Program execution control method and device, medium and program product

Abstract

The invention relates to the field of financial science and technology, and discloses a program execution control method and device, a medium and a program product. The method comprises the steps of obtaining a to-be-executed program, and performing signature verification on the to-be-executed program to obtain a signature verification result; if it is detected that the signature verification result is that verification is not passed, a parent process application corresponding to the program to be executed is obtained, and a trusted label list is obtained; and performing trust verification on the parent process application based on the trusted tag list to obtain a trust verification result, and when the trust verification result is that the verification is passed, executing the program to be executed to obtain a program execution result. According to the scheme of the embodiment, when the to-be-executed program does not pass the signature verification, the parent process application is subjected to the trust verification, and whether the to-be-executed program is executed or not is judged according to the trust verification result, so that the security verification of the executable program can be realized under an unsigned condition, and the program execution efficiency can be improved while the system security is ensured.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a method, device, medium, and program product for controlling program execution. Background Technology

[0002] To ensure the security of applications running on the operating system, enterprise-level operating systems typically use a certificate signing mechanism. This involves using the operating system's certificate to sign the application and verifying the relevant certificate signature during runtime before the application can run normally.

[0003] Since certificate signing needs to be done before the application runs, it is impossible to sign executable programs that are dynamically generated during the application's runtime. This can easily lead to these executable programs failing to run due to not being signed. Summary of the Invention

[0004] This invention provides a method, device, medium, and program product for controlling program execution, which can achieve secure verification of executable programs even without signatures, and can improve program execution efficiency while ensuring system security.

[0005] According to one aspect of the present invention, a method for controlling program execution is provided, comprising:

[0006] Obtain the program to be executed, perform signature verification on the program to be executed, and obtain the signature verification result;

[0007] If the signature verification result is detected as verification failure, then obtain the parent process application corresponding to the program to be executed, and obtain the list of trusted tags;

[0008] The parent process application is trusted based on the trusted tag list, the trust verification result is obtained, and the program to be executed is executed when the trust verification result is successful, and the program execution result is obtained.

[0009] According to another aspect of the present invention, a control device for program execution is provided, comprising:

[0010] The signature verification module is used to obtain the program to be executed, perform signature verification on the program to be executed, and obtain the signature verification result;

[0011] The parent process application acquisition module is used to acquire the parent process application corresponding to the program to be executed and to acquire a list of trusted tags if the signature verification result is detected as verification failure.

[0012] The trust verification module is used to perform trust verification on the parent process application based on the trusted label list, obtain the trust verification result, and execute the program to be executed when the trust verification result is successful, and obtain the program execution result.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the program execution control method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, the computer program being used to cause a processor to execute a control method for program execution as described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the program execution control method described in any embodiment of the present invention.

[0019] The technical solution of this invention involves obtaining a program to be executed and performing signature verification on the program to be executed to obtain a signature verification result. If the signature verification result is detected as failing, the parent process application corresponding to the program to be executed is obtained, and a list of trusted tags is obtained. Based on the list of trusted tags, the parent process application is verified for trust, and a trust verification result is obtained. If the trust verification result is successful, the program to be executed is executed, and the program execution result is obtained. By performing trust verification on the parent process application when the program to be executed fails signature verification, and determining whether to execute it based on the trust verification result, secure verification of executable programs can be achieved without signature verification, which can improve program execution efficiency while ensuring system security.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the structure of a program execution control system provided by existing technology;

[0023] Figure 2 This is a flowchart of a program execution control method provided in Embodiment 1 of the present invention;

[0024] Figure 3 This is a flowchart of a program execution control method provided in Embodiment 2 of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of a program execution control device according to Embodiment 3 of the present invention;

[0026] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the program execution control method of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be noted that for executable programs dynamically generated during application (APP) runtime, which cannot be pre-signed and therefore fail signature verification and thus cannot be executed, current operating systems typically address this issue by setting exceptions (e.g., whitelists) for the application's installation directory. All executable programs in this installation directory are exempt from certificate signing verification to ensure that the programs can run normally without a signature.

[0030] For example, the structure of a prior art program execution control system can be as follows: Figure 1 As shown, the system includes a certificate signing module 101, an operating system signature verification module 102, and an operating system policy control module 103. The certificate signing module 101 is responsible for signing unsigned apps to ensure they pass verification in the operating system signature verification module 102, allowing them to run normally in the operating system. The operating system signature verification module 102 is responsible for verifying the certificates of apps about to run. If the verification shows the app has been signed by the organization, it is allowed to run in the operating system. Simultaneously, it receives policy messages from the operating system policy control module 103 to determine if the executable program is in the whitelist directory. If it is, it allows the program to run without verifying the signing certificate; otherwise, it refuses to run. The operating system policy control module 103 is responsible for managing the certificate verification whitelist directory and distributing the whitelist directory to the operating system signature verification module 102.

[0031] However, this whitelist-like exception management method still has a series of problems, such as inconvenient operation and maintenance, requiring each application to set an exception directory separately in the background, and maintenance when the application directory changes; the privileged directory of the whitelist may become a target for malicious exploitation, etc. To address these problems, this invention proposes a new program execution control system that adds a trust label mechanism and corresponding background management capabilities to dynamically executable programs. Before signing, a trusted registration is initiated in the system. Then, for dynamically generated executable files, the operating system verifies whether its parent process is a trusted application to determine whether to execute it.

[0032] For example, the program execution control system proposed in this invention may include a signature registration module, a trust label registration module, a signature verification module, and a policy control module. The signature registration module is responsible for signing unsigned apps with certificates, ensuring they pass verification in the signature verification module. The trust label registration module is responsible for marking apps with trust labels; after the trust label is successfully registered in the trust label management unit of the policy control module, the app can run normally in the operating system.

[0033] The signature verification module is responsible for verifying the certificates of the upcoming app. If the app is verified as signed by this organization, it is allowed to run in the operating system. Simultaneously, it receives the trusted label list and trust level policy information from the policy control module, determines whether the parent process of the upcoming executable is in the trusted label list, and if so, allows or denies its operation based on the trust level (e.g., fully trusted or untrusted). The policy control module is responsible for managing trust labels and trust levels, and distributing the trusted label list and trust level information to the signature verification module. The policy control module includes a trust label management unit and a trust level management unit. The trust label management unit accepts trust label registration requests from the signature registration module and manages the trust labels of the app. The trust level management unit manages the trust level of the app and can set levels such as fully trusted and untrusted.

[0034] Compared to directory whitelist mechanisms, the technical solution of this invention, since it does not have a privileged directory, eliminates the vulnerability of privileged directories being maliciously exploited, making the risk more controllable. Furthermore, in terms of management, trust tags can be managed through the backend. When malicious tendencies are detected in dynamically executed files loaded by the program during business operations, their trust tags can be revoked in the backend, preventing the spread of malicious behavior. This provides convenient and granular management. The technical solution of this invention will now be described in detail with reference to specific embodiments.

[0035] Example 1

[0036] Figure 2 This is a flowchart illustrating a program execution control method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where trusted verification and execution control are performed on dynamically generated executable programs during application runtime. The method can be executed by a program execution control device, which can be implemented in hardware and / or software. Typically, this program execution control device can be configured in an electronic device, such as a computer or server. Figure 2 As shown, the method includes:

[0037] S110. Obtain the program to be executed, and perform signature verification on the program to be executed, and obtain the signature verification result.

[0038] The executable program can be a dynamically generated executable program during the application's runtime within the operating system, and may include dynamic library files and binary programs. The executable program is not pre-compiled and packaged within the application; instead, it is automatically generated by the application after runtime based on different parameters, environment variables, etc.

[0039] Specifically, after obtaining the program to be executed, a signature verification can be performed on it. For example, verifying whether the program has a corresponding certificate signature, or verifying whether the certificate signature corresponding to the program conforms to preset verification rules, to obtain the signature verification result. The signature verification result can include verification passed and verification failed.

[0040] Optionally, performing signature verification on the program to be executed and obtaining the signature verification result may include:

[0041] Determine whether the program to be executed has a corresponding certificate signature;

[0042] If the program to be executed does not have a corresponding certificate signature, the signature verification result is determined to be verification failed; if the program to be executed has a corresponding certificate signature, the signature verification result is determined to be verification passed.

[0043] In an optional example, the certificate signature can be stored in a specified file in the program's installation directory. If the specified file is successfully found in the program's installation directory, it is determined that the program has the corresponding certificate signature, and thus the verification is considered successful. If the specified file cannot be found in the installation directory, it is determined that the program does not have the corresponding certificate signature, and thus the verification is considered unsuccessful.

[0044] In this embodiment, signature verification is achieved by verifying whether the program to be executed has a corresponding certificate signature, which can realize accurate and efficient signature verification.

[0045] S120. If the signature verification result is detected as verification failure, then obtain the parent process application corresponding to the program to be executed, and obtain the list of trusted tags.

[0046] In this embodiment, when the signature verification result is determined to be a failure, the parent process application corresponding to the program to be executed can be found based on the association between the program and the application, or the association between the thread and the process. The parent process application refers to the application that generated the program to be executed during its runtime. Simultaneously, the list of trusted tags can be read from local storage.

[0047] The trusted label list can include the mapping relationship between applications and trusted labels. In this embodiment, each application needs to be signed and registered with trusted labels before running. After successful registration, the mapping relationship between applications and trusted labels can be generated, and a trusted label list can be generated and stored in local storage based on the mapping relationship.

[0048] S130. Perform trust verification on the parent process application based on the trusted label list, obtain the trust verification result, and execute the program to be executed when the trust verification result is successful, and obtain the program execution result.

[0049] In this embodiment, trust verification of the parent process application can be performed based on a list of trusted tags. For example, it can be determined whether a record related to the parent process application can be found in the list of trusted tags, or whether the parent process application and its corresponding trust tag match the record in the list of trusted tags, thus obtaining a trust verification result. The trust verification result can include verification passed and verification failed. Once a trust verification result of "verification passed" is detected, the program to be executed can be executed, and the program execution result can be obtained after execution.

[0050] Optionally, performing trust verification on the parent process application based on the trusted label list and obtaining the trust verification result may include:

[0051] Determine whether the parent process application has a corresponding trust label; if so, determine whether the parent process application and the corresponding trust label exist in the trusted label list.

[0052] If the parent process application and its corresponding trust tag are detected to exist in the list of trusted tags, then the trust verification result is determined to be successful.

[0053] In an optional example, when performing trust verification on the parent process application, firstly, it is determined whether the corresponding trust label exists in the installation directory of the parent process application. If it is determined not to exist, the execution of the program to be executed is directly abandoned. If it is determined to exist, it is further determined whether the parent process application and its corresponding trust label exist in the list of trusted labels. If they exist, the trust verification result is determined to be successful; otherwise, the trust verification result is determined to be unsuccessful.

[0054] Optionally, determining whether the parent process application and its corresponding trust label exist in the trusted label list may include: first searching for a record matching the parent process application in the trusted label list, and then performing an information consistency check between the trust label and the found record. If they match, it can be determined that the parent process application and its corresponding trust label exist in the trusted label list; if they do not match, it can be determined that the parent process application and its corresponding trust label do not exist in the trusted label list.

[0055] In this embodiment, by performing trust verification on the parent process application based on trust tags, the accuracy and efficiency of trust verification of the parent process application can be improved.

[0056] Optionally, the technical solution of this embodiment may further include: generating a certificate signature corresponding to the parent process application in response to a signature registration request for the parent process application;

[0057] In response to a trust tag registration request for a parent process application, the trust tag and trust level corresponding to the parent process application are obtained, a correspondence between the parent process application and the trust tag is generated, and the correspondence is added to the trusted tag list.

[0058] In this embodiment, after the parent process application is compiled, it can pre-register its signature and trust label. Upon receiving the corresponding registration request, the operating system can assign the corresponding certificate signature, trust label, and trust level to the parent process application. Furthermore, the operating system can generate a mapping between the parent process application and the trust label and add this mapping to the trusted label list.

[0059] In this embodiment, by pre-signing certificates and registering trust labels for the parent process application, a data foundation can be provided for the trustworthiness judgment of the executable program, ensuring that the trustworthy executable program can be executed smoothly.

[0060] The technical solution of this invention involves obtaining a program to be executed and performing signature verification on the program to be executed to obtain a signature verification result. If the signature verification result is detected as failing, the parent process application corresponding to the program to be executed is obtained, and a list of trusted tags is obtained. Based on the list of trusted tags, the parent process application is verified for trust, and a trust verification result is obtained. If the trust verification result is successful, the program to be executed is executed, and the program execution result is obtained. By performing trust verification on the parent process application when the program to be executed fails signature verification, and determining whether to execute it based on the trust verification result, secure verification of executable programs can be achieved without signature verification, which can improve program execution efficiency while ensuring system security.

[0061] Example 2

[0062] Figure 3 This is a flowchart illustrating a program execution control method according to Embodiment 2 of the present invention. This embodiment is a further refinement of the above technical solution, and the technical solution in this embodiment can be combined with one or more of the above implementation methods. For example... Figure 3 As shown, the method includes:

[0063] S210. Obtain the program to be executed, and perform signature verification on the program to be executed, and obtain the signature verification result.

[0064] S220. If the signature verification result is detected as verification failure, then obtain the parent process application corresponding to the program to be executed, and obtain the list of trusted tags.

[0065] S230. Determine whether the parent process application has a corresponding trust label. If so, determine whether the parent process application and the corresponding trust label exist in the trusted label list.

[0066] S240. If the parent process application and its corresponding trust tag are detected to exist in the trusted tag list, then obtain the trust level corresponding to the parent process application and determine whether the trust level corresponding to the parent process application meets the preset execution trust conditions.

[0067] The preset execution trust condition can be a pre-defined trust condition used to determine whether the parent process application is trustworthy. For example, it could be a trust level of full trust, partial trust, or no trust level. In this embodiment, if the parent process application and its corresponding trust tag are successfully detected to exist in the trusted tag list, it is further determined whether the trust level of the parent process application meets the preset execution trust condition.

[0068] S250. If it is detected that the trust level corresponding to the parent process application meets the preset execution trust conditions, then the trust verification result is determined to be a successful verification.

[0069] Specifically, if the trust level meets the preset execution trust conditions, the final trust verification result is determined to be verification passed; if the trust level does not meet the preset execution trust conditions, the trust verification result is determined to be verification failed.

[0070] Optionally, the trust level includes full trust, partial trust, and / or no trust. Detecting that the trust level corresponding to the parent process application meets the preset execution trust conditions may include:

[0071] If the trust level of the parent process application is detected to be fully trusted, then it is determined that the trust level of the parent process application meets the preset execution trust conditions.

[0072] In an optional example, the trust level can include three levels: full trust, partial trust, and no trust. The default condition for performing trust is that the trust level is full trust, that is, the application is considered trustworthy only when the trust level is full trust.

[0073] In this embodiment, by setting the preset execution trust condition to a trust level of full trust, the accuracy of application trust determination can be improved.

[0074] Optionally, the technical solution of this embodiment may further include: if it is detected that the parent process application does not have a corresponding trust label, or the parent process application and the corresponding trust label do not exist in the trusted label list, or the trust level corresponding to the parent process application does not meet the preset execution trust conditions, then the trust verification result is determined to be verification failure.

[0075] In this embodiment, if the parent process application does not have a corresponding trust label, the verification is deemed to have failed; or, although the parent process application has a corresponding trust label, if the trust label does not match the record of the parent process application in the trusted label list, the verification is also deemed to have failed; or, even if it has been determined that the parent process application has a corresponding trust label, and the parent process application and the corresponding trust label exist in the trusted label list, but the trust level is untrusted, the verification is also deemed to have failed. Once the trust verification result is determined to be a failure, the execution of the current pending program is refused.

[0076] In this embodiment, by determining that the trust verification result is unsuccessful when the parent process application does not meet the trust label judgment condition or the trust level judgment condition, the abnormal execution of untrusted programs can be avoided, thereby improving system security.

[0077] S260. When the trust verification result is successful, execute the program to be executed and obtain the program execution result.

[0078] The technical solution of this invention, if the parent process application and its corresponding trust tag are detected to exist in the trusted tag list, then the trust level corresponding to the parent process application is obtained, and it is determined whether the trust level corresponding to the parent process application meets the preset execution trust conditions; if the trust level corresponding to the parent process application is detected to meet the preset execution trust conditions, then the trust verification result is determined to be verification passed; by further verifying the trust level after determining that the parent process application has passed the trust tag verification, the accuracy of trust verification can be improved, and the accuracy of program execution control can be improved.

[0079] Example 3

[0080] Figure 4 This is a schematic diagram of a program execution control device provided in Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a signature verification module 310, a parent process application acquisition module 320, and a trust verification module 330; wherein,

[0081] The signature verification module 310 is used to obtain the program to be executed, perform signature verification on the program to be executed, and obtain the signature verification result.

[0082] The parent process application acquisition module 320 is used to acquire the parent process application corresponding to the program to be executed and acquire a list of trusted tags if the signature verification result is detected as verification failure.

[0083] The trust verification module 330 is used to perform trust verification on the parent process application based on the trusted label list, obtain the trust verification result, and execute the program to be executed when the trust verification result is successful, and obtain the program execution result.

[0084] The technical solution of this invention involves obtaining a program to be executed and performing signature verification on the program to be executed to obtain a signature verification result. If the signature verification result is detected as failing, the parent process application corresponding to the program to be executed is obtained, and a list of trusted tags is obtained. Based on the list of trusted tags, the parent process application is verified for trust, and a trust verification result is obtained. If the trust verification result is successful, the program to be executed is executed, and the program execution result is obtained. By performing trust verification on the parent process application when the program to be executed fails signature verification, and determining whether to execute it based on the trust verification result, secure verification of executable programs can be achieved without signature verification, which can improve program execution efficiency while ensuring system security.

[0085] Optionally, the trust verification module 330 is specifically used to determine whether the parent process application has a corresponding trust label. If so, it determines whether the parent process application and the corresponding trust label exist in the trusted label list.

[0086] If the parent process application and its corresponding trust tag are detected to exist in the list of trusted tags, then the trust verification result is determined to be successful.

[0087] Optionally, the trust verification module 330 is further configured to obtain the trust level corresponding to the parent process application and determine whether the trust level corresponding to the parent process application meets the preset execution trust conditions.

[0088] If the trust level of the parent process application is found to meet the preset execution trust conditions, the trust verification result is determined to be successful.

[0089] Optionally, the trust verification module 330 is further configured to determine that the trust verification result is a failure if it is detected that the parent process application does not have a corresponding trust label, or the parent process application and the corresponding trust label do not exist in the trusted label list, or the trust level corresponding to the parent process application does not meet the preset execution trust conditions.

[0090] Optionally, trust levels include full trust, partial trust, and / or no trust;

[0091] The trust verification module 330 is further configured to determine that the trust level of the parent process application meets the preset execution trust conditions if it is detected that the trust level of the parent process application is fully trusted.

[0092] Optionally, the signature verification module 310 is specifically used to determine whether the program to be executed has a corresponding certificate signature;

[0093] If the program to be executed does not have a corresponding certificate signature, the signature verification result is determined to be verification failed; if the program to be executed has a corresponding certificate signature, the signature verification result is determined to be verification passed.

[0094] Optionally, the control device for program execution also includes:

[0095] The signature registration module is used to generate a certificate signature corresponding to the parent process application in response to a signature registration request for the parent process application.

[0096] The trust label registration module is used to respond to a trust label registration request for a parent process application, obtain the trust label and trust level corresponding to the parent process application, generate a correspondence between the parent process application and the trust label, and add the correspondence to the trusted label list.

[0097] The program execution control device provided in the embodiments of the present invention can execute the program execution control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0098] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0099] Example 4

[0100] Figure 5 A schematic diagram of an electronic device 40 that can be used to implement embodiments of the present invention is shown. The electronic device 40 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 40 may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0101] like Figure 5As shown, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 42 or loaded from the storage unit 48 into the random access memory 43. The RAM 43 can also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0102] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0103] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as control methods for program execution.

[0104] In some embodiments, the program execution control method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the program execution control method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to execute the program execution control method by any other suitable means (e.g., by means of firmware).

[0105] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0106] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0107] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0108] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device 40, which includes: a display device (e.g., a cathode ray tube or liquid crystal display) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device 40. Other types of devices can also be used to provide interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0109] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0110] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact via a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server.

[0111] This embodiment may also include a computer program product, which includes a computer program that, when executed by a processor, implements the program execution control method provided in any embodiment of the present invention.

[0112] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0113] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for controlling program execution, characterized in that, include: Obtain the program to be executed, perform signature verification on the program to be executed, and obtain the signature verification result; If the signature verification result is detected as verification failure, then obtain the parent process application corresponding to the program to be executed, and obtain the list of trusted tags; The parent process application is trusted based on the trusted tag list, the trust verification result is obtained, and the program to be executed is executed when the trust verification result is successful, and the program execution result is obtained.

2. The method according to claim 1, characterized in that, Based on the trusted label list, a trust verification is performed on the parent process application to obtain the trust verification result, including: Determine whether the parent process application has a corresponding trust label; if so, determine whether the parent process application and the corresponding trust label exist in the trusted label list. If the parent process application and its corresponding trust tag are detected to exist in the list of trusted tags, then the trust verification result is determined to be successful.

3. The method according to claim 2, characterized in that, After detecting that the parent process application and its corresponding trust tag exist in the trusted tag list, the process further includes: Obtain the trust level corresponding to the parent process application, and determine whether the trust level corresponding to the parent process application meets the preset execution trust conditions; If the trust level corresponding to the parent process application is detected to meet the preset execution trust conditions, then the trust verification result is determined to be a successful verification.

4. The method according to claim 3, characterized in that, Also includes: If it is detected that the parent process application does not have a corresponding trust label, or the parent process application and its corresponding trust label do not exist in the trusted label list, or the trust level corresponding to the parent process application does not meet the preset execution trust conditions, then the trust verification result is determined to be verification failure.

5. The method according to claim 3, characterized in that, Trust levels include full trust, partial trust, and / or no trust. The system detects that the trust level corresponding to the parent process application meets preset execution trust conditions, including: If the trust level of the parent process application is detected to be fully trusted, then it is determined that the trust level of the parent process application meets the preset execution trust conditions.

6. The method according to claim 1, characterized in that, Perform signature verification on the program to be executed and obtain the signature verification result, including: Determine whether the program to be executed has a corresponding certificate signature; If the program to be executed does not have a corresponding certificate signature, the signature verification result is determined to be verification failed; if the program to be executed has a corresponding certificate signature, the signature verification result is determined to be verification passed.

7. The method according to claim 1, characterized in that, Also includes: In response to a signature registration request for the parent process application, a certificate signature corresponding to the parent process application is generated; In response to a trust tag registration request for a parent process application, the trust tag and trust level corresponding to the parent process application are obtained, a correspondence between the parent process application and the trust tag is generated, and the correspondence is added to the trusted tag list.

8. An electronic device, characterized in that, The electronic device includes: At least one processor, and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the program execution control method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that enables a processor to execute the control method for program execution as described in any one of claims 1-7.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the control method for program execution according to any one of claims 1-7.

Images