Application installation method, application access method, operating system and intelligent card

Abstract

The invention relates to the technical field of smart cards, and discloses an application installation method, an application access method, an operating system and a smart card, and a plurality of applications are installed in the operating system of the smart card application. When the operating system is used for installing an application, the method comprises the following steps: creating a directory file corresponding to the current application and a basic data file located under the directory file; wherein the directory file is a directory file supporting file system data access, and the basic data file is at least used for storing an application object; when an application on the smart card is accessed, determining an application identifier according to an application access request or determining object reference information according to the application access request; and determining an accessed target directory file according to the application identifier or determining a target object according to the object reference information. The intelligent card can be accessed by adopting a file system data access mode and can also be accessed by adopting object data access; and the security of the applications of the smart card installed with the plurality of applications can be improved.

Description

Technical Field

[0001] The present application relates to the field of smart card technology, and in particular to an application installation method, an access method, an operating system and a smart card. Background Art

[0002] For the convenience of using the card, the existing smart card can realize the integration of multiple applications. For example, a card can be used as a bank card, a bus card, a social security card, etc. However, due to the different card application types, the data access methods are also different. Some need to use file system data access, and some need to use object data access. The inventor of this application noticed in the research that the same smart card in the prior art can usually only provide one data access method, so it has certain limitations, and the data of multiple applications of the smart card in the prior art is easy to cross, which makes the application unsafe. Summary of the invention

[0003] In view of this, embodiments of the present application provide an application installation method, an access method, an operating system, and a smart card, which can improve the security of applications on a smart card with multiple applications installed.

[0004] In a first aspect, an embodiment of the present application provides an application installation method, which is applied to a smart card, and the method includes:

[0005] When the application is installed, a directory file corresponding to the current application and a basic data file under the directory file are created; wherein the directory file is a directory file that supports file system data access, and the basic data file is used to store at least the objects of the application.

[0006] In some embodiments, the method further includes: storing an application identifier of the current application in the corresponding directory file, so that the current application and the directory file form a one-to-one correspondence.

[0007] In some embodiments, the method further includes: creating an object corresponding to the current application, storing basic information of the current object into the corresponding basic data file, and generating object reference information of the object;

[0008] Registering an object to establish a mapping relationship between the object reference information of the current object and the variable accessing the object in the current application;

[0009] The object reference information includes an application identifier of an object-associated application.

[0010] In some embodiments, it also includes: allocating memory space for the current application, and packaging the directory file, the basic data file and the memory space of the current application into an independent space.

[0011] In a second aspect, an embodiment of the present application provides an application access method for accessing multiple applications installed in an operating system according to the above-mentioned application installation method, including:

[0012] In response to an application access request, determining an application identifier according to the application access request or determining object reference information according to the application access request;

[0013] The target directory file to be accessed is determined according to the application identifier or the target object is determined according to the object reference information.

[0014] In some embodiments, if the application access request is requested by calling a file system data access interface, after determining the target directory file to be accessed according to the application identifier, the method further includes:

[0015] Switch the file system to the target directory file to access the basic data files under the target directory file; or, if the application access request is requested by calling an object access interface, determine the target object based on the object reference information, including: obtaining the object-associated application identifier and the object unique identifier in the object reference information; determine the access object based on the object unique identifier; obtain the object application identifier in the object attribute information of the access object; compare the object application identifier in the object attribute information with the object-associated application identifier in the object reference information; if they are consistent, determine that the access object is the target object.

[0016] In some embodiments, each of the applications is a wasm application;

[0017] When the current application interacts with the operating system or other applications, the interactive access operation is performed by calling the interactive interface of the operating system or other applications.

[0018] In a third aspect, an embodiment of the present application provides an operating system, which is used to provide a creation interface when an application is installed, so that the application executes the above-mentioned application installation method by calling the creation interface;

[0019] During application access, the operating system executes the above-mentioned application access method by calling the access interface.

[0020] In some embodiments, the operating system is further used to monitor the memory space usage of each application and adjust the memory space of each application according to the memory space usage.

[0021] In a fourth aspect, an embodiment of the present application provides a smart card, on which the above-mentioned operating system is installed; and a plurality of applications are installed in the operating system.

[0022] The embodiments of the present application have the following beneficial effects: the smart card of the embodiments of the present application can install multiple applications, including but not limited to bank card applications, social security card applications, bus card applications, membership card applications, student card applications, etc., that is, the smart card can be used as but not limited to bank cards, social security cards, bus cards, membership cards, student cards, etc., so that the application can be accessed using the file system data access method or the object data access method; in addition, the data between multiple applications in the smart card can also be isolated from each other, that is, each application can intelligently access its own data, thereby realizing the safe application of the smart card. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A schematic diagram showing a flow chart of an application installation method according to an embodiment of the present application;

[0025] Figure 2 A schematic diagram showing a flow chart of an application access method according to an embodiment of the present application is shown;

[0026] Figure 3 A schematic structural diagram of a smart card according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0028] The components of the embodiments of the present application generally described and shown in the drawings herein may be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0029] Hereinafter, the terms "including", "having" and their cognates that can be used in various embodiments of the present application are intended only to indicate specific features, numbers, steps, operations, elements, components or a combination of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or a combination of the foregoing items or increasing the possibility of one or more features, numbers, steps, operations, elements, components or a combination of the foregoing items. In addition, the terms "first", "second", "third" and the like are only used to distinguish descriptions and cannot be understood as indicating or implying relative importance.

[0030] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present application belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present application.

[0031] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0032] Since the same smart card in the prior art can usually only provide one data access method, it has certain limitations, and the data of multiple applications of the smart card in the prior art are easily crossed, which makes the application unsafe.

[0033] Based on this, the present application proposes an application installation method, an access method, an operating system and a smart card to achieve data isolation between multiple applications on the same smart card, thereby improving the security of access between multiple applications.

[0034] The application installation method is described below in conjunction with some specific embodiments.

[0035] The application installation method of the embodiment of the present application is applied to a smart card, and the method includes:

[0036] When an application is installed, a directory file corresponding to the current application and a basic data file under the directory file are created synchronously.

[0037] The directory file is a directory file that supports file system data access; the basic data file is at least used to store objects of the corresponding application.

[0038] Among them, file system data access is a way to store, retrieve and manage data through file and directory structures. In most operating systems, the file system organizes data in a tree structure, where each file or directory is a node and the location of the file or directory is located by the path name. Object data access mainly relies on the data structure and methods provided by object-oriented programming languages ​​(such as Java, C++, Python, etc.). In such an environment, data is regarded as an object, and each object has specific properties and methods (operations).

[0039] When an application is installed on an operating system, the operating system synchronously creates a directory file for the application. The directory file is associated with the currently installed application, that is, the directory file created by the operating system is only used to store data of the currently installed application.

[0040] After creating the directory file corresponding to the currently installed application, the currently installed application can create its own basic data files by calling the file creation interface. These basic data files are placed under the directory file of the currently installed application.

[0041] Among them, for applications accessed through objects, its basic data file is the basis for object creation, registration and management. It records the basic information of the object (such as object type, object attributes and access rights, etc.) and object data. Through the provided object access interface, the operating system can efficiently support the creation, registration and management of application objects, thereby providing a stable and secure environment for the multi-application smart card operating system, ensuring data isolation and interoperability between various applications. For applications accessed through files, its basic data files include but are not limited to binary files, record files and key files; wherein, binary files are used to store a series of data units and are accessed through offset addresses; record files include but are not limited to fixed-length record files, variable-length record files, and circular record files. If an application supports both file system access and object data methods, then when the application is installed and the basic data file located under the directory file is created, its basic file data includes the basis for object creation, registration and management, and also includes application-related data (including but not limited to binary files, record files and key files), thereby enabling the application to achieve both file system access and object data access.

[0042] In some embodiments, for directory files that support file system data access, the directory file data structure includes but is not limited to fields such as file identification, file type, link address of the first basic data file, link address of the next directory file of the same level, parent directory file address, operation permission byte, application identification of the associated application, etc.; these fields are all used to retrieve files when accessing files. For example, when accessing an application, the associated directory file will be opened at the same time, that is, the corresponding directory file will be retrieved from the file list through the application identification, and the link address of the next directory file of the same level will be obtained in sequence from the root directory to compare the application identification of the associated application to search; if accessing the basic data files under the directory, it is necessary to search and search in sequence from the link address of the first basic file under the currently opened directory file according to the file identification of the specified file until there is no link address of the next file; the operation permission byte is used for file access control to control the reading, writing, creation, and deletion operations of the file.

[0043] It should be noted that when installing the application, only one directory file is created, but the application supports both file system data access and object data access. In order to implement this design, when creating the basic data file under the directory file, the basic information of the object is stored in the basic data file.

[0044] In some implementations, the method further includes: storing an application identifier of the current application in a corresponding directory file, so that the current application and the directory file form a one-to-one correspondence.

[0045] It can be understood that if the application to be installed is suitable for file system data access, in this embodiment, the application identifier of the application can be stored in the corresponding directory file to link the application and the directory file. In this way, when accessing the application, the corresponding directory file can be determined according to the application identifier in the application access request, thereby realizing that the application can only access the files in its corresponding directory.

[0046] If the installed application is suitable for object data access, then Figure 1 As shown, the method of this embodiment also includes:

[0047] Step S10, creating an object corresponding to the current application, and storing basic information of the current object in a corresponding basic data file.

[0048] Step S20, registering the object to establish a mapping relationship between the object reference information of the current object and the variable for accessing the object in the current application.

[0049] For example, the object reference information includes a unique identifier of the object and an application identifier of an associated application.

[0050] It can be understood that for applications suitable for object data access, objects will be created by calling the object creation class interface provided by the operating system. In the process of creating objects, the basic information of the object (such as object type, attributes, methods, etc.) will be stored in the basic data file. These basic information are used to guide the operating system on how to understand and execute the behavior of the object; and the corresponding application reference information is generated while storing the basic information of the object in the corresponding basic data file. After the object is created, the object registration is performed by calling the object registration interface of the operating system to establish a mapping relationship between the object reference information of the current object and the variable for accessing the object in the current application to ensure that the object can be correctly managed, accessed and tracked; wherein, the object reference information includes but is not limited to the unique identifier of the object and the application identifier of the associated application, so that when accessing the object through the object data access method, the object reference information can be determined by accessing the variable of the object, thereby realizing the access of the object; it can be understood that the object reference information will be established when the object is created, and the object can be accessed through the object reference information when the object is accessed later.

[0051] In some implementations, the application installation method of the embodiment of the present application further includes: allocating memory space for the current application, and encapsulating the directory files, basic data files and memory space of the current application into an independent space.

[0052] It can be understood that this embodiment encapsulates the directory files, basic data files and memory space allocated by the operating system for each application into an independent space, thereby realizing application isolation of multiple applications in the same operating system, ensuring that the operation of one application will not affect or interfere with the operation and data security of other applications, and providing a security foundation for subsequent application access, in which each application can only access its own associated data.

[0053] The embodiment of the present application creates a directory file corresponding to the application when the application is installed, and creates a basic data file under the directory file, so that when multiple applications are installed on the operating system, each application corresponds to its own directory file, which provides a basis for subsequent applications to only access the data corresponding to the application when accessing. In addition, the directory file, basic data file and memory space allocated by the operating system for each application are encapsulated into an independent space, so that even if an application fails or is maliciously attacked, its impact is limited to its own operating environment and will not spread to other applications or the operating system itself. In this embodiment, a mapping relationship is formed between the installed application and the file system directory file, and the file system is switched to the corresponding directory file when the application is selected, so that the data of other applications can be invisible to the current application, that is, the file system only exposes the current directory file to the application during the switching process, and the directory files of other applications are invisible to the currently running application, so as to prevent an application from snooping or modifying the data of other applications, thereby realizing the isolation of application data.

[0054] In another embodiment, Figure 2 A flow chart of an application access method according to an embodiment of the present application is shown. Exemplarily, the application access method is used to access multiple applications installed in an operating system according to the application installation method of the above embodiment, and the method includes:

[0055] Step S100: In response to an application access request, determining an application identifier according to the application access request or determining object reference information according to the application access request.

[0056] Step S200: determining a target directory file to be accessed according to an application identifier or determining a target object according to object reference information.

[0057] Exemplarily, when a user needs to access an application in an operating system, the user can access the application through the access interface provided by the operating system, that is, by calling the access interface to send an application access request to the operating system. Among them, the access interface provided by the operating system can be divided according to the access method, and it provides a file system access class interface and an object access class interface; that is, if a certain application is accessed by calling the file system access class interface, the operating system can determine the target directory file according to the application identifier in the application access request, so that when accessing the application, only the directory file corresponding to the application is accessed. Further, in this embodiment, after determining the target directory file, the operating system can switch the file system to the target directory file to access the target directory file, thereby realizing that the application can only access the data under the current directory file, but cannot access the data of other applications. That is to say, after determining the application to be accessed and before canceling the access to the application, the read and write operations of the basic data file when the application processes the command can only be limited to this directory file, and the application cannot open other directory files through the interface, thereby ensuring that the application can only access the data under this directory file, and then realizing the firewall function.

[0058] If an application is accessed by calling the object access class interface of the operating system, the object reference information can be determined through the application access request, and then the target object can be determined according to the determined object reference information. Specifically, the object-associated application identifier and the object unique identifier are determined according to the object reference information in the application access request; then the access object is obtained according to the object unique identifier, and then the basic information of the access object (also called "object attribute information") is obtained. Among them, the basic information of the object (i.e., the object attribute information) is stored in the basic data file. After the basic information of the object is obtained, the application identifier (hereinafter referred to as "the object-associated application identifier") saved is obtained from the basic information of the object, and then the object-associated application identifier obtained from the basic information of the access object is compared with the object-associated application identifier obtained from the object reference information of the application access request, that is, the application identifier obtained from the basic data file is compared with the application identifier in the application access request. If they are consistent, it is determined that the access object is the target object. If they are inconsistent, it means that the application requesting access is not the owner of the access object, and access is denied. In this way, this embodiment can ensure that only the application initiating the access can access its own objects. If the object does not belong to the current application, it means that a security exception may occur and access is denied.

[0059] In some implementations, each application in the operating system is a wasm application, so the memory space of each application is completely independent, and the current application can only access the data in its own memory space, and cannot access the memory of other applications, unless through a controlled interface, thereby further achieving the independence and security of application data. When the current application interacts with the operating system or other applications, the interactive access operation is performed by calling the interactive interface of the operating system or other applications.

[0060] In this embodiment, based on the above-mentioned application installation method, when accessing an application, if the access is performed by calling a file system access interface, the application identifier is determined according to the application access request, and then the target directory file is determined according to the application identifier, so that when the application is accessed by file system data access, the application only accesses the data under the directory file corresponding to the application. Furthermore, in this embodiment, after the target directory file is determined, the file system of the operating system can be switched to the target directory file, so as to further ensure that the application in the access request can only access the data under its corresponding directory file, and cannot access the data under other applications. If the access is performed by calling an object access interface, the object reference information is first determined according to the application access request, and then the storage address of the object is obtained from the object registry according to the object reference information in the application access request, and then the target object is determined, so that it can be ensured that the application of the access request can only access its own objects. That is, the application access method of this embodiment can achieve that each application can only access its own data, thereby improving the security of data access.

[0061] In another embodiment, the present application shows an operating system, which, when installing an application, is used to provide a creation interface so that the application can install the application by calling the creation interface to execute the above-mentioned application installation method; when accessing the application, the operating system accesses the application by calling the access interface to execute the above-mentioned application access method.

[0062] It can be understood that the operating system of this embodiment is the same as the above embodiment in terms of application installation and application access, so it will not be described again here.

[0063] In some embodiments, the operating system is further configured to monitor the memory space usage of each application, and adjust the memory space of each application according to the memory space usage. Exemplarily, when the application is installed, the operating system allocates a memory space to the installed application for the normal operation of the application. In addition, the operating system can also monitor the memory space of each application, and then adjust the memory space of the application according to the memory space usage of the application, so as to prevent the application from excessively occupying resources and affecting the normal operation of other applications, and also to prevent the application from being affected by insufficient memory space.

[0064] In some embodiments, the operating system is also used to set security policies and permissions for each application, so that different applications can be set differently. For applications with higher confidentiality or security requirements, high standards can be set for security levels and permissions. For applications with lower security requirements, security levels and access permissions can be set as needed. This is crucial for protecting sensitive application data, preventing unauthorized access, and ensuring that different applications do not interfere with each other.

[0065] In some implementations, the operating system also provides an object deletion interface, and the application can delete the object by calling this interface. The deleted object cannot be accessed, and the object data space can also be released.

[0066] In yet another embodiment, the present application proposes a smart card, such as Figure 3 As shown, the smart card 100 is installed with the above-mentioned operating system 110 ; the operating system 110 is installed with a plurality of applications.

[0067] It can be understood that the operating system 110 used in the smart card 100 of this embodiment has been described in the above embodiments, so it will not be described again here.

[0068] According to the above embodiments, the smart card 100 can be installed with multiple applications, including but not limited to bank card applications, social security card applications, bus card applications, membership card applications, student card applications, etc., that is, the smart card 100 can be used as but not limited to bank cards, social security cards, bus cards, membership cards, student cards, etc., so that applications can be accessed using file system data access methods or object data access methods; in addition, the data between multiple applications in the smart card 100 can also be isolated from each other, that is, each application can access its own data, thereby realizing the secure application of the smart card 100. In addition, the operating system 110 in the present application provides different interfaces for the file system and object data, so that while realizing different data access methods, application developers do not need to design the data management structure from scratch, thereby reducing development complexity.

[0069] The smart card of this embodiment further includes a processor and a memory, wherein the memory stores a computer program, and the processor runs the computer program, thereby enabling the smart card to execute the above-mentioned application installation method or the above-mentioned application access method.

[0070] Among them, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU) and a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or at least one of other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., which can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application.

[0071] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory is used to store a computer program, and the processor may execute the computer program accordingly after receiving an execution instruction.

[0072] The present application also provides a computer-readable storage medium for storing the computer program used in the smart card. For example, the computer-readable storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0073] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or the flow diagram, and the combination of boxes in the structure diagram and / or the flow diagram, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0074] In addition, the functional modules or units in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0075] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

[0076] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. An application installation method, characterized in that: Applied to a smart card, the method comprises: When the application is installed, a directory file corresponding to the current application and a basic data file under the directory file are created; wherein the directory file is a directory file that supports file system data access, and the basic data file is used to store at least the objects of the application.

2. The application installation method according to claim 1, characterized in that: Also includes: The application identifier of the current application is stored in the corresponding directory file, so that the current application and the directory file form a one-to-one correspondence.

3. The application installation method according to claim 1, characterized in that: Also includes: Creating an object corresponding to the current application, storing basic information of the current object into the corresponding basic data file and generating object reference information of the object; Registering an object to establish a mapping relationship between the object reference information of the current object and the variable accessing the object in the current application; The object reference information includes an application identifier of an object-associated application.

4. The application installation method according to any one of claims 1 to 3, characterized in that: Also includes: A memory space is allocated for the current application, and the directory file, the basic data file and the memory space of the current application are packaged into an independent space.

5. An application access method, characterized in that: Used to access multiple applications installed in an operating system according to the application installation method according to any one of claims 1 to 4, comprising: In response to an application access request, determining an application identifier according to the application access request or determining object reference information according to the application access request; The target directory file to be accessed is determined according to the application identifier or the target object is determined according to the object reference information.

6. The application access method according to claim 5, characterized in that: If the application access request is made by calling a file system data access interface, after determining the target directory file to be accessed according to the application identifier, the method further includes: switching the file system to the target directory file to access the basic data files under the target directory file; or If the application access request is requested by calling an object access interface, then determining the target object based on the object reference information includes: obtaining the object-associated application identifier and the object unique identifier in the object reference information; determining the access object based on the object unique identifier; obtaining the object application identifier in the object attribute information of the access object; comparing the object application identifier in the object attribute information with the object-associated application identifier in the object reference information; if they are consistent, determining that the access object is the target object.

7. The application access method according to claim 5 or 6, characterized in that: Each of the above applications is a wasm application; When the current application interacts with the operating system or other applications, the interactive access operation is performed by calling the interactive interface of the operating system or other applications.

8. An operating system, characterized in that: When installing the application, the operating system is used to provide a creation interface so that the application executes the application installation method according to any one of claims 1 to 4 by calling the creation interface; During application access, the operating system executes the application access method as described in any one of claims 5 to 7 by calling an access interface.

9. The operating system according to claim 8, characterized in that: The operating system is also used to monitor the memory space usage of each application and adjust the memory space of each application according to the memory space usage.

10. A smart card, characterized in that: The smart card has the operating system as claimed in claim 8 installed thereon; the operating system has multiple applications installed therein.

Images