API (Application Program Interface) access control method and device based on resource-constrained device, equipment and medium
The caller is authenticated and authorization information is generated through the TSM platform, which is then written into the EF file for static analysis. This solves the problem in existing technologies where API access control cannot protect data security, implements fine-grained API access permission control, and improves the data security of the callee.
Patent Information
- Application Number
- CN202510871309.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-26
- Publication Date
- 2025-10-17
AI Technical Summary
In the prior art, the API access control method based on the auxiliary link file cannot effectively protect the data security of the callee and cannot guarantee the access permission control of the caller.
The caller is authenticated through the TSM platform, authorization information is generated and written into the EF file, and static analysis of the constant pool data segment is performed based on the EF file to determine the APIs that the caller can call, thereby achieving fine-grained API access permission control.
This ensures that only the caller with correct authorization information can call the callee, improving the data security of the callee.
Smart Images
Figure CN120805115A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of smart card operating system, and particularly relates to an API access control method and device based on a resource-limited device, equipment and a medium. BACKGROUND
[0002] The virtual machine of the resource-limited device includes a multi-application smart card, and the multi-application smart card includes an auxiliary link file and an executable file (EF file). The auxiliary link file includes a method export item corresponding to a package-visible method of a library package of the multi-application smart card. The EF file stores data in the multi-application smart card, and the EF file includes a constant pool and an import data segment. The constant pool includes a method data item corresponding to a package-visible method of a called party package, and the import data segment includes the library package of the multi-application smart card.
[0003] In the prior art, when a calling party needs to call a library package of a multi-application smart card, the calling party acquires an auxiliary link file of the multi-application smart card, and can call the library package in the multi-application smart card. However, the application programming interface (API) access based on the auxiliary link file controls the access permission of the calling party, which is not conducive to protecting the sensitive logic of the called party and cannot guarantee the data security of the called party. SUMMARY
[0004] The present application aims to at least solve one of the technical problems in the prior art. To this end, the present application provides an API access control method and device based on a resource-limited device, which can ensure that only a calling party with correct authorization information can call a called party, thereby improving the data security of the called party.
[0005] In a first aspect, an API access control method based on a resource-limited device is provided, which is applied to a virtual machine of a resource-limited device, and the virtual machine is in communication connection with a TSM platform, and the method comprises the following steps. The TSM platform acquires any group of calling parties and called parties based on a constant pool of an EF file. The TSM platform analyzes an import data segment of the EF file and authenticates the calling parties. The calling parties pass the authentication, write authorization information into the EF file, and trigger the called parties to perform static analysis on a constant pool data segment based on the EF file to determine the API that can be called by the calling parties.
[0006] According to some embodiments of the present application, the TSM platform analyzes the import data segment of the EF file, authenticates the caller, and writes authorization information into the EF file to trigger the callee to determine the API that can be called by the caller based on the static analysis of the constant pool data segment of the EF file, including: The TSM platform obtains a caller package of the caller, authenticates the caller package, wherein the import data segment includes the caller package; When the caller package is authenticated, the TSM platform sends the authorization information generated based on the AID of the caller package to the caller package, wherein the caller package includes a unique AID; When the caller is compiled, the caller writes the authorization information into the EF file; The callee parses the EF file, and performs MAC check on the callee package based on the authorization information for API access control, wherein the callee includes the callee package; The callee performs static analysis on the constant pool data segment of the EF file, checks all method permissions of the callee package, and determines the API that can be called by the caller.
[0007] According to some embodiments of the present application, before the TSM platform sends the authorization information generated based on the AID of the caller package to the caller package, it further includes: The TSM platform generates a token and obtains a key version number; The TSM platform obtains a plaintext license and generates a first MAC value based on the plaintext license; The TSM platform encrypts the plaintext license to generate a ciphertext license; The TSM platform generates the authorization information based on the token, the key version number, the first MAC value, and the ciphertext license.
[0008] According to some embodiments of the present application, the TSM platform encrypts the plaintext license to generate a ciphertext license, including: Obtain the AID of the caller package, the AID of the callee package, the major version number of the callee package, and the minor version number of the callee package; Serially concatenate the token, the AID of the caller package, the AID of the callee package, the major version number of the callee package, and the minor version number of the callee package, and complete the length to obtain session data; Obtaining an encryption key corresponding to the key version number, wherein the TSM platform includes multiple pairs of the key version number and the encryption key of the callee, and the key version number is unique; Encrypting the session data using the encryption key to generate a session key; The plaintext license is encrypted using the session key to generate the ciphertext license.
[0009] According to some embodiments of the present invention, the called party parses the EF file and performs MAC verification on the called party package for API access control based on the authorization information, including: The callee parses the EF file to obtain a first callee package and the authorization information of the first callee package, wherein the callee includes the first callee package; The callee performs MAC verification on the first callee packet based on the authorization information of the first callee packet; When the first callee packet passes the MAC check, the callee performs an API access permission check on the first callee packet.
[0010] According to some embodiments of the present invention, the callee performing MAC verification on the first callee packet based on the authorization information of the first callee packet includes: Acquire the ciphertext license of the first callee package and the key version number of the first callee package based on the authorization information of the first callee package; Obtaining the session data of the first callee package based on the token, the AID of the caller package, the AID of the first callee package, the major version number of the first callee package, and the minor version number of the first callee package; obtaining a corresponding encryption key based on the key version number, and generating the session key based on the session data of the first callee packet and the encryption key, wherein the key version number is unique among a plurality of pairs of the key version number and the encryption key of the callee; Decrypting the ciphertext license using the session key to generate a decrypted license; A second MAC value is generated based on the decryption license, and the first MAC value and the second MAC value are compared. If the first MAC value and the second MAC value are the same, the first callee packet passes the MAC verification.
[0011] According to some embodiments of the present application, the API access permission check of the first callee package comprises: When the first callee package passes the MAC check and is the last callee package to perform the API access control check, the callee obtains a first method data item from the constant pool data segment, and compares the first method data item with a permission bitmap table, wherein the permission bitmap table is generated based on a helper file. When the permission bitmap table indicates that the first method data item is allowed to access, and the first method data item is the last method data item compared with the permission bitmap table, the callee package passes the access permission check, and it is determined that the API can be called by the caller.
[0012] In a second aspect, the embodiments of the present application provide an API access control device based on a resource-limited device, which comprises at least one control processor and a memory in communication connection with the at least one control processor; the memory stores instructions executable by the at least one control processor, and the instructions are executed by the at least one control processor to enable the at least one control processor to perform the API access control method based on a resource-limited device as described in the first aspect.
[0013] In a third aspect, the embodiments of the present application provide an electronic device comprising the API access control device based on a resource-limited device as described in the second aspect.
[0014] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium storing computer executable instructions for performing the API access control method based on a resource-limited device as described in the first aspect.
[0015] The API access control method based on a resource-limited device according to the embodiments of the present application has at least the following beneficial effects: the TSM platform obtains any group of callers and callees based on the constant pool of an EF file; the TSM platform analyzes the import data segment of the EF file to authenticate the callers; the callers that pass the authentication write authorization information into the EF file, triggering the callees to perform static analysis on the constant pool data segment based on the EF file to determine the API that can be called by the callers. According to the technical solution of the embodiments of the present application, the callers that pass the authentication are authorized, the callers write authorization information into the EF file, and the callees perform API access permission control based on the authorization information in the EF file to determine the target API that can be called by the callers, so that only the callers with correct authorization information can call the callees, thereby ensuring the data security of the callees. BRIEF DESCRIPTION OF DRAWINGS
[0016] Figure 1 is a flow chart of the API access control method based on the resource-limited device provided by one embodiment of the present application; Figure 2 is a flow chart of the API access control method based on the resource-limited device provided by one embodiment of the present application; Figure 3 is a schematic diagram of the relationship between the permission bitmap table and the auxiliary linking file and the EF file provided by another embodiment of the present application; Figure 4 is a structural diagram of the API access control device based on the resource-limited device provided by another embodiment of the present application. DETAILED DESCRIPTION
[0017] The embodiments of the present application are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary, only for explaining the present application, and cannot be understood as a limitation of the present application.
[0018] In the description of the present application, it is understood that the orientation description, such as the orientation or position relationship indicated by up, down, front, back, left, right, etc. is based on the orientation or position relationship shown in the drawings, only for the convenience of describing the present application and simplifying the description, and is not intended to indicate or imply that the device or element indicated must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.
[0019] In the description of the present application, when the meaning of one or more is one or more, the meaning of more than two is more than two, greater than, less than, more than, etc. are not included in the number, above, below, etc. are included in the number. If it is described as first, second, only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of indicated technical features.
[0020] In the description of the present application, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and the person skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.
[0021] According to the API access control method based on the resource-limited device provided in the embodiment of the present application, the following beneficial effects are achieved: the TSM platform obtains any group of calling parties and called parties based on the constant pool of the EF file; the TSM platform analyzes the import data segment of the EF file to authenticate the calling parties; the calling parties write authorization information into the EF file after being authenticated, and trigger the called parties to determine the API that can be called by the calling parties based on the static analysis of the constant pool data segment of the EF file. According to the technical scheme of the embodiment of the present application, the calling parties that pass the authentication are authorized, the calling parties write the authorization information into the EF file, and the called parties control the API access right based on the authorization information in the EF file, so as to determine the target API that can be called by the calling parties, and only the calling parties with correct authorization information can call the called parties, thereby ensuring the data security of the called parties.
[0022] The technical scheme of the embodiment of the present application is further described below based on the drawings.
[0023] Referring to Figure 1 , Figure 1 A flowchart of an API access control method based on a resource-limited device provided in the embodiment of the present application is shown in the figure, and the API access control method based on the resource-limited device includes but is not limited to the following steps: S10, the TSM platform obtains any group of calling parties and called parties based on the constant pool of the EF file; S20, the TSM platform analyzes the import data segment of the EF file to authenticate the calling parties; S30, the calling parties write authorization information into the EF file after being authenticated, and trigger the called parties to determine the API that can be called by the calling parties based on the static analysis of the constant pool data segment of the EF file.
[0024] It should be noted that the resource-limited device includes a virtual machine, the virtual machine includes a multi-application smart card, the multi-application smart card includes a plurality of library packages, the called party is a library package in the multi-application smart card, and the calling party is an application.
[0025] It should be noted that the EF file includes a constant pool, in the multi-application smart card based on the virtual machine, the called party includes at least one called party package, the externally visible method of each called party package has a corresponding method data item in the constant pool, and the constant pool data segment describes the location information of the classes, methods and fields involved in the data segment. The constant pool includes at least one calling relationship, the TSM platform randomly selects one calling relationship and obtains the calling party and the called party corresponding to the calling relationship.
[0026] It should be noted that the embodiment is based on the authorization information to realize the access control of API, the TSM platform outside the multi-application smart card authenticates the calling party, and generates the authorization information by the TSM platform after the calling party is authenticated. When the calling party calls the called party, the TSM platform authenticates the calling party, and when the calling party is authenticated, the TSM platform generates the authorization information and sends it to the calling party, and the calling party realizes the calling of the called party based on the authorization information.
[0027] It should be noted that in the process of loading the EF file by the virtual machine, the TSM platform authenticates the calling party when the import data section is statically analyzed; in the process of loading the EF file by the virtual machine, the TSM platform checks the access control of API of the called party when the method data item of the constant pool data section of the called party is statically analyzed, so that the calling party can determine the API that can be called before the calling party initiates the calling of the called party, and the API access control of the called party is realized. After determining the callable API of the calling party, the calling party initiates the calling of the called party. The embodiment checks the calling relationship between a group of calling parties and called parties before the calling parties call the called parties.
[0028] It should be noted that in the prior art, the calling party initiates the calling of the called party, and the calling party can access all APIs of the called party. In the present application, the calling relationship between the calling party and the called party is checked before the calling party initiates the calling of the called party, and when it is determined that the calling party has the access right of the called party and the callable API of the calling party, the calling of the calling party to the called party is performed. The identity permission of the calling party is preset, and the authorization is performed after the calling party is authenticated, and then the authorization information is checked to determine the available API of the called party, and the access control of the API in the present application realizes that only the authorized calling party can load and call the functions in the library, and the security of the sensitive logic of the called party and the data of the called party is improved.
[0029] It should be noted that the identity permission of the calling party is preset before the calling party is authenticated, and those skilled in the art are familiar with how to check the identity of the calling party with preset identity, and the present application does not improve the identity authentication step, and will not be described here.
[0030] It should be noted that the called party performs static analysis on the constant pool data segment of the EF file in which the authorization information has been written, first traverses each called party package of the import data segment, performs API access checking on each called party package, when the called party package does not need to perform API access checking, it indicates that the called party package has access permission to all APIs; when the called party package needs to perform API access checking, it is checked based on the authorization information, identity authentication of the calling party is completed, and after the calling party passes the identity authentication, each method data item of the constant pool data item is traversed to determine the API that can be called by the calling party.
[0031] It should be noted that the virtual machine determines a group of calling parties and called parties based on the calling instruction sent by the calling party to the called party. The identity of the calling party is set in advance, and when the virtual machine loads the EF file of the called party, the identity of the calling party is verified when the import data segment is analyzed. When the calling party passes the identity verification, the authorization information is sent to the calling party. When the calling party is compiled, the calling party writes the received authorization information into the EF file. When the virtual machine loads the EF file of the called party, the constant pool data segment is statically analyzed, the called party parses the EF file, traverses all called party packages in the import data segment of the EF file, and performs authorization information checking. After completing the authorization information checking of the called party package, the method data item of the constant pool data segment is traversed to determine the API that can be called by the calling party. Through the API access permission checking based on the authorization information of the present application, fine-grained API access permission control of the calling party is realized, and the calling party can only access the API with access permission, thereby improving the security of sensitive logic and data security in the called party.
[0032] In addition, in an embodiment, the virtual machine is in communication connection with the TSM platform, and in steps S20 and S30, the following steps are included but not limited to: S21, the TSM platform obtains a calling party package of a calling party, and performs identity authentication on the calling party package, wherein the import data segment includes the calling party package; S22, when the calling party package passes the identity authentication, the TSM platform sends authorization information generated based on the AID of the calling party package to the calling party package, wherein the calling party package includes a unique AID; S23, when the calling party is compiled, the calling party writes the authorization information into the EF file; S24, the called party parses the EF file, and performs MAC checking on the called party package based on the authorization information, wherein the called party includes the called party package; S25, the called party performs static analysis on the constant pool data segment based on the EF file, checks all method permissions of the called party package, and determines the API that can be called by the calling party.
[0033] It should be noted that the caller includes at least one caller package, and the caller package has been configured with identity authority before identity authentication of the caller package. How to perform identity authentication on the caller package with identity configuration is a routine technical means for those skilled in the art, and the present application does not make any improvement, and will not be described here.
[0034] It should be noted that the AID of the caller package is unique, and the number of the caller package is at least one. The authorization information generated based on the AID enables only the caller package with the AID to call the callee, instead of all caller packages to access the same API, thereby realizing fine-grained API access control.
[0035] It should be noted that the TSM platform sends the authorization information to the caller package, the caller package receives the authorization information, and the compiler of the caller writes the authorization information into the license data item of the import data segment of the EF file during compilation of the caller. The callee parses the EF file with written authorization information, and performs MAC check on the authorization information in the EF file. If the MAC check fails, it indicates that the identity authentication of the caller fails, and the caller has no access to the callee. If the MAC check passes, the callable API of the caller is determined based on the authorization information.
[0036] It should be noted that the callee performs static analysis on the constant pool data segment of the EF file with written authorization information, first traverses each callee package of the import data segment, and performs API access control check on each callee package. When the callee package does not need to perform API access control check, it indicates that the callee package has access to all APIs. When the callee package needs to perform API access control check, the authorization information is checked. When the caller passes the identity authentication, each method data item of the constant pool data item is traversed to determine the callable API of the caller.
[0037] In addition, in an embodiment, before step S22, the following steps are further included, but are not limited to: S31, the TSM platform generates a token and obtains a key version number; S32, the TSM platform obtains a plaintext license and generates a first MAC value based on the plaintext license; S33, the TSM platform encrypts the plaintext license to generate a ciphertext license; S34, the TSM platform generates authorization information based on the token, the key version number, the first MAC value, and the ciphertext license.
[0038] It should be noted that the token is a credential generated by the TSM platform after the calling party is authenticated, and the validity range of the token is within a session period or within a specified time. The length of the token is 16 bytes, or 32 bytes, or 64 bytes.
[0039] It should be noted that the TSM platform manages all encryption keys of the called party, the encryption key of the TSM platform is the same as the encryption key of the called party package in the multi-application smart card, the called party package has a plurality of pairs of key version numbers and encryption keys, and the key version numbers are unique. The encryption key of the called party package is stored in the PackageEntry.accessKeys list of the called party package.
[0040] It should be noted that in this embodiment, the ciphertext license is generated by using a symmetric encryption algorithm based on the plaintext license; and the plaintext license is decrypted based on the ciphertext license in the case that the data is not tampered with.
[0041] It should be noted that the MAC value of 16 bits is encrypted by using a MAC algorithm based on the plaintext license and the session key.
[0042] It should be noted that the authorization information includes the key version number, the MAC value, the length and content of the token, the length and content of the ciphertext license. The content of the ciphertext license includes the number of classes visible outside the package, the permission configuration information of the classes visible outside the package, and the permission bitmap table. The number of classes visible outside the package is consistent with the number of called classes of the auxiliary link file, and the sorting order is the same. When the permission configuration information of the class visible outside the package indicates that all the package-visible methods of the class are not allowed to be accessed, or all the package-visible methods of the class are allowed to be accessed, the authorization information does not have the permission bitmap table.
[0043] In addition, in an embodiment, step S33 further includes but is not limited to the following steps: S41, obtaining the AID of the calling party package, the AID of the called party package, the major version number of the called party package, and the minor version number of the called party package; S42, serially concatenating the token, the AID of the calling party package, the AID of the called party package, the major version number of the called party package, and the minor version number of the called party package, and performing length completion to obtain session data; S43, obtaining the encryption key corresponding to the key version number, wherein the TSM platform includes a plurality of pairs of key version numbers and encryption keys of the called party, and the key version numbers are unique; S44, encrypting the session data by using the encryption key to generate a session key; S45: Encrypt the plaintext license using the session key to generate a ciphertext license.
[0044] It should be noted that after serially concatenating the token, the AID of the caller package, the AID of the callee package, the major version number of the callee package, and the minor version number of the callee package, the length of the data obtained after serial concatenation is padded based on the encryption algorithm used. The length of the major version number of the callee package and the length of the minor version number of the callee package are both 1 byte. For example, when using the AES algorithm for encryption, the length of the data obtained by serial concatenation is padded to a multiple of 8 according to the AES algorithm specifications.
[0045] It should be noted that, in this embodiment, a symmetric encryption algorithm is used to generate a ciphertext license based on the plaintext license and the session key; if the data has not been tampered with, the plaintext license is obtained based on the session key and the ciphertext license.
[0046] In addition, in one embodiment, referring to Figure 2 , Figure 2 This is a flowchart of API access permission control based on a plaintext license. Step S24 specifically includes but is not limited to the following steps: S51, the callee parses the EF file to obtain the first callee package and the authorization information of the first callee package, wherein the callee includes the first callee package; S52, the callee performs MAC verification on the first callee packet based on the authorization information of the first callee packet; S53: When the first called party packet passes the MAC check, the called party performs an API access permission check on the first called party packet.
[0047] It should be noted that, in this embodiment, API access permission control is implemented based on the plain text license of the authorization information.
[0048] It should be noted that, by parsing the EF file, an import data segment in the EF file is obtained, and the import data segment includes multiple callee packages.
[0049] It should be noted that the first callee package and the AID of the first callee package are obtained, and the access permission configuration file (accessConfig) of the corresponding callee package is searched based on the AID of the first callee package in the registry. When the access permission configuration file (accessConfig) of the first callee package represents that the first callee package does not perform API permission check, it means that the first callee package has access permission to all APIs, and there is no need to traverse the constant pool data segment to determine the API that can be called by the caller. When the access permission configuration file (accessConfig) of the first callee package represents that the first callee package performs API permission check, it means that the first callee package has access permission to the API, but further determination of the specific callable API is still needed.
[0050] In addition, in an embodiment, step S52 specifically further includes but is not limited to the following steps: S61, obtaining the ciphertext license of the first callee package and the key version number of the first callee package based on the authorization information of the first callee package; S62, obtaining the session data of the first callee package based on the token, the AID of the caller package, the AID of the first callee package, the major version number of the first callee package, and the minor version number of the first callee package; S63, obtaining the corresponding encryption key based on the key version number, and generating the session key based on the session data of the first callee package and the encryption key, wherein the plurality of pairs of key version numbers and encryption keys of the callee are unique in key version number; S64, decrypting the ciphertext license by the session key to generate the decrypted license; S65, generating the second MAC value based on the decrypted license, and comparing the first MAC value and the second MAC value, if the first MAC value and the second MAC value are the same, the first callee package passes the MAC check.
[0051] It should be noted that the ciphertext license is generated by using a symmetric encryption algorithm based on the plaintext license and the session key; and the plaintext license is obtained by decryption based on the ciphertext license and the session key in the case that the data is not tampered.
[0052] It should be noted that, in the case of using symmetric encryption algorithm to encrypt the plaintext license, the decrypted license is obtained based on the generated session key and the ciphertext license in the authorization information; the second MAC value is generated based on the decrypted license and the session key; the first MAC value and the second MAC value are compared, and when the first MAC value and the second MAC value are the same, the authorization information is not tampered with, and the caller passes the MAC check; if the first MAC value and the second MAC value are not the same, it means that the authorization information is tampered with, and the caller does not pass the MAC check, and the EF file loading fails.
[0053] It should be noted that when the first callee package passes the MAC check, it is judged whether all callee packages have completed the API access control check, and if not, another callee package and the AID of the callee package are obtained and subjected to the API access control check; if all callee packages have completed the API access control check, it means that each callee package of the import data section has been traversed, and the method data item of the constant pool data section is traversed when all callee packages are traversed.
[0054] In addition, in an embodiment, with reference to Figure 3 , Figure 3 The figure is a schematic diagram of the relationship between the permission bitmap table and the auxiliary link file and the EF file, and step S53 further includes but is not limited to the following steps: S71, when the first callee package passes the MAC check and is the last callee package subjected to the API access control check, the callee obtains the first method data item from the constant pool data section, and compares the first method data item with the permission bitmap table, wherein the permission bitmap table is generated based on the auxiliary link file; S72, when the permission bitmap table indicates that the first method data item is allowed to access and the first method data item is the last method data item compared with the permission bitmap table, the calling method permission of the callee package is passed, and it is determined that the API that can be called by the caller.
[0055] It should be noted that the permission bitmap table includes at least one byte, and one bit of one byte represents the permission configuration of one package-visible method; if the bit is set to 1, it means that the access permission of the corresponding package-visible method is possessed; if the bit is set to 0, it means that the access permission of the corresponding package-visible method is not possessed.
[0056] It should be noted that, with reference to Figure 3 , Figure 3The following is a diagram of the relationship between the permission bit chart, auxiliary link file and EF file. Each package-visible method in the called package has a corresponding method export item in the class structure of the classes data segment of the auxiliary link file. Each package-visible method has only two access rights settings: allow access and disallow access. Therefore, one bit is used to represent the access right configuration of a package-visible method. The permission bit chart includes at least one byte. A bit in the byte is set to 1, indicating that the corresponding package-visible method is allowed to access. A bit in the byte is set to 0, indicating that the corresponding package-visible method is not allowed to access. One byte can represent the access rights of 8 package-visible methods. The method array of each class in the auxiliary link file corresponds to a permission bit chart. One bit in the permission bit chart represents the access right of a package-visible method, and a corresponding relationship is established between the index number of the package-visible method and the permission bit chart.
[0057] It should be noted that the first method data item is obtained, the permission bitmap is located by the class and method index number, and the first method data item is compared with the permission bitmap. If the permission bitmap indicates that the first method data item is not allowed to be accessed, the EF file fails to load. If it indicates that the first method data item is allowed to be accessed, it is checked whether all method data items in the constant pool data segment have been compared with the permission bitmap. If not, another method data item is obtained and compared with the permission bitmap. If it is completed, it indicates that all method data items in the constant pool data segment have been completed, and all calling method permissions of the called package have been passed.
[0058] like Figure 4 As shown, Figure 4 The present invention also provides an API access control device based on a resource-constrained device, including: The processor 801 may be implemented as a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application. The memory 802 can be implemented in the form of Read Only Memory (ROM), static storage device, dynamic storage device or Random Access Memory (RAM), etc. The memory 802 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 802 and are called and executed by the processor 801 to implement the API access control method based on a resource-limited device according to the embodiments of the present application. The input / output interface 803 is configured to realize information input and output. The communication interface 804 is configured to realize the communication interaction between the device and other devices. The communication can be realized by a wired manner (for example, USB, network cable, etc.) or a wireless manner (for example, mobile network, WIFI, Bluetooth, etc.). The bus 805 is configured to transmit information between various components (for example, the processor 801, the memory 802, the input / output interface 803 and the communication interface 804) of the device. The processor 801, the memory 802, the input / output interface 803 and the communication interface 804 are connected to each other through the bus 805 to realize the communication connection between the device.
[0059] The embodiments of the present application also provide an electronic device comprising the API access control device based on a resource-limited device as described above.
[0060] The embodiments of the present application also provide a storage medium, which is a computer readable storage medium. The storage medium stores a computer program. When the computer program is executed by a processor, the API access control method based on a resource-limited device is realized.
[0061] The memory is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor. These remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof. The device embodiments described above are only schematic and the units described as separate components can or can not be physically separated, and can be implemented in one place or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.
[0062] Those skilled in the art will appreciate that all or some of the steps and systems disclosed above can be implemented as software, firmware, hardware, or any suitable combination thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVDs) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.
[0063] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above implementation. Those skilled in the art can also make various equivalent modifications or substitutions under the shared conditions that do not violate the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.
Claims
1. A method for controlling API access based on resource-constrained devices, characterized in that: A virtual machine applied to a resource-constrained device, the virtual machine being in communication with a TSM platform, the method comprising: The TSM platform obtains any set of callers and callees based on the constant pool of the EF file; The TSM platform analyzes the import data segment of the EF file and authenticates the caller; The caller passes identity authentication and writes authorization information into the EF file, triggering the callee to perform static analysis on the constant pool data segment based on the EF file to determine the API that the caller can call.
2. The API access control method based on resource-constrained devices according to claim 1, characterized in that: The TSM platform analyzes the import data segment of the EF file and authenticates the caller; the caller writes authorization information into the EF file after authentication, triggering the callee to perform static analysis on the constant pool data segment based on the EF file to determine the API that the caller can call, including: The TSM platform obtains a caller package of the caller and authenticates the caller package, wherein the import data segment includes the caller package; When the caller package passes the authentication, the TSM platform sends the authorization information generated based on the AID of the caller package to the caller package, wherein the caller package includes a unique AID; When the caller compiles, the caller writes the authorization information into the EF file; The callee parses the EF file and performs MAC verification on the callee package for API access control based on the authorization information, wherein the callee includes the callee package; The callee performs static analysis on the constant pool data segment based on the EF file, checks all method permissions of the callee package, and determines the callable API of the caller.
3. The API access control method based on resource-constrained devices according to claim 2, characterized in that: Before the TSM platform sends the authorization information generated based on the AID of the caller package to the caller package, the method further includes: The TSM platform generates a token and obtains the key version number; The TSM platform obtains a plaintext license and generates a first MAC value based on the plaintext license; The TSM platform encrypts the plaintext license to generate a ciphertext license; The TSM platform generates the authorization information based on the token, the key version number, the first MAC value and the ciphertext license.
4. The API access control method based on resource-constrained devices according to claim 3, characterized in that: The TSM platform encrypts the plaintext license to generate a ciphertext license, including: Obtain the AID of the caller package, the AID of the callee package, the major version number of the callee package, and the minor version number of the callee package; The token, the AID of the caller package, the AID of the callee package, the major version number of the callee package, and the minor version number of the callee package are serially concatenated and length-completed to obtain session data; Obtaining an encryption key corresponding to the key version number, wherein the TSM platform includes multiple pairs of the key version number and the encryption key of the callee, and the key version number is unique; Encrypting the session data using the encryption key to generate a session key; The plaintext license is encrypted using the session key to generate the ciphertext license.
5. The API access control method based on resource-constrained devices according to claim 3, characterized in that: The called party parses the EF file and performs MAC verification on the called party package for API access control based on the authorization information, including: The callee parses the EF file to obtain a first callee package and the authorization information of the first callee package, wherein the callee includes the first callee package; The callee performs MAC verification on the first callee packet based on the authorization information of the first callee packet; When the first callee packet passes the MAC check, the callee performs an API access permission check on the first callee packet.
6. The API access control method based on resource-constrained devices according to claim 5, characterized in that: The callee performs MAC verification on the first callee packet based on the authorization information of the first callee packet, including: Acquire the ciphertext license of the first callee package and the key version number of the first callee package based on the authorization information of the first callee package; Obtaining the session data of the first callee package based on the token, the AID of the caller package, the AID of the first callee package, the major version number of the first callee package, and the minor version number of the first callee package; obtaining a corresponding encryption key based on the key version number, and generating the session key based on the session data of the first callee packet and the encryption key, wherein the key version number is unique among a plurality of pairs of the key version number and the encryption key of the callee; Decrypting the ciphertext license using the session key to generate a decrypted license; A second MAC value is generated based on the decryption license, and the first MAC value and the second MAC value are compared. If the first MAC value and the second MAC value are the same, the first callee packet passes the MAC verification.
7. The API access control method based on resource-constrained devices according to claim 5, characterized in that: The callee performs an API access permission check on the first callee package, including: When the first callee packet passes the MAC check and is the last callee packet to undergo the API access control check, the callee obtains a first method data item from the constant pool data segment and compares the first method data item with a permission bitmap table, wherein the permission bitmap table is generated based on an auxiliary link file; When the permission bitmap table indicates that the first method data item is allowed to be accessed, and the first method data item is the method data item that is last compared with the permission bitmap table, the callee passes all the calling method permissions and determines the API that the caller can call.
8. An API access control device based on a resource-constrained device, characterized in that: It includes at least one control processor and a memory for communicating with the at least one control processor; the memory stores instructions that can be executed by the at least one control processor, and the instructions are executed by the at least one control processor to enable the at least one control processor to execute the API access control method based on the resource-constrained device as described in any one of claims 1 to 7.
9. An electronic device, characterized in that: The device comprises the API access control device based on the resource-constrained device as claimed in claim 8.
10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the API access control method based on a resource-constrained device according to any one of claims 1 to 7.