Application development prototype management method and terminal

Abstract

The invention discloses an application development prototype management method and a terminal, and the method comprises the steps: a server side receives terminal information of a user side, and verifies whether the user side has a development mode permission or not according to the terminal information; if yes, configuring a development mode switching instruction and a development mode certificate according to the terminal information, and returning the development mode switching instruction and the development mode certificate to the user side; and the user side switches the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate, and returns an execution result to the server side. According to the invention, after the user side receives the development mode switching instruction and the development mode certificate returned by the server side, development mode conversion is carried out on the TEE and the REE of the user side respectively, so that the security of the user side in the conversion process is ensured; and moreover, the conversion of the model machine between a use mode and a development mode is realized by setting a verification mode, and the model machine is taken as a management and control main body, so that the use safety of the model machine is ensured while application development and testing are facilitated.

Description

Technical Field

[0001] The present invention relates to the field, and in particular to a method for managing an application development prototype and a terminal. Background Art

[0002] Industry terminals are different from the common mobile phone terminals of users. Usually, some specialized application programs need to be developed specifically to meet the usage requirements of specific industries. With the development of industry terminals, more and more intelligent systems such as Android and OpenHarmony are used in industry terminals. These types of production terminals often have protection strategies such as application signature and log protection. These strategies make the terminals officially used in the market have higher security, but they also bring great inconvenience to application development. For example, the developed applications cannot be directly installed on the terminal, and some permissions need special processing to be invoked, the logs are encrypted or cannot be obtained, etc. In this way, a series of prototype solutions for application development are needed. In addition, due to the security requirements of this type of terminal, strong control over the development prototypes is required to prevent the prototypes from being used to crack system vulnerabilities or to forge normal machines for payment transactions and other behaviors. However, since the native Android and OpenHarmony systems do not have strong management functions for application development prototypes, nor do they have flexible switching functions. Summary of the Invention

[0003] The technical problem to be solved by the present invention is: to provide a method for managing an application development prototype and a terminal, and to realize permission management for the prototype during the development process.

[0004] To solve the above technical problem, a technical solution adopted by the present invention is:

[0005] A method for managing an application development prototype includes the steps of:

[0006] The server receives the terminal information of the user terminal, and verifies whether the user terminal has the development mode permission according to the terminal information; if so, configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the user terminal;

[0007] After the user terminal switches the states of TEE and REE according to the development mode switching instruction and the development mode certificate, it returns the execution result to the server.

[0008] To solve the above technical problem, another technical solution adopted by the present invention is:

[0009] An application development prototype management terminal includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0010] The server receives the terminal information of the client, and verifies whether the client has the development mode permission according to the terminal information; if so, it configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the client.

[0011] After the client switches the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate, it returns the execution result to the server.

[0012] The beneficial effects of the present invention are as follows: The server receives the terminal information sent by the client, verifies whether the client has the development mode permission, and if so, configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the client. After the client receives the development mode switching instruction and the development mode certificate returned by the server, it respectively performs the conversion of the development mode on its own TEE and REE, ensuring the security of the client during the conversion process; and by setting up a verification method, the transformation of the prototype between the usage mode and the development mode is realized, taking the prototype itself as the control subject, which ensures the security of the prototype usage while facilitating application development and testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a step flow chart of a method for managing an application development prototype according to an embodiment of the present invention;

[0014] Figure 2 It is an implementation architecture diagram of a method for managing an application development prototype according to an embodiment of the present invention;

[0015] Figure 3 It is a schematic flow chart of establishing a connection between the client and the server according to an embodiment of the present invention;

[0016] Figure 4 It is a schematic diagram of configuration information according to an embodiment of the present invention;

[0017] Figure 5 It is a structural schematic diagram of an application development prototype management terminal according to an embodiment of the present invention;

[0018] Reference Numeral Explanation:

[0019] 1. An application development prototype management terminal; 2. A processor; 3. A memory. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] To describe in detail the technical content, the achieved objectives and the effects of the present invention, the following is described in conjunction with the embodiments and with reference to the accompanying drawings.

[0021] Please refer to Figure 1 , a method for managing an application development prototype, including the steps:

[0022] The server receives the terminal information of the client, and verifies whether the client has the development mode permission according to the terminal information; if so, it configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the client.

[0023] After the client switches the states of the TEE and REE according to the development mode switching instruction and the development mode certificate, it returns the execution result to the server.

[0024] As can be seen from the above description, the beneficial effects of the present invention are as follows: The server receives the terminal information sent by the client, verifies whether the client has the development mode permission, and if so, configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the client. After receiving the development mode switching instruction and the development mode certificate returned by the server, the client separately performs the conversion of the development mode on its own TEE and REE, ensuring the security of the client during the conversion process; and through the setting of the verification method, the conversion between the usage mode and the development mode of the prototype is realized, taking the prototype itself as the control subject, which ensures the security of the prototype usage while facilitating application development and testing.

[0025] Further, before verifying whether the client has the development mode permission according to the terminal information, it includes:

[0026] The server receives a terminal registration request, and the registration request includes a terminal serial number.

[0027] The server receives the configuration information corresponding to the terminal serial number and stores the terminal serial number and the configuration information in an associated manner.

[0028] Verifying whether the terminal has the development mode permission according to the terminal information includes:

[0029] Receiving terminal information, where the terminal information includes a terminal serial number.

[0030] Judging whether the corresponding configuration information is stored for the terminal serial number, and if so, the terminal has the development mode permission.

[0031] As can be seen from the above description, the server first receives a terminal registration request, which includes the terminal serial number corresponding to the client. When the client registers, the server can configure the corresponding configuration information for it. The client saves the configuration information and the corresponding terminal serial number in an associated manner. Then, when receiving the terminal information, if the included terminal serial number has been registered on the server, it means that the terminal is a prototype that can be converted into the development mode. By means of the client registering on the server first, the scope of the prototype is controlled, and the terminal serial number corresponds to the hardware one by one, avoiding being cracked and misused.

[0032] Further, verifying whether the client has development mode permissions based on the terminal information further includes:

[0033] If so, verify whether the conditions for entering the development mode are met. If they are met, execute the steps of configuring the development mode switching instruction and the development mode certificate based on the terminal information and returning them to the client.

[0034] As can be seen from the above description, the client having development mode permissions means that its permissions can be switched between the usage mode and the development mode. However, at this time, it cannot be guaranteed whether factors such as the environment of the terminal are safe. Therefore, further judgment on whether the conditions for entering the development mode are met is introduced. On the basis of having the permission to switch, the conditions for switching also need to be met to execute the mode conversion, further ensuring the security of the mode conversion process and avoiding the abuse of the normal state or development state of the prototype.

[0035] Further, the client switching the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate includes:

[0036] Update and save the development mode status value, the development mode certificate, and the log encryption switch in the TEE;

[0037] Change the application status in the REE according to the development mode status value.

[0038] As can be seen from the above description, updating and saving the application development mode status value, the development mode certificate, and the log encryption switch in the TEE can utilize the security of the TEE itself to prevent these security values from being directly changed by the outside world and thus changing the state of the prototype. And the REE changes the application status based on the development mode status value in the TEE. In this way, when the TEE is secure, the change process of the REE is also secure.

[0039] Further, changing the application status in the REE according to the development mode status value includes:

[0040] If the development mode status value is that the development mode is switched to the usage mode, perform operations of uninstalling informal applications, removing the development mode watermark, and hiding the manufacturer's special application entry in the REE;

[0041] If the development mode status value is that the usage mode is switched to the development mode, perform operations of installing informal applications, displaying the development mode watermark, and displaying the manufacturer's special application entry in the REE.

[0042] As described above, for the operation of the REE, different operations are implemented according to different state transitions. When switching to the development mode, install informal applications, display a development watermark to prompt the operator, and open the manufacturer's special application entry for invocation. When switching from the development mode to the usage mode, uninstall the informal applications, turn off the development watermark, and close the manufacturer's special entry, which facilitates the operator to directly conduct a trial after completing the application development on the prototype or directly conduct a trial on the application in the development progress, improving the development efficiency.

[0043] Please refer to Figure 5 , an application development prototype management terminal, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0044] The server receives the terminal information of the client, and verifies whether the client has the development mode permission according to the terminal information; if so, configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the client;

[0045] After the client switches the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate, it returns the execution result to the server.

[0046] The beneficial effects of the present invention are as follows: The server receives the terminal information sent by the client, verifies whether the client has the development mode permission, and if so, configures a development mode switching instruction and a development mode certificate according to the terminal information and returns them to the client. After the client receives the development mode switching instruction and the development mode certificate returned by the server, it respectively converts the TEE and the REE of itself to the development mode, ensuring the security of the client during the conversion process; and realizes the transformation of the prototype between the usage mode and the development mode through the setting of verification method. Taking the prototype itself as the control subject, it ensures the security of the prototype usage while facilitating application development and testing.

[0047] Further, before verifying whether the client has the development mode permission according to the terminal information, it includes:

[0048] The server receives a terminal registration request, and the registration request includes a terminal serial number;

[0049] The server receives the configuration information corresponding to the terminal serial number and stores the terminal serial number and the configuration information in an associated manner;

[0050] Verifying whether the terminal has the development mode permission according to the terminal information includes:

[0051] Receive terminal information, where the terminal information includes a terminal serial number;

[0052] Determine whether the corresponding configuration information is stored for the terminal serial number. If so, the terminal has development mode permissions.

[0053] As can be seen from the above description, the server first receives a terminal registration request, which includes a terminal serial number corresponding to the user terminal. When the user terminal registers, the server can configure corresponding configuration information for it. The user terminal associates and saves the configuration information with the corresponding terminal serial number. Then, when receiving the terminal information, if the included terminal serial number has been registered on the server, it means that the terminal is a prototype that can be converted to the development mode. By registering the user terminal on the server first, the scope of the prototype is controlled, and the terminal serial number corresponds one-to-one with the hardware, avoiding being cracked and misused.

[0054] Further, the verifying whether the user terminal has development mode permissions according to the terminal information further includes:

[0055] If so, verify whether the conditions for entering the development mode are met. If they are met, execute the steps of configuring a development mode switching instruction and returning a development mode certificate to the user terminal according to the terminal information.

[0056] As can be seen from the above description, the user terminal having development mode permissions means that its permissions can be switched between the usage mode and the development mode. However, at this time, it cannot be guaranteed whether factors such as the environment where the terminal is located are safe. Therefore, further judgment on whether the conditions for entering the development mode are met is introduced. On the basis of having the permission to switch, the conditions for switching also need to be met to execute the conversion between the modes, further ensuring the safety of the mode conversion process and avoiding the abuse of the normal state or development state of the prototype.

[0057] Further, the user terminal switching the states of TEE and REE according to the development mode switching instruction and the development mode certificate includes:

[0058] Update and save the development mode status value, the development mode certificate, and the log encryption switch in the TEE;

[0059] Change the application status in the REE according to the development mode status value.

[0060] As can be seen from the above description, updating and saving the application development mode status value, the development mode certificate, and the log encryption switch in the TEE can utilize the security of the TEE itself to prevent these security values from being directly changed by the outside world and thus changing the state of the prototype. And the REE changes the application status based on the development mode status value in the TEE. In this way, when the TEE is secure, the change process of the REE is also secure.

[0061] Further, the changing of the application state according to the development mode status value in the REE includes:

[0062] If the development mode status value is that the development mode is switched to the usage mode, then in the REE, perform operations of uninstalling the informal application, removing the development mode watermark, and hiding the manufacturer's special application entry;

[0063] If the development mode status value is that the usage mode is switched to the development mode, then in the REE, perform operations of installing the informal application, displaying the development mode watermark, and displaying the manufacturer's special application entry.

[0064] As can be seen from the above description, for the operations of the REE, different operations are implemented according to different state transitions. When switching to the development mode, install the informal application, display the development watermark to prompt the operator, and open the manufacturer's special application entry for invocation. When switching from the development mode to the usage mode, uninstall the informal application, close the development watermark, and close the manufacturer's special entry, which facilitates the operator to directly conduct trials after completing the application development on the prototype machine, or directly conduct trials on the application in the development process, improving the development efficiency.

[0065] The above application development prototype management method and terminal of the present invention can be applied to the management of prototype devices during the user-side development process, which will be described below through specific embodiments.

[0066] Please refer to Figure 1 , the first embodiment of the present invention is:

[0067] An application development prototype management method includes the steps of:

[0068] S01. The server receives a terminal registration request, and the registration request includes the terminal serial number;

[0069] In an optional implementation manner, please refer to Figure 2, a secure link is established between the server and the user terminal through the PC client. The user initiates a switching operation through the PC client without directly contacting the user terminal, which further ensures the isolation of the user terminal and improves security. Among them, the server includes a security channel related module to implement the management of operation instructions, the creation of channels, and authentication related functions. The development mode setting module implements the execution of setting functions. The prototype pool entry authorization management module implements the authorization management of prototypes. The user operation authorization module implements the management of user operation permissions. The terminal information system and the account system are used as general services and can be abstracted and shared with other business platforms. The PC side is the entry point for initiating the switching operation and is also the transit link for building the secure link channel. The user terminal includes each module of the TEE layer and the REE layer. The TEE layer executes sensitive operations, authentication, and encryption and decryption operations. The REE layer implements related services for development mode operations and management. Among them, there can also be a third-party background. The system supports the services of third-party platforms. In actual business, third-party platforms often need to be connected to the management system of development prototypes. After authorization, the third-party background can be connected to the secure channel module of the background and request to execute the management functions of development prototypes for the terminals it controls;

[0070] In an alternative implementation, after directly establishing a secure transmission channel between the server and the user terminal, messages are sent through the secure transmission channel, including:

[0071] (1) The user terminal logs in to the server through the status switching APP for one-way HTTPS authentication. If the authentication is passed, the user terminal sends a registration request for sensitive operation instructions to the server;

[0072] (2) After the server verifies the user terminal's permissions, it saves the operation instruction set into the instruction pool and returns the verification passed result to the user terminal;

[0073] (3) After receiving the verification passed result, the user terminal starts the secure link TA and establishes a TLS two-way authentication channel with the server. Specifically, it creates a TCP connection with the server through a socket and performs two-way TLS authentication and negotiates a session key;

[0074] (4) The user terminal starts to send the first service frame. The transmitted data is encrypted and transmitted through the TLS protocol using the previously negotiated session key. After the user terminal link module receives this data frame, it sends the CPUID, SN number, and terminal capabilities to the server instruction management module and notifies that the secure link is successfully established;

[0075] S02. The server receives the configuration information corresponding to the terminal serial number and stores the terminal serial number and the configuration information in an associated manner;

[0076] Please refer to Figure 3, in an alternative embodiment, the configuration information includes the valid days in the pool and the valid operation days, which control the validity period of the permission for a certain client to perform the management operation of the development prototype. When the validity period expires, the user cannot perform the operation of switching the development mode on this machine; a deadline can be directly set, or the number of days can be given, and the duration is calculated starting from the receipt of the terminal information; the valid operation days control how long the device can continue in the development mode after being switched to the development mode; for example, if the preset valid operation days of a client's development mode is 10 days, then after he performs the operation of switching the development mode, if he does not perform the switching operation again within 10 days, then after 10 days, the terminal will enter the locked screen state, prompting the user that the running time of the device development mode has expired and asking the user to perform the switching operation again;

[0077] In an alternative embodiment, when there are some urgent requirements, such as when customer service repair personnel need to switch the mode of the device on-site to troubleshoot problems, a whitelist can be set, and the whitelist has a limited valid time. When a user in the valid time of the whitelist operates the client, they are not restricted by the permission to enter the prototype pool, that is, they can directly execute the switching without going through the judgment in step S1;

[0078] S1. The server receives the terminal information of the client and verifies whether the client has the development mode permission according to the terminal information; if so, execute S22;

[0079] Among them, the verification of whether the terminal has the development mode permission according to the terminal information includes:

[0080] S11. Receive the terminal information, where the terminal information includes the terminal serial number;

[0081] S12. Judge whether the corresponding configuration information is stored for the terminal serial number. If so, the terminal has the development mode permission;

[0082] In an alternative embodiment, if the corresponding configuration information is not stored for the terminal serial number, then judge whether the third-party platform information is stored. If so, forward it to the third-party platform to judge whether the terminal has the development mode permission, and receive the judgment result returned by the third-party platform;

[0083] In an alternative embodiment, if the client has the development mode permission, then execute S21. Verify whether the conditions for entering the development mode are met. If so, execute S22; for example, verify whether the current time exceeds the valid days in the pool;

[0084] S22. Configure the development mode switching instruction and the development mode certificate according to the terminal information and return them to the client;

[0085] In an alternative embodiment, a development mode switching instruction, a valid running number of days, and a development mode certificate are returned to the client according to the terminal information;

[0086] S3. The client switches the states of the TEE and REE according to the development mode switching instruction and the development mode certificate, and returns an execution result to the server, including:

[0087] S31. Update and save the development mode status value, the valid running number of days, the development mode certificate, and the log encryption switch in the TEE;

[0088] Among them, for financial terminals, some industry specifications such as PCI (Payment Card Industry Data Security Standard) require clearing the financial key certificates used in mass production in the terminal in the development mode. Therefore, after entering the development mode, the development mode certificate will be downloaded and installed, and the development mode certificate chain will be enabled; after exiting the development mode, the official certificate chain will be enabled; in the usage mode, some key logs, such as modem logs and transaction logs, will be encrypted to prevent sensitive information from leaking from the logs; in the development mode, encryption will not be performed for development and debugging. Therefore, the log encryption switch flag will be changed accordingly according to the change of the development mode; the encryption switch permission is closed in the development mode, and the encryption switch is opened after exiting the development mode to prevent information leakage;

[0089] S32. Change the application state in the REE according to the development mode status value, including:

[0090] If the development mode status value is that the development mode is switched to the usage mode, the operations of uninstalling the adb / hdc application and informal applications, removing the development mode watermark, and hiding the manufacturer's special application entry are performed in the REE;

[0091] If the development mode status value is that the usage mode is switched to the development mode, the operations of installing the adb / hdc application, displaying the development mode watermark, and displaying the manufacturer's special application entry are performed in the REE;

[0092] To sum up, in the development mode, developers need to execute various debugging instructions through adb / hdc, so the adb / hdc application needs to be installed to perform normal development and debugging. When exiting the development mode, to ensure the security of the terminal and prevent users from using some sensitive instructions, the adb / hdc application will be uninstalled and installation is not allowed; in the usage state, to prevent the informal applications installed in the development mode from causing potential hazards to the formally used machine, the applications installed in the development mode need to be uninstalled; S33. If it is initiated by a PC tool, the execution result is returned to the PC tool and the server; if it is initiated by the APP in the client for self-switching, the execution result is returned to the server and the APP.

[0093] Please refer to Figure 5 , Embodiment 2 of the present invention is as follows:

[0094] An application development prototype management terminal 1 includes a processor 2, a memory 3, and a computer program stored on the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, each step in Embodiment 1 is implemented.

[0095] In summary, the present invention provides an application development prototype management method and terminal. The server receives the terminal information sent by the user terminal and verifies the identity of the user terminal. Only if the user terminal registered with the development mode permission is allowed to switch between the development mode and the usage mode. Further, the verification process is divided into two stages. In the first stage, only whether the identifier of the terminal itself is saved is simply verified. If so, further verification is carried out to determine whether the permission conditions are met. Here, a third-party system is introduced, and identity verification can be further implemented through the third-party system. Finally, during the switching process, the user terminal first switches the TEE, and the REE switching is carried out only after the switching information of the TEE is read. The high security provided by the TEE itself is used to ensure the security of the REE switching, ensuring both the flexibility of the state switching and the security.

[0096] The above are only the embodiments of the present invention, and do not limit the patent scope of the present invention accordingly. Any equivalent transformation made using the specification and drawings of the present invention, or directly or indirectly applied in the related technical fields, shall be equally included in the patent protection scope of the present invention.

Claims

1. A method for managing an application development prototype, characterized in that, Including the steps: The server receives the terminal information of the client, and verifies whether the client has the development mode permission according to the terminal information; if so, configures the development mode switching instruction and the development mode certificate according to the terminal information and returns them to the client; After the client switches the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate, it returns the execution result to the server.

2. The management method of an application development prototype according to claim 1, wherein Before verifying whether the client has the development mode permission according to the terminal information, it includes: The server receives a terminal registration request, and the registration request includes a terminal serial number; The server receives the configuration information corresponding to the terminal serial number and stores the terminal serial number and the configuration information in an associated manner; Verifying whether the terminal has the development mode permission according to the terminal information includes: Receiving terminal information, where the terminal information includes a terminal serial number; Judging whether the corresponding configuration information is stored for the terminal serial number, and if so, the terminal has the development mode permission.

3. The management method of an application development prototype according to claim 1, characterized in that Verifying whether the client has the development mode permission according to the terminal information further includes: If so, verifying whether the conditions for entering the development mode are met, and if so, executing the step of configuring the development mode switching instruction and the development mode certificate according to the terminal information and returning them to the client.

4. The management method of an application development prototype according to claim 1, characterized in that The client switching the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate includes: Updating and saving the development mode status value, the development mode certificate, and the log encryption switch in the TEE; Changing the application state in the REE according to the development mode status value.

5. A method for managing an application development prototype as described in claim 4, characterized in that, Changing the application state in the REE according to the development mode status value includes: If the development mode status value is that the development mode is switched to the usage mode, perform operations such as uninstalling the informal application, removing the development mode watermark, and hiding the manufacturer's special application entry in the REE; If the development mode status value is that the usage mode is switched to the development mode, perform operations such as installing the informal application, displaying the development mode watermark, and displaying the manufacturer's special application entry in the REE.

6. An application development prototype management terminal, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the following steps: The server receives the terminal information of the client, and verifies whether the client has the development mode permission according to the terminal information; if so, configures the development mode switching instruction and the development mode certificate according to the terminal information and returns them to the client; After the client switches the states of the TEE and the REE according to the development mode switching instruction and the development mode certificate, it returns the execution result to the server.

7. The management terminal of an application development prototype according to claim 6, characterized in that, Before verifying whether the client has the development mode permission according to the terminal information, it includes: The server receives a terminal registration request, and the registration request includes a terminal serial number; The server receives the configuration information corresponding to the terminal serial number and stores the terminal serial number and the configuration information in an associated manner; Verifying whether the terminal has the development mode permission according to the terminal information includes: Receiving terminal information, where the terminal information includes a terminal serial number; Determine whether the corresponding configuration information is stored in the terminal serial number. If so, the terminal has the development mode permission.

8. An application development prototype management terminal according to claim 6, characterized in that, The verification of whether the client has the development mode permission according to the terminal information further includes: If so, verify whether the conditions for entering the development mode are met. If they are met, execute the steps of configuring the development mode switching instruction and the development mode certificate according to the terminal information and returning them to the client.

9. The management terminal of an application development prototype according to claim 6, characterized in that The switching of the states of TEE and REE by the client according to the development mode switching instruction and the development mode certificate includes: Update and save the development mode status value, the development mode certificate, and the log encryption switch in TEE; Change the application status in REE according to the development mode status value.

10. The management terminal for application development prototype according to claim 9, characterized in that, The changing of the application status in REE according to the development mode status value includes: If the development mode status value is that the development mode is switched to the usage mode, perform operations of uninstalling the informal application, removing the development mode watermark, and hiding the manufacturer's special application entry in REE; If the development mode status value is that the usage mode is switched to the development mode, perform operations of installing the informal application, displaying the development mode watermark, and displaying the manufacturer's special application entry in REE.

Images