the above embodiment, the method also includes: before querying the record entry corresponding to the application behavior in the application behavior record table through the control application, receiving different control strategies corresponding to different application behaviors transmitted by the issuer's backend system through the control application, and constructing the application behavior record table according to the control strategy.

[0087] Specifically, after the application behavior is passed to the control application through the system interface, it also includes: passing the application behavior to the background system corresponding to the operating system through the control application; if the control application receives the updated control strategy transmitted by the background system, the application behavior record table is updated according to the updated control strategy.

[0088] In a specific embodiment, Figure 3b This is a schematic diagram of a scenario in which an application behavior control method in this embodiment is applicable, such as Figure 3b As shown, business applications, operating systems, and control applications can be deployed in hardware devices (i.e., resource-constrained devices). After the operating system detects the application behavior associated with the business application, the behavior type and application identification information corresponding to the application behavior can be transmitted to the control application through the system interface.

[0089] The control application can pass the behavior type and application identification information corresponding to the application behavior to the issuer's backend system corresponding to the operating system. The issuer's backend system can analyze the application behavior, and then update the control strategy (such as the maximum allowed number of times corresponding to a certain application behavior, etc.) in real time based on the analysis results, and feed back the updated control strategy to the control application.

[0090] Specifically, when the issuer's backend system updates the control policy, it may update the maximum allowed number of times corresponding to a certain application behavior, or add a control policy for a new application behavior type, etc. This embodiment does not limit this.

[0091] In this embodiment, when data is transmitted between the control application and the issuer's backend system, active reporting or event acquisition may be adopted, and this embodiment does not limit this.

[0092] For example, the method of controlling the active reporting of applications is limited to operating systems that support the technical capability of actively sending data, such as SIM cards with the ability to send SMS or BIP. The SIM card can use existing remote communication technology to actively send application behaviors to the issuer's backend system in encrypted form.

[0093] For the issuer's backend system, the event acquisition method is adopted. Specifically, the issuer's backend system can send data acquisition instructions to the control application through communication channels such as counters. The control application responds to the data acquisition instructions and feeds back the application behavior to the issuer's backend system.

[0094] The advantage of this setting is that by controlling the application to transmit the application behavior to the background system corresponding to the operating system and receiving the updated control strategy fed back by the background system, the real-time nature of the control strategy can be ensured, thereby improving the effectiveness of the application behavior control results.

[0095] Figure 4 FIG. 1 is a flow chart of another application behavior control method provided according to an embodiment of the present invention. Figure 4 The method flow shown can be executed by the issuer's backend system. Figure 4 As shown, the application behavior control method executed by the issuer backend system includes:

[0096] Step 410: Receive an application behavior for controlling application delivery, and count the occurrence frequency of the application behavior within a preset time period according to a historical delivery record corresponding to the application behavior.

[0097] Step 420: Evaluate the risk coefficient corresponding to the operating system according to the occurrence frequency; if the risk coefficient is greater than a preset threshold, update the control strategy corresponding to the application behavior.

[0098] The higher the frequency of occurrence, the higher the risk factor; the lower the frequency of occurrence, the lower the risk factor. Different risk factor preset thresholds can be set for different types of application behaviors.

[0099] Alternatively, for different types of application behaviors, the risk coefficient may be determined in combination with the application behavior type and the occurrence frequency. In this case, different types of application behaviors may have the same preset risk coefficient threshold.

[0100] When the risk factor is greater than the corresponding preset threshold, the maximum allowed number of times in the control strategy can be reduced to avoid high-frequency execution of application behaviors and protect the hardware device. When reducing the maximum allowed number of times, the maximum allowed number of times can be reduced to the same degree according to the degree to which the risk factor exceeds the corresponding preset threshold, that is, degree = (risk factor-preset threshold) / preset threshold, that is, the updated maximum allowed number of times is the original maximum allowed number of times × (1-degree).

[0101] Step 430: delivering the updated control policy corresponding to the application behavior to the control application, so that the control application updates the application behavior record table according to the updated control policy.

[0102] By updating the control strategy according to the frequency of application behavior within a preset time period, the control strategy can be made more reasonable and the protection performance of the hardware equipment can be stronger.

[0103] Figure 5 FIG. 1 shows a schematic diagram of a resource-constrained device or server 10 that can be used to implement an embodiment of the present invention. Figure 5 As shown, the resource-constrained device or server 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the resource-constrained device or server 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0104] A number of components in the resource-constrained device or server 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the resource-constrained device or server 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0105] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the application behavior control method.

[0106] In some embodiments, the application behavior control method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the resource-constrained device or server 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the application behavior control method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the application behavior control method in any other appropriate manner (e.g., by means of firmware).

[0107] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0108] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0109] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0110] To provide interaction with a user, the systems and techniques described herein may be implemented on a resource-constrained device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the resource-constrained device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0111] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0112] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0113] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0114] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An application behavior control method, characterized in that: The method is applied to a resource-constrained device supporting multiple applications, and the method comprises: After detecting the application behavior associated with the business application through the operating system, the application behavior is transmitted to the control application through the system interface; By means of the control application, querying the record entry corresponding to the application behavior in the application behavior record table, and comparing the current record count of the application behavior in the record count with the maximum allowed count; Feedback the control result corresponding to the application behavior to the operating system according to the comparison result through the control application; The application behavior record table records the behavior types, current record times, and maximum allowed times corresponding to different application behaviors.

2. The method according to claim 1, characterized in that After detecting the application behavior associated with the business application through the operating system, it also includes: Triggering the audit function through the operating system, traversing the pre-built application registry, and determining whether there is a control application in the application registry; If it does not exist, the audit function is exited through the operating system, and the code corresponding to the application behavior is executed.

3. The method according to claim 1, characterized in that: The application behavior is transmitted to the control application through the system interface, including: The behavior type and application identification information corresponding to the application behavior are transmitted to the control application through the system interface; By means of the control application, querying the record entry corresponding to the application behavior in the application behavior record table includes: Through the control application, a pre-configured function flag is queried to obtain a function query result; If it is determined according to the function query result that the audit function matching the application behavior is enabled, then according to the behavior type corresponding to the application behavior and the application identification information, the record entry corresponding to the application behavior in the application behavior record table is queried.

4. The method according to claim 3, characterized in that: The pre-configured function flag bit is queried through the control application, including: querying, through the control application, whether the overall audit function in the function flag bit is in an enabled state; If the overall audit function is in an enabled state, then according to the behavior type corresponding to the application behavior, it is queried whether some audit functions matching the behavior type in the function flag bit are in an enabled state.

5. The method according to claim 4, characterized in that After querying, through the control application, whether the overall audit function in the function flag bit is in an enabled state, the method further includes: If the overall audit function is in a disabled state, the execution result is allowed to be fed back to the operating system through the control application; After querying whether some audit functions matching the behavior type in the function flag bit are in an enabled state, the method further includes: If the partial audit function is in a disabled state, the execution result will be allowed to be fed back to the operating system through the control application.

6. The method according to claim 3, characterized in that After querying the record entry corresponding to the application behavior in the application behavior record table, the method further includes: If there is no record entry corresponding to the application behavior in the application behavior record table, adding a record entry corresponding to the application behavior in the application behavior record table according to the behavior type corresponding to the application behavior and the application identification information; In the added record entry, the maximum allowed number of times is set to zero, the current number of times of recording is set to one, and then the execution permission result is fed back to the operating system.

7. The method according to claim 3, characterized in that Comparing the current number of application behavior records in the record entry with the maximum allowed number of times, and feeding back the control result corresponding to the application behavior to the operating system according to the comparison result, including: Determine whether the maximum allowed number of times in the record entry is zero; If it is zero, the current record count in the record table entry is increased by one, and then the execution permission result is fed back to the operating system; If it is not zero, determining whether the current record count in the record table item plus one is greater than the maximum allowed count; If it is greater, the execution result will be prohibited and fed back to the operating system; If not, the current record count recorded in the record entry is increased by one, and then the execution permission result is fed back to the operating system.

8. The method according to claim 1, characterized in that: Before querying the record entry corresponding to the application behavior in the application behavior record table through the control application, the method further includes: Through the control application, different control strategies corresponding to different application behaviors transmitted by the issuer's backend system are received, and the application behavior record table is constructed according to the control strategy.

9. The method according to claim 8, characterized in that After the application behavior is transmitted to the control application through the system interface, the method further includes: The application behavior is transmitted to the issuer backend system through the control application; If the control application receives the updated control policy transmitted by the issuer's backend system, the application behavior record table is updated according to the updated control policy.

10. An application behavior control method, characterized in that: The method is applied to the issuer backend system, and the method includes: receiving an application behavior transmitted by a control application, and counting the occurrence frequency of the application behavior within a preset time period according to a historical transmission record corresponding to the application behavior; According to the occurrence frequency, the risk coefficient corresponding to the operating system is evaluated, and if the risk coefficient is greater than a preset threshold, the control strategy corresponding to the application behavior is updated; The updated control strategy corresponding to the application behavior is transmitted to the control application, so that the control application updates the application behavior record table according to the updated control strategy.

11. A resource-constrained device, characterized in that: The resource-constrained device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application behavior control method according to any one of claims 1 to 9.

12. A server, characterized in that: The server comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application behavior control method described in claim 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application behavior control method according to any one of claims 1 to 9 or 10 when executed.

Images