Multi-application management and control method and device and storage medium
By employing a dual architecture design of main process and container process, precise control over enterprise applications is achieved, solving the data leakage problem under the single-process centralized processing architecture and providing secure isolation and protection for enterprise data.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHENZHEN LEAGSOFT TECH
- Filing Date
- 2026-01-07
- Publication Date
- 2026-05-12
AI Technical Summary
In existing technologies, the single-process centralized processing architecture poses a security risk of enterprise data leakage. The main process and business application processes are not effectively isolated, making them vulnerable to malicious attacks that could lead to data leakage.
The system employs a dual architecture design with a main process and container processes. The main process is responsible for event listening and initial distribution, while the container process executes control policies. By registering multiple listening events in the main process and forwarding the target listening event to the container process, the container process executes the corresponding control policies according to the first control policy mapping table, thereby achieving precise control of multiple applications.
It achieves interaction isolation and responsibility separation, blocks the spread path of malicious attacks, and provides reliable security for enterprise data.
Smart Images
Figure CN122020648A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of mobile terminal management, and in particular to a multi-application management method, device and storage medium. Background Technology
[0002] With the deepening of digital transformation and the widespread adoption of mobile office models, various enterprise-level applications have emerged in the market. These include OA systems, supply chain management software, and project management platforms. These applications have become core carriers supporting daily operations and improving work efficiency. Users can flexibly access different enterprise applications through terminal devices, efficiently completing tasks such as task approval, data entry, and cross-departmental collaboration. However, the diversification of enterprise applications and the complexity of access scenarios have also brought serious data security challenges. Enterprise applications involve the transmission and storage of sensitive data such as trade secrets, customer privacy, and internal configurations during operation. Data leaks, unauthorized access, or unauthorized application operations can cause significant economic losses and reputational risks to enterprises. Therefore, implementing real-time and precise monitoring and control of enterprise applications on the terminal side has become a core requirement for ensuring enterprise data security.
[0003] Currently, traditional enterprise application management solutions mostly adopt a single-process centralized processing architecture. Its core design logic is to integrate core functional modules such as event listening, policy decision-making, and control execution into the same main process on the client side.
[0004] However, this single-process centralized processing architecture presents significant security vulnerabilities in practical applications. The main process inevitably involves the interaction of sensitive data during policy execution. On one hand, it needs to read core configuration data from the enterprise mobility management (EMM) client, such as control policy parameters or enterprise security rules. On the other hand, it needs to directly transmit data with enterprise application processes. Because the main process and various business application processes run in the same environment without effective security isolation, a malicious attack on the main process can easily lead to enterprise data leakage, thereby triggering systemic security risks. Summary of the Invention
[0005] This application provides a multi-application management method, apparatus, computer device, and storage medium, aiming to solve the technical problem of enterprise data leakage caused by a single-process centralized processing architecture.
[0006] In a first aspect, embodiments of this application provide a multi-application management method, the method being applied to an enterprise mobile management client, the enterprise mobile management client including a main process and a container process, comprising: Register multiple listening events in the main process, including the target listening event; When the target listening event is received, the main process forwards the target listening event to the container process; The container process executes the control policy corresponding to the target listening event according to the first control policy mapping table to achieve multi-application control. The first control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
[0007] Optionally, when the target listening event is received, the main process forwards the target listening event to the container process, including: When the target listening event is received, the main process determines whether the target listening event needs to be intercepted; If the target listening event does not need to be intercepted, the main process forwards the target listening event to the container process.
[0008] Optionally, the method further includes: When the target listening event is received, the main process executes the control policy corresponding to the target listening event according to the second control policy mapping table. The second control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
[0009] Optionally, if the target monitoring event is a registered network change event, the container process executes the control policy corresponding to the target monitoring event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: disable the network proxy function and switch to the preset network tunnel.
[0010] Optionally, if the target listening event is a peripheral device plugging / unplugging event, the container process executes the control policy corresponding to the target listening event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: disable data cable debugging function, disable storage device mounting function, disable camera access permission, and disable microphone access permission.
[0011] Optionally, if the target monitoring event is a third-party behavior event, the container process executes the control policy corresponding to the target monitoring event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: disable screen recording function, disable sharing function, and disable clipboard function.
[0012] Optionally, if the target monitoring event is a top-level application change event, the container process executes the control policy corresponding to the target monitoring event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: generating or updating the visual watermark overlay of the front-end application interface and switching to the preset visitor mode.
[0013] Optionally, if the target listening event is an installation event, the container process executes the control policy corresponding to the target listening event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: prompting information about unauthorized applications and blocking the installation of unauthorized applications.
[0014] Secondly, embodiments of this application also provide a multi-application management device, which includes a unit for performing the above-described method.
[0015] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.
[0016] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.
[0017] This application provides a multi-application management method, apparatus, computer device, and storage medium. The method is applied to an enterprise mobile management client, which includes a main process and a container process. The method includes: registering multiple listening events in the main process, the multiple listening events including a target listening event; when the target listening event is received, the main process forwards the target listening event to the container process; the container process executes the management policy corresponding to the target listening event according to a first management policy mapping table to achieve multi-application management. The first management policy mapping table includes at least one listening event and at least one management policy, with each listening event corresponding to one management policy. Therefore, in this application's technical solution, multiple listening events are registered in the main process, including a target listening event. Then, when the target listening event is received, the main process forwards the target listening event to the container process. Finally, the container process executes the management policy corresponding to the target listening event according to the first management policy mapping table to achieve multi-application management. The first management policy mapping table includes at least one listening event and at least one management policy. Each listening event corresponds to one management policy. Therefore, the technical solution of this application adopts a dual architecture design of main process and container process. Specifically, the main process, as the sole interface carrier for external interfaces, is responsible for listening to and initially distributing global events. When the main process captures a target listening event, it immediately forwards the target listening event to an independent container process. Finally, the container process executes the control policy matching the target listening event according to the first control policy mapping table, thereby achieving precise control over multiple applications. This mechanism enables interaction isolation and division of responsibilities. The main process only undertakes event listening, interface interface, and forwarding functions, and does not participate in core policy execution or sensitive data processing. The container process, as an independent security domain, is specifically responsible for policy execution, effectively isolating direct interactions between various applications and the outside world. This design with clear boundaries of responsibilities blocks the propagation path of malicious attacks at the architectural level, providing reliable protection for enterprise data security. Attached Figure Description
[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0020] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.
[0021] Figure 1a A flowchart illustrating a multi-application management method provided in an embodiment of this application; Figure 1b This application provides a schematic diagram of a broadcast registration and deregistration process. Figure 2 A schematic block diagram of a multi-application control device provided in this application embodiment; Figure 3 A computer device provided in an embodiment of this application. Detailed Implementation
[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0023] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.
[0024] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0025] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0026] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0027] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."
[0028] To address the technical problem of enterprise data leakage caused by the single-process centralized processing architecture in the prior art, this application provides a multi-application management and control device that can prevent enterprise data leakage.
[0029] Figure 1a Figure b is a flowchart illustrating a multi-application management method provided in an embodiment of this application. Figure 1b This is a schematic diagram of a broadcast registration and deregistration process provided in an embodiment of this application. In one embodiment, the method is applied to an enterprise mobility management client, which includes a main process and a container process, and the method includes: S101-S103.
[0030] S101. Register multiple listener events in the main process.
[0031] Multiple listener events include the target listener event.
[0032] It should be noted that the Enterprise Mobile Management Client is used to manage multiple enterprise applications. These applications include, but are not limited to, OA systems, supply chain software, and project management platforms. The Enterprise Mobile Management Client consists of a main process and a container process. The main process implements control-level functions, including but not limited to policy distribution, network proxy, certificate verification, session establishment, and event broadcasting. The container process runs in a sandbox, isolated from the main process, and directly manages the multiple enterprise applications under its control. The container process also implements data-level functions, including but not limited to encrypted data storage, file or clipboard sharing, application whitelisting, access to sensitive interface data, and event re-filtering.
[0033] It should be noted that in this embodiment of the application, the corresponding event cancellation operation is performed when the main process exits.
[0034] S102. When a target listening event is received, the main process forwards the target listening event to the container process.
[0035] It should be noted that the main process notifies the container process of the target listening events through the IPC interface, so that the container process can execute the corresponding strategy.
[0036] S103. The container process executes the control policy corresponding to the target listening event according to the first control policy mapping table to achieve multi-application control.
[0037] The first control policy mapping table includes at least one monitoring event and at least one control policy. There is a one-to-one correspondence between the at least one monitoring event and the at least one control policy.
[0038] It should be noted that this embodiment uses different policies to manage multiple enterprise applications. In this embodiment, the management policy content corresponding to each listening event in the first management policy mapping table can be customized. When the container process interface reaches the target listening event, it can query the first management policy mapping table to obtain the policy corresponding to the target listening event and execute that policy.
[0039] This application provides a multi-application management method. The method is applied to an enterprise mobile management client, which includes a main process and a container process. The method includes: registering multiple listening events in the main process, the multiple listening events including a target listening event; when the target listening event is received, the main process forwards the target listening event to the container process; the container process executes the management policy corresponding to the target listening event according to a first management policy mapping table to achieve multi-application management. The first management policy mapping table includes at least one listening event and at least one management policy, with each listening event corresponding to one management policy. Therefore, in this application, multiple listening events are registered in the main process, including a target listening event. Then, when the target listening event is received, the main process forwards the target listening event to the container process. Finally, the container process executes the management policy corresponding to the target listening event according to the first management policy mapping table to achieve multi-application management. The first management policy mapping table includes at least one listening event and at least one management policy. Each listening event corresponds to one management policy. Therefore, the technical solution of this application adopts a dual architecture design of main process and container process. Specifically, the main process, as the sole interface carrier for external interfaces, is responsible for listening to and initially distributing global events. When the main process captures a target listening event, it immediately forwards the target listening event to an independent container process. Finally, the container process executes the control policy matching the target listening event according to the first control policy mapping table, thereby achieving precise control over multiple applications. This mechanism enables interaction isolation and division of responsibilities. The main process only undertakes event listening, interface interface, and forwarding functions, and does not participate in core policy execution or sensitive data processing. The container process, as an independent security domain, is specifically responsible for policy execution, effectively isolating direct interactions between various applications and the outside world. This design with clear boundaries of responsibilities blocks the propagation path of malicious attacks at the architectural level, providing reliable protection for enterprise data security.
[0040] In one embodiment, the above 102 specifically includes the following steps: S1021-S1022.
[0041] S1021. When a target listening event is received, the main process determines whether the target listening event needs to be intercepted.
[0042] In this embodiment, permissions are set for each listening event. For sensitive listening events, higher-level permissions are set so that only authorized applications can receive the listening event, effectively avoiding the risk of unauthorized injection.
[0043] S1022. If the target listening event does not need to be intercepted, the main process forwards the target listening event to the container process.
[0044] The main process forwards a target event to the container process only if the target event does not need to be intercepted. Otherwise, the main process discards the target event.
[0045] In one embodiment, before forwarding the target listening event to the container process, the main process needs to encapsulate the target listening event according to a preset standardized event format to generate a standardized target listening event. Finally, the main process forwards the standardized target listening event to the container process to trigger the container process to execute the corresponding strategy.
[0046] In one embodiment, the method further includes: S104.
[0047] S104. When a target listening event is received, the main process executes the control policy corresponding to the target listening event according to the second control policy mapping table.
[0048] The second control policy mapping table includes at least one monitoring event and at least one control policy. There is a one-to-one correspondence between the at least one monitoring event and the at least one control policy.
[0049] The second control strategy mapping table is the same as or similar to the first control strategy mapping table. This will not be elaborated further here.
[0050] It should be noted that, in this embodiment of the application, when a target monitoring event occurs, the main process executes the control policy corresponding to the target monitoring event according to the second control policy mapping table.
[0051] In one embodiment, if the target monitoring event is a registered network change event, then the above S103 specifically includes the following steps: S1031.
[0052] S1031. The container process performs at least one of the following operations according to the first management policy mapping table: disable the network proxy function and switch to the preset network tunnel.
[0053] Specifically, when a container process detects a registered network change event, it indicates that the current network may be at risk. In this case, it is necessary to disable the network proxy function or switch to the preset network tunnel to reduce the risk of attack.
[0054] In one embodiment, if the target listening event is a peripheral device plug-in / plug-out event, then the above S103 specifically includes the following steps: S1032.
[0055] S1032. The container process performs at least one of the following operations according to the first management policy mapping table: disable data cable debugging function, disable storage device mounting function, disable camera access permission, and disable microphone access permission.
[0056] It should be noted that when the target monitoring event is a peripheral device plug-in / unplug event, it indicates that an external device is connected to the system. These external devices include, but are not limited to, debugging tools, storage devices, cameras, and microphones. In this embodiment, to improve device security, it is necessary to disable data cable debugging, storage device mounting, camera access permissions, and microphone access permissions to prevent the system from being damaged by external attacks or sensitive data leakage.
[0057] In one embodiment, if the target listening event is a third-party behavior event, then the above S103 specifically includes the following steps: S1033.
[0058] S1033. The container process performs at least one of the following operations according to the first management policy mapping table: disable screen recording function, disable sharing function, and disable clipboard function.
[0059] The triggering methods for third-party behavioral events include, but are not limited to, screen recording, data sharing, and data copying. In this embodiment, upon receiving a third-party behavioral event, the screen recording function, sharing function, and clipboard function are disabled to prevent the leakage of sensitive data.
[0060] In one embodiment, if the target listening event is a top-level application change event, then the above S103 specifically includes the following steps: S1034.
[0061] S1034. The container process performs at least one of the following operations according to the first management policy mapping table: generating or updating the visual watermark overlay of the front-end application interface and switching to the preset guest mode.
[0062] The top-level application change event is triggered when the user switches the top-level application interface. When a target listener event is received, the container process generates or updates the visual watermark overlay on the foreground application interface and switches to the preset guest mode. The preset guest mode is a system operating mode set up by the applicant based on experience; in this mode, users cannot access sensitive data or perform sensitive operations.
[0063] In one embodiment, if the target listening event is an installation event, then the above S103 specifically includes the following steps: S1035.
[0064] S1035. The container process performs at least one of the following operations according to the first management policy mapping table: prompting information about unauthorized applications and blocking the installation of unauthorized applications.
[0065] The installation time refers to the event triggered when the system installs an application. In this embodiment, after receiving the installation event, the container process determines whether the application to be installed has permission to install. If not, it displays an unauthorized application message and blocks the installation of the unauthorized application, thereby preventing attackers from attacking the system through external applications.
[0066] In one embodiment, if the target listening event is a WIFI scan event, the container process obtains the WIFI scan result and uses the result for network access control (NAC) whitelist verification.
[0067] In one embodiment, the target monitoring event is a virtual machine instruction event. The virtual machine instruction event is triggered when the master process issues a policy command to the container process. The policy command includes, but is not limited to, a camera-opening command.
[0068] In one embodiment, if the target listening event is an audit reporting event, the container process reports the audit log to the server for subsequent tracing.
[0069] It should be noted that for the same monitored event, the main process and the container process can execute the same strategy or different strategies. This application does not impose any restrictions on this.
[0070] In one embodiment, if multiple listening events are triggered simultaneously, the container process can be notified in sequence according to the priority of the listening events, and / or the strategy corresponding to the listening events can be executed.
[0071] See Figure 2 , Figure 2 This is a schematic block diagram of a multi-application management device provided in an embodiment of this application. Corresponding to the above multi-application management method, this application also provides a multi-application management device. The multi-application management device includes a unit for executing the above multi-application management method, and can be configured in terminals such as desktop computers, tablet computers, and laptops. Specifically, the device is applied to an enterprise mobile management client, which includes a main process and a container process. The multi-application management device includes: Registration unit 201 is used to register multiple listening events in the main process, the multiple listening events including a target listening event; Forwarding unit 202 is used so that when the target listening event is received, the main process forwards the target listening event to the container process; The first execution unit 203 is used to execute the control policy corresponding to the target listening event according to the first control policy mapping table to realize multi-application control. The first control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
[0072] In one embodiment, the forwarding unit 202 is specifically used for: When the target listening event is received, the main process determines whether the target listening event needs to be intercepted; If the target listening event does not need to be intercepted, the main process forwards the target listening event to the container process.
[0073] In one embodiment, the device further includes: The second execution unit 204 is used to, when the target listening event is received, execute the control policy corresponding to the target listening event according to the second control policy mapping table, whereby the main process executes the control policy corresponding to the target listening event. The second control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
[0074] In one embodiment, if the target monitoring event is a registered network change event, the first execution unit 203 is specifically used for: The container process performs at least one of the following operations according to the first management policy mapping table: disable the network proxy function and switch to the preset network tunnel.
[0075] In one embodiment, if the target monitoring event is a peripheral device plug-in / plug-out event, the first execution unit 203 is specifically used for: The container process performs at least one of the following operations according to the first management policy mapping table: disable data cable debugging function, disable storage device mounting function, disable camera access permission, and disable microphone access permission.
[0076] In one embodiment, if the target monitoring event is a third-party behavior event, the first execution unit 203 is specifically used for: The container process performs at least one of the following operations according to the first management policy mapping table: disable screen recording function, disable sharing function, and disable clipboard function.
[0077] In one embodiment, if the target monitoring event is a top-level application change event, the first execution unit 203 is specifically used for: The container process performs at least one of the following operations according to the first management policy mapping table: generating or updating the visual watermark overlay of the front-end application interface and switching to the preset visitor mode.
[0078] In one embodiment, if the target listening event is an installation event, the first execution unit 203 is specifically used for: The container process performs at least one of the following operations according to the first management policy mapping table: prompting information about unauthorized applications and blocking the installation of unauthorized applications.
[0079] like Figure 3 As shown, this application provides a computer device including a processor 31, a communication interface 32, a memory 33, and a communication bus 34. The processor 31, the communication interface 32, and the memory 33 communicate with each other through the communication bus 34. The memory 33 is used to store computer programs. In one embodiment of this application, when the processor 31 executes the program stored in the memory 33, it implements the multi-application management control method provided in any of the foregoing method embodiments.
[0080] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.
[0081] Therefore, embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the multi-application management method provided in any of the foregoing method embodiments.
[0082] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.
[0083] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.
[0084] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
[0085] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0086] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.
[0087] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0088] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Since these modifications and variations fall within the scope of the claims and their equivalents, this application also intends to include these modifications and variations.
[0089] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A multi-application control method, characterized in that, The method is applied to an enterprise mobile management client, which includes a main process and a container process. The method includes: Register multiple listening events in the main process, including the target listening event; When the target listening event is received, the main process forwards the target listening event to the container process; The container process executes the control policy corresponding to the target listening event according to the first control policy mapping table to achieve multi-application control. The first control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
2. The method according to claim 1, characterized in that, When the target listening event is received, the main process forwards the target listening event to the container process, including: When the target listening event is received, the main process determines whether the target listening event needs to be intercepted; If the target listening event does not need to be intercepted, the main process forwards the target listening event to the container process.
3. The method according to claim 1, characterized in that, The method further includes: When the target listening event is received, the main process executes the control policy corresponding to the target listening event according to the second control policy mapping table. The second control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
4. The method according to claim 1, characterized in that, If the target listening event is a registered network change event, the container process executes the control policy corresponding to the target listening event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: disable the network proxy function and switch to the preset network tunnel.
5. The method according to claim 1, characterized in that, If the target listening event is a peripheral device plugging / unplugging event, the container process executes the control policy corresponding to the target listening event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: disable data cable debugging function, disable storage device mounting function, disable camera access permission, and disable microphone access permission.
6. The method according to claim 1, characterized in that, If the target monitoring event is a third-party behavior event, the container process executes the control policy corresponding to the target monitoring event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: disable screen recording function, disable sharing function, and disable clipboard function.
7. The method according to claim 1, characterized in that, If the target monitoring event is a top-level application change event, the container process executes the control policy corresponding to the target monitoring event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: generating or updating the visual watermark overlay of the front-end application interface and switching to the preset visitor mode.
8. The method according to claim 1, characterized in that, If the target listening event is an installation event, the container process executes the control policy corresponding to the target listening event according to the first control policy mapping table, including: The container process performs at least one of the following operations according to the first management policy mapping table: prompting information about unauthorized applications and blocking the installation of unauthorized applications.
9. A multi-application control device, characterized in that, The device is applied to an enterprise mobile management client, the enterprise mobile management client including a main process and a container process, and the device includes: A registration unit is used to register multiple listening events in the main process, the multiple listening events including a target listening event; A forwarding unit is used so that when the target listening event is received, the main process forwards the target listening event to the container process; The first execution unit is used to execute the control policy corresponding to the target listening event according to the first control policy mapping table to realize multi-application control. The first control policy mapping table includes at least one listening event and at least one control policy, and the at least one listening event corresponds one-to-one with the at least one control policy.
10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1 to 8.