Application publishing method and device, electronic equipment and storage medium

Abstract

The invention provides an application publishing method and device, electronic equipment, a chip and a storage medium. The method comprises the steps that publishing information and an application package of a first application are received; wherein the published information comprises basic application information and installation control information, and the installation control information is used for representing that the first terminal has the permission of installing the first application; performing signature verification on the basic information of the application through a first certificate of the application store; in response to successful signature verification, determining terminal identification information of the first terminal according to the installation control information; and publishing the first application in an application store according to the terminal identification information, the basic application information and the application package. According to the embodiment of the invention, in the application distribution process, the terminal identification information of the first terminal with the permission of installing the first application is determined according to the installation control information in the published information, and the terminal identification information is carried when published, so that the installation of the application by the terminal can be limited in the application distribution process.

Description

Technical Field

[0001] This disclosure relates to the field of authentication technology, and in particular to an application publishing method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, applications for mobile devices are generally distributed through app stores. During the distribution process, the app store verifies the signature of the application uploaded by the developer to prevent tampering. At present, verification of the device can only be performed after application distribution, using the application account. This method can only restrict the device from logging into the application, but cannot restrict the device from installing the application. Summary of the Invention

[0003] This disclosure provides an application distribution method, apparatus, electronic device, and storage medium. During the application distribution process, the terminal identification information of a first terminal with the permission to install a first application is determined based on the installation control information in the distribution information, and the terminal identification information is carried during distribution. This allows the installation of applications by the terminal to be restricted during the application distribution process.

[0004] A first aspect of this disclosure provides an application publishing method, the method comprising: receiving publishing information and an application package for a first application; wherein the publishing information includes basic application information and installation control information, the installation control information being used to characterize that a first terminal has the permission to install the first application; performing signature verification on the basic application information using a first certificate from an application store; in response to successful signature verification, determining terminal identification information of the first terminal based on the installation control information; and publishing the first application in the application store based on the terminal identification information, the basic application information, and the application package.

[0005] In some embodiments of this disclosure, the signature verification of application basic information is performed using a first certificate from the app store, including: parsing the application basic information to obtain channel information and first signature information of the first application; wherein, the first signature information is information generated by signing the first application based on the first certificate of the app store, and the channel information is used to characterize that the first application originates from the app store; determining whether the channel information is preset channel information; in response to the preset channel information, signing the application package of the first application to obtain second signature information; verifying whether the second signature information is consistent with the first signature information; if consistent, then performing the step of determining the terminal identification information of the first terminal based on the installation control information.

[0006] In some embodiments of this disclosure, determining the terminal identification information of the first terminal based on the installation control information includes: verifying whether the installation control information is valid; and, in response to the installation control information being valid, determining the terminal identification information of the first terminal based on the installation control information.

[0007] In some embodiments of this disclosure, if the installation control information includes control information corresponding to the second certificate, then determining the terminal identification information of the first terminal based on the installation control information includes: detecting whether the second certificate is installed in the SIM card of the first terminal; if it is installed, then determining that the terminal identification information of the first terminal is the terminal identification information corresponding to the second certificate.

[0008] In some embodiments of this disclosure, if the installation control information further includes control information corresponding to the first account information, then determining the terminal identification information of the first terminal based on the installation control information includes: obtaining the second account information of the first terminal; detecting whether the second account information of the first terminal is consistent with the first account information; if consistent, determining that the terminal identification information of the first terminal is the terminal identification information corresponding to the first account information.

[0009] In some embodiments of this disclosure, if the installation control information includes control information corresponding to the second certificate, then verifying whether the installation control information is valid includes: in response to detecting that the SIM card of the first terminal is activated, scheduling the STK module in the SIM card of the first terminal to perform the following steps: verifying whether the issuing authority of the second certificate is the SIM card certificate issuing authority specified by the application store; if so, determining whether the second certificate is a root certificate; if the second certificate is a root certificate, determining that the installation control information is valid.

[0010] In some embodiments of this disclosure, if the installation control information also includes first account information, then verifying whether the installation control information is valid further includes: verifying whether at least one of the following in the first account information is valid: length, number segment, character type.

[0011] In some embodiments of this disclosure, the first account information is determined based on the following steps: obtaining the original account information; determining the digest value of the original account information and the public salt of the app store using a hash algorithm; and encrypting the digest value using the public key of the app store's asymmetric encryption to obtain the first account information.

[0012] In some embodiments of this disclosure, the first account information is determined based on the following steps: obtaining the original account information; concatenating a portion of the original account information with the public salt of the app store to obtain the concatenation result; and processing the concatenation result using a digest algorithm to obtain the first account information.

[0013] In some embodiments of this disclosure, the published information also includes first API version identification information of the first application; wherein, the first API version identification information is used to identify the API version information supported by the first terminal.

[0014] In some embodiments of this disclosure, after publishing the first application in an app store, the method further includes: in response to receiving search request information sent by a second terminal, matching the metadata information of each second application with the search request information to obtain application matching results; wherein the metadata information of the second application is data obtained by parsing the publication information and application package of the second application; sending the application matching results to the second terminal; receiving a download request sent by the second terminal for the second application, wherein the download request carries at least a second certificate, the second certificate being used to verify whether the second terminal has permission to install the second application; performing signature verification on the second certificate; and in response to successful signature verification, sending the application package of the second application to the second terminal.

[0015] In some embodiments of this disclosure, if the download request also carries first verification information, the public key of the first certificate, and the private key of the second certificate, then the second certificate is signed and verified, including: encrypting the first verification information according to the public key of the first certificate, and signing the ciphertext information according to the private key of the second certificate to generate second verification information; encrypting the second verification information according to the private key of the first certificate, and signing the ciphertext information according to the public key of the second certificate to generate third verification information; verifying whether the first verification information and the third verification information are consistent; if they are consistent, then the step of sending the application package of the second application to the second terminal is executed.

[0016] In some embodiments of this disclosure, in response to successful signature verification, sending the application package of the second application to the second terminal includes: if they match, encapsulating the application package of the second application to obtain a first encapsulation result; and sending the first encapsulation result to the second terminal.

[0017] In some embodiments of this disclosure, if the metadata information of the second application includes terminal identification information, the application package of the second application is encapsulated to obtain a first encapsulation result, including: cyclically shifting the application package of the second application to the right according to the terminal identification information and the third verification information to obtain a second encapsulation result; encrypting the terminal identification information of the second application according to the private key of the first certificate, and signing the ciphertext information with the public key of the second certificate to obtain the first encapsulation result.

[0018] In some embodiments of this disclosure, the method further includes: in response to detecting that the download of the first packaging result has been completed, scheduling the STK module in the SIM card of the second terminal to sign the first encryption key according to the public key of the first certificate to obtain third signature information; encrypting the third signature information according to the private key of the second certificate to obtain application decryption key and installation control information; decrypting the first packaging result according to the application decryption key and installation control information to obtain the application package to be installed, and writing the application package to be installed into the RAM of the second terminal.

[0019] In some embodiments of this disclosure, the method further includes: deleting the application package to be installed from memory RAM in response to detecting that the writing of the application package to be installed has been completed.

[0020] In some embodiments of this disclosure, if the metadata information of the second application includes application basic information, first API version identifier information, and terminal identifier information, then the metadata information of the second application is matched with the search request information to obtain application matching results, including: matching the application basic information of the second application with keywords in the search request information, and taking the second application that matches the keywords as the first matching result; matching the first API version identifier information with the API version information supported by the second terminal, and taking the second application that matches the API version information supported by the second terminal in the first matching result as the second matching result; and matching the third account information of the second terminal with the terminal identifier information, and taking the second application that matches the third account information of the second terminal in the second matching result as the application matching result.

[0021] In some embodiments of this disclosure, if the application basic information includes the application release date and the application package name, then the second application that matches the third account information of the second terminal in the second matching result is taken as the application matching result, including: grouping the third matching result according to the application package name of each second application in the third matching result; sorting the second applications in each group according to the application release date, and taking the second application with the largest release date as the application matching result.

[0022] In some embodiments of this disclosure, if the application basic information also includes application version information, then the second application with the largest release date is taken as the application matching result, including: if there are multiple second applications with the largest release date, the second application with the highest application version is taken as the application matching result.

[0023] A second aspect of this disclosure provides an application publishing apparatus, comprising: a receiving module for receiving publishing information and an application package of a first application; wherein the publishing information includes basic application information and installation control information, the installation control information being used to indicate that a first terminal has the permission to install the first application; a verification module for performing signature verification on the basic application information using a first certificate from an application store; a determining module for determining terminal identification information of the first terminal based on the installation control information in response to successful signature verification; and a publishing module for publishing the first application in an application store based on the terminal identification information, the basic application information, and the application package.

[0024] A third aspect of this disclosure provides an electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods described in the first aspect of this disclosure.

[0025] A fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform the methods described in the first aspect of this disclosure.

[0026] A fifth aspect of this disclosure provides a chip including one or more interfaces and one or more processors; the interfaces are configured to receive signals from the memory of an electronic device and send signals to the processors, the signals including computer instructions stored in the memory, which, when executed by the processor, cause the electronic device to perform the methods described in the first aspect of this disclosure.

[0027] In summary, the application distribution method, apparatus, electronic device, and storage medium proposed in this disclosure determine the terminal identification information of the first terminal with the right to install the first application based on the installation control information in the distribution information during the application distribution process, and carry the terminal identification information during distribution, thereby enabling the restriction of the terminal's installation of the application during the application distribution process.

[0028] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0030] Figure 1 A flowchart illustrating an application publishing method provided in this embodiment of the disclosure; Figure 2 (a) ~ Figure 2 (d) A schematic diagram of the application publishing management page provided in an embodiment of this disclosure; Figure 3 A schematic diagram of a verification certificate provided in an embodiment of this disclosure; Figure 4 A flowchart illustrating an application publishing method provided in this embodiment of the disclosure; Figure 5 This is a schematic diagram of an application publishing device provided in an embodiment of the present disclosure; Figure 6This is a schematic diagram of the electronic device structure provided in the embodiments of this disclosure; Figure 7 This is a schematic diagram of the chip structure provided in an embodiment of this disclosure. Detailed Implementation

[0031] Embodiments of this disclosure are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0032] Currently, terminal applications are generally distributed through app stores. During the application distribution process, the application uploaded by the developer is signed by the app store's CA certificate and then uploaded to the app store management terminal. The app store management terminal verifies the signature of the application and distributes it. After the terminal downloads the application from the app store, the application installation is completed. Based on the app store's signature of the application, the trustworthiness of the distributed application is verified to ensure that the application has not been tampered with.

[0033] For app store management, when it needs to restrict terminals, common restriction strategies include: login-based app account control and pre-launch environment checks. Login-based app account control requires users to log in before using specific app functions to confirm their app usage permissions. Pre-launch environment checks involve the app obtaining runtime environment information and checking and verifying it during the startup process after installation to ensure that the app's usage environment meets the app store management's expectations.

[0034] Currently, app signing in app stores only verifies the signature on the developer side, without verifying it on the device side. When the app developer has restrictions on the device, it is impossible to restrict the user when the app is released. On the management side, app account control can only restrict the login user, not the app installation user.

[0035] In the embodiments of this disclosure, during the application distribution process, the terminal identification information of the first terminal with the permission to install the first application is determined according to the installation control information in the release information, and the terminal identification information is carried during the release, thereby enabling the restriction of the terminal's installation of the application during the application distribution process.

[0036] Figure 1 This is a flowchart illustrating an application publishing method provided in an embodiment of this disclosure. Figure 1 As shown, the execution subject of this method is an electronic device, which may optionally be an app store management terminal. The method may include the following steps.

[0037] Step 101: Receive the release information and application package of the first application; wherein, the release information includes basic application information and installation control information, and the installation control information is used to indicate that the first terminal has the permission to install the first application.

[0038] Step 102: Verify the signature of the application's basic information using the app store's first certificate.

[0039] Step 103: In response to successful signature verification, determine the terminal identification information of the first terminal based on the installation control information.

[0040] Step 104: Publish the first application in the app store based on the terminal identification information, application basic information, and application package.

[0041] The application distribution method proposed in this disclosure first receives the distribution information and application package of a first application. The distribution information includes basic application information and installation control information, whereby the installation control information indicates that the first terminal has the permission to install the first application. Then, the basic application information is signed and verified using a first certificate from the application store. Following successful signature verification, the terminal identification information of the first terminal is determined based on the installation control information. Finally, the first application is distributed in the application store based on the terminal identification information, the basic application information, and the application package. This method enables the determination of the terminal identification information of the first terminal with the permission to install the first application based on the installation control information in the distribution information during the application distribution process. This terminal identification information is carried during distribution, thereby restricting the terminal's ability to install the application during the application distribution process.

[0042] The following describes step 101 (i.e., receiving the release information and application package of the first application; wherein the release information includes basic application information and installation control information, and the installation control information is used to indicate that the first terminal has the permission to install the first application) in detail.

[0043] After the application development team completes the application development, the user on the application development team logs into the application store management interface and enters the application distribution management page. On the application distribution management page, the following operations can be performed: fill in the basic application information, upload the application installation package, and select installation control information, etc.

[0044] exist Figure 2 Application management page (such as) Figure 2 (a) As shown, you can fill in basic application information, such as application name, application package name, version number, and distribution method; select installation control information, such as all account information of the original account (e.g., ...). Figure 2 (b) The mobile phone number shown), partial account information of the original account information (such as...) Figure 2 (c) the number range shown), the certificate issued to the SIM card (such as...) Figure 2(d) etc. Optionally, the SIM card may be a Super SIM card.

[0045] Here, installation control information is used to control the terminal during the application development phase, such as controlling only the terminal with permission to install the first application.

[0046] In one example of this disclosure, the installation control information includes control information corresponding to the second certificate; or, the installation control information includes control information corresponding to the second certificate and control information corresponding to the first account information. Optionally, the first account information may be part or all of the account information of the original account information.

[0047] In some embodiments of this disclosure, in addition to filtering terminals that can install the first application by using installation control information, terminals that can be used to install the first application can also be filtered by using the application's API version identification information.

[0048] Correspondingly, in this example, the release information also includes the first API version identification information of the first application; wherein, the first API version identification information is used to identify the API version information supported by the first terminal.

[0049] Here, the first API version identification information is used to filter out terminals that support this identification information.

[0050] The following is a detailed description of step 102 (i.e., verifying the signature of the application's basic information using the app store's first certificate).

[0051] In one example, the signature verification of the application's basic information using the first certificate of the app store includes: parsing the application's basic information to obtain the channel information and first signature information of the first application; wherein, the first signature information is the information generated by signing the first application based on the first certificate of the app store, and the channel information is used to indicate that the first application originates from the app store; determining whether the channel information is preset channel information; in response to the preset channel information, signing the application package of the first application to obtain second signature information; verifying whether the second signature information is consistent with the first signature information; if consistent, then executing the step of determining the terminal identification information of the first terminal based on the installation control information.

[0052] After receiving the application installation package uploaded by the developer, the app store management console performs channel and signature checks. Upon receiving the application installation package, the app store parses out the channel and signature information. Then, it verifies whether the channel information corresponds to the current app store. If the channel information matches the current app store's channel information, the application installation package is re-signed, and the resulting application signature is compared with the original signature. If they match, the application upload by the developer is considered successful, and the channel and signature verification passes.

[0053] The following is a detailed description of step 103 (i.e., in response to successful signature verification, determining the terminal identification information of the first terminal based on the installation control information).

[0054] In the embodiments of this disclosure, when the signature verification is successful, the installation control information is matched with the terminal identification information to obtain the terminal identification information of the first terminal.

[0055] In the embodiments of this disclosure, terminal identification information can be characterized by unique identity information, such as a second certificate issued by its SIM card issuing authority or the terminal's mobile phone number.

[0056] In the embodiments of this disclosure, only terminals that match the installation control information have the permission to install the first application. This allows for the selection of terminals with the permission to install the first application during the application distribution phase by using the installation control information.

[0057] In one example, the installation control information includes control schemes and control parameters. The table below lists several control schemes and control parameters:

[0058] The second certificate is a certificate issued by the certificate authority specified by the SIM card, meaning the second certificate is a valid certificate in the SIM card.

[0059] Here, the control scheme may include at least one control parameter, which can be used to filter at least one terminal that has the right to install the first application. The control parameter corresponds to the terminal identification information. During the application distribution phase, the terminal corresponding to the terminal identification information that matches the control parameter is filtered, that is, the first application can only be seen on the terminal with the terminal identification information that matches the control parameter.

[0060] In one example of this disclosure, determining the terminal identification information of the first terminal based on the installation control information may include: verifying whether the installation control information is valid; and, in response to the installation control information being valid, determining the terminal identification information of the first terminal based on the installation control information.

[0061] In one example, if the installation control information includes control information corresponding to the second certificate, then the terminal identification information of the first terminal is determined based on the installation control information, including: detecting whether the second certificate is installed in the SIM card of the first terminal; if it is installed, then the terminal identification information of the first terminal is determined to be the terminal identification information corresponding to the second certificate.

[0062] In this example, it can be determined whether the first terminal has the permission to install the first application by detecting whether the second certificate has been installed on the SIM card of the first terminal. If the second certificate has been installed on the SIM card of the first terminal, then the terminal identification information of the first terminal is the terminal identification information corresponding to the second certificate.

[0063] In one example, if the installation control information also includes control information corresponding to the first account information, then the terminal identification information of the first terminal is determined based on the installation control information, including: obtaining the second account information of the first terminal; detecting whether the second account information of the first terminal is consistent with the first account information; if consistent, then determining that the terminal identification information of the first terminal is the terminal identification information corresponding to the first account information.

[0064] In this example, it can be determined whether the first terminal has the permission to install the first application by detecting whether the second account information of the first terminal is consistent with the first account information. If the second account information is consistent with the first account information, the terminal identification information of the first terminal is determined to be the terminal identification information corresponding to the second account information.

[0065] In one example of this disclosure, the installation control information may include a control scheme and control parameters. Optionally, verifying the validity of the installation control information may include verifying the validity of the control parameters.

[0066] During the application distribution phase, after setting the application control scheme, you can check whether the corresponding control parameters are set correctly using the following table:

[0067] In this example, if the installation control information includes control information corresponding to the second certificate, and the control parameter is the second certificate, then verifying the validity of the installation control information may include: in response to detecting that the SIM card of the first terminal is activated, scheduling the STK module in the SIM card of the first terminal to perform the following steps: verifying whether the issuing authority of the second certificate is the SIM card certificate issuing authority specified by the application store; if so, determining whether the second certificate is a root certificate; if the second certificate is a root certificate, determining that the second certificate is valid.

[0068] In this example, if the installation control information also includes control information corresponding to the first account information, and the control parameter is the first account information, then verifying whether the installation control information is valid also includes verifying whether at least one of the following in the first account information is valid: length, number range, character type.

[0069] In one example, the first account information is determined based on the following steps: obtaining the original account information; determining the digest value of the original account information and the app store's public salt using a hash algorithm; and encrypting the digest value using the app store's asymmetric encryption public key to obtain the first account information.

[0070] In another example, the first account information is determined based on the following steps: obtaining the original account information; concatenating a portion of the original account information with the app store's public salt to obtain the concatenated result; and processing the concatenated result using a digest algorithm to obtain the first account information.

[0071] In the embodiments of this disclosure, when the control scheme is a mobile phone number, the mobile phone number can be an encrypted mobile phone number; when the control scheme is a number segment, the number segment is an encrypted number segment. The following details how to encrypt both the mobile phone number and the number segment: Control Scheme 1: Encrypt the mobile phone number to obtain the encrypted mobile phone number: exist Figure 2 (b) When the selected control scheme is mobile phone number, fill in the mobile phone number on the application management page. Since mobile phone numbers have high privacy requirements, this scheme uses hash digest processing for mobile phone numbers to avoid the risk of mobile phone number leakage. At the same time, the mobile phone number is encrypted during transmission.

[0072] In one example, the encrypted phone number can be obtained using the following formula:

[0073] in, The phone number is unencrypted. For the public salt of the app store, The public key for asymmetric encryption of the app store; | represents the concatenation operation. Indicates to The summary value can be calculated as follows:

[0074] Where part(x) represents obtaining the number segment of number x, SM3 is the Chinese national cryptographic data digest algorithm, | is the concatenation operation, and encrypt(x,y) performs asymmetric encryption on message x using public key y. The phone number is for encrypted transmission.

[0075] After receiving an encrypted phone number, the app store decrypts it to obtain the implicit representation of the phone number. Its decryption logic is as follows:

[0076] in, The private key for asymmetric decryption in the app store is y. decrypt(x,y) is used to perform asymmetric decryption of the encrypted message x using the private key y.

[0077] Control scheme two: Encrypt the number segment to obtain the encrypted number segment: exist Figure 2 (c) When the selected control scheme is number segment, enter the target number segment on the application management page. The encrypted number segment can be obtained using the following formula:

[0078] in, For the plaintext of the number segment, This is an encrypted number segment.

[0079] Control Scheme 3: Certificates issued for SIM cards: exist Figure 2 When the control scheme selected in (d) is a certificate, fill in the issuing authority of the certificate (i.e., the first certificate or the second certificate), which is selected from the issuing authorities supported by the SIM card.

[0080] After selecting a certificate authority, the SIM card can be used to verify the certificate. Figure 3 The described process: Step 1: Call the STK module in the SIM card to complete the certificate initialization process: (1) The STK module triggers the certificate initialization process.

[0081] When activating the SIM card, the SIM card is called, triggering the STK module to complete the initialization of the second certificate. First, it checks whether the second certificate directory is stored in the SIM card and whether the certificate is valid. If there is no certificate, the certificate is not valid, or the common name of the certificate is not the app store domain name, or the organization is not the company to which the app store belongs, the certificate initialization process can be triggered.

[0082] (2) Obtain the certificate using the STK module.

[0083] When obtaining the second certificate, the system retrieves the second certificate according to the certificate retrieval path set by the STK module (firstly, it checks whether a valid certificate already exists locally; if it already exists, it does not retrieve it from that path but directly reads the local certificate). It also checks whether the second certificate authority is in the trusted authority list saved by default on the SIM card (i.e., the authorities supported by the SIM card). When the authority of the certificate to be tested is already in the trusted list, it checks whether there is a parent authority. If there is no parent authority, it recursively queries according to the above steps until the second certificate is a root certificate, has no parent authority, and is already in the trusted authority list, at which point the recursion terminates. If so, the validity check of the second certificate is confirmed to be successful, and it is a valid certificate.

[0084] When obtaining the first certificate (i.e., the certificate issued by the app store), the first certificate of the app store SIM card is obtained according to the certificate acquisition path set by the STK module (firstly, it checks whether there is already a valid certificate locally; if it already exists, it will not be obtained from this path, but will directly read the local certificate). After obtaining the certificate, it is determined whether the issuing authority of the first certificate is the same as the issuing authority in the app store distribution signature certificate stored on the SIM card. If they are consistent, the verification is successful, and the certificate issued by the app store is stored in the SIM card.

[0085] Step 2: The STK module in the SIM card is used to complete the certificate update operation. Once an expired or revoked certificate is detected, delete the expired or revoked certificate and repeat step one to complete the certificate update.

[0086] The following is a detailed description of step 104 (i.e., publishing the first application in the app store based on the terminal identification information, application basic information, and application package).

[0087] According to embodiments of this disclosure, a first application is published in an app store based on terminal identification information, application basic information, and application package.

[0088] In embodiments of this disclosure, after publishing the first application in an app store, the method further includes: in response to receiving search request information sent by a second terminal, matching the metadata information of each second application with the search request information to obtain application matching results; wherein the metadata information of the second application is data obtained by parsing the publication information and application package of the second application; sending the application matching results to the second terminal; receiving a download request sent by the second terminal for the second application, wherein the download request carries at least a second certificate, the second certificate being used to verify whether the second terminal has permission to install the second application; performing signature verification on the second certificate; and in response to successful signature verification, sending the application package of the second application to the second terminal.

[0089] In the embodiments of this disclosure, when the app store management terminal receives the search request information sent by the second terminal, it matches the metadata information of each second application published on the app terminal with the search request information to obtain the application matching results. Then, the app store management terminal sends the application matching results to the second terminal, which selects a second application from the application matching results. The second terminal then sends a download request to the app store management terminal for the selected second application. This download request carries at least a second certificate, which is used to verify whether the second terminal has the permission to install the second application. Next, the second certificate is signed and verified, and when the signature verification passes, the application package of the second application is sent to the second terminal.

[0090] It should be noted that the terms "first application" and "second application" in the embodiments of this disclosure are not used to represent different orders, but can be used to represent the same or different applications. Similarly, the terms "first terminal" and "second terminal" in the embodiments of this disclosure are not used to represent different orders, but can be used to represent the same or different terminals.

[0091] In one example, if the download request also carries first verification information, the public key of the first certificate, and the private key of the second certificate, then the second certificate is signed and verified, including: encrypting the first verification information using the public key of the first certificate, and signing the ciphertext information using the private key of the second certificate to generate second verification information; encrypting the second verification information using the private key of the first certificate, and signing the ciphertext information using the public key of the second certificate to generate third verification information; verifying whether the first verification information and the third verification information are consistent; if they are consistent, then the step of sending the application package of the second application to the second terminal is executed.

[0092] After receiving the application matching result, the second terminal in the embodiments of this disclosure selects the required application to install (e.g., a second application in the application matching result). The second terminal submits a download request to the application store management terminal for the second application. The download request may carry the metadata information of the second terminal, the second certificate, the first verification information, the public key of the first certificate and the private key of the second certificate, etc.

[0093] Here, the public key of the first certificate and the private key of the second certificate can be obtained from the SIM card of the second terminal.

[0094] In this example, the second verification information can be obtained using the following formula:

[0095] Here, encrypt(x,y) means encrypting x using y, and decrypt(x,y) means signing x using y. This is the first verification information. The public key of the first certificate, This is the private key for the second certificate.

[0096] Optionally, the first verification information can be a random number.

[0097] In this example, the third verification information can be obtained using the following formula: Get random numbers from download requests Japanese Classics Encrypted random number and based on the public key of the second certificate The private key of the first certificate Calculate the third verification information :

[0098] when and If they match, then the step of sending the application package of the second application to the second terminal is executed.

[0099] When the first verification information and the third verification information are consistent, the method further includes: encapsulating the application, specifically: encapsulating the application package of the second application to obtain a first encapsulation result; and sending the first encapsulation result to the second terminal.

[0100] In one example, if the metadata information of the second application includes terminal identification information, then the application package of the second application is encapsulated to obtain a first encapsulation result, including: The application package of the second application is cyclically shifted to the right according to the terminal identification information and the third verification information to obtain the second encapsulation result; the terminal identification information of the second application is encrypted according to the private key of the first certificate, and the ciphertext information is signed with the public key of the second certificate to obtain the first encapsulation result.

[0101] Correspondingly, in this example, for the selected application (That is, using a second application from the matching results) to generate a random password. The first encapsulation result can be obtained using the following formula:

[0102]

[0103] Here, >>> represents a circular right shift, | represents a concatenation operation, and len(x) represents the length of the binary representation of x. Within the packet, this position has a fixed length of 64 bits. This means that after expanding the binary representation of y to the same length as the binary representation of x (using circular copying for expansion), a binary XOR operation is performed on it. This is the second encapsulation result. This is the first encapsulation result.

[0104] Optionally, apply Control parameters The digest (such as the digest of an encrypted mobile phone number) as .

[0105] After packaging is complete, the app store will display the first package result. The application package is sent to the second terminal for installation. After receiving the first packaging result, the second terminal parses the application package and performs a signature check. If the check passes, the application installation is executed. It should be noted that the parsing process is the reverse of the packaging process described above. If the packaging process is encrypted, it needs to be decrypted during the parsing process, which will not be elaborated further.

[0106] The terminal received the result of the first packet. Then, first extract the first 64 bits to obtain the application length. and in length The remaining part is divided into two parts, which are then used to obtain encrypted applications. Encryption result with encryption key:

[0107] Next, the STK module in the SIM card of the second terminal is invoked according to... The first certificate is signed and verified. The application decryption key is obtained using the following formula. and control scheme :

[0108] in, The public key of the first certificate is obtained from the first certificate stored in SuperSIM through the STK module in SuperSIM; The private key for the second certificate is obtained from the second certificate stored in SuperSIM via the STK module in SuperSIM.

[0109] In one example, upon detecting that the download of the first encapsulation result has been completed, the method further includes: in response to detecting that the download of the first encapsulation result has been completed, scheduling the STK module in the SIM card of the second terminal to sign the first encryption key according to the public key of the first certificate to obtain third signature information; encrypting the third signature information according to the private key of the second certificate to obtain application decryption key and installation control information; decrypting the first encapsulation result according to the application decryption key and installation control information to obtain the application package to be installed, and writing the application package to be installed into the RAM of the second terminal.

[0110] In this example, the STK module in the scheduling SIM card, based on the control scheme and control parameters, can decompress the application package to obtain the application package to be installed according to the following formula. ,Will The application has been installed in the terminal and distribution is complete.

[0111] In one example, during the installation process in the terminal, Only write to RAM, not ROM; delete the application package from RAM once it is detected that the application package to be installed has been written completely. .

[0112] In one example, after filling in the application release information: Afterwards, the app store management interface will process the published information. and application package Perform parsing to obtain metadata information. .

[0113] in, Indicates the application name. Indicates the category to which the application belongs. Indicates the application package name. Indicates the application release date. Indicates the application version number. This indicates the minimum API version number supported by the terminal. This indicates the maximum API version number supported by the terminal. Indicates the name of the application development side. For control scheme, To control parameters, metadata information With application package The application is submitted to the application review process for review. After the review is completed, the application is listed on the app store management platform based on the review results. Once listed, the application can be searched, downloaded, and installed on the app store.

[0114] In one example, if the metadata information of the second application includes basic application information, first API version identification information, and terminal identification information, then the metadata information of the second application is matched with the search request information to obtain application matching results, including: matching the basic application information of the second application with the keywords in the search request information, and taking the second application that matches the keywords as the first matching result; matching the first API version identification information with the API version information supported by the second terminal, and taking the second application that matches the API version information supported by the second terminal in the first matching result as the second matching result; and matching the third account information of the second terminal with the terminal identification information, and taking the second application that matches the third account information of the second terminal in the second matching result as the application matching result.

[0115] In one example, if the application's basic information includes the application's release date and application package name, then the second application in the second matching result that matches the third account information of the second terminal is taken as the application matching result. This includes: grouping the third matching result according to the application package name of each second application in the third matching result; sorting the second applications in each group according to their release date, and taking the second application with the largest release date as the application matching result.

[0116] In one example, if the application basic information also includes application version information, then the second application with the largest release date will be used as the application matching result. This includes: if there are multiple second applications with the largest release date, then the second application with the highest application version will be used as the application matching result.

[0117] The process of determining the application matching results is described in detail below.

[0118] Step 1: Based on the search request information, perform a fuzzy search in the app store. Specifically: When searching for apps in an app store, the app store uses keywords from the search request as search criteria, iterates through the metadata of all apps in the app store, and performs fuzzy keyword matching on the app name, category, and app developer name in the metadata to obtain a list of apps that meet the search criteria (i.e., the first matching result). ,Right now: ,satisfy:

[0119] Where k1 represents the number of applications that meet the conditions, index(x,y) represents the position of string y in string x, returns -1 if x does not contain y, and i is the i-th application in the first matching result. If x contains y, it returns the index of the first character of y in x. Represents metadata information The application name in the metadata information The application belongs to the category of Represents metadata information The application publisher name in the value is (x)or(y), which means that if either x or r is true, it returns true, otherwise it returns false.

[0120] The second step is to filter the first matching result based on the metadata information and the API version information supported by the second terminal. Specifically: Iterate through the matching results obtained in the first step and check the API version information supported by the second terminal. Is it in: Minimum API version number? With the maximum API version number Between, that is: If a second terminal is deemed available, it is not filtered; otherwise, it is filtered out in the returned list, thus obtaining a list of applications that meet the search criteria (i.e., the second matching result). Each second application in the second matching result may include the minimum API version number. and / or the maximum API version number .

[0121] The third step, based on the control schemes and parameters included in the installation control information for each application in the second step, specifically: Iterate through the matching results obtained in the second step and retrieve the corresponding control scheme according to the application. With control parameters The system then uses the control parameters uploaded by the user to perform a matching check. Applications that fail the matching check are removed from the list, resulting in a list of applications that meet the criteria (i.e., the third matching result). The specific inspection logic is as follows:

[0122] The fourth step is to filter the matching results from the third step based on different versions of the same application. Specifically: Iterate through the matching results obtained in step three, sorted by application package name. They are grouped, and within each group, they are further categorized by application release date. Sort the results and take the one with the largest release date. If multiple applications are still released in the result with the largest release date, then retrieve the application version. The largest value is used as the unique result in that group, thus obtaining a list of applications that meet the search criteria (i.e., application matching results). .

[0123] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should know that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps may be performed in other orders or simultaneously.

[0124] Secondly, those skilled in the art should also know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by this disclosure.

[0125] The following is combined with Figure 4 Specific application examples will provide further detailed description of the technical solutions disclosed herein.

[0126] This disclosure provides an application publishing method, which may include the following steps: Step 1: Execute the application release phase.

[0127] During this stage, users on the application development side log in to the application store management terminal, enter the application distribution management page, and can perform the following operations on the application distribution management page: fill in the basic application information, upload the application installation package, and select installation control information, etc.

[0128] Step 2: Perform the release check phase.

[0129] This stage involves verifying the application's basic information and checking the validity of installation control information. For details, please refer to the above. Figure 1 The corresponding description in the embodiments.

[0130] After successful verification, the terminal identification information is determined based on the installation control information (see above for details). Figure 1 (The corresponding description in the embodiments).

[0131] After determining the terminal identification information, the application is published.

[0132] Step 3: Perform the application search phase.

[0133] This stage includes the following steps: Step 1: Based on the search request information, perform a fuzzy search in the app store. Specifically: When searching for apps in an app store, the app store uses keywords from the search request as search criteria, iterates through the metadata of all apps in the app store, and performs fuzzy keyword matching on the app name, category, and app developer name in the metadata to obtain a list of apps that meet the search criteria (i.e., the first matching result). ,Right now: ,satisfy:

[0134] Where k1 represents the number of applications that meet the conditions, and index(x,y) represents the position of string y in string x. If x does not contain y, it returns -1; if x contains y, it returns the index of the first character of y in x. Represents metadata information The application name in Represents metadata information The application belongs to the category of Represents metadata information The application publisher name in the value is (x)or(y), which means that if either x or r is true, it returns true, otherwise it returns false.

[0135] The second step is to filter the first matching result based on the metadata information and the API version information supported by the second terminal. Specifically: Iterate through the matching results obtained in the first step and check the API version information supported by the second terminal. Is it in: Minimum API version number? With the maximum API version number Between, that is: If a second terminal is deemed available, it is not filtered; otherwise, it is filtered out in the returned list, thus obtaining a list of applications that meet the search criteria (i.e., the second matching result). Each second application in the second matching result may include the minimum API version number. and / or the maximum API version number .

[0136] The third step, based on the control schemes and parameters included in the installation control information for each application in the second step, specifically: Iterate through the matching results obtained in the second step and retrieve the corresponding control scheme according to the application. With control parameters The system then uses the control parameters uploaded by the user to perform a matching check. Applications that fail the matching check are removed from the list, resulting in a list of applications that meet the criteria (i.e., the third matching result). The specific inspection logic is as follows:

[0137] The fourth step is to filter the matching results from the third step based on different versions of the same application. Specifically: Iterate through the matching results obtained in step three, sorted by application package name. They are grouped, and within each group, they are further categorized by application release date. Sort the results and take the one with the largest release date. If multiple applications are still released in the result with the largest release date, then retrieve the application version. The largest value is used as the unique result in that group, thus obtaining a list of applications that meet the search criteria (i.e., application matching results). .

[0138] Step 4: Execute the application packet phase.

[0139] In this stage, the application package is encapsulated to obtain the first encapsulation result (see above for details). Figure 1 (The corresponding description in the embodiments).

[0140] Step 5: Perform the application installation phase.

[0141] At this stage, the app store will release the first packet results. The application package is sent to the second terminal for installation. Upon receiving the first packaging result, the second terminal parses the application package and performs a signature check. If the check passes, the application installation is executed. It should be noted that the parsing process is the reverse of the packaging process. If the packaging process is encrypted, it must be decrypted during parsing. This will not be elaborated further (see the above description for details). Figure 1 (The corresponding description in the embodiments).

[0142] Figure 5 This is a block diagram of an application publishing device 500 provided in an embodiment of this disclosure. (See diagram below.) Figure 5 As shown, the device 500 includes: a receiving module 501, used to receive the release information and application package of a first application; wherein the release information includes basic application information and installation control information, and the installation control information is used to indicate that the first terminal has the permission to install the first application; a verification module 502, used to perform signature verification on the basic application information using a first certificate from an application store; a determining module 503, used to determine the terminal identification information of the first terminal based on the installation control information in response to successful signature verification; and a releasing module 504, used to release the first application in the application store based on the terminal identification information, the basic application information, and the application package.

[0143] In some embodiments, the verification module 502 includes: a parsing unit, configured to parse the basic information of the application to obtain channel information and first signature information of the first application; wherein the first signature information is information generated by signing the first application based on the first certificate of the application store, and the channel information is used to characterize that the first application originates from the application store; determining whether the channel information is preset channel information; a signing unit, configured to sign the application package of the first application in response to the preset channel information to obtain second signature information; and a first verification unit, configured to verify whether the second signature information is consistent with the first signature information; if consistent, then performing the step of determining the terminal identification information of the first terminal based on the installation control information.

[0144] In some embodiments, the determining module 503 includes: a second verification unit for verifying whether the installation control information is valid; and a determining unit for determining the terminal identification information of the first terminal based on the installation control information in response to the installation control information being valid.

[0145] In some embodiments, if the installation control information includes control information corresponding to the second certificate, the determining unit is configured to: detect whether the second certificate is installed in the SIM card of the first terminal; if it is installed, determine that the terminal identification information of the first terminal is the terminal identification information corresponding to the second certificate.

[0146] In some embodiments, if the installation control information further includes control information corresponding to the first account information, the determining unit is further configured to: obtain the second account information of the first terminal; detect whether the second account information of the first terminal is consistent with the first account information; if consistent, determine that the terminal identification information of the first terminal is the terminal identification information corresponding to the first account information.

[0147] In some embodiments, if the installation control information includes control information corresponding to the second certificate, the second verification unit is configured to: in response to detecting that the SIM card of the first terminal is activated, schedule the STK module in the SIM card of the first terminal to perform the following steps: verify whether the issuing authority of the second certificate is the SIM card certificate issuing authority specified by the application store; if so, determine whether the second certificate is a root certificate; if the second certificate is a root certificate, determine that the installation control information is valid.

[0148] In some embodiments, if the installation control information further includes first account information, the second verification unit is further configured to: verify whether at least one of the following in the first account information is valid: length, number segment, and character type.

[0149] In some embodiments, the apparatus further includes: an acquisition module for acquiring original account information; a determination module 503 for determining a digest value of the original account information and the public salt of the app store using a hash algorithm; and an encryption module for encrypting the digest value using the public key of the app store's asymmetric encryption to obtain first account information.

[0150] In some embodiments, the apparatus further includes: an acquisition module for acquiring original account information; a obtaining module for concatenating a portion of the original account information with a public salt from an app store to obtain a concatenation result; and a concatenation module for processing the concatenation result using a digest algorithm to obtain first account information.

[0151] In some embodiments, the published information may further include first API version identification information of the first application; wherein, the first API version identification information is used to identify the API version information supported by the first terminal.

[0152] In some embodiments, after the first application is published in the app store, the device further includes: a receiving module 501, further configured to: receive search request information sent by a second terminal; a matching module, configured to, in response to receiving the search request information sent by the second terminal, match the metadata information of each second application with the search request information respectively to obtain application matching results; wherein, the metadata information of the second application is data obtained by parsing the publication information and application package of the second application; a sending module, configured to send the application matching results to the second terminal; the receiving module 501, further configured to receive a download request sent by the second terminal for the second application, wherein the download request carries at least a second certificate, the second certificate being used to verify whether the second terminal has the permission to install the second application; a verification module, configured to perform signature verification on the second certificate; and a sending module, further configured to, in response to the signature verification passing, send the application package of the second application to the second terminal.

[0153] In some embodiments, if the download request also carries first verification information, the public key of the first certificate, and the private key of the second certificate, the verification module is specifically configured to: encrypt the first verification information according to the public key of the first certificate, and sign the ciphertext information according to the private key of the second certificate to generate second verification information; encrypt the second verification information according to the private key of the first certificate, and sign the ciphertext information according to the public key of the second certificate to generate third verification information; verify whether the first verification information and the third verification information are consistent; if they are consistent, then execute the step of sending the application package of the second application to the second terminal.

[0154] In some embodiments, the sending module is further configured to: if they match, encapsulate the application package of the second application to obtain a first encapsulation result; and send the first encapsulation result to the second terminal.

[0155] In some embodiments, if the metadata information of the second application includes terminal identification information, the sending module is further configured to: cyclically shift the application package of the second application to the right according to the terminal identification information and the third verification information to obtain a second encapsulation result; encrypt the terminal identification information of the second application according to the private key of the first certificate, and sign the ciphertext information with the public key of the second certificate to obtain a first encapsulation result.

[0156] In some embodiments, the apparatus further includes: a scheduling module, configured to, in response to detecting that the download of the first packaging result has been completed, schedule the STK module in the SIM card of the second terminal to sign the first encryption key according to the public key of the first certificate to obtain third signature information; an encryption module, configured to encrypt the third signature information according to the private key of the second certificate to obtain an application decryption key and installation control information; and a decryption module, configured to decrypt the first packaging result according to the application decryption key and installation control information to obtain an application package to be installed, and write the application package to be installed into the RAM of the second terminal.

[0157] In some embodiments, the apparatus further includes a deletion module for deleting the application package to be installed from memory RAM in response to detecting that the application package to be installed has been written.

[0158] In some embodiments, if the metadata information of the second application includes application basic information, first API version identification information, and terminal identification information, then the matching module specifically includes: a first matching unit, configured to match the application basic information of the second application with keywords in the search request information, and take the second application that matches the keywords as the first matching result; a second matching unit, configured to match the first API version identification information with API version information supported by the second terminal, and take the second application in the first matching result that matches the API version information supported by the second terminal as the second matching result; and a third matching unit, configured to match the third account information of the second terminal with the terminal identification information, and take the second application in the second matching result that matches the third account information of the second terminal as the application matching result.

[0159] In some embodiments, if the application basic information includes the application release date and the application package name, the third matching unit includes: a grouping unit, used to group the third matching results according to the application package names of each second application in the third matching results; and a sorting unit, used to sort the second applications in each group according to the application release date, and take the second application with the largest release date as the application matching result.

[0160] In some embodiments, if the application basic information also includes application version information, the sorting unit is used to: if there are multiple second applications with the largest release date, select the second application with the highest application version as the application matching result.

[0161] Figure 6 This is a block diagram of an electronic device 600 for implementing the above-described application publishing method, provided as an embodiment of the present disclosure.

[0162] Based on the hardware implementation of the above program modules, and in order to implement the method of this disclosure embodiment, this disclosure embodiment also provides an electronic device, such as... Figure 6 As shown, the electronic device 600 includes: The communication interface 601 enables information exchange with other devices; The processor 602 is connected to the communication interface 601 to enable information interaction with other devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running a computer program; The computer program is stored in memory 603.

[0163] Specifically, the processor 602 can receive the release information and application package of the first application; wherein, the release information includes basic application information and installation control information, and the installation control information is used to indicate that the first terminal has the permission to install the first application; the basic application information is signed and verified by the first certificate of the application store; in response to the successful signature verification, the terminal identification information of the first terminal is determined according to the installation control information; and the first application is released in the application store according to the terminal identification information, the basic application information and the application package.

[0164] It should be noted that the specific processing procedure of processor 602 can be understood by referring to the above method.

[0165] Of course, in practical applications, the various components in electronic device 600 are coupled together through bus system 604. It can be understood that bus system 604 is used to realize the connection and communication between these components. In addition to a data bus, bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 6 The general designated all buses as Bus System 604.

[0166] The memory 603 in this embodiment is used to store various types of data to support the operation of the electronic device 600. Examples of such data include any computer program used to operate on the electronic device 600.

[0167] The methods disclosed in the above embodiments of this disclosure can be applied to or implemented by processor 602. Processor 602 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 602 or by instructions in software form. The first processor 602 mentioned above may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 602 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this disclosure can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 603. Processor 602 reads information from memory 603 and combines it with its hardware to complete the steps of the aforementioned method.

[0168] In an exemplary embodiment, the electronic device 600 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0169] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 603 including instructions, which can be executed by a processor 602 of an electronic device 600 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0170] Embodiments of this disclosure also provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform the methods described in the above embodiments of this disclosure.

[0171] Embodiments of this disclosure also propose a chip, such as Figure 7 As shown, the chip includes a processor and an interface. The number of processors can be one or more, and the number of interfaces can be multiple. The interface circuitry is used to receive signals from the electronic device's memory and send signals to the processor. The signals include computer instructions stored in the memory. When the processor executes the computer instructions, it causes the electronic device to perform the methods described in the above embodiments of this disclosure.

[0172] It should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0173] It should be understood that the terms "system," "apparatus," "unit," and / or "module" used in this disclosure are a method of distinguishing different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they may be replaced by other expressions.

[0174] As indicated in this disclosure and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of expressly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements. An element defined by the phrase "comprising an..." does not exclude the presence of other identical elements in the process, method, product, or apparatus that includes the element.

[0175] In the description of the embodiments of this disclosure, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this disclosure, "multiple" refers to two or more.

[0176] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0177] Flowcharts are used in this disclosure to illustrate the operations performed by a system according to embodiments of this disclosure. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0178] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0179] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0180] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processing module, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (control method), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic device, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0181] It should be understood that various parts of the embodiments of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0182] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0183] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc.

[0184] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An application deployment method, characterized in that, The method includes: The system receives the release information and application package of a first application; wherein the release information includes basic application information and installation control information, and the installation control information is used to indicate that the first terminal has the permission to install the first application; The application's basic information is signed and verified using the app store's primary certificate. In response to successful signature verification, the terminal identification information of the first terminal is determined based on the installation control information; The first application is published in the app store based on the terminal identification information, application basic information, and application package.

2. The method according to claim 1, characterized in that, The signature verification of the application's basic information using the first certificate from the app store includes: The basic information of the application is parsed to obtain the channel information and the first signature information of the first application; wherein, the first signature information is the information generated by signing the first application based on the first certificate of the application store, and the channel information is used to indicate that the first application originates from the application store. Determine whether the channel information is preset channel information; In response to preset channel information, the application package of the first application is signed to obtain second signature information; Verify whether the second signature information is consistent with the first signature information; If they match, then proceed with the step of determining the terminal identification information of the first terminal based on the installation control information.

3. The method according to claim 2, characterized in that, Determining the terminal identification information of the first terminal based on the installation control information includes: Verify that the installation control information is valid; In response to the installation control information being valid, the terminal identification information of the first terminal is determined based on the installation control information.

4. The method according to any one of claims 1-3, characterized in that, If the installation control information includes control information corresponding to the second certificate, then the terminal identification information of the first terminal is determined based on the installation control information, including: Detect whether the second certificate is installed in the SIM card of the first terminal; If it has already been installed, then the terminal identification information of the first terminal is determined to be the terminal identification information corresponding to the second certificate.

5. The method according to claim 4, characterized in that, If the installation control information further includes control information corresponding to the first account information, then the terminal identification information of the first terminal is determined based on the installation control information, including: Obtain the second account information of the first terminal; Detect whether the second account information of the first terminal is consistent with the first account information; If they match, then the terminal identification information of the first terminal is determined to be the terminal identification information corresponding to the first account information.

6. The method according to claim 4, characterized in that, If the installation control information includes control information corresponding to the second certificate, then verifying the validity of the installation control information includes: In response to the detection that the SIM card of the first terminal is activated, the STK module in the SIM card of the first terminal is scheduled to perform the following steps: Verify whether the issuing authority of the second certificate is the SIM card certificate issuing authority specified by the app store; If so, then determine whether the second certificate is a root certificate; If the second certificate is a root certificate, then the second certificate is deemed valid.

7. The method according to claim 5, characterized in that, If the installation control information also includes first account information, then verifying the validity of the installation control information further includes: Verify that at least one of the following items in the first account information is valid: Length, number range, character type.

8. The method according to claim 5 or 7, characterized in that, The first account information is determined based on the following steps: Obtain the original account information; The digest value of the original account information and the public salt of the app store is determined by a hash algorithm; The digest value is encrypted using the app store's asymmetric encryption public key to obtain the first account information.

9. The method according to claim 5 or 7, characterized in that, The first account information is determined based on the following steps: Obtain the original account information; The original account information is concatenated with the public salt of the app store to obtain the concatenation result; The concatenation result is processed using a digest algorithm to obtain the first account information.

10. The method according to claim 1, characterized in that, The release information also includes the first API version identification information of the first application; wherein, the first API version identification information is used to identify the API version information supported by the first terminal.

11. The method according to any one of claims 1-3, 5-7, and 10, characterized in that, After publishing the first application in the app store, the method further includes: In response to receiving a search request from a second terminal, the metadata information of each second application is matched with the search request information to obtain application matching results; wherein, the metadata information of the second application is data obtained by parsing the release information and application package of the second application; The application matching result is sent to the second terminal; The system receives a download request sent by the second terminal for the second application, wherein the download request carries at least a second certificate, which is used to verify whether the second terminal has permission to install the second application. Perform signature verification on the second certificate; In response to successful signature verification, the application package of the second application is sent to the second terminal.

12. The method according to claim 11, characterized in that, If the download request also carries first verification information, the public key of the first certificate, and the private key of the second certificate, then the signature verification of the second certificate includes: The first verification information is encrypted using the public key of the first certificate, and the ciphertext information is signed using the private key of the second certificate to generate the second verification information. The second verification information is encrypted using the private key of the first certificate, and the ciphertext information is signed using the public key of the second certificate to generate the third verification information. Verify whether the first verification information is consistent with the third verification information; If they match, then proceed with the step of sending the application package of the second application to the second terminal.

13. The method according to claim 12, characterized in that, The step of sending the application package of the second application to the second terminal in response to successful signature verification includes: If they match, the application package of the second application is encapsulated to obtain the first encapsulation result of the second application; The first encapsulation result is sent to the second terminal.

14. The method according to claim 13, characterized in that, If the metadata information of the second application includes terminal identification information, then the encapsulation of the application package of the second application to obtain the first encapsulation result of the second application includes: The application package of the second application is cyclically shifted to the right according to the terminal identification information and the third verification information to obtain the second encapsulation result of the second application. The terminal identification information of the second application is encrypted using the private key of the first certificate, and the ciphertext information is signed using the public key of the second certificate to obtain the first encapsulation result of the second application.

15. The method according to claim 13, characterized in that, The method further includes: In response to the detection that the download of the first encapsulation result has been completed, the STK module in the SIM card of the second terminal is scheduled to sign the first encryption key according to the public key of the first certificate to obtain the third signature information; The third signature information is encrypted using the private key of the second certificate to obtain the application decryption key and installation control information; The first packaging result is decrypted according to the application decryption key and the installation control information to obtain the application package to be installed, and the application package to be installed is written into the RAM of the second terminal.

16. The method according to claim 15, characterized in that, The method further includes: In response to the detection that the application package to be installed has been written, the application package to be installed is deleted from the memory RAM.

17. The method according to claim 11, characterized in that, If the metadata information of the second application includes basic application information, first API version identification information, and terminal identification information, then the metadata information of the second application is matched with the search request information respectively to obtain application matching results, including: The application basic information of the second application is matched with the keywords in the search request information, and the second application that matches the keywords is taken as the first matching result; The first API version identifier information is matched with the API version information supported by the second terminal, and the second application that matches the API version information supported by the second terminal in the first matching result is taken as the second matching result; The third account information of the second terminal is matched with the terminal identification information, and the second application that matches the third account information of the second terminal in the second matching result is taken as the application matching result.

18. The method according to claim 17, characterized in that, If the application's basic information includes the application's release date and application package name, then the step of using the second application that matches the third account information of the second terminal in the second matching result as the application matching result includes: The third matching results are grouped according to the application package names of each second application in the third matching results; For the second application in each group, sort them according to the application's release date, and take the second application with the largest release date as the application matching result.

19. The method according to claim 18, characterized in that, If the basic application information also includes application version information, then selecting the second application with the largest release date as the application matching result includes: If there are multiple second applications with the largest release date, the second application with the highest version will be used as the application matching result.

20. An application publishing device, characterized in that, The device includes: A receiving module is used to receive the release information and application package of the first application; wherein, the release information includes basic application information and installation control information, and the installation control information is used to indicate that the first terminal has the permission to install the first application; The verification module is used to perform signature verification on the basic information of the application using the first certificate from the app store. The determination module is used to determine the terminal identification information of the first terminal based on the installation control information in response to successful signature verification. The publishing module is used to publish the first application in the application store based on the terminal identification information, application basic information, and application package.

21. An electronic device, characterized in that, include: One or more processors; A storage device communicatively connected to the one or more processors, wherein one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method as described in any one of claims 1-19.

22. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-19.

23. A chip, characterized in that, The device includes one or more interface circuits and one or more processors; the interface circuits are configured to receive signals from the memory of the electronic device and send the signals to the processors, the signals including computer instructions stored in the memory, which, when executed by the processors, cause the electronic device to perform the method of any one of claims 1-19.

Images