Application operation environment detection method
By generating and sending application information to the cloud mobile platform on the cloud client and obtaining and verifying trust credentials, the lack of third-party application security detection in the cloud mobile environment is solved, and the security detection of the application operation environment is achieved.
Patent Information
- Application Number
- CN202411993682.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-31
- Publication Date
- 2025-04-22
AI Technical Summary
The prior art lacks effective security detection methods for the operation of third-party applications in cloud mobile environments.
By generating application information corresponding to the target application on the cloud client and sending it to the cloud mobile platform, sending a trust credential acquisition request to the cloud mobile platform, and receiving and verifying the trust credentials to determine the operating environment of the target application.
It realizes security detection of third-party applications in cloud mobile environments to ensure the security of the application operation environment.
Smart Images
Figure CN119865819A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of cloud computing, and in particular to a method for detecting an application running environment. Background Art
[0002] With the rise of cloud-native technology, more and more software will be cloud-based. Cloud phone technology is a product of the times. Cloud phone is a virtual phone service based on cloud computing technology. Users can use virtual phones to make calls, send and receive text messages, and run applications through the cloud phone platform. At present, there is no comprehensive solution for security detection of third-party applications running in the cloud phone environment. Summary of the invention
[0003] The present application discloses a method for detecting an application running environment, which can realize security detection when a third-party application runs in a cloud phone environment.
[0004] In order to solve the above problems, this application adopts the following technical solutions: In a first aspect, an embodiment of the present application discloses a method for detecting an application operating environment, which is applied to a cloud client, comprising: generating application information corresponding to the target application based on system information of the cloud client and application data of the target application, wherein the target application is installed on the cloud client; sending the application information to a cloud phone platform, wherein the cloud phone platform corresponds to the cloud client; sending a trust credential acquisition request to the cloud phone platform, wherein the trust credential acquisition request is used to request to obtain a trust credential from the cloud phone platform, wherein the trust credential is generated based on the application information; receiving the trust credential sent by the cloud phone platform in response to the trust credential acquisition request; and determining that the operating environment of the target application is secure when the trust credential is verified based on the application data.
[0005] In a second aspect, an embodiment of the present application discloses a method for detecting an application running environment, which is applied to a cloud phone platform, and includes: receiving application information corresponding to a target application sent by a cloud client; generating a trust credential based on the application information; receiving a trust credential acquisition request sent by the cloud client; and sending the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information.
[0006] In a third aspect, an embodiment of the present application discloses a device for detecting an application running environment, which is applied to a cloud client and includes: a first generating module, which is used to generate application information corresponding to the target application based on the system information of the cloud client and the application data of the target application, wherein the target application is installed on the cloud client; a first sending module, which is used to send the application information to a cloud phone platform, wherein the cloud phone platform corresponds to the cloud client; the first sending module is also used to send a trust credential acquisition request to the cloud phone platform, wherein the trust credential acquisition request is used to request to obtain a trust credential from the cloud phone platform, and the trust credential is generated based on the application information; a first receiving module, which is used to receive the trust credential sent by the cloud phone platform in response to the trust credential acquisition request; a determination module, which is used to determine that the running environment of the target application is secure when the trust credential is verified based on the application data.
[0007] In the fourth aspect, an embodiment of the present application discloses a device for detecting an application running environment, which is applied to a cloud phone platform, and includes: a second receiving module, used to receive application information corresponding to a target application sent by a cloud client; a second generating module, used to generate a trust credential based on the application information; the second receiving module is also used to receive a trust credential acquisition request sent by the cloud client; a second sending module, used to send the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information.
[0008] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect are implemented.
[0009] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect are implemented.
[0010] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, which, when executed by a computer, cause the computer to execute: the steps of the method described in the first aspect or the second aspect.
[0011] The technical solution adopted in this application can achieve the following beneficial effects: The embodiment of the present application provides a method for detecting an application running environment. The cloud client generates application information corresponding to the target application based on the system information of the cloud client and the application data of the target application installed on the cloud client, and sends the application information to the cloud phone platform, which corresponds to the cloud client. Then, a trust credential acquisition request is sent to the cloud phone platform, and the trust credential sent by the cloud phone platform in response to the trust credential acquisition request is received. The trust credential is generated based on the application information. When the trust credential is verified based on the application data, the target application's running environment is determined to be safe. Since the cloud phone runs on the cloud client and the target application runs on the cloud phone, the solution of the present application can realize security detection when a third-party application runs in the cloud phone environment. BRIEF DESCRIPTION OF THE DRAWINGS
[0012] Figure 1 A flowchart of a method for detecting an application running environment disclosed in an embodiment of the present application; Figure 2 A flowchart of a method for detecting an application running environment disclosed in an embodiment of the present application; Figure 3 A module diagram of an application running environment detection system disclosed in an embodiment of the present application; Figure 4 An execution flow chart of an application running environment detection system disclosed in an embodiment of the present application; Figure 5 A schematic diagram of an application identity ticket disclosed in an embodiment of the present application; Figure 6 A schematic diagram of a trust credential disclosed in an embodiment of the present application; Figure 7 A schematic diagram of a request body for obtaining a trust credential disclosed in an embodiment of the present application; Figure 8 A schematic diagram of the structure of a device for detecting an application running environment disclosed in an embodiment of the present application; Fig. 9 A schematic diagram of the structure of a device for detecting an application running environment disclosed in an embodiment of the present application; Fig.10 A schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION
[0013] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.
[0014] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the selected connection objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.
[0015] The following is a detailed description of the method for detecting the application running environment disclosed in the embodiment of the present application through specific embodiments and their application scenarios in conjunction with the accompanying drawings.
[0016] The present application discloses a method for detecting an application running environment, which is applied to a cloud client. Figure 1 The following is a flow chart of a method for detecting an application running environment disclosed in an embodiment of the present application. Figure 1 As shown, the method comprises the following steps: S110. Generate application information corresponding to the target application based on the system information of the cloud client and the application data of the target application.
[0017] Wherein, the target application is installed on the cloud client.
[0018] In the present application, the cloud phone runs on the cloud client, and the system information of the cloud client may include a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client. The target application may be a third-party application running on the cloud phone, that is, a cloud application. The application data of the target application may include application process information (for example, the PID of the target application when it runs on the cloud phone) and an application random string generated and saved by the target application.
[0019] S120: Send the application information to the cloud phone platform.
[0020] Among them, the cloud phone platform corresponds to the cloud client.
[0021] By sending the application information to the cloud phone platform, the cloud phone platform generates corresponding trust credentials based on the application information. For example, the cloud client can first send the generated application information to the cloud application platform corresponding to the target application, and then the cloud application platform transmits the application information to the cloud phone platform according to the agreement agreed with the cloud phone platform.
[0022] S130: Send a trust credential acquisition request to the cloud phone platform.
[0023] The trust credential acquisition request is used to request to obtain the trust credential from the cloud phone platform, and the trust credential is generated based on the application information.
[0024] The trust credential is obtained by sending a trust credential acquisition request to the cloud phone platform.
[0025] S140: Receive the trust credential sent by the cloud phone platform in response to the trust credential acquisition request.
[0026] S150: When the trust credential is verified successfully based on the application data, determine that the operating environment of the target application is secure.
[0027] The embodiment of the present application provides a method for detecting an application running environment. The cloud client generates application information corresponding to the target application based on the system information of the cloud client and the application data of the target application installed on the cloud client, and sends the application information to the cloud phone platform, which corresponds to the cloud client. Then, a trust credential acquisition request is sent to the cloud phone platform, and the trust credential sent by the cloud phone platform in response to the trust credential acquisition request is received. The trust credential is generated based on the application information. When the trust credential is verified based on the application data, the target application's running environment is determined to be safe. Since the cloud phone runs on the cloud client and the target application runs on the cloud phone, the solution of the present application can realize security detection when a third-party application runs in the cloud phone environment.
[0028] In the embodiment of the present application, the sending of the trust credential acquisition request to the cloud phone platform may include: receiving a request identifier sent by the cloud phone platform; sending the trust credential acquisition request to the cloud phone platform, wherein the trust credential acquisition request carries the request identifier. That is, after the cloud phone platform generates the trust credential based on the application information, it feeds back the corresponding request identifier to the cloud client, and then the cloud client sends the trust credential acquisition request carrying the request identifier to the cloud phone platform.
[0029] In one implementation, the application data may include an application random string, the trust credential may include a request identifier, a first identifier corresponding to the cloud phone platform, a target time when the cloud phone platform receives the application information, an application random string and a signature, and determining the security of the target application's operating environment when the trust credential is verified based on the application data may include: determining a first digital summary based on the request identifier, the first identifier, the target time and the application random string in the trust credential; determining a second digital summary based on the public key of the cloud phone platform and the signature; and determining the security of the target application's operating environment when the first digital summary is the same as the second digital summary and the application random string in the trust credential is the same as the application random string in the application data.
[0030] Exemplarily, the first digital summary is determined based on the request identifier, first identifier, target time and application random string in the trust credential. Specifically, the request identifier, first identifier, target time and application random string in the trust credential are concatenated and then processed with the MD5 algorithm to obtain the first digital summary.
[0031] Exemplarily, the second digital summary is determined based on the public key and signature of the cloud phone platform, which may be specifically: the signature is decrypted based on the public key of the cloud phone platform to obtain the second digital summary.
[0032] In one implementation, the generating of application information corresponding to the target application based on the system information of the cloud client and the application data of the target application may include: generating application information corresponding to the target application based on the system information of the cloud client and the application data of the target application when it is determined that the target application is in a non-real machine environment. That is, when it is determined that the target application is running in a cloud phone environment, generating application information corresponding to the target application based on the system information of the cloud client and the application data of the target application, sending the application information to the cloud phone platform, sending a trust credential acquisition request to the cloud phone platform, receiving the trust credential sent by the cloud phone platform in response to the trust credential acquisition request, and determining that the operating environment of the target application is safe when the trust credential is verified based on the application data.
[0033] In this application, the following methods are used to determine whether the target application is running in a real machine environment: The first method is to determine whether it is a real machine environment by detecting the model of the device. Since each device has a unique model, you can determine whether it is a real machine environment by comparing the device model list.
[0034] The second method is to determine whether it is a real device environment by detecting whether the device is jailbroken (iOS) or rooted (Android). Jailbreaking or rooting means bypassing the restrictions of the device operating system, which may affect the normal operation of the application.
[0035] The third method: Determine whether it is a real machine environment by detecting the hardware information of the device. Since real machines usually have specific hardware information, you can determine whether it is in a real machine environment by obtaining the hardware information of the device (such as CPU model, memory size, etc.).
[0036] In one implementation, the system information includes a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client, the application data includes an application random string and application process information, and generating application information corresponding to the target application based on the system information of the cloud client and the application data of the target application may include: determining an application secret string based on the public key of the cloud phone platform, the application random string and the application process information; and generating application information corresponding to the target application based on the first identifier, the second identifier and the application secret string.
[0037] Exemplarily, the application secret string is determined based on the public key of the cloud phone platform, the application random string and the application process information. Specifically, the application random string and the application process information are combined, and then the combination is encrypted using the public key of the cloud phone platform to obtain the application secret string.
[0038] Based on the first identifier, the second identifier and the application secret string, application information corresponding to the target application is generated. Specifically, the first identifier, the second identifier and the application secret string are filled into a preset first data structure to generate application information corresponding to the target application. The application information corresponding to the target application is the identity ticket of the target application.
[0039] It should be noted that, since the cloud phone runs on the cloud client, the second identifier corresponding to the cloud client is the cloud phone identifier.
[0040] This application discloses a method for detecting an application running environment, which is applied to a cloud phone platform. Figure 2 The following is a flow chart of a method for detecting an application running environment disclosed in an embodiment of the present application. Figure 2 As shown, the method comprises the following steps: S220: Receive application information corresponding to the target application sent by the cloud client.
[0041] In this application, the application information corresponding to the target application may include a first identifier corresponding to the cloud phone platform, a second identifier corresponding to the cloud client, a second IP address for the target application to access the Internet, and an application secret string. It should be noted that since the cloud phone runs on the cloud client, the second identifier corresponding to the cloud client is the cloud phone identifier.
[0042] S240: Generate a trust credential based on the application information.
[0043] S260: Receive a trust credential acquisition request sent by the cloud client.
[0044] S280: When the trust credential acquisition request is verified successfully based on the application information, the trust credential is sent to the cloud client.
[0045] The embodiment of the present application provides a method for detecting an application running environment. The cloud phone platform receives application information corresponding to a target application sent by a cloud client, generates a trust credential based on the application information, and then receives a trust credential acquisition request sent by the cloud client. When the trust credential acquisition request is verified based on the application information, the trust credential is sent to the cloud client to determine whether the running environment of the target application is safe. Since the cloud phone runs on the cloud client and the target application runs on the cloud phone, the solution of the present application can realize security detection when a third-party application runs in a cloud phone environment.
[0046] In an embodiment of the present application, the application information may include a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client. Generating a trust credential based on the application information may include: generating a trust credential based on the application information when it is determined based on the recorded data that the first identifier is correct and the second identifier is in an activated state.
[0047] The cloud phone platform will record all states of the cloud client, such as entering the cloud client, exiting the cloud client, shutting down the cloud client, cloud client allocation, and connection establishment between users and cloud clients.
[0048] The cloud phone platform can determine whether the first identifier corresponding to the cloud phone platform in the received application information is correct based on the recorded identifier of itself. If the recorded data of the cloud phone platform shows that the second identifier corresponding to the cloud client has been assigned to the cloud phone client (for example, a mobile phone), or the cloud phone client is establishing a connection with the cloud client corresponding to the second identifier, then it is determined that the second identifier is in an activated state.
[0049] In one implementation, the application information may further include an application secret string, and generating a trust credential based on the application information may include: generating a trust credential based on a private key of the cloud phone platform, the application secret string, a request identifier, the first identifier, and a target time for receiving the application information.
[0050] In one implementation, the generating of a trust credential based on the private key of the cloud phone platform, the application secret string, the request identifier, the first identifier, and the target time of receiving the application information may include: determining the application random string of the target application based on the private key of the cloud phone platform and the application secret string; determining the second digital summary based on the request identifier, the first identifier, the target time of receiving the application information, and the application random string; obtaining a signature based on the private key of the cloud phone platform and the second digital summary; generating a trust credential based on the request identifier, the first identifier, the target time, the application random string, and the signature.
[0051] In the present application, the application secret string can be decrypted using the private key of the cloud phone platform to obtain the application random string and application process information of the target application. The request identifier, first identifier, target time, and application random string can be concatenated and then the second digital summary can be obtained using the MD5 algorithm. The second digital summary can be encrypted based on the private key of the cloud phone platform to obtain a signature. The request identifier, first identifier, target time, application random string, and signature can then be filled into a preset second data structure to generate a trust credential.
[0052] In one implementation, the trust credential may include a request identifier, and the receiving the trust credential acquisition request sent by the cloud client may include: sending the request identifier to the cloud client; receiving the trust credential acquisition request sent by the cloud client, wherein the trust credential acquisition request carries the request identifier. That is, the cloud phone platform may generate a corresponding request identifier when generating a trust credential, and send the request identifier to the cloud client, so that the cloud client sends a trust credential acquisition request based on the request identifier.
[0053] In one implementation, the trust credential acquisition request may also carry access credentials and a second identifier corresponding to the cloud client. When the trust credential acquisition request is verified based on the application information, the trust credential is sent to the cloud client, which may include: determining user information corresponding to the access credential; when it is determined that the second identifier corresponds to the user information and the source IP address of the trust credential acquisition request is the same as the first IP address, determining the trust credential corresponding to the request identifier and sending it to the cloud client, wherein the first IP address and the second identifier have a corresponding relationship.
[0054] It should be noted that the access credential can be sent from the cloud phone platform to the cloud client. Specifically, the user initiates a cloud phone login operation on the cloud phone client, and the cloud phone platform returns the access credential to the cloud phone client. The user views the cloud phone list on the cloud phone client, selects a cloud phone to enter, and the cloud phone client sends the access credential to the cloud client corresponding to the selected cloud phone. The user information corresponding to the access credential can be a mobile phone number. When the cloud phone platform sends the access credential to the cloud phone client, it can record the corresponding relationship between the mobile phone number of the cloud phone client and the access credential. Therefore, after receiving the trust credential acquisition request, the cloud phone platform can determine the user information corresponding to the access credential, and then determine whether the second identifier belongs to the cloud client identifier issued to the user information, that is, determine whether there is a corresponding relationship between the second identifier and the user information, and the cloud phone platform database records the first IP address (Internet Protocol Address) corresponding to the second identifier. When it is determined that the second identifier corresponds to the user information and the source IP address of the trust credential acquisition request is the same as the first IP address, the trust credential corresponding to the request identifier is determined and sent to the cloud client.
[0055] In one implementation, the trust credential acquisition request may also carry a second identifier corresponding to the cloud client and caller process information, the application information may include a second IP address for the target application to access the Internet, a second identifier corresponding to the cloud client, and application process information, and in a case where the trust credential acquisition request is verified based on the application information, sending the trust credential to the cloud client may include: determining the application information corresponding to the request identifier; in a case where the source IP address of the trust credential acquisition request is the same as the second IP address, the second identifier carried by the trust credential acquisition request is the same as the second identifier in the application information, and the caller process information is the same as the application process information, determining the trust credential corresponding to the request identifier and sending it to the cloud client.
[0056] In the present application, there is a corresponding relationship between the request identifier, the trust credential and the application information. When a trust credential acquisition request is received, the application information corresponding to the request identifier carried by the trust credential acquisition request can be determined, and then it is determined whether the source IP address of the trust credential acquisition request is the same as the second IP address in the application information, whether the second identifier carried by the trust credential acquisition request is the same as the second identifier in the application information, and whether the caller process information carried by the trust credential acquisition request is the same as the application process information in the application information. When it is determined that all three are the same, the trust credential corresponding to the request identifier is determined and sent to the cloud client.
[0057] In one implementation, the trust credential acquisition request may also carry access credentials, a second identifier corresponding to the cloud client, and caller process information, and the application information may include a second IP address for the target application to access the Internet, a second identifier corresponding to the cloud client, and application process information, and sending the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information may include: determining user information corresponding to the access credential; determining the application information corresponding to the request identifier when it is determined that the second identifier carried by the trust credential acquisition request corresponds to the user information and the source IP address of the trust credential acquisition request is the same as the first IP address, wherein the first IP address and the second identifier have a corresponding relationship; determining the trust credential corresponding to the request identifier and sending it to the cloud client when the source IP address of the trust credential acquisition request is the same as the second IP address, the second identifier carried by the trust credential acquisition request is the same as the second identifier in the application information, and the caller process information is the same as the application process information.
[0058] It should be noted that the specific implementation here is similar to the above, and this application will not repeat it here.
[0059] The present application embodiment provides an application running environment detection system, such as Figure 3 As shown, the system includes a cloud phone client, a cloud client, a cloud application platform and a cloud phone platform. The user completes identity authentication through the cloud phone client. The cloud phone client provides the cloud phone entrance and the function of operating the cloud phone. The cloud phone client includes a terminal SDK (Software Development Kit). The terminal SDK is responsible for communicating with the cloud SDK to build a communication bridge between the cloud phone client and the cloud phone. The cloud phone runs on the cloud client. The cloud phone includes a cloud SDK and an environment verification component. In addition, a cloud application (i.e., the target application described above) is installed on the cloud phone. The cloud phone is a virtual phone seen by the user. It runs an operating system. The operating system is installed with system applications and cloud applications provided by a third party. The cloud SDK is responsible for communicating with the terminal SDK, transmitting data between the cloud phone client and the cloud phone and sending data to the environment verification component. The environment verification component is a system application installed in the cloud phone. The environment verification component is responsible for providing an interface for obtaining current system information, an interface for obtaining trust credentials, initiating a trust credential acquisition request to the cloud phone platform, and receiving the cloud phone platform access credentials transmitted by the cloud SDK. The cloud application platform is responsible for processing business requests sent by cloud applications. The cloud phone platform processes requests from the cloud phone client and the environment verification component, and connects with the cloud application platform.
[0060] The execution process of the application running environment detection system provided by this application is as follows Figure 4 As shown: (1) The user initiates a cloud phone login operation on the cloud phone client, and the cloud phone platform returns access credentials.
[0061] (2) The user views the cloud phone list on the cloud phone client and selects a cloud phone to enter. The cloud phone client passes the access credentials to the cloud side SDK through the client side SDK. The cloud side SDK calls the access credential saving interface of the environment verification component, and the environment verification component saves the access credentials of the cloud phone platform.
[0062] (3) The user opens the cloud application on the cloud phone and operates it. The cloud application on the cloud phone triggers risk control measures. It first determines whether the application is in a real machine environment. If the application is not in a real machine environment, it calls the system information acquisition interface of the environment verification component to obtain the system information of the cloud phone. The system information includes the cloud phone platform identifier (i.e., the first identifier mentioned above) and the cloud machine ID (i.e., the second identifier mentioned above). The cloud application generates an application random string and obtains application process information. The application random string and application process information are combined and encrypted with the public key of the cloud phone platform to obtain the application secret string. The cloud application creates an application identity ticket, fills the cloud phone platform identifier, cloud machine ID and application secret string into the application identity ticket (i.e., obtains the application information mentioned above), and sends the application identity ticket to the cloud application platform.
[0063] (4) After receiving the application identity ticket, the cloud application platform obtains the cloud application source IP (i.e., the second IP address mentioned above) and fills it into the application IP field of the application identity ticket to obtain the following: Figure 5 The application identity ticket is shown, and then the application identity ticket is sent to the corresponding cloud phone platform according to the agreed request method (APPID, APPKEY and other parameters are used to build a request signature).
[0064] (5) After receiving the application identity ticket, the cloud phone platform verifies whether the cloud phone platform identifier in the application identity ticket is correct and whether the cloud machine ID is in an activated state based on the recorded data. If the cloud phone platform identifier is correct and the cloud machine ID is in an activated state, the cloud phone platform decrypts the application secret string in the application identity ticket based on the private key of the cloud phone platform to obtain the application random string and application process information. In addition, the cloud phone platform creates a trust credential, generates a request ID (i.e. the request identifier mentioned above) and a timestamp corresponding to the time when the application identity ticket is received. The cloud phone platform concatenates the request ID, the cloud phone platform identifier, the timestamp and the application random string, and processes them using the MD5 algorithm to obtain a second digital summary. The second digital summary is encrypted based on the private key of the cloud phone platform to obtain a signature. Then, the request ID, the cloud phone platform identifier, the timestamp, the application random string and the signature are filled into the trust credential to obtain the following: Figure 6 The trust credentials shown.
[0065] (6) The cloud phone platform establishes a mapping relationship between the request ID, trust credential, and application identity ticket, and returns the request ID to the cloud application through the cloud application platform.
[0066] (7) The cloud application carries the request ID to call the environment verification component to obtain the trust credential interface. The environment verification component builds a trust credential based on the access credential, request ID, cloud machine ID, and caller process information. Figure 7 The obtained trust credential request body (i.e. the trust credential obtaining request described above) is sent to the cloud phone platform to obtain the trust credential from the cloud phone platform.
[0067] It should be noted that the application identity ticket, trust credential, and request body for obtaining trust credential can be displayed in JSON, XML, text, and other formats.
[0068] (8) After receiving the request body for obtaining the trust credential, the cloud phone platform performs the following verification process: A. Verify the request parameters of the environment verification component: determine the user information corresponding to the access credential, and determine whether the cloud machine ID in the request body for obtaining the trust credential corresponds to the user information; query the cloud machine IP corresponding to the cloud machine ID (i.e., the first IP address mentioned above) in the cloud phone platform database, and compare the source IP of the environment verification component (i.e., the source IP address mentioned above) with the cloud machine IP to see if they are consistent; B. Verify whether the application and environment verification components are on the same cloud phone: determine the application identity ticket corresponding to the request ID, and then compare whether the source IP of the environment verification component is the same as the application IP in the application identity ticket; compare whether the cloud machine ID in the Get Trust Credentials request body is the same as the cloud machine ID in the application identity ticket; compare whether the caller process information in the Get Trust Credentials request body is the same as the application process information in the application identity ticket; C. If the above A and B processes are verified, the trust credential corresponding to the request ID is determined and returned to the cloud application through the environment verification component.
[0069] (9) After receiving the trust credential, the cloud application concatenates the request ID, cloud phone platform identifier, timestamp and application random string in the trust credential and processes them using the MD5 algorithm to obtain a first digital summary. The signature in the trust credential is decrypted using the public key of the cloud phone platform to obtain a second digital summary. If the first digital summary and the second digital summary are the same, the signature verification is successful. The application random string in the trust credential is compared with the application random string saved by the cloud application to see if they are the same. If they are the same, the verification is successful, confirming that the operating environment of the cloud application is secure and trustworthy.
[0070] (10) Users use applications on the cloud phone normally.
[0071] It should be noted that before executing this process, preparations can be made for the application to access the cloud machine, including: (1) the application manufacturer provides the cloud phone manufacturer with the application APP signature for verification when installing the application; (2) the cloud phone manufacturer creates an APPID (Application Identity document, the identifier of the cloud application), APPKEY (Application key, the key of the cloud application), public key, and private key, and issues the APPID, APPKEY, and public key to the application manufacturer.
[0072] Using the solution of the present application, the cloud application combines the current application process information with the randomly generated application random string, and encrypts it through the public key of the cloud phone platform to create an application identity ticket, and sends the application identity ticket to the cloud application platform. The cloud application does not care about the subsequent circulation process of the application identity ticket. As long as it can obtain the trust credential generated by the partner based on the application identity ticket from the current environment and pass the local verification, it is determined that the current system environment belongs to the partner's cloud machine environment and is a trusted environment.
[0073] By adopting the solution of the present application, the usability of applications in cloud phones is improved, and the difference between cloud phones and real phones is reduced.
[0074] The method for detecting the application running environment provided in the embodiment of the present application can be performed by a device for detecting the application running environment. In the embodiment of the present application, the method for detecting the application running environment performed by the device for detecting the application running environment is taken as an example to illustrate the device for detecting the application running environment provided in the embodiment of the present application. The device for detecting the application running environment is applied to a cloud client.
[0075] Figure 8 This is a schematic diagram of the structure of a device for detecting an application running environment disclosed in an embodiment of the present application. Figure 8 As shown, the device 800 for detecting an application running environment includes: a first generating module 810 , a first sending module 820 , a first receiving module 830 and a determining module 840 .
[0076] In the present application, a first generating module 810 is used to generate application information corresponding to the target application based on the system information of the cloud client and the application data of the target application, wherein the target application is installed on the cloud client; a first sending module 820 is used to send the application information to a cloud phone platform, wherein the cloud phone platform corresponds to the cloud client; the first sending module 820 is also used to send a trust credential acquisition request to the cloud phone platform, wherein the trust credential acquisition request is used to request to obtain a trust credential from the cloud phone platform, and the trust credential is generated based on the application information; a first receiving module 830 is used to receive the trust credential sent by the cloud phone platform in response to the trust credential acquisition request; a determining module 840 is used to determine the security of the operating environment of the target application when the trust credential is verified based on the application data.
[0077] In one implementation, the first sending module 820 sends a trust credential acquisition request to the cloud phone platform, including: receiving a request identifier sent by the cloud phone platform; sending a trust credential acquisition request to the cloud phone platform, wherein the trust credential acquisition request carries the request identifier.
[0078] In one implementation, the application data includes an application random string, and the trust credential includes a request identifier, a first identifier corresponding to the cloud phone platform, a target time when the cloud phone platform receives the application information, an application random string and a signature. The determination module 840 determines the security of the operating environment of the target application when the trust credential is verified based on the application data, including: determining a first digital summary based on the request identifier, the first identifier, the target time and the application random string in the trust credential; determining a second digital summary based on the public key of the cloud phone platform and the signature; and determining the security of the operating environment of the target application when the first digital summary is the same as the second digital summary and the application random string in the trust credential is the same as the application random string in the application data.
[0079] In one implementation, the first generation module 810 generates application information corresponding to the target application based on the system information of the cloud client and the application data of the target application, including: when it is determined that the target application is in a non-real machine environment, generating application information corresponding to the target application based on the system information of the cloud client and the application data of the target application.
[0080] In one implementation, the system information includes a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client, the application data includes an application random string and application process information, and the first generation module 810 generates application information corresponding to the target application based on the system information of the cloud client and the application data of the target application, including: determining the application secret string based on the public key of the cloud phone platform, the application random string and the application process information; generating application information corresponding to the target application based on the first identifier, the second identifier and the application secret string.
[0081] The device for detecting the application running environment provided in the embodiment of the present application can implement each process implemented in the method embodiment for detecting the application running environment. To avoid repetition, they will not be described here.
[0082] The method for detecting the application running environment provided in the embodiment of the present application can be executed by a device for detecting the application running environment. In the embodiment of the present application, the method for detecting the application running environment performed by the device for detecting the application running environment is taken as an example to illustrate the device for detecting the application running environment provided in the embodiment of the present application. The device for detecting the application running environment is applied to a cloud phone platform.
[0083] Fig. 9 This is a schematic diagram of the structure of a device for detecting an application running environment disclosed in an embodiment of the present application. Fig. 9As shown, the device 900 for detecting an application running environment includes: a second receiving module 910 , a second generating module 920 and a second sending module 930 .
[0084] In the present application, the second receiving module 910 is used to receive application information corresponding to the target application sent by the cloud client; the second generating module 920 is used to generate a trust credential based on the application information; the second receiving module 910 is also used to receive a trust credential acquisition request sent by the cloud client; the second sending module 930 is used to send the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information.
[0085] In one implementation, the application information includes a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client. The second generation module 920 generates a trust credential based on the application information, including: when it is determined based on the recorded data that the first identifier is correct and the second identifier is in an activated state, generating a trust credential based on the application information.
[0086] In one implementation, the application information also includes an application secret string, and the second generation module 920 generates a trust credential based on the application information, including: generating a trust credential based on the private key of the cloud phone platform, the application secret string, the request identifier, the first identifier and the target time of receiving the application information.
[0087] In one implementation, the second generation module 920 generates a trust credential based on the private key of the cloud phone platform, the application secret string, the request identifier, the first identifier, and the target time of receiving the application information, including: determining the application random string of the target application based on the private key of the cloud phone platform and the application secret string; determining the second digital summary based on the request identifier, the first identifier, the target time of receiving the application information, and the application random string; obtaining a signature based on the private key of the cloud phone platform and the second digital summary; generating a trust credential based on the request identifier, the first identifier, the target time, the application random string, and the signature.
[0088] In one implementation, the trust credential includes a request identifier, and the second receiving module 910 receives the trust credential acquisition request sent by the cloud client, including: sending the request identifier to the cloud client; receiving the trust credential acquisition request sent by the cloud client, wherein the trust credential acquisition request carries the request identifier.
[0089] In one implementation, the trust credential acquisition request also carries access credentials and a second identifier corresponding to the cloud client. The second sending module 930 sends the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information, including: determining user information corresponding to the access credential; when it is determined that the second identifier corresponds to the user information and the source IP address of the trust credential acquisition request is the same as the first IP address, determining the trust credential corresponding to the request identifier and sending it to the cloud client, wherein the first IP address and the second identifier have a corresponding relationship.
[0090] In one implementation, the trust credential acquisition request also carries a second identifier corresponding to the cloud client and caller process information, and the application information includes a second IP address for the target application to access the Internet, a second identifier corresponding to the cloud client, and application process information. The second sending module 930 sends the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information, including: determining the application information corresponding to the request identifier; when the source IP address of the trust credential acquisition request is the same as the second IP address, the second identifier carried by the trust credential acquisition request is the same as the second identifier in the application information, and the caller process information is the same as the application process information, determining the trust credential corresponding to the request identifier and sending it to the cloud client.
[0091] In one implementation, the trust credential acquisition request also carries access credentials, a second identifier corresponding to the cloud client, and caller process information, and the application information includes a second IP address for the target application to access the Internet, a second identifier corresponding to the cloud client, and application process information. The second sending module 930 sends the trust credential to the cloud client when the trust credential acquisition request is verified based on the application information, including: determining user information corresponding to the access credential; determining the application information corresponding to the request identifier when it is determined that the second identifier carried by the trust credential acquisition request corresponds to the user information and the source IP address of the trust credential acquisition request is the same as the first IP address, wherein the first IP address and the second identifier have a corresponding relationship; determining the trust credential corresponding to the request identifier and sending it to the cloud client when the source IP address of the trust credential acquisition request is the same as the second IP address, the second identifier carried by the trust credential acquisition request is the same as the second identifier in the application information, and the caller process information is the same as the application process information.
[0092] The device for detecting the application running environment provided in the embodiment of the present application can implement each process implemented in the method embodiment for detecting the application running environment. To avoid repetition, they will not be described here.
[0093] Alternatively, if Fig.10 As shown, an embodiment of the present application also provides an electronic device 1000, including a processor 1001 and a memory 1002, wherein the memory 1002 stores programs or instructions that can be executed on the processor 1001, and when the program or instructions are executed by the processor 1001, the various steps of the method embodiment for detecting the application running environment described above are implemented, and the same technical effect can be achieved. To avoid repetition, they will not be described here.
[0094] It should be noted that the electronic devices in the embodiments of the present application include mobile electronic devices and non-mobile electronic devices.
[0095] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned application running environment detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
[0096] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.
[0097] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes: the steps of the method for detecting the application running environment as described above.
[0098] The above embodiments of the present application focus on describing the differences between the various embodiments. As long as the different optimization features between the various embodiments are not contradictory, they can be combined to form a better embodiment. Considering the simplicity of the text, they will not be repeated here.
[0099] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims
1. A method for detecting an application running environment, characterized in that: Applied to cloud clients, including: generating application information corresponding to the target application based on the system information of the cloud client and the application data of the target application, wherein the target application is installed on the cloud client; Sending the application information to a cloud phone platform, wherein the cloud phone platform corresponds to the cloud client; Sending a trust credential acquisition request to the cloud phone platform, wherein the trust credential acquisition request is used to request to obtain a trust credential from the cloud phone platform, and the trust credential is generated based on the application information; Receiving the trust credential sent by the cloud phone platform in response to the trust credential acquisition request; In a case where the trust credential is verified successfully based on the application data, it is determined that the operating environment of the target application is secure.
2. The method according to claim 1, characterized in that The step of sending a trust credential acquisition request to the cloud phone platform includes: Receiving a request identifier sent by the cloud phone platform; A trust credential acquisition request is sent to the cloud phone platform, wherein the trust credential acquisition request carries the request identifier.
3. The method according to claim 1, characterized in that The application data includes an application random string, the trust credential includes a request identifier, a first identifier corresponding to the cloud phone platform, a target time when the cloud phone platform receives the application information, an application random string, and a signature, and when the trust credential is verified based on the application data, determining that the operating environment of the target application is secure includes: Determine a first digital digest based on the request identifier, the first identifier, the target time, and an application random string in the trust credential; Determine a second digital summary based on the public key of the cloud phone platform and the signature; When the first digital digest is the same as the second digital digest, and the application random string in the trust credential is the same as the application random string in the application data, it is determined that the operating environment of the target application is secure.
4. The method according to claim 1, characterized in that: The generating application information corresponding to the target application based on the system information of the cloud client and the application data of the target application includes: When it is determined that the target application is in a non-real machine environment, application information corresponding to the target application is generated based on the system information of the cloud client and the application data of the target application.
5. The method according to claim 1, characterized in that The system information includes a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client, the application data includes an application random string and application process information, and the application information corresponding to the target application is generated based on the system information of the cloud client and the application data of the target application, including: Determine the application secret string based on the public key of the cloud phone platform, the application random string and the application process information; Based on the first identifier, the second identifier and the application secret string, application information corresponding to the target application is generated.
6. A method for detecting an application running environment, characterized in that: Applied to cloud phone platform, including: Receiving application information corresponding to the target application sent by the cloud client; Based on the application information, generating a trust credential; Receiving a trust credential acquisition request sent by the cloud client; In the case where the trust credential acquisition request is verified successfully based on the application information, the trust credential is sent to the cloud client.
7. The method according to claim 6, characterized in that The application information includes a first identifier corresponding to the cloud phone platform and a second identifier corresponding to the cloud client, and generating a trust credential based on the application information includes: When it is determined based on the recorded data that the first identifier is correct and the second identifier is in an activated state, a trust credential is generated based on the application information.
8. The method according to claim 7, characterized in that The application information also includes an application secret string, and generating a trust credential based on the application information includes: A trust credential is generated based on the private key of the cloud phone platform, the application secret string, the request identifier, the first identifier, and the target time of receiving the application information.
9. The method according to claim 8, characterized in that The generating of the trust credential based on the private key of the cloud phone platform, the application secret string, the request identifier, the first identifier and the target time of receiving the application information includes: Determine the application random string of the target application based on the private key of the cloud phone platform and the application secret string; determining a second digital summary based on the request identifier, the first identifier, a target time of receiving the application information, and the application random string; Obtaining a signature based on the private key of the cloud phone platform and the second digital summary; A trust credential is generated based on the request identifier, the first identifier, the target time, the application random string and the signature.
10. The method according to claim 6, characterized in that The trust credential includes a request identifier, and the receiving the trust credential acquisition request sent by the cloud client includes: Sending the request identifier to the cloud client; A trust credential acquisition request sent by the cloud client is received, wherein the trust credential acquisition request carries the request identifier.