Method, device and storage medium for processing an application

Abstract

This application discloses a method, apparatus, and storage medium for processing application programs, belonging to the field of computer science. The method is applied to a communication system, where the computing device of the communication system includes a first system function, a first application program, and a target process. The first system function is a function provided by the operating system of the computing device. In the method, a first call request is received from the target process, which runs the first application program. The first application program is obtained by replacing the system interface of the first system function included in a second application with a shadow interface. The shadow interface is used to indicate the first system function, and the first call request includes the shadow interface. The first system function is executed based on the shadow interface to obtain an execution result. The execution result is then returned to the target process. This application can improve the security of application programs.

Description

Technical Field

[0001] This application relates to the field of computers, and in particular to a method, apparatus, and storage medium for processing application programs. Background Technology

[0002] An application is a computer program designed to perform a specific function. Applications can run on computing devices, whose operating systems include at least one system function. During operation, applications can call system functions, and the computing device executes these called system functions to achieve the specific function.

[0003] After an application runs, attackers can exploit vulnerabilities to inject malicious code into it, thereby carrying out their attacks. For example, if malicious code is executed during application operation, it can call system functions, and the computing device can then execute these called functions to perform the attack. Related technologies can detect whether an application has been injected with malicious code, and if so, issue an alert.

[0004] In related technologies, application detection is very costly and difficult. Once an application starts running, attackers may inject malicious code at any time, making it impossible to effectively prevent malicious code attacks and reducing application security. Summary of the Invention

[0005] This application provides a method, apparatus, and storage medium for processing applications to improve application security. The technical solution is as follows:

[0006] In a first aspect, this application provides a method for processing an application, applied to a communication system. The computing device of the communication system includes a first system function, a first application, and a target process. The first system function is a function provided by the operating system of the computing device. In the method, a first invocation request is received from the target process. The target process runs the first application, which is a program obtained by replacing the system interface of the first system function included in a second application with a shadow interface. The shadow interface is used to indicate the first system function, and the first invocation request includes the shadow interface. The first system function is executed based on the shadow interface to obtain an execution result. The execution result is then returned to the target process.

[0007] Because the first application is obtained by replacing the system interface in the second application with a shadow interface, the first call request sent by the target process when the first application is running includes the shadow interface. Since the shadow interface is a newly defined interface and not exposed to hackers, upon receiving the first call request including the shadow interface, it can be deduced that the first call request was sent by the target process running the first application's program code. The execution result is then obtained by executing the first system function based on the shadow interface. Thus, upon receiving a call request, it is possible to detect whether it was sent by the target process running the first application's program code. Only if it was sent by the target process running the first application's program code will the first system function be executed, effectively preventing malicious code attacks and protecting the application, thereby improving its security.

[0008] In one possible implementation, a second call request is sent to the operating system based on the shadow interface. This second call request requests the operating system to execute the first system function and obtain the execution result. This intercepts the first call request sent by the target process. Since the shadow interface is not exposed to hackers, and the first call request includes the shadow interface, it can be deduced that the first call request was sent by the target process running the program code of the first application. Therefore, a second call request is sent to the operating system based on the shadow interface, causing the operating system to execute the first system function. This can prevent the execution of malicious code attacks, protect the application, and improve application security.

[0009] In another possible implementation, the computing device further includes a protection module; the protection module intercepts a first call request sent by the target process; if the first call request includes a shadow interface, the protection module determines that the first call request is a request from the program code of a first application and sends a second call request to the operating system. Since the protection module can intercept the first call request sent by the target process and determine whether the first call request is a request from the program code of the first application by detecting whether the first call request includes a shadow interface, when the first call request is a request from the program code of the first application, the second call request is sent to the operating system, causing the operating system to execute a first system function. This can prevent the execution of malicious code attack operations, achieving real-time protection of the application and improving application security.

[0010] In another possible implementation, the first call request also includes the identification information of the first application. Based on the identification information of the first application and the shadow interface, a second call request is sent to the operating system. The identification information of the first application is used to identify whether the first application is a protected program. This allows for targeted protection of protected applications, saving resources needed for protection and reducing costs.

[0011] In another possible implementation, the first call request also includes parameter information for the first system function, and the second call request is used to request the operating system to execute the first system function based on the parameter information to obtain a first execution result. This ensures that the first system function is executed correctly and an accurate first execution result is obtained.

[0012] In another possible implementation, the first system function includes a first dynamic library function, the shadow interface includes a dynamic library shadow interface for indicating the first dynamic library function, and the system interface includes the dynamic library interface of the first dynamic library function.

[0013] In another possible implementation, the computing device includes the memory space of a first application, which contains a first dynamic library function and a mapping between dynamic library interfaces and dynamic library shadow interfaces. Based on the dynamic library shadow interface, the dynamic library interface is retrieved from this mapping. Based on the dynamic library interface, the first dynamic library function is executed to obtain the execution result. In this way, by using the mapping in the memory space, the dynamic library interface corresponding to the dynamic library shadow interface can be found, and the first dynamic library function to be called can be found based on the dynamic library interface, ensuring successful execution of the first dynamic library function.

[0014] In another possible implementation, a first dynamic library function calls a kernel interface, which in turn indicates a kernel system call function. Replacing the kernel interface called by the first dynamic library function with a kernel shadow interface yields a second dynamic library function, which in turn indicates a kernel system call function. The second dynamic library function is then executed based on its dynamic library interface. Finally, the kernel system call function is executed based on the kernel shadow interface called by the second dynamic library function, yielding the execution result.

[0015] By replacing the kernel interface for the first dynamic library function call with a kernel shadow interface, when the first application needs to call kernel system call functions, these calls will be made through the kernel shadow interface. Since the kernel shadow interface is not exposed to hackers, calling kernel system call functions through it improves security.

[0016] In another possible implementation, the first system function includes a kernel system call function, the shadow interface includes a kernel shadow interface for indicating the kernel system call function, and the system interface includes the kernel interface of the kernel system call function.

[0017] In another possible implementation, the computing device further includes a first correspondence between kernel interfaces and the identification information of kernel system call functions. This first correspondence is replaced with a second correspondence between kernel shadow interfaces and the identification information of kernel system call functions. Based on the kernel shadow interface and the second correspondence, the identification information of the kernel system call functions is obtained. The kernel system call function corresponding to this identification information is executed to obtain the execution result.

[0018] In this way, the identification information of the kernel system call function corresponding to the kernel shadow interface can be found through the second correspondence, and the called kernel system call function can be found based on the identification information, ensuring that the kernel system call function can be executed successfully.

[0019] In another possible implementation, the computing device further includes a second system function. The first application includes malicious code, which includes a system interface for instructing the second system function. A third invocation request is received from the target process. This third invocation request includes the system interface of the second system function, and is a request sent by the target process running the malicious code. The execution of the second system function is prevented based on its system interface.

[0020] After the first application runs, if a hacker injects malicious code into it, because the hacker is unaware of the shadow interface's existence, the malicious code, including system interfaces, will not include the shadow interface in the third-party call requests sent by the target process when executing the malicious code. Since the execution of the second system function depends on the shadow interface, the second system function will not be executed for the malicious code. This effectively prevents the execution of malicious code attacks, achieving real-time application protection and improving application security.

[0021] In another possible implementation, if a third-party call request includes a system interface, the request is determined to be malicious and the execution of the second system function is blocked. This approach, by detecting the system interface included in the third-party call request, can identify malicious code and prevent its execution, thus improving application security.

[0022] Secondly, this application provides an apparatus for processing an application, used to perform the method in the first aspect or any possible implementation thereof. Specifically, the apparatus includes units for performing the method in the first aspect or any possible implementation thereof.

[0023] Thirdly, this application provides a computing device including a processor and a memory; the processor is configured to execute instructions stored in the memory to cause the computing device to perform the method of the first aspect or any possible implementation thereof.

[0024] Fourthly, this application provides a computing device cluster, the computing device cluster including at least one computing device, each computing device including a processor and a memory;

[0025] The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device to perform the method in the first aspect or any possible implementation thereof.

[0026] Fifthly, this application provides a computer program product containing instructions that, when executed by a computing device, cause the computing device to perform the method of the first aspect or any possible implementation thereof.

[0027] In a sixth aspect, this application provides a computer-readable storage medium including computer program instructions, which, when executed by a computing device, perform the method of the first aspect or any possible implementation thereof.

[0028] In a seventh aspect, this application provides a chip including a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to perform the method in the first aspect or any possible implementation thereof. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the structure of a communication system provided in an embodiment of this application;

[0030] Figure 2 This is a schematic diagram of another communication system provided in an embodiment of this application;

[0031] Figure 3 This is a flowchart of a method for processing an application provided in an embodiment of this application;

[0032] Figure 4 This is a flowchart of another method for processing an application provided in an embodiment of this application;

[0033] Figure 5 This is a flowchart of another method for processing an application provided in an embodiment of this application;

[0034] Figure 6 This is a flowchart of another method for processing an application provided in an embodiment of this application;

[0035] Figure 7 This is a flowchart of another method for processing an application provided in an embodiment of this application;

[0036] Figure 8 This is a flowchart of another method for processing an application provided in an embodiment of this application;

[0037] Figure 9 This is a schematic diagram of a device structure for processing an application provided in an embodiment of this application;

[0038] Figure 10 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0039] Figure 11 This is a schematic diagram of a cluster structure for processing applications provided in an embodiment of this application;

[0040] Figure 12 This is a schematic diagram of another cluster structure for processing applications provided in this application embodiment. Detailed Implementation

[0041] The operating system of a computing device includes system functions. The operating system of a computing device uses system interfaces to indicate system functions. System functions are functions provided by the operating system of the computing device, and system interfaces are standard interfaces used to indicate system functions.

[0042] A computing device includes an application to be run. During the running of the application, the application can call system functions. The operating system of the computing device executes the system function and returns the execution result to the application to realize the function of the application.

[0043] For example, the operating system of a computing device includes a system function 1 for creating files. When an application is running, it may need to create a file. The application can send a call request, which includes system interface 1, which instructs system function 1. The operating system of the computing device receives the call request, determines the system function 1 indicated by system interface 1 based on system interface 1, and executes system function 1 to create the file, returning the created file to the application.

[0044] Optionally, the operating system of the computing device may also include file names and / or file types that system function 1 can create, such as creating a file with the name of that file and the type of that file.

[0045] For example, the operating system of a computing device includes a system function 2 for deleting files. When an application is running, it may need to delete a file. The application can send a request to delete the file, which includes system interface 2. System interface 2 is used to instruct system function 2. The operating system of the computing device receives request 2, determines system function 2 based on system interface 2, and executes system function 2 to delete the file, returning a successful deletion response to the application.

[0046] In some embodiments, the system interface used to indicate a system function may include the address of the system function and / or the name of the system function, etc.

[0047] In some embodiments, system functions in the operating system of a computing device include dynamic library functions and / or kernel system call functions. System interfaces used to indicate system functions include dynamic library interfaces and / or kernel interfaces; the dynamic library interface indicates dynamic library functions, and the kernel interface indicates kernel system call functions.

[0048] In some embodiments, the system interface of a system function may include one or more of the following:

[0049] Process interfaces, for example, can be execution interfaces (execve) or fork, where fork represents a creation interface;

[0050] File interfaces, for example, can be open, read, write, or close;

[0051] Memory interface, for example, a memory interface could be mmap, where mmap stands for memory mapping; or,

[0052] Network interfaces, for example, can be sockets, connects, or binds, where a socket indicates the creation of a connection socket.

[0053] In some embodiments, when a computing device runs an application, it allocates memory space for the application, loads the application's code into the memory space, and the application's code includes call statements for invoking system functions. These call statements include system interfaces for instructing the system functions. For ease of explanation, this call statement is referred to as a first call statement for invoking a first system function, and the first call statement includes a first system interface for instructing the first system function. A target process is then created, and the target process runs the application's code stored in the memory space to execute the application.

[0054] When the target process reaches the first call statement used to invoke the first system function, it sends a call request 1, including the first system interface, to the operating system of the computing device. The operating system of the computing device receives the call request 1, determines the first system function based on the first system interface included in the call request 1, and executes the first system function.

[0055] The application may contain a vulnerability that hackers could exploit to inject malicious code into the application's code stored in memory. This malicious code includes a call statement that invokes a second system function. For clarity, this call statement in the malicious code will be referred to as a second call statement including a second system interface. The second system interface instructs the malicious code to perform its attack through the second system function indicated by the second system interface.

[0056] In this way, the target process executes the malicious code while the application is running. When it reaches the second call statement included in the malicious code, it sends a call request 2, which includes a second system interface, to the operating system of the computing device. The operating system of the computing device receives the call request 2, determines the second system function based on the second system interface included in the call request 2, and executes the second system function, thereby executing the attack operation implemented by the malicious code. Optionally, the first system function and the second system function may be the same or different.

[0057] During application runtime, hackers can inject malicious code into the application's code, causing the malicious code to execute and perform attack operations, resulting in low application security. To improve application security, any of the following embodiments can be used to address the issue.

[0058] See Figure 1 This application provides a communication system 100, which includes a compilation device 101 and a computing device 102. The computing device 102 can be used to run a first application program, which is a program obtained by replacing the system interfaces of system functions in a second application with shadow interfaces.

[0059] The compilation device 101 includes a compiler, which includes a source code instrumentation module, a dynamic library protection module, and a mapping between system interfaces and shadow interfaces. The operating system of the computing device 102 includes at least one system function, and the mapping between system interfaces and shadow interfaces is used to store the mapping between the system interface and shadow interface of each of the at least one system function.

[0060] For each system function, there is a system interface used to indicate that system function. This system interface is a standard interface used to indicate the system function in the operating system of the computing device 102. In this embodiment, a shadow interface is also defined, and this shadow interface is also defined to indicate the system function. Therefore, the interface used to indicate the system function includes the system interface and the shadow interface. The shadow interface is a custom interface defined in this application; it is a private interface and will not be exposed externally. The shadow interface is different from the system interface, but has the same function: both are used to indicate system functions.

[0061] The source code instrumentation module is used to obtain the second application, add a dynamic library protection module to the second application, establish the mapping between system interfaces and shadow interfaces, and replace the system interfaces of system functions in the second application with shadow interfaces to obtain the first application. Therefore, the first application includes program code, the dynamic library protection module, and the mapping between system interfaces and shadow interfaces. This program code is used to implement the functionality of the first application.

[0062] In some embodiments, at least one system function includes at least one dynamic library function and / or at least one kernel system call function.

[0063] The first application includes a shadow interface for dynamic library functions. When the target process of the first application runs using the computing device 102, the target process sends a call request including the shadow interface when running the shadow interface of the dynamic library functions in the first application.

[0064] The dynamic library protection module is used to intercept the call request. When the call request includes the shadow interface, it determines that the call request was sent by the target process when running the program code of the first application. Based on the shadow interface, it obtains the corresponding system interface from the correspondence between the system interface and the shadow interface, and executes the dynamic library function indicated by the system interface.

[0065] See Figure 2 The operating system of computing device 102 includes dynamic libraries, which include at least one dynamic library function as described above. For each dynamic library function, the dynamic library function includes a dynamic library interface for indicating the dynamic library function.

[0066] The dynamic library interface is a standard interface used in the operating system of the computing device 102 to indicate the dynamic library function. This embodiment defines a dynamic library shadow interface, which is also used to indicate the dynamic library function. Therefore, the interfaces used to indicate the dynamic library function include the dynamic library interface and the dynamic library shadow interface.

[0067] The correspondence between system interfaces and shadow interfaces includes the correspondence between the dynamic library interface and the dynamic library shadow interface of each dynamic library function.

[0068] See Figure 2 The operating system of computing device 102 further includes a kernel protection module and a first correspondence relationship. At least one system function includes the aforementioned at least one kernel system call function. The first correspondence relationship is used to store the correspondence between the kernel interface and identification information of the kernel system call function. The kernel protection module is a new module added to the operating system of computing device 102 in this embodiment of the application.

[0069] The kernel protection module is used to replace the first correspondence with the second correspondence, which is used to store the correspondence between the shadow interface and the identification information of the kernel system call function.

[0070] The first application includes a shadow interface for kernel system call functions. When the target process runs the first application, the target process sends a call request that includes the shadow interface when running the shadow interface for the kernel system call functions in the first application.

[0071] The kernel protection module is also used to intercept the call request, and when the call request includes the shadow interface, it determines that the call request was sent when the target process runs the program code of the first application. Based on the shadow interface, it obtains the identification information of the kernel system call function from the second correspondence and executes the kernel system call function indicated by the identification information.

[0072] For each kernel system call function, there is a corresponding kernel interface that indicates that kernel system call function.

[0073] The kernel interface is a standard interface used in the operating system of computing device 102 to indicate the kernel system call function. This application embodiment also defines a kernel shadow interface, and defines the kernel shadow interface for indicating the kernel system call function. Therefore, the interfaces used to indicate the kernel system call function include the kernel interface and the kernel shadow interface.

[0074] The correspondence between system interfaces and shadow interfaces also includes the correspondence between the kernel interface and the kernel shadow interface of each kernel system call function.

[0075] The first correspondence is used to store the correspondence between the kernel interface and the identification information of the kernel system call function. That is, the first correspondence is used to store the kernel interface and identification information of each kernel system call function. The identification information of each kernel system call function is used to identify each kernel system call function.

[0076] In some embodiments, a dynamic library may contain some dynamic library functions that may need to call a kernel system call function. These dynamic library functions include a kernel interface, and when the dynamic library function runs to that kernel interface, it can call the kernel system call function indicated by that kernel interface.

[0077] For the second application that needs to be run, the program code of the second application includes a first call statement, the first call statement includes a system interface, the system interface includes a dynamic library interface and / or a kernel interface, that is, the second application needs to call the dynamic library function indicated by the dynamic library interface and / or needs to call the kernel system call function indicated by the kernel interface.

[0078] In some embodiments, the program code of the second application includes a first call statement. Optionally, the first call statement may include first call statement 1 and / or first call statement 2, where first call statement 1 is used to call a dynamic library function, and first call statement 2 is used to call a kernel system call function.

[0079] After obtaining the second application, the compilation device 101 uses a compiler to compile the second application.

[0080] During the compilation of the second application, the compiler of compilation device 101 includes a source code instrumentation module that can add dynamic library protection modules to the second application, as well as the mapping between system interfaces and shadow interfaces. Furthermore,

[0081] For the first call statement in the program code of the second application, which includes a system interface, a shadow interface corresponding to the system interface is obtained from the correspondence between system interfaces and shadow interfaces. Both the system interface and the shadow interface refer to the same system function. The first call statement in the program code of the second application is replaced with a third call statement, which includes the shadow interface, to obtain the first application. Thus, the first application includes the third call statement, the dynamic library protection module, and the correspondence between system interfaces and shadow interfaces. The second application includes the system interface of the system function; the first application is the program obtained by replacing the system interface in the second application with the shadow interface.

[0082] In some embodiments, the first calling statement can be a first calling statement 1 that includes a dynamic library interface. Thus, the source code instrumentation module included in the compiler 101, based on the dynamic library interface, obtains the dynamic library shadow interface corresponding to the dynamic library interface from the correspondence between system interfaces and shadow interfaces. The dynamic library interface and the dynamic library shadow interface are used to indicate the same dynamic library function. The first calling statement 1 in the program code of the second application is replaced with a third calling statement 1, which includes the dynamic library shadow interface.

[0083] In some embodiments, the first call statement can be a first call statement 2 that includes a kernel interface. Thus, the source code instrumentation module included in the compiler 101, based on this kernel interface, obtains the kernel shadow interface corresponding to the kernel interface from the correspondence between system interfaces and shadow interfaces. The kernel interface and the kernel shadow interface are used to indicate the same kernel system call function. The first call statement 2 in the program code of the second application is replaced with a third call statement 2, which includes the kernel shadow interface.

[0084] In some embodiments, a user can configure the identification information of a protected application to the compilation device 101. When the compilation device 101 determines that a second application is a protected application based on the identification information, it compiles the second application into a first application in the manner described above. That is, the system interfaces in the protected application are replaced with shadow interfaces, while the system interfaces in the unprotected application are not replaced with shadow interfaces.

[0085] Optionally, users can configure applications with higher security requirements as protected applications.

[0086] After obtaining the first application, when it needs to be run, the computing device 102 can allocate a first memory space and a second memory space for the first application. The code of the first application is loaded into the first memory space, and the dynamic library protection module included in the first application, at least one dynamic library function included in the dynamic library, and the correspondence between the system interface and the shadow interface are loaded into the second memory space. The computing device 102 starts the target process to run the first application in the first memory space, and the computing device 102 starts the dynamic library protection module in the second memory space to begin running.

[0087] The computing device 102 also updates the first correspondence in the operating system to a second correspondence, that is, replacing the kernel interface with the kernel shadow interface. The second correspondence is used to store the correspondence between the shadow interface and the identification information of each kernel system call function. Then the computing device 102 starts the kernel protection module in the operating system and makes the kernel protection module run.

[0088] Optionally, the second correspondence is used to store the correspondence between the kernel interface, kernel shadow interface, and identification information of each kernel system call function. Thus, for unprotected applications, since the kernel interface in the unprotected application is not replaced with the kernel shadow interface, when running the unprotected application, the kernel system call function indicated by the kernel interface can be run based on the kernel interface and the second correspondence.

[0089] The third call statement in the program code of the first application includes a shadow interface. When the target process runs to the third call statement, it will send a first call request, which includes the shadow interface.

[0090] In some embodiments, for a third call statement 1 in the first application that includes a dynamic library shadow interface, the target process sends a first call request 1 when it runs the third call statement 1. The first call request 1 includes the dynamic library shadow interface.

[0091] The dynamic library protection module can intercept the first call request 1. Based on the dynamic library shadow interface included in the first call request 1, it can be deduced that the first call request 1 was sent by the target process when running the first application. Based on the dynamic library shadow interface, the dynamic library interface is obtained from the correspondence between system interfaces and shadow interfaces stored in the second memory space, and a second call request 1, which includes the dynamic library interface, is sent to the operating system. Based on the dynamic library interface included in the second call request 1, the operating system obtains the dynamic library function indicated by the dynamic library interface from the second memory space, executes the dynamic library function, obtains the execution result, and returns the execution result to the dynamic library protection module. The dynamic library protection module receives the execution result and returns it to the target process. The target process receives the execution result and continues to run the first application based on it.

[0092] In some embodiments, the program code of the first application includes a third call statement 2 that calls the kernel shadow interface. When the target process runs to the third call statement 2, it sends a first call request 2, which includes the kernel shadow interface.

[0093] The kernel protection module can intercept the first call request 2. Based on the kernel shadow interface included in the first call request 2, it can determine that the first call request 2 was sent by the target process when running the first application, and then send a second call request 2 to the operating system. Optionally, the first call request 2 and the second call request 2 can be the same. The operating system, based on the kernel shadow interface included in the second call request 2, obtains the identification information of the kernel system call function indicated by the kernel shadow interface from the second correspondence; based on the identification information of the kernel system call function, it obtains the kernel system call function, executes the kernel system call function to obtain the execution result, and returns the execution result to the kernel protection module. The kernel protection module receives the execution result and returns it to the target process. The target process receives the execution result and continues to run the first application based on the execution result.

[0094] A hacker might inject malicious code into a first application running in the first memory space. This would cause the first application to include not only program code, dynamic library protection modules, and the mapping between system interfaces and shadow interfaces, but also the malicious code. The malicious code includes a second call statement, which includes the system interface but not the corresponding shadow interface. This second call statement is used to invoke a second system function indicated by that system interface. For example, the malicious code might include a second call statement 1 and / or a second call statement 2. Second call statement 1 includes a dynamic library interface for invoking dynamic library functions. Second call statement 2 includes a kernel interface for invoking kernel system call functions.

[0095] In some embodiments, when the target process executes a second call statement 1 that includes a dynamic library interface in malicious code, it will send a third call request 1, which includes the dynamic library interface.

[0096] The dynamic library protection module can intercept third call request 1. Based on the dynamic library interface included in third call request 1, it can be deduced that third call request 1 was sent when the target process was running malicious code. By discarding third call request 1, the execution of the dynamic library function indicated by the dynamic library interface is prevented, thus preventing the malicious code's attack operation and improving the security of the first application.

[0097] In some embodiments, when the target process executes a second call statement 2 that includes a kernel interface in malicious code, it sends a third call request 2 that includes the kernel interface.

[0098] The kernel protection module can intercept third call request 2. Based on the kernel interface included in third call request 2, it can be deduced that third call request 2 was sent when the target process was running malicious code. Discarding third call request 2 prevents the execution of the kernel system call function indicated by the kernel interface, thus preventing the malicious code's attack operation and improving the security of the first application.

[0099] In some embodiments, the compilation device 101 may be a server or a terminal device, and the computing device 102 may be a server or a terminal device, etc. Optionally, the compilation device 101 and the computing device 102 may be devices in a cloud service platform, such as servers in a cloud service platform. Optionally, the compilation device 101 and the computing device 102 may be the same device or different devices.

[0100] See Figure 3 This application provides a method 300 for processing applications, the method 300 being applied to... Figure 1The method 300, which includes the following steps, is the communication system 100 shown in Figure 2.

[0101] Step 301: Compile the device to obtain a second application, which includes a system interface that indicates system functions, which are functions provided by the operating system of the computing device.

[0102] The compilation device can receive a second application. Optionally, the second application may be written by a technician. When the technician needs the compilation device to compile the second application, he / she can input the second application into the compilation device, and then the compilation device will receive the second application.

[0103] The program code of the second application includes a first call statement, which includes a system interface. The first call statement is used to call the system function indicated by the system interface, thereby requiring the second application to call the system function.

[0104] In some embodiments, the system function includes a dynamic library function, and the system interface indicating the system function includes a dynamic library interface, which in turn indicates the dynamic library function. A second application may need to call the dynamic library function; that is, the program code of the second application may include a first call statement 1, which includes the dynamic library interface, enabling the first call statement 1 to call the dynamic library function.

[0105] In some embodiments, the system function includes a kernel system call function, and the system interface used to indicate the system function includes a kernel interface, which is used to indicate the kernel system call function. A second application may need to call the kernel system call function; that is, the program code of the second application may include a first call statement 2, which includes the kernel interface, so that the first call statement 2 is used to call the kernel system call function.

[0106] Step 302: The compilation device replaces the system interface in the second application with a shadow interface to obtain the first application, which is used to indicate the system function.

[0107] The compilation device includes the correspondence between the system interface and the shadow interface.

[0108] In some embodiments, the compilation device includes user-configured identification information of a protected application. Based on this identification information, the compilation device determines whether a second application is a protected application. If the second application is a protected application, the system interface in the second application is replaced with a shadow interface. If the second application is not a protected application, the system interface in the second application is not replaced with a shadow interface.

[0109] In step 302, after receiving the second application, the compilation device compiles the second application. During the compilation process, if a first call statement including a system interface is encountered, the system interface is obtained from the first call statement. Based on the system interface, the shadow interface corresponding to the system interface is obtained from the correspondence between system interfaces and shadow interfaces. A third call statement is generated, which includes the shadow interface. The first call statement in the program code of the second application is replaced with the third call statement to obtain the first application.

[0110] Alternatively, the compilation device can directly replace the system interface in the first call statement with the shadow interface, making the first call statement a third call statement that includes the shadow interface, thereby obtaining the first application.

[0111] In some embodiments, the first calling statement is a first calling statement 1 that includes a dynamic library interface, and the system function includes the dynamic library function indicated by the dynamic library interface. Based on the dynamic library interface, the compilation device obtains the shadow interface corresponding to the dynamic library interface from the correspondence between system interfaces and shadow interfaces; this shadow interface is a dynamic library shadow interface. A third calling statement 1 is generated, which includes the dynamic library shadow interface, and the first calling statement 1 in the program code of the second application is replaced with the third calling statement 1. Alternatively, the third calling statement 1 is obtained by replacing the dynamic library interface included in the first calling statement 1 with the dynamic library shadow interface.

[0112] In some embodiments, the first call statement is a first call statement 2 that includes a kernel interface, and the system function includes a kernel system call function indicated by the kernel interface. The compilation device, based on this kernel interface, obtains the shadow interface corresponding to the kernel interface from the correspondence between system interfaces and shadow interfaces; this shadow interface is a kernel shadow interface. A third call statement 2 is generated, which includes the kernel shadow interface, and the first call statement 2 in the program code of the second application is replaced with the third call statement 2. Alternatively, the kernel interface included in the first call statement 2 is replaced with the kernel shadow interface to obtain the third call statement 2.

[0113] In some embodiments, the compilation device includes a dynamic library protection module. When compiling the second application, the dynamic library protection module can also be added to the first application, meaning the first application includes the dynamic library protection module. And / or, when compiling the second application, the mapping between system interfaces and shadow interfaces can also be added to the first application, meaning the first application includes the mapping between system interfaces and shadow interfaces.

[0114] In some embodiments, see Figure 1 or Figure 2 The compilation equipment includes a compiler, which includes a source code instrumentation module, a dynamic library protection module, and the correspondence between system interfaces and shadow interfaces.

[0115] After the compilation device receives the second application, the source code instrumentation module in the compiler can add the dynamic library protection module and the mapping between system interfaces and shadow interfaces to the second application. The compiler compiles the second application. For the first call statement in the program code of the second application that includes the system interface, based on the system interface, it obtains the shadow interface corresponding to the system interface from the mapping between system interfaces and shadow interfaces. The first call statement in the program code of the second application is replaced with a third call statement, which includes the shadow interface, to obtain the first application; or, the system interface included in the first call statement is replaced with the shadow interface, to obtain the first application, and the program code of the first application includes the replaced third call statement. In other words, the first application includes program code, the dynamic library protection module, and the mapping between system interfaces and shadow interfaces, and the program code includes the third call statement.

[0116] In some embodiments, a technician may replace the system interface in the second application with the shadow interface corresponding to the system interface to obtain the first application, and then use a computing device to run the first application; that is, the specific method of replacement is not limited.

[0117] Step 303: The computing device obtains the first application compiled by the compilation device.

[0118] In some embodiments, during the deployment phase, a first application obtained from the compilation device is input into the computing device.

[0119] For example, when manufacturing a computing device, a first application obtained from the compilation device can be acquired and input into the computing device.

[0120] In some embodiments, the compilation device may establish a connection with the computing device and send a first application to the computing device through the connection.

[0121] Alternatively, the connection can be wireless or wired. For example, the compiler and the computing device may be connected by optical fiber, which can be an optical connection, such as a passive optical network (PON) connection.

[0122] Optionally, if the compilation device and the computing device are the same device, step 303 is not required, and the first application can be run directly through the following process.

[0123] In some embodiments, a first application, compiled by the device, is uploaded to an app store. The computing device can then download the first application from the app store.

[0124] Step 304: The computing device runs the first application using the target process.

[0125] In step 304, the computing device allocates a first memory space and a second memory space for the first application. It loads the application's code into the first memory space, loads the dynamic library protection module included in the first application, and the mapping between the system interface and the shadow interface into the second memory space, and loads the dynamic libraries from the computing device's operating system into the second memory space. The computing device starts the target process and uses it to run the application's code in the first memory space. The computing device also starts the dynamic library protection module in the second memory space and the kernel protection module in the operating system, causing them to begin running.

[0126] Optionally, the first memory space and the second memory space may be two contiguous memory spaces or two non-contiguous memory spaces. The program code of the first application is the part of the first application excluding the dynamic library protection module and the correspondence between the system interface and the shadow interface.

[0127] In some embodiments, some dynamic library functions in the dynamic library include kernel interfaces, meaning that the dynamic library function needs to call the kernel system call function indicated by the kernel interface. After loading the dynamic library into the second memory space, for the dynamic library functions that include the kernel interface, the kernel shadow interface corresponding to the kernel interface is obtained from the correspondence between system interfaces and shadow interfaces based on the kernel interface. In the second memory space, the kernel interface included in the dynamic library function is replaced with the kernel shadow interface.

[0128] In some embodiments, the operating system of the computing device includes a first correspondence and at least one kernel system call function. The first correspondence is used to store the correspondence between the kernel interface and identification information of each kernel system call function. The computing device may also replace the first correspondence with a second correspondence, which is used to store the correspondence between the kernel shadow interface and identification information of each kernel system call function, or the second correspondence is used to store the correspondence between the kernel interface, kernel shadow interface, and identification information of each kernel system call function.

[0129] The second correspondence is derived from the correspondence between system interfaces and shadow interfaces. In implementation, for each kernel system call function in the operating system of the computing device, the corresponding kernel shadow interface is obtained from the correspondence between system interfaces and shadow interfaces based on the kernel interface of that kernel system call function. The kernel shadow interface and the identification information of that kernel system call function are stored in the second correspondence; alternatively, the kernel interface, the kernel shadow interface, and the identification information of that kernel system call function are stored in the second correspondence.

[0130] The process begins by launching the target process, which then runs the first application. The first application's code includes a third call statement, which contains a shadow interface. This third call statement invokes a first system function indicated by the shadow interface. When the target process reaches the third call statement, it sends a first call request. This first call request includes the shadow interface and the identification information of the first application. The identification information of the first application is identical to that of the second application. The first call request is sent by the target process when running the first application to request the invocation of the first system function.

[0131] Optionally, the first call request may also include parameter information for the first system function.

[0132] For example, this parameter information might include verification information. Another example is that the first system function is system function 1 used to create files, and its parameter information might include the filename and / or file type that system function 1 can create. Yet another example is that the first system function is system function 2 used to delete files, and its parameter information might include the filename of the file to be deleted.

[0133] Optionally, the operating system of the computing device may also include file names and / or file types that system function 1 can create.

[0134] In some embodiments, the program code of the first application includes a third call statement 1, which includes a dynamic library shadow interface. When the target process reaches the third call statement 1, it sends a first call request 1, which includes the dynamic library shadow interface and the identification information of the first application. The first system function includes a dynamic library function indicated by the dynamic library shadow interface. This dynamic library function may be a first dynamic library function that does not include a kernel shadow interface, or it may be a second dynamic library function that includes a kernel shadow interface.

[0135] In some embodiments, the program code of the first application includes a third call statement 2, the third call statement 2 includes a kernel shadow interface, and when the target process runs to the third call statement 2, it sends a first call request 2, the first call request 2 including the kernel shadow interface and the identification information of the first application.

[0136] Step 305: The computing device receives a first call request sent by the target process, the first call request including the shadow interface.

[0137] In step 305, the computing device includes a protection module (dynamic library protection module and / or kernel protection module). The protection module intercepts the first call request sent by the target process. Based on the shadow interface included in the first call request, it can be determined that the first call request was sent by the target process when running the program code of the first application. The protection module then sends a second call request to the operating system of the computing device. The second call request is used to request the operating system of the computing device to execute the first system function to obtain the first execution result.

[0138] In some embodiments, the first invocation request further includes parameter information of the first system function, and the second invocation request also includes the parameter information. The second invocation request is used to request the operating system of the computing device to execute the first system function based on the parameter information to obtain a first execution result.

[0139] In some embodiments, after receiving a first call request from a target process for the first time, the computing device (dynamic library protection module and / or kernel protection module) detects that the first call request includes the shadow interface, identifies the first application as an application that needs protection, records the identification information of the first application, and uses the identification information of the first application as the identification information of the protected application. Furthermore, based on the shadow interface, a second call request is sent to the operating system of the computing device.

[0140] Thus, in step 305, after receiving the first call request from the target process for the i-th time (i being an integer greater than 1), a second call request is sent to the operating system based on the identification information of the first application and the shadow interface. The identification information of the first application is used to identify whether the first application is a protected program. Optionally, in implementation:

[0141] Based on the identification information of the first application and the recorded identification information of the protected application, it is determined whether the first application is a protected application. If the first application is a protected application, a second call request is sent to the operating system of the computing device based on the shadow interface.

[0142] In some embodiments, the identification information of protected applications can be configured in advance in the computing device. Thus, upon receiving a first invocation request, it can be determined whether the first application is a protected application based on the identification information of the first application and the recorded identification information of protected applications. If the first application is a protected application, a second invocation request is sent to the operating system of the computing device based on the shadow interface.

[0143] In some embodiments, see Figure 4 The first call request is designated as call request 1, which includes a dynamic library shadow interface. The target process sends call request 1. The dynamic library protection module can intercept call request 1 to receive it. Based on the dynamic library shadow interface included in call request 1, it can be deduced that call request 1 is sent by the target process when running the program code of the first application. Then, based on the dynamic library shadow interface included in call request 1, the dynamic library interface is obtained from the correspondence between system interfaces and shadow interfaces, and a second call request 1, which includes the dynamic library interface, is sent to the operating system of the computing device. Alternatively,

[0144] The dynamic library protection module can intercept the first call request 1 and determine whether the first application is a protected application based on the identification information of the first application and the identification information of protected applications recorded by the computing device. If the first application is a protected application, based on the dynamic library shadow interface included in the first call request 1, it can be concluded that the first call request 1 was sent when the target process was running the program code of the first application. Then, based on the dynamic library shadow interface included in the first call request 1, the dynamic library interface is obtained from the correspondence between system interfaces and shadow interfaces, and a second call request 1 including the dynamic library interface is sent to the operating system of the computing device.

[0145] Optionally, the operating system of the computing device includes a kernel protection module, which may also receive the first call request 1, detect that the first call request 1 includes a dynamic library shadow interface, and may discard the first call request 1.

[0146] In some embodiments, see Figure 5The operating system of the computing device includes a kernel protection module. The first call request is designated as first call request 2, which includes a kernel shadow interface. The target process sends first call request 2. The kernel protection module can intercept first call request 2 to receive it. Based on the kernel shadow interface included in first call request 2, it can be deduced that first call request 2 is sent by the target process when running the program code of the first application. A second call request 2, which also includes the kernel shadow interface, is then sent to the operating system. Alternatively,

[0147] The kernel protection module can intercept the first call request 2 and determine whether the first application is a protected application based on the identification information of the first application and the identification information of protected applications recorded by the computing device. If the first application is a protected application, based on the kernel shadow interface included in the first call request 2, it can be concluded that the first call request 2 was sent when the target process was running the program code of the first application, and a second call request 2, which includes the kernel shadow interface, is sent to the operating system of the computing device.

[0148] Optionally, the dynamic library protection module may also receive the first call request 2, and if it detects that the first call request 2 includes the kernel shadow interface, it can discard the first call request 2.

[0149] Optionally, the first call request 2 and the second call request 2 may be the same.

[0150] If the first application is not a protected application and the first call request 1 includes a dynamic library interface, the dynamic library protection module can send the first call request 1 to the operating system of the computing device. Alternatively,

[0151] If the first application is not a protected application and the first call request 2 includes a kernel interface, the dynamic library protection module can send the first call request 2 to the operating system of the computing device.

[0152] Step 306: The computing device executes the first system function indicated by the shadow interface and obtains the first execution result.

[0153] In step 306, the operating system of the computing device can receive a second call request, obtain a first system function based on the second call request, execute the first system function to obtain a first execution result.

[0154] In some embodiments, the second invocation request may also include parameter information, so that the first system function is executed based on the parameter information to obtain the first execution result.

[0155] For example, this parameter information is verification information. The operating system of the computing device performs verification based on this verification information. If the verification passes, it obtains the first system function based on the second call request, executes the first system function, and obtains the first execution result.

[0156] In some embodiments, see Figure 4 The second call request is second call request 1, which includes a dynamic library interface. Based on the dynamic library interface included in second call request 1, the operating system of the computing device obtains the first dynamic library function indicated by the dynamic library interface from the second memory space, executes the first dynamic library function to obtain a first execution result, and returns the first execution result to the dynamic library protection module. Alternatively,

[0157] The operating system of the computing device, based on the dynamic library interface included in the second call request 1, obtains the second dynamic library function indicated by the dynamic library interface from the second memory space and executes the second dynamic library function. Based on the kernel shadow interface called by the second dynamic library function, the kernel system call function is executed to obtain the first execution result.

[0158] Optionally, during implementation, the second dynamic library function is executed. When the execution reaches the kernel shadow interface included in the second dynamic library function, a kernel system call function is executed based on the kernel shadow interface to obtain a second execution result. Based on the second execution result, the second dynamic library function continues to be executed to obtain a first execution result, which is then returned to the dynamic library protection module.

[0159] Optionally, the operating system of the computing device includes a second correspondence, which stores the correspondence between the kernel shadow interface and identification information of each kernel system call function in the operating system. The operation of executing the kernel system call function based on the kernel shadow interface to obtain the second execution result can be:

[0160] Based on the kernel shadow interface, the identification information of the kernel system call function indicated by the kernel shadow interface is obtained from the second correspondence. Based on the identification information of the kernel system call function, the kernel system call function is obtained from at least one kernel system call function included in the operating system of the computing device, and the kernel system call function is executed to obtain a second execution result.

[0161] In some embodiments, see Figure 5The second call request is second call request 2, which includes a kernel shadow interface. Based on the kernel shadow interface included in second call request 2, the operating system of the computing device obtains the identification information of the kernel system call function indicated by the kernel shadow interface from the second correspondence. Based on the identification information of the kernel system call function, the operating system of the computing device obtains the kernel system call function from at least one kernel system call function included in the operating system of the computing device, executes the kernel system call function to obtain a first execution result, and returns the first execution result to the kernel protection module.

[0162] Step 307: The computing device inputs the first execution result to the target process so that the target process continues to run the first application based on the first execution result.

[0163] In some embodiments, the dynamic library protection module receives the first execution result and returns it to the target process. The target process receives the first execution result and continues to run the first application based on it.

[0164] In some embodiments, the kernel protection module receives the first execution result and returns it to the target process. The target process receives the first execution result and continues to run the first application based on it.

[0165] Specifically, the code of the first application running in the first memory space may have a vulnerability. An attacker could exploit this vulnerability to inject malicious code into the code of the first application stored in the first memory space. This malicious code would then need to call a second system function to carry out the attack. The first and second system functions may be the same or different.

[0166] Since the shadow interface used to indicate the second system function is a newly defined interface in this embodiment, while the system interface used to indicate the second system function is a standard interface defined by the operating system, the hacker only knows the system interface used to indicate the second system function and will not know the shadow interface used to indicate the second system function. Therefore, the malicious code injected by the hacker into the first application in the first memory space includes the second call statement, which includes the system interface but not the shadow interface.

[0167] In some embodiments, the second call statement in the malicious code may include a second call statement 1, which includes a dynamic library interface. And / or, the second call statement in the malicious code may include a second call statement 2, which includes a kernel interface.

[0168] After malicious code is injected into the code of the first application in the first memory space, the target process will execute the malicious code when running the code of the first application. When the malicious code includes a second call statement, the target process will send a third call request. The third call request includes the system interface in the second call statement. The third call request is used to request the invocation of the second system function indicated by the system interface to carry out the attack operation. Therefore, the third call request is a request sent by the target process when running the malicious code to request the invocation of the second system function.

[0169] In some embodiments, the malicious code includes a second call statement 1, which includes a dynamic library interface. When the target process reaches the second call statement 1, it sends a third call request 1, which includes the dynamic library interface and the identification information of the first application. The third call request 1 is used to request the invocation of the dynamic library function indicated by the dynamic library interface to carry out the attack operation.

[0170] In some embodiments, the malicious code includes a second call statement 2, which includes a kernel interface. When the target process reaches the second call statement 2, it sends a third call request 2, which includes the kernel interface and identification information of the first application. The third call request 2 is used to request the invocation of the kernel system call function indicated by the kernel interface to carry out the attack operation.

[0171] To improve the security of the first application, see [link / reference]. Figure 6 The malicious code's call to the second system function can be intercepted by processing the application's workflow as follows, preventing the computing device from executing the second system function and thus preventing the attack from being carried out.

[0172] Step 601: The computing device receives a third call request sent by the target process. The third call request includes a system interface, which is used to indicate a second system function.

[0173] Optionally, the third invocation request may also include identification information of the first application.

[0174] In some embodiments, see Figure 7 The third call request is designated as Third Call Request 1, which includes a dynamic library interface. The target process sends Third Call Request 1. The dynamic library protection module can intercept Third Call Request 1 to enable the reception of Third Call Request 1.

[0175] In some embodiments, see Figure 8The operating system of the computing device includes a kernel protection module. The third call request is third call request 2, which includes a kernel interface. The target process sends third call request 2. The kernel protection module can intercept third call request 2 to achieve the function of receiving third call request 2.

[0176] Step 602: The computing device prevents the system function from being executed based on the system interface.

[0177] In step 602, based on the system interface included in the third call request, it can be concluded that the third call request was sent when the target process was running malicious code. Therefore, sending third call requests to the operating system of the computing device is stopped, and the third call request can be discarded to prevent the system function from being executed. Alternatively,

[0178] The third invocation request includes the identification information of the first application. Based on the identification information of the first application and the identification information of the protected application recorded by the computing device, it is determined whether the first application is a protected application. If the first application is a protected application, based on the system interface included in the third invocation request, it can be concluded that the third invocation request was sent when the target process was running malicious code. The sending of the third invocation request to the operating system of the computing device is stopped, and the third invocation request can be discarded to prevent the system function from being executed.

[0179] In some embodiments, see Figure 7 The third call request is third call request 1. Third call request 1 includes a dynamic library interface. After the dynamic library protection module intercepts third call request 1, based on the dynamic library interface included in third call request 1, it can be concluded that third call request 1 was sent when the target process was running malicious code. Therefore, it stops sending third call request 1 to the operating system of the computing device and can discard third call request 1. Alternatively,

[0180] After the dynamic library protection module intercepts the third call request 1, it determines whether the first application is a protected application based on the identification information of the first application and the identification information of the protected application recorded by the computing device. If the first application is a protected application, based on the dynamic library interface included in the third call request 1, it can be concluded that the third call request 1 was sent when the target process was running malicious code. Therefore, the module stops sending the third call request 1 to the operating system of the computing device and can discard the third call request 1.

[0181] In some embodiments, see Figure 8The third call request is third call request 2. Third call request 2 includes a kernel interface. After the kernel protection module intercepts third call request 2, based on the kernel interface included in third call request 2, it can be concluded that third call request 2 was sent when the target process was running malicious code. Therefore, it stops sending third call request 2 to the operating system of the computing device and can discard third call request 2. Alternatively,

[0182] After the kernel protection module intercepts the third call request 2, it determines whether the first application is a protected application based on the identification information of the first application and the identification information of the protected application recorded by the computing device. If the first application is a protected application, based on the kernel interface included in the third call request 2, it can be concluded that the third call request 2 was sent when the target process was running malicious code. Therefore, sending the third call request 2 to the operating system of the computing device is stopped, and the third call request 2 can be discarded.

[0183] This involves protecting the application based on the identification information of the first application in the third call request and the identification information of the protected application recorded by the computing device. In other words, calls to system interfaces in the protected application's code can be replaced with calls to shadow interfaces. This allows for targeted protection of applications with high security requirements, avoiding the waste of computing resources by protecting all applications and reducing costs. Alternatively,

[0184] For each application on a computing device, calls to system interfaces in the application's code can be replaced with calls to shadow interfaces, thus providing more comprehensive protection for each application.

[0185] In some embodiments, for a non-protected third application, since the calling statements in the program code of the third application have not been modified, when the process running to the calling statement in the program code of the third application that includes the system interface, the process sends a fourth calling request including the system interface and the identification information of the third application.

[0186] The computing device (dynamic library protection module and / or kernel protection module) receives a fourth call request. Based on the identification information of the third application included in the fourth call request and the identification information of protected applications recorded by the computing device, it determines that the third application is not a protected application. Since the fourth call request includes a system interface, it sends a fourth call request to the operating system of the computing device. The operating system of the computing device executes the system function indicated by the system interface included in the fourth call request, obtaining a third execution result. The third execution result is returned to the process, allowing the process to continue running the first application based on the third execution result.

[0187] For example, the fourth call request is fourth call request 1, which includes a dynamic library interface. The dynamic library protection module intercepts fourth call request 1 and, based on the identification information of the third application included in fourth call request 1 and the identification information of protected applications recorded by the computing device, determines that the third application is not a protected application. Since fourth call request 1 includes a dynamic library interface, it sends fourth call request 1 to the operating system of the computing device.

[0188] The operating system of the computing device obtains the dynamic library function indicated by the dynamic library interface based on the dynamic library interface included in the fourth call request 1. Executing the dynamic library function yields a third execution result, which is then returned to the process, allowing the process to continue running the third application based on the third execution result.

[0189] For example, the fourth call request is fourth call request 2, which includes a kernel interface. The kernel protection module intercepts fourth call request 2 and, based on the identification information of the third application included in fourth call request 2 and the identification information of protected applications recorded by the computing device, determines that the third application is not a protected application. Since fourth call request 2 includes a kernel interface, it sends fourth call request 2 to the operating system of the computing device.

[0190] The second mapping relationship of the computing device's operating system is used to store the mapping relationship between the kernel interface, kernel shadow interface, and identification information of each kernel system call function. Based on the kernel interface included in the fourth call request 2, the computing device's operating system obtains the identification information of the kernel system call function indicated by the kernel interface from the second mapping relationship in the computing device's operating system. Based on the identification information of the kernel system call function, the computing device's operating system obtains the kernel system call function. Executing the kernel system call function yields a third execution result, which is returned to the process, allowing the process to continue running the third application based on the third execution result.

[0191] In this embodiment, when compiling a second application, the computing device adds a dynamic library protection module to the second application and replaces a first call statement including a system interface in the program code of the second application with a third call statement including a shadow interface, thus obtaining the first application. The third call statement may be a third call statement 1 including a dynamic library shadow interface and / or a third call statement 2 including a kernel shadow interface. When the first application needs to be run, the code of the first application is loaded into a first memory space, and the dynamic library protection module in the first application is loaded into a second memory space. The target process is started to run the code of the first application in the first memory space, and the dynamic library protection module in the second memory space and the kernel protection module in the operating system of the computing device are started. When the target process runs the third call statement 1 in the program code of the first application, it sends a first call request 1, which includes the dynamic library shadow interface in the third call statement 1. The dynamic library protection module can intercept the first call request 1, and based on the fact that the first call request 1 includes the dynamic library shadow interface, it determines that the first call request 1 was sent when the target process runs the program code of the first application, and sends a second call request 1 to the operating system of the computing device, so that the operating system of the computing device executes the dynamic library function indicated by the dynamic library shadow interface. Alternatively, when the target process executes the third call statement 2 in the program code of the first application, it sends a first call request 2, which includes the kernel shadow interface in the third call statement 2. The kernel protection module can intercept the first call request 2, and based on the fact that the first call request 2 includes the kernel shadow interface, it can determine that the first call request 2 was sent when the program code of the first application was running. It then sends a second call request 2 to the operating system of the computing device, which executes the kernel system call function indicated by the kernel shadow interface. In this way, the dynamic library protection module and the kernel protection module can intercept call requests sent by the target process in real time and determine whether the call request was sent when the program code of the first application was running or when malicious code was running. This enables real-time interception of call requests sent when the target process is running malicious code, preventing malicious code from calling system functions, thereby effectively protecting the first application and improving its security.

[0192] See Figure 9 This application provides an apparatus 900 for processing applications. The apparatus 900 is deployed in a communication system, which can be... Figure 1 or Figure 2 The communication system 100 shown. Alternatively, the communication system can be... Figure 3 The communication system in method 300 shown.

[0193] The computing device in the device 900 includes a first system function, a first application program, and a target process. The first system function is a function provided by the operating system of the computing device. The device 900 may include a receiving unit 901, a processing unit 902, and a sending unit 903.

[0194] The receiving unit 901 is used to receive a first call request sent by the target process. The first application is a program obtained by replacing the system interface of the first system function included in the second application with a shadow interface. The shadow interface is used to indicate the first system function. The first call request includes the shadow interface.

[0195] Processing unit 902 is used to execute a first system function based on the shadow interface to obtain a first execution result;

[0196] Sending unit 903 is used to return the first execution result to the target process.

[0197] In some embodiments, the processing unit 902, the receiving unit 901, and the sending unit 903 are units that logically divide the aforementioned compiler, dynamic library protection module, and / or kernel protection module, etc.

[0198] Optionally, the processing unit 902 replaces the system interface of the first system function included in the second application with a shadow interface to obtain the detailed implementation process of the first application. (See [link to relevant documentation]). Figure 3 The relevant content in step 302 of method 300 shown will not be described in detail here.

[0199] Optionally, the detailed implementation process of receiving unit 901 receiving the first call request sent by the target process can be found in [reference needed]. Figure 3 The relevant content in step 305 of method 300 shown will not be described in detail here.

[0200] Optionally, the detailed implementation process of the processing unit 902 executing the first system function based on the shadow interface to obtain the first execution result can be found in [reference needed]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0201] Optionally, the detailed implementation process of the sending unit 903 returning the first execution result to the target process can be found in [reference needed]. Figure 3 The relevant content in step 307 of method 300 shown will not be described in detail here.

[0202] The sending unit 903 is also used to send a second call request to the operating system based on the shadow interface. The second call request is used to request the operating system to execute the first system function and obtain the execution result.

[0203] Optionally, the sending unit 903, based on the shadow interface, sends a second call request to the operating system. For detailed implementation information, please refer to [link / reference needed]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0204] The receiving unit 901 is used to intercept the first call request sent by the target process;

[0205] The processing unit 902 is configured to determine, if the first call request includes a shadow interface, that the first call request is a request from the program code of the first application, and send a second call request to the operating system via the sending unit 903.

[0206] Optionally, the detailed implementation process of the receiving unit 901 intercepting the first call request sent by the target process can be found in [reference needed]. Figure 3 The relevant content in step 305 of method 300 shown will not be described in detail here.

[0207] Optionally, if the processing unit 902 detects that the first call request includes a shadow interface, determines that the first call request is a request from the program code of the first application, and sends the second call request to the operating system through the sending unit 903, the detailed implementation process can be found in [link to relevant documentation]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0208] Optionally, the first call request may also include the identification information of the first application. The sending unit 903 is used to send a second call request to the operating system based on the identification information of the first application and the shadow interface. The identification information of the first application is used to identify whether the first application is a protected program.

[0209] Optionally, the detailed implementation process of the sending unit 903 sending the second call request to the operating system based on the identification information and shadow interface of the first application can be found in [reference needed]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0210] Optionally, the first call request may also include parameter information of the first system function, and the second call request may be used to request the operating system to execute the first system function based on the parameter information to obtain the execution result.

[0211] Optionally, the first system function includes a first dynamic library function, the shadow interface includes a dynamic library shadow interface for indicating the first dynamic library function, and the system interface includes the dynamic library interface of the first dynamic library function.

[0212] Optionally, the device 900 includes a memory space for a first application, the memory space including a first dynamic library function, and a correspondence between the dynamic library interface and the dynamic library shadow interface.

[0213] Processing unit 902 is used for:

[0214] Based on the dynamic library shadow interface, the dynamic library interface is obtained from the correspondence;

[0215] Based on the dynamic library interface, the execution result is obtained by executing the first dynamic library function.

[0216] Optionally, the detailed implementation process of processing unit 902 obtaining the dynamic library interface based on the dynamic library shadow interface can be found in [reference needed]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0217] Optionally, the processing unit 902, based on the dynamic library interface, executes the first dynamic library function to obtain the execution result. For detailed implementation details, please refer to [link to relevant documentation]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0218] Optionally, the first dynamic library function is used to call the kernel interface, which in turn instructs the kernel system call function.

[0219] Processing unit 902 is used for:

[0220] The kernel interface included in the first dynamic library function is replaced with the kernel shadow interface to obtain the second dynamic library function. The kernel shadow interface is used to indicate the kernel system call function.

[0221] Execute the second dynamic library function based on the dynamic library interface;

[0222] The kernel shadow interface, based on the second dynamic library function call, executes the kernel system call function to obtain the execution result.

[0223] Optionally, the processing unit 902 replaces the kernel interface included in the first dynamic library function with a kernel shadow interface to obtain the second dynamic library function. For detailed implementation process, please refer to [link to relevant documentation]. Figure 3 The relevant content in step 304 of method 300 shown will not be described in detail here.

[0224] Optionally, the processing unit 902 is based on a dynamic library interface. For detailed implementation of the second dynamic library function, please refer to [link to relevant documentation]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0225] Optionally, the processing unit 902 executes kernel system call functions and obtains execution results based on the kernel shadow interface of the second dynamic library function call. For detailed implementation details, please refer to [link to relevant documentation]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0226] Optionally, the first system function includes kernel system call functions, the shadow interface includes a kernel shadow interface for indicating kernel system call functions, and the system interface includes the kernel interface of kernel system call functions.

[0227] Optionally, the computing device further includes a first correspondence between the kernel interface and the identification information of the kernel system call function, and the processing unit replaces the first correspondence with a second correspondence between the kernel shadow interface and the identification information of the kernel system call function;

[0228] Based on the kernel shadow interface and the second correspondence, obtain the identification information of kernel system call functions;

[0229] The first execution result is obtained by executing the kernel system call function corresponding to the identifier information.

[0230] Optionally, the detailed implementation process of the processing unit 902 replacing the first correspondence with the second correspondence between the kernel shadow interface and the identification information of the kernel system call function can be found in [reference needed]. Figure 3 The relevant content in step 304 of method 300 shown will not be described in detail here.

[0231] Optionally, the detailed implementation process of processing unit 902 obtaining the identification information of kernel system call functions based on the kernel shadow interface and the second correspondence can be found in [reference needed]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0232] Optionally, the detailed implementation process of the processing unit 902 executing the kernel system call function corresponding to the identification information to obtain the first execution result can be found in [reference needed]. Figure 3 The relevant content in step 306 of method 300 shown will not be described in detail here.

[0233] Optionally, the device 900 further includes a second system function, the first application includes malicious code, and the malicious code includes a system interface of the second system function;

[0234] The receiving unit 901 is also used to receive a third call request sent by the target process. The third call request includes the system interface of the second system function. The third call request is a request sent by the target process when running malicious code.

[0235] The processing unit 902 is also used to prevent the second system function from being executed based on the system interface of the second system function.

[0236] Optionally, the detailed implementation process of receiving unit 901 receiving the third call request sent by the target process can be found in [reference needed]. Figure 6 The details of step 601 of the method shown will not be explained in detail here.

[0237] Optionally, the detailed implementation process of the processing unit 902 preventing the execution of the second system function based on the system interface of the second system function can be found in [reference needed]. Figure 6 The details of step 602 in the method shown will not be explained in detail here.

[0238] Optionally, the processing unit 902 is configured to determine that the third call request is a request for malicious code and prevent the second system function from being executed if the third call request includes a system interface.

[0239] Optionally, the detailed implementation process of the processing unit 902 determining that the third call request is a malicious code request and preventing the execution of the second system function when it detects that the third call request includes a system interface can be found in [reference needed]. Figure 6 The details of step 602 in the method shown will not be explained in detail here.

[0240] In this embodiment, because the processing unit replaces the system interface in the second application with a shadow interface, when the target process runs the first application and needs to call the first system function, the first call request sent includes the shadow interface. Thus, after the receiving unit receives the first call request including the shadow interface, the processing unit can determine from the shadow interface that the first call request was sent by the target process running the program code of the first application, and execute the first system function based on the shadow interface to obtain the first execution result. After running the first application, if a hacker injects malicious code into the first application, since the hacker is unaware of the existence of the shadow interface, the malicious code includes the system interface, and the call request sent by the target process when running the malicious code will not include the shadow interface. Since the condition for executing a system function is the shadow interface, the processing unit will not execute the system function for the malicious code. In this way, the processing unit effectively prevents the execution of malicious code attacks, achieving real-time protection of the application and improving its security.

[0241] See Figure 10 This application provides a computing device 1000. For example, the computing device 1000 can be... Figure 1 or Figure 2The computing device in the communication system 100 shown may integrate the compilation device and computing device in the communication system 100. Alternatively, the computing device 900 may be... Figure 3 The computing device in method 300 shown may integrate the compilation device and computing device of method 300 shown. The device 900 may include the aforementioned compiler, dynamic library protection module, and / or kernel protection module, etc.

[0242] like Figure 10 As shown, the computing device 1000 includes a bus 1002, a processor 1004, a memory 1006, and a communication interface 1008. The processor 1004, the memory 1006, and the communication interface 1008 communicate with each other via the bus 1002. The computing device 1000 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 1000.

[0243] Bus 1002 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 10 The bus 1002 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 1002 may include a path for transmitting information between various components of the computing device 1000 (e.g., processor 1004, memory 1006, communication interface 1008).

[0244] The processor 1004 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0245] The memory 1006 may include volatile memory, such as random access memory (RAM). The memory 1006 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0246] See Figure 10 The memory 1006 stores executable program code, and the processor 1004 executes the executable program code to implement the following respectively. Figure 9 The processing unit 902, receiving unit 901, and transmitting unit 903 in the illustrated device 900 function to implement the method provided in any of the above embodiments. That is, the memory 1006 stores instructions for executing the method provided in any of the above embodiments. Alternatively,

[0247] The communication interface 1008 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1000 and other devices or communication networks.

[0248] This application also provides a cluster for processing applications. The application processing cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0249] like Figure 11 As shown, the cluster for processing applications includes at least one computing device 1000, and the at least one computing device 1000 may include... Figure 1 or Figure 2 The communication system 100 may include a compilation device 101 and a computing device 102, or may include... Figure 3 The compilation device or computing device in method 300 shown. The memory 1006 of one or more computing devices 1000 in the cluster of the processing application may store the same instructions for performing the methods provided in any of the above embodiments.

[0250] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the cluster of the processing application may also store partial instructions for executing the methods of the aforementioned processing application. In other words, a combination of one or more computing devices 1000 can jointly execute instructions for performing the methods provided in any of the above embodiments.

[0251] In some possible implementations, one or more computing devices in the cluster of the processing application can be connected via a network. This network can be a wide area network (WAN), a local area network (LAN), or similar. Figure 12 One possible implementation is shown. For example... Figure 12 As shown, the two computing devices 1000A and 1000B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device.

[0252] In this type of possible implementation, the memory 1006 in the computing device 1000A stores the execution of, for example Figure 9 Instructions for the function of the processing unit 902 in the illustrated embodiment. Meanwhile, the memory 1006 in the computing device 1000B stores instructions for executing such... Figure 9 Instructions for the functions of the receiving unit 901 and the transmitting unit 903 in the illustrated embodiment.

[0253] It should be understood that Figure 12 The functions of computing device 1000A shown can also be performed by multiple computing devices 1000. Similarly, the functions of computing device 1000B can also be performed by multiple computing devices 1000.

[0254] This application also provides another cluster for processing applications. The connection relationships between the computing devices in this application processing cluster can be similarly referenced. Figure 12 The connection method of the cluster of processing applications. The difference is that the memory 1006 of one or more computing devices 1000 in the cluster of processing applications can store the same instructions for executing the methods provided in any of the above embodiments.

[0255] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the cluster of the processing application may also store partial instructions for executing the methods provided in any of the above embodiments. In other words, a combination of one or more computing devices 1000 can jointly execute instructions for executing the methods provided in any of the above embodiments.

[0256] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform the methods provided in any of the above embodiments.

[0257] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computing device to perform the method provided in any of the above embodiments.

[0258] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0259] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for processing an application, characterized in that, The method is applied to a communication system, wherein the computing device of the communication system includes a first system function, a first application program, and a target process, wherein the first system function is a function provided by the operating system of the computing device, and the method includes: The system receives a first call request sent by the target process, the target process being used to run the first application, the first application being a program obtained by replacing the system interface of the first system function included in the second application with a shadow interface, the shadow interface being used to indicate the first system function, and the first call request including the shadow interface; The execution result is obtained by executing the first system function based on the shadow interface; Return the execution result to the target process.

2. The method as described in claim 1, characterized in that, The step of obtaining the execution result by executing the first system function based on the shadow interface includes: Based on the shadow interface, a second call request is sent to the operating system, the second call request being used to request the operating system to execute the first system function to obtain the execution result.

3. The method as described in claim 2, characterized in that, The computing device further includes a protection module; receiving the first call request sent by the target process includes: The protection module intercepts the first call request sent by the target process; The step of sending a second call request to the operating system based on the shadow interface includes: If the protection module detects that the first call request includes the shadow interface, it determines that the first call request is a request from the program code of the first application and sends the second call request to the operating system.

4. The method as described in claim 2, characterized in that, The first invocation request also includes the identification information of the first application, and the step of sending the second invocation request to the operating system based on the shadow interface includes: Based on the identification information of the first application and the shadow interface, a second call request is sent to the operating system, wherein the identification information of the first application is used to identify whether the first application is a protected program.

5. The method according to any one of claims 2-4, characterized in that, The first call request further includes parameter information of the first system function, and the second call request is used to request the operating system to execute the first system function based on the parameter information to obtain the execution result.

6. The method according to any one of claims 1-5, characterized in that, The first system function includes a first dynamic library function, the shadow interface includes a dynamic library shadow interface for indicating the first dynamic library function, and the system interface includes the dynamic library interface of the first dynamic library function.

7. The method as described in claim 6, characterized in that, The computing device further includes the memory space of the first application, the memory space including the first dynamic library function, and the correspondence between the dynamic library interface and the dynamic library shadow interface; The step of obtaining the execution result by executing the first system function based on the shadow interface includes: Based on the dynamic library shadow interface, the dynamic library interface is obtained from the correspondence; Based on the dynamic library interface, the first dynamic library function is executed to obtain the execution result.

8. The method as described in claim 7, characterized in that, The first dynamic library function is used to call a kernel interface, the kernel interface being used to instruct a kernel system call function, and the method further includes: The kernel interface called by the first dynamic library function is replaced with a kernel shadow interface to obtain the second dynamic library function, wherein the kernel shadow interface is used to indicate the kernel system call function; The step of executing the first dynamic library function based on the dynamic library interface to obtain the execution result includes: Based on the dynamic library interface, the second dynamic library function is executed; The kernel shadow interface, based on the second dynamic library function call, executes the kernel system call function to obtain the execution result.

9. The method according to any one of claims 1-5, characterized in that, The first system function includes a kernel system call function, the shadow interface includes a kernel shadow interface for indicating the kernel system call function, and the system interface includes the kernel interface of the kernel system call function.

10. The method as described in claim 9, characterized in that, The computing device further includes a first correspondence between the kernel interface and the identification information of the kernel system call function, and the method further includes: Replace the first correspondence with a second correspondence between the kernel shadow interface and the identifier information of the kernel system call function; The step of obtaining the execution result by executing the first system function based on the shadow interface includes: Based on the kernel shadow interface and the second correspondence, the identification information of the kernel system call function is obtained; The execution result is obtained by executing the kernel system call function corresponding to the identification information.

11. The method according to any one of claims 1-10, characterized in that, The computing device further includes a second system function, the first application includes malicious code, the malicious code includes a system interface of the second system function, and the method further includes: Receive a third call request sent by the target process, the third call request including the system interface of the second system function, the third call request being a request sent by the target process to run the malicious code; The system interface based on the second system function prevents the second system function from being executed.

12. The method as described in claim 11, characterized in that, The system interface based on the second system function prevents the second system function from being executed, including: If the system interface is detected as part of the third call request, the system determines that the third call request is a request from the malicious code and prevents the execution of the second system function.

13. An apparatus for processing an application program, characterized in that, The device is deployed in a communication system. The computing device within the device includes a first system function, a first application program, and a target process. The first system function is a function provided by the operating system of the computing device. The device includes: A receiving unit is configured to receive a first call request sent by the target process, the target process being used to run the first application, the first application being a program obtained by replacing the system interface of the first system function included in the second application with a shadow interface, the shadow interface being used to indicate the first system function, and the first call request including the shadow interface; The processing unit is further configured to execute the first system function based on the shadow interface to obtain the execution result; The sending unit is used to return the execution result to the target process.

14. The apparatus as claimed in claim 13, characterized in that, The sending unit is further configured to send a second call request to the operating system based on the shadow interface, the second call request being used to request the operating system to execute the first system function to obtain the execution result.

15. The apparatus as claimed in claim 14, characterized in that, The receiving unit is used to intercept the first call request sent by the target process; The processing unit is configured to determine, if the first call request includes the shadow interface, that the first call request is a request from the program code of the first application, and send the second call request to the operating system through the sending unit.

16. The apparatus as claimed in claim 14, characterized in that, The first call request also includes the identification information of the first application. The sending unit is used to send the second call request to the operating system based on the identification information of the first application and the shadow interface. The identification information of the first application is used to identify whether the first application is a protected program.

17. The apparatus according to any one of claims 14-16, characterized in that, The first call request further includes parameter information of the first system function, and the second call request is used to request the operating system to execute the first system function based on the parameter information to obtain the execution result.

18. The apparatus according to any one of claims 13-17, characterized in that, The first system function includes a first dynamic library function, the shadow interface includes a dynamic library shadow interface for indicating the first dynamic library function, and the system interface includes the dynamic library interface of the first dynamic library function.

19. The apparatus as claimed in claim 18, characterized in that, The device includes the memory space of the first application, the memory space includes the first dynamic library function, and the correspondence between the dynamic library interface and the dynamic library shadow interface; The processing unit is used for: Based on the dynamic library shadow interface, the dynamic library interface is obtained from the correspondence; Based on the dynamic library interface, the first dynamic library function is executed to obtain the execution result.

20. The apparatus as claimed in claim 19, characterized in that, The first dynamic library function is used to call a kernel interface, the kernel interface is used to instruct kernel system call functions, and the processing unit is used to: The kernel interface called by the first dynamic library function is replaced with a kernel shadow interface to obtain the second dynamic library function, wherein the kernel shadow interface is used to indicate the kernel system call function; Based on the dynamic library interface, the second dynamic library function is executed; The kernel shadow interface, based on the second dynamic library function call, executes the kernel system call function to obtain the execution result.

21. The apparatus according to any one of claims 13-17, characterized in that, The first system function includes a kernel system call function, the shadow interface includes a kernel shadow interface for indicating the kernel system call function, and the system interface includes the kernel interface of the kernel system call function.

22. The apparatus as claimed in claim 21, characterized in that, The device further includes a first correspondence between the kernel interface and the identification information of the kernel system call function, and the processing unit is used for: Replace the first correspondence with a second correspondence between the kernel shadow interface and the identifier information of the kernel system call function; Based on the kernel shadow interface and the second correspondence, the identification information of the kernel system call function is obtained; The execution result is obtained by executing the kernel system call function corresponding to the identification information.

23. The apparatus according to any one of claims 13-22, characterized in that, The device further includes a second system function, and the first application includes malicious code, the malicious code including the system interface of the second system function; The receiving unit is further configured to receive a third call request sent by the target process, the third call request including the system interface of the second system function, and the third call request being a request sent by the target process to run the malicious code; The processing unit is also configured to prevent the execution of the second system function based on the system interface of the second system function.

24. The apparatus as claimed in claim 23, characterized in that, The processing unit is used for: If the system interface is detected as part of the third call request, the system determines that the third call request is a request from the malicious code and prevents the execution of the second system function.

25. A computing device, characterized in that, It includes a processor and a memory; the processor is configured to execute instructions stored in the memory to cause the computing device to perform the method as described in any one of claims 1-12.

26. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a computing device, cause the computing device to perform the method as described in any one of claims 1-12.

27. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device, the computing device performs the method as described in any one of claims 1-12.

Images