Safety access method and device of application program, equipment, terminal and medium

Abstract

The invention discloses a secure access method and device for an application program, equipment, a terminal, a medium and a product. The method is executed by a runtime environment in an embedded operating system, the embedded operating system is installed in a limited device, and the method comprises the steps that when a target application program is activated to run in a target logic channel, description information of permission access data of the target application program is written in a virtual machine running domain corresponding to the target logic channel; and according to the virtual machine operation domain, controlling a target application program to carry out data security access in the operation process. According to the technical scheme provided by the embodiment of the invention, when the security access control is performed in the operating system in the resource limited environment, the storage space can be effectively saved, and meanwhile, the risk of data leakage can be avoided.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, terminal, medium, and product for secure access to applications. Background Technology

[0002] WebAssembly (WASM) is a virtual instruction set architecture. Based on WebAssembly bytecode technology, applications can be written in various programming languages, and the written applications are converted into WebAssembly bytecode, which is then interpreted and executed by the virtual machine, thus enabling the application to run normally.

[0003] Currently, when running a WebAssembly bytecode-based application on a general-purpose computer, it is necessary to run the application in a separate thread within a sandbox environment provided by the operating system, and allocate independent memory space for it. The sandbox restricts the application's access to certain critical resources by intercepting the application's calls to operating system resources.

[0004] However, for embedded operating systems operating in resource-constrained environments, there may not be sufficient resources to implement a sandbox environment, and it may also be impossible to create independently running threads and allocate the memory space required for application runtime. Therefore, it is necessary to propose a new method for secure application access to effectively adapt to embedded operating systems operating in resource-constrained environments. Summary of the Invention

[0005] This invention provides a method, apparatus, device, terminal, medium, and product for secure access to applications, enabling the secure operation of WebAssembly-based applications in resource-constrained environments.

[0006] According to one aspect of the present invention, a secure access method for an application is provided, executed by a runtime environment in an embedded operating system installed in a restricted device, the method comprising:

[0007] When the target application is activated and running within the target logical channel, description information of the target application's permission access data is written into the virtual machine runtime domain corresponding to the target logical channel.

[0008] Based on the virtual machine runtime domain, control the target application to securely access data during runtime.

[0009] According to another aspect of the present invention, a secure access device for an application is also provided, configured in a runtime environment of an embedded operating system, the embedded operating system being installed in a restricted device, the device comprising:

[0010] The description information writing module is used to write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel when the target application is activated and running within the target logical channel.

[0011] The security access control module is used to control the secure data access of the target application during operation based on the virtual machine runtime domain.

[0012] According to another aspect of the present invention, a restricted device is also provided, wherein an embedded operating system is installed on the restricted device, and a runtime environment is executed in the embedded operating system, and the restricted device includes:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform a secure access method for an application as described in any of the embodiments of the present invention.

[0016] According to another aspect of the present invention, a terminal is also provided, including a restricted device as described in any one of the embodiments of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the secure access method for an application as described in any one of the embodiments of the present invention.

[0018] According to another aspect of the present invention, a computer program product is also provided, the computer program product including a computer program that, when executed by a processor, implements the secure access method for an application according to any one of the embodiments of the present invention.

[0019] The technical solution of this invention, by independently writing description information of the data accessed by the application running within the logical channel into the virtual machine runtime domain bound to the logical channel, can control secure data access during application execution based on the aforementioned description information. In resource-constrained operating systems, the number of logical channels is limited, thus eliminating the need to consume a large amount of storage space to record the aforementioned description information, thereby saving storage space. Furthermore, when the application accesses data and code, the virtual machine runtime domain can be used to check whether the access policy is met, without needing to read the data content of the application data to be accessed, avoiding the risk of data leakage.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a secure access method for an application provided according to an embodiment of the present invention;

[0023] Figure 2 This is a schematic diagram illustrating various types of permission access data written in a virtual machine runtime domain, as applicable to an embodiment of the present invention.

[0024] Figure 3 This is a flowchart of another secure access method for an application provided according to an embodiment of the present invention;

[0025] Figure 4 This is a flowchart of another secure access method for an application provided according to an embodiment of the present invention;

[0026] Figure 5 This is a flowchart of another secure access method for an application provided according to an embodiment of the present invention;

[0027] Figure 6 This is a flowchart of another secure access method for an application provided according to an embodiment of the present invention;

[0028] Figure 7 This is a structural diagram of a secure access device for an application provided according to an embodiment of the present invention;

[0029] Figure 8 This is a structural diagram of a restricted device provided according to an embodiment of the present invention;

[0030] Figure 9 This is a structural diagram of a terminal provided according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] Figure 1 This is a flowchart of a secure access method for an application provided in an embodiment of the present invention. This embodiment is applicable to situations where the runtime environment in an embedded operating system controls the secure access of data by the application. The method can be executed by a secure access device for the application, which can be implemented in hardware and / or software and is generally configured in a restricted device (e.g., various security elements or smart cards) with an embedded operating system installed.

[0034] The method in this embodiment is executed by a runtime environment within the embedded operating system. A runtime environment (RTE) is a secure runtime environment that executes a virtual machine on constrained resources such as a smart card or secure element; it can be considered a lightweight container. The application runs within the runtime environment, thus achieving complete isolation from the native functions of the embedded operating system.

[0035] Correspondingly, such as Figure 1 As shown, the method includes:

[0036] S110. When the target application is activated and running within the target logical channel, write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel.

[0037] In this context, a logical channel can be understood as a concept used to establish communication connections between a host and a restricted device. It allows multiple independent communication channels to be established simultaneously between the host and the restricted device, each with its own command and response stream, and all channels are isolated from each other.

[0038] Controlling the activation and operation of a target application within a target logical channel may include: when it is determined that a specified logical channel (i.e., the target logical channel) is in an open state, invoking the application selection interface corresponding to the selected application (i.e., the target application); and upon receiving an acceptance response from the application selection interface, controlling the selected application to activate and run within the specified logical channel.

[0039] Alternatively, controlling the activation and operation of the target application within the target logical channel may further include: in response to a logical channel opening instruction, opening a specified logical channel (i.e., the target logical channel); obtaining a default selected application in the specified logical channel as the selected application (i.e., the target application), and controlling the selected application to activate and run within the specified logical channel.

[0040] The application can be understood as a WebAssembly-based application. The goal of each embodiment of the present invention is to enable the secure operation of WebAssembly-based applications in resource-constrained environments.

[0041] A virtual machine runtime domain refers to the virtual memory space constructed by the Real-Time Execution Environment (RTE) for the scope of application runtime access data (also known as accessible data). It records information such as application identifiers and logical channels. Corresponding to each logical channel, there is one and only one running application bound to the virtual machine runtime domain on that logical channel.

[0042] The description information of the target application's access to data is used to limit the data that the target application can access after it is activated and running.

[0043] In an optional implementation of this embodiment, the description information of the licensed access data includes at least one of the following:

[0044] The storage address range of the licensed access data, the identifier of the licensed access data, and the data characteristics of the licensed access data.

[0045] The identifier of the licensed access data may include the application module identifier, the application program identifier, and the logical channel identifier; the data characteristics of the licensed access data may include whether it is cross-domain data.

[0046] In this embodiment, by writing the storage address range of the permission access data into the virtual machine runtime domain, after obtaining the data address of the target application's required access data, the target application can determine whether it can access the required access data by comparing the data address with the storage address range.

[0047] In addition, the identifier of the licensed access data can be recorded through the virtual machine runtime domain. For example, it can indicate which application module the licensed access data belongs to, or which virtual machine runtime domain the licensed access data corresponds to. Alternatively, the identifier of the licensed access data can be directly the application module identifier of the application module to which the target application belongs, the application identifier of the target application, or the logical channel identifier of the target logical channel.

[0048] Accordingly, after obtaining the identifier of the target application's required access data, by comparing the identifier of the required access data with the identifier of the permitted access data, it can be determined whether the target application can access the required access data.

[0049] Additionally, the data characteristics of permitted access data can be recorded through the virtual machine runtime domain, indicating whether the permitted access data is cross-domain data. Specifically, when the permitted access data is cross-domain data, all virtual machine runtime domains permit applications to access that data; when the permitted access data is not cross-domain data, only a specific virtual machine runtime domain can permit access. Cross-domain data can be understood as a special type of temporary static variable data, not restricted by the virtual machine runtime domain access control policy, and applications from all application modules can access cross-domain data.

[0050] Based on the above embodiments, in an embedded operating system, data belonging to different modules (e.g., application modules or library modules) can be stored in different storage spaces according to their data types, or data from different applications belonging to the same application can be stored in different storage spaces according to their data types, based on preset data storage rules. Furthermore, after obtaining the storage address range of the data to be accessed, the data type of the data to be accessed can be obtained accordingly.

[0051] Furthermore, by combining the description information of the permission access data recorded in the virtual machine runtime domain with the determined data type of the permission access data, the target application can be controlled to securely access data during runtime.

[0052] Based on the above embodiments, the types of the licensed access data may include: module datasets, module assemblies, and application datasets.

[0053] The module dataset is used to store a collection of all data information within a specific module, including global data and local data.

[0054] Global data refers to data defined within an application that is visible to the entire module, but its scope is limited to that specific module; it is also known as global variables. This type of data is typically used to share information within a module, but is invisible or inaccessible to other modules. A module can be understood as a container of executable application code contained within a binary file, including the application's instructions, data, and metadata, which can be directly executed by the operating system. Modules generally contain application modules and library modules.

[0055] The global data includes: module read-only data and module global data.

[0056] Module read-only data refers to global data that is visible to the entire module but can only be read and not modified. It is typically used to store constants, configuration information, or other values ​​that do not change during application runtime, such as application constants. Module global data refers to global data that is visible to the entire module and can be modified by applications within the module, such as application global data or the application global variable heap.

[0057] Furthermore, this global data may also include: module reference field data or module field data, etc.

[0058] Module reference field data is a variable used to record temporary or persistent data. Module reference field data can be stored in the memory area of ​​non-volatile memory in a restricted device. The data referenced by the module reference field data can be accessed through direct variable access or via an API (Application Programming Interface).

[0059] Module domain data is stored in the memory area of ​​non-volatile memory in the restricted device. The module domain data space is shared within the module, and the module domain data can be accessed by direct access variable method or API method.

[0060] Local data refers to data defined within an application that is only visible within a specific scope, and its lifespan is limited to that specific scope. It typically includes temporary variables or function parameters defined inside functions, methods, or code blocks, and can only be accessed and used within their respective scopes.

[0061] The local data may include: local structure type data, local basic type data, and function parameter data.

[0062] Local structure type data mainly refers to local data of types such as arrays, structures, and unions. These structure type data are defined inside functions. Local structure type data is stored in the indirect access variable stack; memory for the indirect access variable stack is allocated when the function is called and reclaimed when the function exits. Local basic type data mainly refers to basic type data defined inside functions. Function parameter data mainly refers to the parameter type data input during function calls.

[0063] In this embodiment, the module assembly is used to store a collection of all program code information or module program data within a specific module. The application dataset is used to store a collection of all data information within a specific application, i.e., the application data of the application, including temporary data and persistent data.

[0064] Optionally, the application dataset may include: temporary static variable data, temporary dynamic variable data, and persistent data.

[0065] Temporary static variable data and temporary dynamic variable data are both temporary data. Temporary data is a type of data used during the operation of an application. It is cleared or reset when a specific event occurs to ensure security and protect sensitive data.

[0066] Temporary static variable data refers to resource data whose state is reset to 0 whenever the embedded operating system is reset. This resource state is not shared between applications and is typically used to store data related to a specific session or transaction, ensuring security and data isolation. Temporary dynamic variable data refers to resource data whose state is retained during interaction with the application until the application is deselected, at which point the resource state is cleared to 0. This resource is typically used to share temporary data between applications, such as temporary counters or caches.

[0067] Persistent data refers to non-volatile storage data created during application module installation or operation by calling the storage space allocation interface provided by the operating system runtime environment. Its initial value is 0. Persistent data belongs to the application itself. This persistent data can be written to and read from through the interfaces or pointer variables provided by the operating system runtime environment. Virtual machine instructions can directly access this persistent data through pointer variables.

[0068] The temporary static variable data includes a data characteristic indicating whether it is cross-domain data. Optionally, a flag can be added to the temporary static variable data to describe whether it is cross-domain data. If it is cross-domain data, it can be accessed across virtual machine runtime domains; if it is not cross-domain data, it cannot be accessed across virtual machine runtime domains.

[0069] Furthermore, the application dataset may also include reference data, which is used to store reference field data. When an application module creates an application, this reference data is allocated by the operating system's runtime environment; each application has one and only one set of reference data. In addition, when the virtual machine accesses the module's reference field data, the operating system runtime environment interprets this as access to the reference data of the currently running application, i.e., accessing the reference data content.

[0070] Optionally, the module read-only data is stored in the memory area of ​​a non-volatile memory in the restricted device; the module global data is stored in the memory area of ​​a volatile memory in the restricted device; and

[0071] Local structure type data, local basic type data, and function parameter data are all stored in the indirect access variable stack in volatile memory.

[0072] In addition, application module reference field data and application module field data are both stored in the memory area of ​​non-volatile memory in the restricted device.

[0073] Optionally, persistent data is stored in the memory area of ​​non-volatile memory in the restricted device; the contents of temporary static variable data and temporary dynamic variable data are stored in the memory area of ​​volatile memory in the restricted device.

[0074] In addition, the referenced data is also stored in the memory area of ​​the non-volatile memory in the restricted device.

[0075] As an example rather than a limitation, in Figure 2 The diagram illustrates various types of licensed access data written in a virtual machine runtime domain, as applicable to an embodiment of the present invention.

[0076] S120. Based on the virtual machine runtime domain, control the target application to securely access data during operation.

[0077] In this embodiment, after the target application is activated and running within the target logical channel, by writing the description information of the target application's permitted access data into the virtual machine runtime domain corresponding to the target logical channel, whenever the target application wants to access the requested data, by combining information such as the type, identifier, or data characteristics of the requested data, the relevant information recorded in the virtual machine runtime domain is queried to determine whether the target application can access the requested data.

[0078] The technical solution of this invention, by independently writing description information of the data accessed by the application running within the logical channel into the virtual machine runtime domain bound to the logical channel, can control secure data access during application execution based on the aforementioned description information. In resource-constrained operating systems, the number of logical channels is limited, thus eliminating the need to consume a large amount of storage space to record the aforementioned description information, thereby saving storage space. Furthermore, when the application accesses data and code, the virtual machine runtime domain can be used to check whether the access policy is met, without needing to read the data content of the application data to be accessed, avoiding the risk of data leakage.

[0079] Based on the above embodiments, controlling the secure data access of the target application during operation according to the virtual machine runtime domain may include:

[0080] When it is determined from the virtual machine runtime domain that the module dataset data to be accessed by the target application belongs to the application module to which the target application belongs, the target application is allowed to access the module dataset data.

[0081] If, based on the virtual machine runtime domain, it is determined that the module dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

[0082] In this embodiment, the module dataset can be defined as the data that all applications of the same module are allowed to access. Therefore, when it is determined that the application module identifier of the data to be accessed is consistent with the application module identifier of the target application module, it can be directly determined that the target application is allowed to access the module dataset data.

[0083] Figure 3 This is a flowchart of another secure access method for an application provided by an embodiment of the present invention. This embodiment is based on the above embodiments and is optimized. In this embodiment, for the case where the target application needs to access data that belongs to the module dataset, the operation of "controlling the target application to perform secure data access during operation according to the virtual machine runtime domain" is specified.

[0084] Correspondingly, such as Figure 3 As shown, the method includes:

[0085] S310. When the target application is activated and running within the target logical channel, write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel.

[0086] S320. When it is determined from the virtual machine runtime domain that the module dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

[0087] In this embodiment, it is pre-defined that application modules should not be allowed to access the module datasets of other application modules across virtual machine runtime domains. That is, different application modules cannot access each other's module datasets.

[0088] In this embodiment, the type data belonging to each application module is stored in the volatile memory or non-volatile memory of the resource-constrained device according to the preset data storage rules.

[0089] Accordingly, after obtaining the memory address of the data to be accessed by the target application, the application module to which the data belongs and the data type to be accessed can be obtained. Furthermore, when it is determined that the data to be accessed by the target application belongs to module dataset data, and the application module identifier corresponding to the data to be accessed is obtained, the application module identifier corresponding to the data to be accessed can be compared with the application module identifier of the application module to which the target application belongs, written in the virtual machine runtime domain. If the two are inconsistent, the target application's access to the module dataset data is prohibited.

[0090] Furthermore, if the two are consistent, then the target application is allowed access to the module dataset data.

[0091] S330. When determining, based on the virtual machine runtime domain, that the module dataset data to be accessed by the target application is module global data or local data belonging to the target application module to which the target application belongs, if the module dataset data belongs to another application in the target application module that is different from the target application, then the target application is prohibited from accessing the module dataset data.

[0092] Furthermore, when the module dataset data to be accessed by the target application is determined to be application module reference domain data belonging to the target application module to which the target application belongs based on the virtual machine runtime domain, if the module dataset data belongs to another application in the target application module that is different from the target application, then the target application is prohibited from accessing the module dataset data.

[0093] In this embodiment, it is further defined that: module global data is independently allocated on different logical channels. Since different applications of the same application module can only run sequentially on the same logical channel, in this case, the application allocates module global data when it runs and reclaims the allocated module global data when it cancels the runtime. Different applications cannot access this data from each other.

[0094] Local data is allocated in the virtual machine stack as function calls occur during application runtime. The virtual machine stack is automatically reclaimed after function execution ends; therefore, different applications cannot access each other's local data. Reference field data is created during application installation. Regardless of whether it belongs to the same application module, different applications cannot access each other's reference field data.

[0095] Similarly, after the target application obtains the module dataset data, it is necessary to further obtain the application module identifier and application identifier of the data to be accessed, and then query the virtual machine runtime domain to obtain the application module identifier of the target application module and the application identifier of the target application.

[0096] As mentioned earlier, when the application module identifier of the data to be accessed is consistent with the application module identifier of the target application module, it can be directly determined that the target application is allowed to access the module dataset data.

[0097] In an optional implementation of this embodiment, in order to maximize the data security of the module dataset, after determining that the application module identifier of the data to be accessed is consistent with the application module identifier of the target application module, the target application may be allowed to access the module dataset only if the application identifier of the data to be accessed is the same as the application identifier of the target application; otherwise, the target application may be prohibited from accessing the module dataset.

[0098] That is, when the application module identifier of the data to be accessed is inconsistent with the application module identifier of the target application module, or when the application module identifier of the data to be accessed is consistent with the application module identifier of the target application module, but the application identifier of the data to be accessed is inconsistent with the application identifier of the target application, the target application is prohibited from accessing the module dataset data.

[0099] S340. When it is determined from the virtual machine runtime domain that the module dataset data to be accessed by the target application belongs to the module read-only data of the application module to which the target application belongs, the target application is allowed to access the module dataset data.

[0100] Furthermore, when it is determined from the virtual machine runtime domain that the module dataset data to be accessed by the target application belongs to the application module domain data of the application module to which the target application belongs, the target application is allowed to access the module dataset data.

[0101] For module read-only data and module domain data, different applications of the same application module can access them, but other applications of different application modules cannot access them.

[0102] The technical solution of this invention uses a virtual machine runtime domain to define a secure access control policy for the module dataset, thereby implementing logical security isolation for the application module and achieving the purpose of protecting sensitive application data.

[0103] Figure 4 This is a flowchart of another secure access method for an application provided by an embodiment of the present invention. This embodiment is an optimization based on the above embodiments. In this embodiment, for the case where the data requested by the target application is application module assembly data belonging to the application module assembly, the operation of "controlling the target application to perform secure data access during operation according to the virtual machine runtime domain" is specified.

[0104] Correspondingly, such as Figure 4 As shown, the method includes:

[0105] S410. When the target application is activated and running within the target logical channel, write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel.

[0106] S420. When it is determined from the virtual machine runtime domain that the module assembly data to be accessed by the target application belongs to the target library module, after switching the description information of the permission access data matching the target library module in the virtual machine runtime domain corresponding to the target logical channel, the access to the module assembly data is performed in the target logical channel.

[0107] In this embodiment, the module assembly refers to the program code of a module, including library module assemblies and application module assemblies.

[0108] Module assembly security access policies fall into two categories:

[0109] 1. When the interface is exported, the program code in the module assembly of the library module should be allowed to be called unconditionally by other library modules or application modules, and vice versa.

[0110] 2. If the interface is not exported, the application module's module assembly should not be allowed to be called by other application modules or library modules; if the interface is exported, it should be accessed only after obtaining interface authorization from the server application.

[0111] In addition, the virtual machine runtime domain security policy should provide protection mechanisms to restrict malicious code modules from accessing application sensitive data. When a malicious code module is illegally forcibly loaded into the embedded operating system, the module should only be able to access application datasets it has created.

[0112] In this embodiment, after determining that the data to be accessed is module assembly data and that the module assembly data belongs to a library module, it is detected whether the interface of the library module is exported. If the library module belongs to the target library module whose interface is exported, the module assembly data can be accessed in the target logical channel after switching and writing the description information of the permission access data matching the target library module in the virtual machine runtime domain corresponding to the target logical channel.

[0113] That is, when the module assembly interface of a library module is called, the module dataset and module assembly in the virtual machine runtime domain should be switched to the module dataset and module assembly of the library module.

[0114] After the virtual machine runtime domain switch is completed, access to module assembly data in the target library module can be performed in the target logical channel.

[0115] S430. When the module assembly data to be accessed by the target application is determined to be an application interface authorized for call by the target application based on the virtual machine runtime domain, after switching and writing the description information of the permission access data matching the application interface in the virtual machine runtime domain corresponding to the target logical channel, the access to the module assembly data is executed in the target logical channel.

[0116] In this embodiment, when it is determined that the data to be accessed is module assembly data, and the module assembly data is application module assembly data, it indicates that it is expected to call the application interface in the application module. At this time, access to the module assembly data to be accessed is only allowed if it is ensured that the module assembly data to be accessed is an application interface authorized to be called by the target application.

[0117] Specifically, the virtual machine runtime domain records the authorization information of each application interface authorized for call by the target application. By querying this virtual machine runtime domain, it can be determined whether the module assembly data to be accessed by the target application is an application interface authorized for call by the target application. If not, access to the module assembly data to be accessed can be directly denied.

[0118] When calling the interface of the application module's module assembly, which is a server-side authorization interface, the runtime environment should switch the module assembly, module dataset, and application dataset in the virtual machine runtime domain to the server-side (i.e., the application to which the authorized application interface belongs) module assembly, module dataset, and application dataset.

[0119] The technical solution of this invention uses a virtual machine runtime domain to define a security access control policy for the module assembly, thereby implementing logical security isolation for the application module and achieving the purpose of protecting application sensitive data.

[0120] Based on the above embodiments, controlling the target application to securely access data during operation according to the virtual machine runtime domain may further include:

[0121] When it is determined from the virtual machine runtime domain that the application dataset data to be accessed by the target application belongs to the application module to which the target application belongs, the target application is allowed to access the module dataset data.

[0122] If, based on the virtual machine runtime domain, it is determined that the application dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

[0123] In this optional implementation, defining the application dataset security access control policy falls into two categories:

[0124] 1. Application data security access policy between applications created by different application modules:

[0125] 1) Application datasets should not be allowed to access each other;

[0126] 2) When programming an application, the application dataset of an application module should not be exported to other modules for access and use. For example, if the application dataset is exported to an external entity through non-programming means and then imported into an application created by another application module, the virtual machine runtime domain should restrict access to that application dataset.

[0127] 2. Security access policies between applications created from the same application module:

[0128] 1) The application's module datasets and module assemblies should be shared;

[0129] 2) Application datasets should be mutually accessible.

[0130] The above implementation method uses a virtual machine runtime domain to define a secure access control policy for the application dataset, thereby implementing logical security isolation for the application modules and achieving the purpose of protecting sensitive application data.

[0131] Figure 5 This is a flowchart of another secure access method for an application provided by an embodiment of the present invention. This embodiment is an optimization based on the above embodiments. In this embodiment, for the case where the target application needs to access application dataset data belonging to the application dataset, the operation of "controlling the target application to perform secure data access during operation according to the virtual machine runtime domain" is specified.

[0132] Correspondingly, such as Figure 5 As shown, the method includes:

[0133] S510. When the target application is activated and running within the target logical channel, write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel.

[0134] S520. When it is determined from the virtual machine runtime domain that the application dataset data to be accessed by the target application contains cross-domain data, the target application is allowed to access the application dataset data.

[0135] In this embodiment, the data to be accessed by the target application is further divided into application dataset data containing cross-domain data features and application dataset data not containing cross-domain data features.

[0136] Specifically, by querying the virtual machine runtime domain, it can be determined whether the application dataset to be accessed contains data characteristics of cross-domain data. For example, the memory addresses of all data containing cross-domain data characteristics can be recorded in the virtual machine runtime domain.

[0137] Alternatively, during the process of querying the data type of the data to be accessed by using its memory address, the storage location of the data can be used to determine whether the application dataset data to be accessed contains cross-domain data characteristics.

[0138] In this embodiment, if the application dataset data to be accessed by the target application contains cross-domain data characteristics, then the application dataset data can be accessed across application modules; otherwise, only applications belonging to the same application module can share and access the application dataset data.

[0139] S530. When it is determined from the virtual machine runtime domain that the application dataset data to be accessed by the target application does not contain cross-domain data, if it is determined that the application dataset data belongs to an application module different from the target application, then the target application is prohibited from accessing the application dataset data.

[0140] S540. When it is determined from the virtual machine runtime domain that the application dataset data to be accessed by the target application does not contain cross-domain data characteristics, if the application dataset data belongs to the application module to which the target application belongs, then the target application is allowed to access the application dataset data.

[0141] The technical solution of this invention uses a virtual machine runtime domain to define a secure access control policy for the application dataset, thereby implementing logical security isolation for the application module and achieving the purpose of protecting sensitive application data.

[0142] Figure 6 This is a flowchart illustrating another method for secure access to an application provided by an embodiment of the present invention. This embodiment is an optimization based on the aforementioned embodiments. In this embodiment, a matching security access control strategy is selected for different situations of the data to be accessed, and secure access control is performed on the data to be accessed. Specifically, the operation of "controlling the target application to perform secure data access during operation according to the virtual machine runtime domain" is specified as follows: during the operation of the target application, the data type of the application data to be accessed by the target application and the address description information of the application data are identified; based on the data type of the application data, the address description information, and the memory address range recorded in the virtual machine runtime domain, the secure data access of the target application during operation is controlled.

[0143] Correspondingly, such as Figure 6 As shown, the method specifically includes:

[0144] S610. When the target application is activated and running within the target logical channel, write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel.

[0145] S620. During the execution of the target application, identify the data type of the application data to be accessed by the target application and the address description information of the application data.

[0146] The address description information for the application data can be its memory address. Based on this memory address, the data type of the application data that the target application needs to access can be determined.

[0147] S630. Detect the data type of the application data: If the data type is global data, execute S640; if the data type is local data, execute S6100.

[0148] Global data can be understood as global variables and other data used by various applications in an embedded operating system during execution. This global data is stored in the memory area of ​​the restricted device; for example, global data can be stored in the global data area, while local data can be stored in the indirect access variable stack. Memory for the indirect access variable stack is allocated when a function is called during program execution and reclaimed when the function exits.

[0149] The global data area is used to store various global variables generated by each application during its operation, and the indirect access variable stack is used to store various local variables generated by each application during its operation.

[0150] In an optional implementation of this embodiment, access control for non-pointer type module data may include:

[0151] 1. Access control of local variables

[0152] Access to local variables stored in the virtual machine stack should only be done by variable index and should not exceed the range of local variable stack variable indexes.

[0153] 2. Access control for indirect access to the variable stack

[0154] 1) When accessing indirect access variable stack data, it should be checked that the access does not exceed its overall boundary range.

[0155] 2) Access permissions should be checked when accessing across operating domains.

[0156] 3. Access control for global data

[0157] 1) When accessing global data of a module, ensure that the memory boundary of the currently accessed data type is not exceeded;

[0158] 2) When accessing module reference field data, access should only be made using 4-byte aligned addresses and cross-runtime domain access is not allowed;

[0159] 3) Access permissions must be checked when module read-only variables and module global data are accessed across runtime domains.

[0160] In another optional implementation of this embodiment, access control for pointer type module data may include:

[0161] 1. Pointer access control for global data

[0162] When accessing the global data memory area through a pointer, it is necessary to check whether the memory accessed by the pointer is within the virtual machine runtime domain to ensure that the application cannot access memory data in the runtime domain of other modules through the pointer.

[0163] 2. Pointer access control for indirect access to the variable stack

[0164] When accessing the variable stack indirectly through a pointer, it should be checked that the pointer accesses memory beyond the overall boundary of the accessed variable stack. Access permissions should be checked when accessing across runtime domains.

[0165] 3. Pointer access control for module read-only data, module global data, and module reference field data.

[0166] 1) It should be ensured that the memory boundary of the currently accessed variable type is not exceeded;

[0167] 2) Module reference variables can only be accessed using 4-byte aligned addresses and are not allowed to be accessed across runtime domains;

[0168] 3) Access permissions must be checked when module read-only variables and module global variables are accessed across runtime domains.

[0169] S640. Detect whether the global data is pointer data: if it is non-pointer global data, then execute S650; if it is pointer global data, then execute S690.

[0170] Pointer-type data refers to data whose memory address is stored, while non-pointer-type data refers to data that is the actual data itself.

[0171] S650, Locate the application data memory address in the memory area that matches the address description information, and execute S660.

[0172] S660. Detect whether the application data memory address matches the memory address range recorded in the virtual machine runtime domain: if yes, execute S670; otherwise, execute S680.

[0173] S670, Allow the target application to access the application data.

[0174] S680, The target application is not allowed to access the application data.

[0175] S690. Locate the memory region corresponding to the subdivided data type of the application data in the memory region, and locate the application data memory address that matches the address description information in the memory region, and execute S660.

[0176] Specifically, the system first locates the memory region corresponding to the module reference field data in the memory area and checks whether the memory region stores the application data memory address that matches the address description information. If yes, the application data memory address is obtained from the memory region corresponding to the module reference field data. Otherwise, the system continues to locate the memory region corresponding to the temporary data (including temporary static variable data and temporary dynamic variable data) in the memory area and checks whether the memory region stores the application data memory address that matches the address description information. If yes, the application data memory address is obtained from the memory region corresponding to the temporary data. Otherwise, the system continues to locate the memory region corresponding to the persistent data in the memory area and checks whether the memory region stores the application data memory address that matches the address description information. If yes, the application data memory address is obtained from the memory region corresponding to the persistent data. Otherwise, a data access exception is thrown to prevent the target application from accessing the application data.

[0177] S6100. Detect whether the local data is pointer data: if it is non-pointer local data, execute S6110; if it is pointer local data, execute S6150.

[0178] S6110. Locate the application data variable stack address that matches the memory address description information in the indirect access variable stack, and execute S6120.

[0179] S6120. Detect whether the stack address of the application data variable matches the memory address range recorded in the virtual machine runtime domain: if yes, execute S6130; otherwise, execute S6140.

[0180] S6130, Allow the target application to access the application data.

[0181] S6140, The target application is not allowed to access the application data.

[0182] S6150, Locate the variable stack interval corresponding to the subdivided data type of the application data in the indirect access variable stack, and locate the application data variable stack address that matches the address description information in the variable stack interval, and execute S6120.

[0183] The technical solution of this invention classifies data during application operation in a reasonable and clear manner, creating an independent virtual memory space and access policy for each logical channel within a virtual machine runtime domain. In resource-constrained operating systems, the number of logical channels is limited, thus eliminating the need to consume large amounts of storage space to record unique module identifiers, thereby saving storage space. When accessing data and code, the access policy can be checked based on the memory address and virtual machine runtime domain, without needing to read the application data content, thus avoiding the risk of data leakage.

[0184] Figure 7 This is a schematic diagram of a secure access device for an application provided in an embodiment of the present invention. The runtime environment is configured within an embedded operating system, which is installed on a restricted device. Figure 7 As shown, the device includes: a description information writing module 710 and a security access control module 720, wherein:

[0185] The description information writing module 710 is used to write description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel when the target application is activated and running in the target logical channel.

[0186] The security access control module 720 is used to control the target application's secure access to data during operation based on the virtual machine's runtime domain.

[0187] The technical solution of this invention, by independently writing description information of the data accessed by the application running within the logical channel into the virtual machine runtime domain bound to the logical channel, can control secure data access during application execution based on the aforementioned description information. In resource-constrained operating systems, the number of logical channels is limited, thus eliminating the need to consume a large amount of storage space to record the aforementioned description information, thereby saving storage space. Furthermore, when the application accesses data and code, the virtual machine runtime domain can be used to check whether the access policy is met, without needing to read the data content of the application data to be accessed, avoiding the risk of data leakage.

[0188] Based on the above embodiments, the description information of the licensed access data may include at least one of the following:

[0189] The storage address range of the licensed access data, the identifier of the licensed access data, and the data characteristics of the licensed access data.

[0190] Based on the above embodiments, the identifier of the permitted access data includes at least one of the following: application module identifier, application program identifier, and logical channel identifier;

[0191] The data characteristics of the permitted access data include whether it is cross-domain data.

[0192] Based on the above embodiments, the types of permitted access data include:

[0193] Module datasets, module assemblies, and application datasets.

[0194] Based on the above embodiments, the module dataset includes: global data and local data;

[0195] The global data includes at least one of the following: module read-only data and module global data;

[0196] The local data includes at least one of the following: local structure type data, local basic type data, and function parameter data.

[0197] Based on the above embodiments, the module read-only data is stored in the memory area of ​​the non-volatile memory in the restricted device; the module global data is stored in the memory area of ​​the volatile memory in the restricted device; and

[0198] Local structure type data, local basic type data, and function parameter data are all stored in the indirect access variable stack in volatile memory.

[0199] Based on the above embodiments, the application dataset includes at least one of the following:

[0200] Temporary static variable data, temporary dynamic variable data, and persistent data;

[0201] The temporary static variable data includes data characteristics such as whether it is cross-domain data.

[0202] Based on the above embodiments, persistent data is stored in the memory area of ​​non-volatile memory in the constrained device;

[0203] The contents of temporary static variable data and temporary dynamic variable data are stored in the memory area of ​​volatile memory in the restricted device.

[0204] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0205] When it is determined from the virtual machine runtime domain that the module dataset data to be accessed by the target application belongs to the application module to which the target application belongs, the target application is allowed to access the module dataset data.

[0206] If, based on the virtual machine runtime domain, it is determined that the module dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

[0207] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0208] When determining, based on the virtual machine runtime domain, whether the module dataset data to be accessed by the target application is module global data or local data belonging to the target application module to which the target application belongs, if the module dataset data belongs to another application in the target application module that is different from the target application, then the target application is prohibited from accessing the module dataset data.

[0209] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0210] When the target application determines, based on the virtual machine runtime domain, that the module dataset data to be accessed by the target application is read-only module data belonging to the application module to which the target application belongs, access to the module dataset data by the target application is permitted.

[0211] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0212] When it is determined that the module assembly data to be accessed by the target application belongs to the target library module based on the virtual machine runtime domain, after switching and writing the description information of the permission access data matching the target library module in the virtual machine runtime domain corresponding to the target logical channel, the access to the module assembly data is executed in the target logical channel.

[0213] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0214] When the module assembly data to be accessed by the target application is determined to be an application interface authorized for call by the target application based on the virtual machine runtime domain, the description information of the permission access data matching the application interface is switched and written in the virtual machine runtime domain corresponding to the target logical channel, and then the access to the module assembly data is executed in the target logical channel.

[0215] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0216] When it is determined from the virtual machine runtime domain that the application dataset data to be accessed by the target application belongs to the application module to which the target application belongs, the target application is allowed to access the module dataset data.

[0217] If, based on the virtual machine runtime domain, it is determined that the application dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

[0218] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0219] When the data characteristics of the application dataset data to be accessed by the target application are determined to include cross-domain data based on the virtual machine runtime domain, the target application is allowed to access the application dataset data.

[0220] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0221] When determining, based on the virtual machine runtime domain, that the application dataset data to be accessed by the target application does not contain cross-domain data, if it is determined that the application dataset data belongs to an application module different from the target application, then the target application is prohibited from accessing the application dataset data.

[0222] Based on the above embodiments, the security access control module 720 can be specifically used for:

[0223] If the application dataset data to be accessed by the target application does not contain cross-domain data characteristics based on the virtual machine runtime domain, then the target application is allowed to access the application dataset data if the application dataset data belongs to the application module to which the target application belongs.

[0224] Based on the above embodiments, the security access control module 720 may specifically include:

[0225] The address description information identification unit is used to identify the data type of the application data to be accessed by the target application and the address description information of the application data during the operation of the target application.

[0226] The virtual machine control unit is used to control the target application to securely access data during operation based on the data type, address description information, and memory address range recorded in the virtual machine runtime domain.

[0227] Based on the above embodiments, the virtual machine control unit can be specifically used for:

[0228] If it is determined that the data type of the application data is non-pointer global data, then locate the application data memory address in the memory area that matches the address description information;

[0229] Detect whether the memory address of the application data matches the memory address range recorded in the virtual machine runtime domain;

[0230] If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

[0231] Based on the above embodiments, the virtual machine control unit can be specifically used for:

[0232] If the data type of the application data is determined to be pointer-type global data, then locate the memory range corresponding to the subdivided data type of the application data in the memory area;

[0233] Within the memory range, locate the application data memory address that matches the address description information;

[0234] Detect whether the memory address of the application data matches the memory address range recorded in the virtual machine runtime domain;

[0235] If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

[0236] Based on the above embodiments, the virtual machine control unit can be specifically used for:

[0237] If it is determined that the data type of the application data is a non-pointer local data, then locate the application data variable stack address that matches the memory address description information in the indirect access variable stack;

[0238] Detect whether the stack address of the application data variable matches the memory address range recorded in the virtual machine runtime domain;

[0239] If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

[0240] Based on the above embodiments, the virtual machine control unit can be specifically used for:

[0241] If the data type of the application data is determined to be pointer-type local data, then locate the variable stack interval corresponding to the subdivided data type of the application data in the indirect access variable stack;

[0242] Within the variable stack region, locate the application data variable stack address that matches the address description information;

[0243] Detect whether the stack address of the application data variable matches the memory address range recorded in the virtual machine runtime domain;

[0244] If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

[0245] The application security access device provided in the embodiments of the present invention can execute the application security access method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0246] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0247] Figure 8 A schematic diagram of the structure of a limited device 10 that can be used to implement an embodiment of the present invention is shown.

[0248] like Figure 8 As shown, the restricted device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the restricted device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0249] The I / O interface 15 in the restricted device 10 may include eSPI (Enhanced Serial Peripheral Interface) and SPI (Serial Peripheral Interface), etc.

[0250] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, for example, performing a secure access method for an application as described in various embodiments of the present invention, executed by a runtime environment in an embedded operating system installed in a restricted device, the method comprising:

[0251] When the target application is activated and running within the target logical channel, description information of the target application's permission access data is written into the virtual machine runtime domain corresponding to the target logical channel.

[0252] Based on the virtual machine runtime domain, control the target application to securely access data during runtime.

[0253] In some embodiments, a secure access method for an application as described in the various embodiments of the present invention may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 16. In some embodiments, part or all of the computer program may be loaded and / or installed on the restricted device 10 via ROM 12. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the secure access method for an application as described above in the various embodiments of the present invention may be performed. Alternatively, in other embodiments, processor 11 may be configured by any other suitable means (e.g., by means of firmware) to execute the secure access method for an application as described in the various embodiments of the present invention.

[0254] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0255] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0256] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0257] Figure 9 This is a structural diagram of a terminal provided according to an embodiment of the present invention. Figure 9 The terminal includes the restricted device 910 as described in any embodiment of the present invention.

[0258] The restricted device can be understood as a resource-restricted device, which can typically be a smart card, USB key, ESAM (Embedded Secure Access Module), or SE (Secure Element), etc. The smart card in question is generally a multi-application smart card.

[0259] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

Claims

1. A method for secure access to an application, characterized in that, The method, executed by a runtime environment within an embedded operating system installed on a restricted device, comprises: When the target application is activated and running within the target logical channel, description information of the target application's permission access data is written into the virtual machine runtime domain corresponding to the target logical channel. Based on the virtual machine runtime domain, control the target application to securely access data during runtime.

2. The method according to claim 1, characterized in that, The description information of the permitted access data includes at least one of the following: The storage address range of the licensed access data, the identifier of the licensed access data, and the data characteristics of the licensed access data.

3. The method according to claim 2, characterized in that, The identifier of the permitted access data includes at least one of the following: application module identifier, application program identifier, and logical channel identifier; The data characteristics of the permitted access data include whether it is cross-domain data.

4. The method according to claim 1, characterized in that, The types of the permitted access data include: Module datasets, module assemblies, and application datasets.

5. The method according to claim 4, characterized in that, The module dataset includes: global data and local data; The global data includes at least one of the following: module read-only data and module global data; The local data includes at least one of the following: local structure type data, local basic type data, and function parameter data.

6. The method according to claim 5, characterized in that, The module's read-only data is stored in the memory area of ​​the non-volatile memory in the restricted device; the module's global data is stored in the memory area of ​​the volatile memory in the restricted device. as well as Local structure type data, local basic type data, and function parameter data are all stored in the indirect access variable stack in volatile memory.

7. The method according to claim 4, characterized in that, The application dataset includes at least one of the following: Temporary static variable data, temporary dynamic variable data, and persistent data; The temporary static variable data includes data characteristics such as whether it is cross-domain data.

8. The method according to claim 7, characterized in that, Persistent data is stored in the memory area of ​​non-volatile memory in a constrained device; The contents of temporary static variable data and temporary dynamic variable data are stored in the memory area of ​​volatile memory in the restricted device.

9. The method according to claim 4, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When it is determined from the virtual machine runtime domain that the module dataset data to be accessed by the target application belongs to the application module to which the target application belongs, the target application is allowed to access the module dataset data. If, based on the virtual machine runtime domain, it is determined that the module dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

10. The method according to claim 5, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When determining, based on the virtual machine runtime domain, whether the module dataset data to be accessed by the target application is module global data or local data belonging to the target application module to which the target application belongs, if the module dataset data belongs to another application in the target application module that is different from the target application, then the target application is prohibited from accessing the module dataset data.

11. The method according to claim 5, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When the target application determines, based on the virtual machine runtime domain, that the module dataset data to be accessed by the target application is read-only module data belonging to the application module to which the target application belongs, access to the module dataset data by the target application is permitted.

12. The method according to claim 4, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When it is determined that the module assembly data to be accessed by the target application belongs to the target library module based on the virtual machine runtime domain, after switching and writing the description information of the permission access data matching the target library module in the virtual machine runtime domain corresponding to the target logical channel, the access to the module assembly data is executed in the target logical channel.

13. The method according to claim 4, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When the module assembly data to be accessed by the target application is determined to be an application interface authorized for call by the target application based on the virtual machine runtime domain, the description information of the permission access data matching the application interface is switched and written in the virtual machine runtime domain corresponding to the target logical channel, and then the access to the module assembly data is executed in the target logical channel.

14. The method according to claim 1, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When it is determined from the virtual machine runtime domain that the application dataset data to be accessed by the target application belongs to the application module to which the target application belongs, the target application is allowed to access the module dataset data. If, based on the virtual machine runtime domain, it is determined that the application dataset data to be accessed by the target application does not belong to the application module to which the target application belongs, the target application is prohibited from accessing the module dataset data.

15. The method according to claim 7, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When the data characteristics of the application dataset data to be accessed by the target application are determined to include cross-domain data based on the virtual machine runtime domain, the target application is allowed to access the application dataset data.

16. The method according to claim 7, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: When determining, based on the virtual machine runtime domain, that the application dataset data to be accessed by the target application does not contain cross-domain data, if it is determined that the application dataset data belongs to an application module different from the target application, then the target application is prohibited from accessing the application dataset data.

17. The method according to claim 7, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: If the application dataset data to be accessed by the target application does not contain cross-domain data characteristics based on the virtual machine runtime domain, then the target application is allowed to access the application dataset data if the application dataset data belongs to the application module to which the target application belongs.

18. The method according to any one of claims 1-17, characterized in that, Based on the virtual machine runtime domain, control the target application's secure data access during runtime, including: During the execution of the target application, identify the data type of the application data to be accessed by the target application and the address description information of the application data; Based on the data type and address description information of the application data, as well as the memory address range recorded in the virtual machine runtime domain, the system controls the target application to securely access data during runtime.

19. The method according to claim 18, characterized in that, Based on the data type, address description information, and memory address range defined in the virtual machine runtime domain, control the target application's secure data access during runtime, including: If it is determined that the data type of the application data is non-pointer global data, then locate the application data memory address in the memory area that matches the address description information; Detect whether the memory address of the application data matches the memory address range recorded in the virtual machine runtime domain; If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

20. The method according to claim 18, characterized in that, Based on the data type, address description information, and memory address range defined in the virtual machine runtime domain, control the target application's secure data access during runtime, including: If the data type of the application data is determined to be pointer-type global data, then locate the memory range corresponding to the subdivided data type of the application data in the memory area; Within the memory range, locate the application data memory address that matches the address description information; Detect whether the memory address of the application data matches the memory address range recorded in the virtual machine runtime domain; If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

21. The method according to claim 18, characterized in that, Based on the data type, address description information, and memory address range defined in the virtual machine runtime domain, control the target application's secure data access during runtime, including: If it is determined that the data type of the application data is a non-pointer local data, then locate the application data variable stack address that matches the memory address description information in the indirect access variable stack; Detect whether the stack address of the application data variable matches the memory address range recorded in the virtual machine runtime domain; If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

22. The method according to claim 18, characterized in that, Based on the data type, address description information, and memory address range defined in the virtual machine runtime domain, control the target application's secure data access during runtime, including: If the data type of the application data is determined to be pointer-type local data, then locate the variable stack interval corresponding to the subdivided data type of the application data in the indirect access variable stack; Within the variable stack region, locate the application data variable stack address that matches the address description information; Detect whether the stack address of the application data variable matches the memory address range recorded in the virtual machine runtime domain; If so, the target application is allowed to access the application data; otherwise, the target application is not allowed to access the application data.

23. A secure access device for an application, characterized in that, A runtime environment configured within an embedded operating system, wherein the embedded operating system is installed in a restricted device, the device comprising: The description information writing module is used to write the description information of the target application's permission access data into the virtual machine runtime domain corresponding to the target logical channel when the target application is activated and running within the target logical channel. The security access control module is used to control the secure data access of the target application during operation based on the virtual machine runtime domain.

24. A restricted device, characterized in that, The restricted device is equipped with an embedded operating system, which executes a runtime environment. The restricted device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the secure access method of the application program according to any one of claims 1-22.

25. A terminal, characterized in that, Includes the restricted device as described in claim 24.

26. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the secure access method for the application program as described in any one of claims 1-22.

27. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the secure access method for the application according to any one of claims 1-22.

Images