An evaluation method, device and equipment of a running environment and a storage medium

Abstract

The application provides an evaluation method, device and equipment of a running environment and a storage medium, and is used for solving the problem of low data security in the evaluation process of the running environment. The method at least comprises: sending a security evaluation instruction to a first application, so that the first application forwards the security evaluation instruction to a second application; the first application runs in a to-be-evaluated running environment provided by a client; the second application runs in a trusted running environment provided by the client; the to-be-evaluated running environment and the trusted running environment are located in different hardware areas, and data communication is performed between the different hardware areas through the first application; receiving evaluation response data reported by the first application; the evaluation response data carries system data of the to-be-evaluated running environment collected by the second application based on the security evaluation instruction; based on the system data, the security of the to-be-evaluated running environment is evaluated, and an evaluation result is obtained. The to-be-evaluated running environment is evaluated based on the trusted running environment, and the data security in the evaluation process is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for evaluating an operating environment. Background Technology

[0002] With the continuous development of technology, more and more client devices can be equipped with a wide variety of applications. These applications run in the normal operating environment provided by the device, such as in a Rich Execution Environment (REE).

[0003] Because some applications (such as payment or financial applications) and some applications' functions (such as payment functions in games or transaction functions in instant messaging applications) require a secure runtime environment, otherwise, abnormal situations such as damage or theft of application account data or application development data can easily occur. Therefore, when a client launches an application or executes a function within an application, the server can first assess the application's runtime environment. Only after ensuring data security should the server instruct the client to continue launching the application or executing the function.

[0004] In related technologies, the evaluation method for the operating environment is usually to install an evaluation application in the ordinary operating environment provided by the client, and use the functions provided by the evaluation application to evaluate the ordinary operating environment.

[0005] However, since evaluation applications still run in a normal operating environment and still need to call the resources provided by the normal operating environment to execute the functions provided by the evaluation applications, there are still security risks when using evaluation applications to evaluate the operating environment. For example, abnormal accounts can exploit code vulnerabilities in the operating system of the normal operating environment to obtain high-level access permissions to the operating system, and thus tamper with the evaluation process and evaluation results of the evaluation applications with high-level access permissions.

[0006] It is evident that data security is low during the evaluation process of the operating environment under related technologies. Summary of the Invention

[0007] This application provides a method, apparatus, device, and storage medium for evaluating operating environments, which addresses the problem of low data security during the evaluation process of operating environments.

[0008] Firstly, a method for evaluating the operating environment is provided, applied to the server side, including:

[0009] A security assessment instruction is sent to a first application, which then forwards the security assessment instruction to a second application. The first application runs in a client-provided environment to be assessed, and the second application runs in a client-provided trusted environment. The environment to be assessed and the trusted environment are located in different hardware regions, and data communication between these different hardware regions is achieved through the first application.

[0010] Receive the evaluation response data reported by the first application; wherein the evaluation response data carries system data of the operating environment to be evaluated collected by the second application based on the security evaluation command;

[0011] Based on the system data, a security assessment is performed on the operating environment to be evaluated, and the assessment results are obtained.

[0012] Secondly, a method for evaluating a runtime environment is provided, applied to a first application, which runs in a runtime environment to be evaluated provided by a client; including:

[0013] A security assessment instruction is sent to a second application, which then collects system data of the operating environment to be assessed based on the security assessment instruction; wherein the second application runs in a trusted operating environment provided by the client; the operating environment to be assessed and the trusted operating environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application;

[0014] Receive evaluation response data sent by the second application; wherein the evaluation response data carries the system data;

[0015] Based on the system data, a security assessment is performed on the operating environment to be evaluated, and the assessment results are obtained.

[0016] Thirdly, a method for evaluating the runtime environment is provided, applied to a second application, which runs in a trusted runtime environment provided by the client; including:

[0017] The system receives a security assessment instruction from a first application; wherein the first application runs in the evaluation environment provided by the client; the evaluation environment and the trusted environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application.

[0018] Based on the security assessment instructions, system data of the operating environment to be assessed is collected;

[0019] An evaluation response data carrying the system data is sent to the first application, so that the first application forwards the evaluation response data to the server. The server then performs a security evaluation on the operating environment to be evaluated based on the system data and obtains the evaluation result.

[0020] Fourthly, an evaluation device for the operating environment is provided, applied to the server side, including:

[0021] Transceiver module: used to send a security assessment instruction to a first application, so that the first application forwards the security assessment instruction to a second application; wherein, the first application runs in a runtime environment to be assessed provided by the client; the second application runs in a trusted runtime environment provided by the client; the runtime environment to be assessed and the trusted runtime environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application;

[0022] The transceiver module is further configured to: receive evaluation response data reported by the first application; wherein the evaluation response data carries system data of the operating environment to be evaluated collected by the second application based on the security evaluation command;

[0023] Processing module: Used to perform a security assessment on the operating environment to be evaluated based on the system data, and obtain the assessment results.

[0024] Optionally, the evaluation response data is generated by the second application in combination with the system data and at least one type of data to be verified; then the processing module is specifically used for:

[0025] Extract at least one data to be verified from the evaluation response data;

[0026] After the at least one piece of data to be verified passes the verification, a security assessment is performed on the operating environment to be evaluated based on the system data to obtain the assessment result.

[0027] Optionally, the at least one piece of data to be verified includes: a first public key; the first public key comes from a first public-private key pair stored on the server; then the processing module is further configured to:

[0028] After extracting at least one type of data to be verified from the evaluation response data, when the evaluation response data is successfully decrypted based on the first private key in the first public-private key pair, it is determined that the verification of one type of data to be verified has passed.

[0029] Optionally, if the at least one piece of data to be verified includes a parameter value, then the processing module is specifically used for:

[0030] After extracting the at least one data to be verified from the evaluation response data, the time when the value of the parameter extracted from the evaluation response data is obtained is acquired.

[0031] When the parameter value matches the pre-stored verification value, and the time interval between the value generation time associated with the verification value and the value acquisition time is within a preset time range, it is determined that the verification of one type of data to be verified has passed; wherein, the verification value is generated by the server based on a preset value generation strategy.

[0032] Optionally, if the at least one piece of data to be verified includes a trusted signature, then the processing module is specifically used for:

[0033] After extracting the at least one data to be verified from the evaluation response data, the device identifier of the client is extracted from the system data;

[0034] In the pre-stored mapping relationship between each reference code and each second public key, the reference code that matches the device identifier is used as the device code, and the second public key corresponding to the device code is obtained; wherein, the device code is used to uniquely represent the device to which the hardware region of the trusted operating environment belongs; the second public key corresponding to the device code comes from the second public-private key pair preset for the second application;

[0035] When the trusted signature is successfully verified based on the second public key corresponding to the device code, it is determined that the verification of one type of data to be verified has passed.

[0036] Optionally, the processing module is specifically used for:

[0037] Parameter values ​​are extracted from the evaluation response data; wherein the parameter values ​​are obtained based on the verification value carried by the security evaluation command, and the verification value is generated by the server based on a preset value generation strategy;

[0038] When the trusted signature is successfully decrypted based on the second public key corresponding to the device code, hash data is obtained; wherein, the hash data is obtained by performing a hash operation on the concatenated data of the system data and the verification value based on a preset hash algorithm;

[0039] Based on the pre-stored hash algorithm, a hash operation is performed on the concatenated data of the system data and the parameter values ​​to obtain the signature verification data;

[0040] When the signature verification data and the hash data match, it is determined that the trusted signature verification was successful.

[0041] Optionally, the system data includes at least one of the following: a system integrity verification field, a developer permission status, and a version identifier of the operating system running in the environment to be evaluated;

[0042] The system integrity verification field is updated by the operating system periodically checking whether the specified configuration data has been modified during operation; the developer permission status indicates whether the permission to modify data for the operating system has been authorized.

[0043] Optionally, the processing module is specifically used for:

[0044] An anomaly assessment result is obtained when at least one of the following conditions is determined based on the system data; wherein the anomaly assessment result indicates that the operating environment to be assessed is abnormal; the various conditions include:

[0045] The value of the system integrity verification field does not match the preset reference value for the system integrity verification field;

[0046] The developer permissions are currently unlocked.

[0047] The version identifier does not match any of the obtained reference identifiers; wherein, each reference identifier comes from a plurality of reference versions released for the operating system, and the time interval between the release time and the current time is within a preset time period.

[0048] Fifthly, an evaluation device for an operating environment is provided, applied to a client, including:

[0049] Transceiver module: Used for a first application to send a security assessment command to a second application, so that the second application can collect system data of the operating environment to be assessed based on the security assessment command; wherein, the first application runs in the operating environment to be assessed provided by the client; the second application runs in a trusted operating environment provided by the client; the operating environment to be assessed and the trusted operating environment are located in different hardware areas, and the different hardware areas communicate with each other by calling the transceiver module through the first application or the second application;

[0050] The transceiver module is further configured to: receive evaluation response data sent by the second application from the first application; wherein the evaluation response data carries the system data;

[0051] Processing module: Used by the first application to perform a security assessment on the operating environment to be evaluated based on the system data, and obtain the assessment result.

[0052] Optionally, the security assessment instruction comes from a third application running in the environment to be assessed, and the security assessment instruction is generated by the third application in response to a function execution operation triggered for a specified function;

[0053] The processing module is further configured to:

[0054] After obtaining the evaluation results, when the evaluation results indicate that there are no anomalies in the operating environment to be evaluated, an environmental safety indication is generated.

[0055] The environmental security instruction is sent to the third application so that the third application performs the specified function based on the environmental security instruction.

[0056] Sixthly, an evaluation device for an operating environment is provided, applied to a client, including:

[0057] Transceiver module: used for the second application to receive security assessment instructions from the first application; wherein, the first application runs in the evaluation environment provided by the client; the second application runs in the trusted environment provided by the client; the evaluation environment and the trusted environment are located in different hardware regions, and the different hardware regions communicate with each other by calling the transceiver module through the first application or the second application;

[0058] Processing module: used by the second application to collect system data of the operating environment to be evaluated based on the security assessment instructions;

[0059] The transceiver module is further configured to: send evaluation response data carrying the system data to the first application, so that the first application forwards the evaluation response data to the server, and the server performs a security evaluation on the operating environment to be evaluated based on the system data to obtain the evaluation result.

[0060] Optionally, the processing module is specifically used for:

[0061] Based on the data collection target indicated by the security assessment instruction, the device interface is invoked to collect system data of the operating environment to be assessed;

[0062] The data collection targets include at least one of the following: a system integrity verification field, a developer permission status, and a version identifier of the operating system running in the environment to be evaluated; the system integrity verification field is updated by periodically checking whether the specified configuration data has been modified during the operation of the operating system; the developer permission status indicates whether the data modification permission for the operating system has been authorized; the device interface is configured for the client and is used to establish a data transmission channel between the client and the operating system.

[0063] In a seventh aspect, an evaluation system for an operating environment is provided, comprising a server and a client; the server includes the apparatus described in the fourth aspect, and the client includes the apparatus described in the fifth or sixth aspect.

[0064] Eighthly, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method as described in the first, second, or third aspect.

[0065] Ninth aspect, a computer device is provided, comprising:

[0066] Memory, used to store program instructions;

[0067] A processor is configured to invoke program instructions stored in the memory and execute the method described in the first, second, or third aspect according to the obtained program instructions.

[0068] A tenth aspect provides a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the methods described in the first, second, or third aspects.

[0069] In this embodiment, since the operating environment to be evaluated and the trusted operating environment are located in different hardware areas, the trusted operating environment is physically isolated from the operating environment to be evaluated. The trusted operating environment is not affected by security vulnerabilities in the operating environment to be evaluated, and its data security is very high. Therefore, performing a security assessment of the operating environment to be evaluated based on the trusted operating environment provided by the client can improve the data security during the evaluation process. Furthermore, collecting system data based on the trusted operating environment ensures the security of the system data during the collection process, thereby improving the data security during the evaluation process.

[0070] Furthermore, security assessments can be performed without installing other applications in the operating environment to be assessed, thus avoiding the problem of unreliable assessment results caused by security vulnerabilities in the operating environment to be assessed, thereby improving data security during the assessment process of the operating environment.

[0071] Furthermore, any third application running in the environment to be evaluated can use the evaluation method provided in the embodiments of this application to evaluate the environment to be evaluated. It is not necessary to pre-build a security evaluation process in each third application, which reduces the development difficulty of the third application running in the environment to be evaluated and improves the applicability of providing clients with the environment to be evaluated and the trusted environment. Attached Figure Description

[0072] Figure 1A A schematic diagram of an application scenario for the evaluation method of the operating environment provided in the embodiments of this application;

[0073] Figure 1B This is a schematic diagram illustrating the principle of an evaluation method for the operating environment in related technologies.

[0074] Figure 1C A schematic diagram illustrating an application area of ​​the evaluation method for the operating environment provided in the embodiments of this application;

[0075] Figure 2 A schematic flowchart of an evaluation method for the operating environment provided in this application embodiment;

[0076] Figure 3A A schematic diagram illustrating the principle of an evaluation method for the operating environment provided in this application embodiment;

[0077] Figure 3B A schematic diagram of the principle of the evaluation method for the operating environment provided in the embodiments of this application. Figure 2 ;

[0078] Figure 4A An interactive schematic diagram of an evaluation method for the operating environment provided in the embodiments of this application;

[0079] Figure 4B An interactive illustration of the evaluation method for the operating environment provided in the embodiments of this application. Figure 2 ;

[0080] Figure 4C A schematic diagram three illustrating the principle of an evaluation method for the operating environment provided in an embodiment of this application;

[0081] Figure 5A A schematic diagram three illustrating an interactive method for evaluating the operating environment provided in an embodiment of this application;

[0082] Figure 5B A schematic diagram four illustrating the principle of an evaluation method for the operating environment provided in an embodiment of this application;

[0083] Figure 5C A flowchart illustrating the evaluation method for the operating environment provided in the embodiments of this application. Figure 2 ;

[0084] Figure 6A A schematic diagram four illustrating an interactive method for evaluating the operating environment provided in an embodiment of this application;

[0085] Figure 6B A schematic diagram five illustrating the principle of an evaluation method for the operating environment provided in this application embodiment;

[0086] Figure 7A A flowchart illustrating an evaluation method for the operating environment provided in this application embodiment is shown in Figure 3.

[0087] Figure 7B A schematic diagram five illustrating an interactive method for evaluating the operating environment provided in an embodiment of this application;

[0088] Figure 8A A schematic diagram of a device for evaluating the operating environment provided in an embodiment of this application;

[0089] Figure 8B A schematic diagram of the structure of the operating environment evaluation device provided in the embodiments of this application. Figure 2 ;

[0090] Figure 8C A schematic diagram three of a structure for an evaluation device of the operating environment provided in an embodiment of this application;

[0091] Figure 9 A schematic diagram four of an evaluation device for the operating environment provided in the embodiments of this application. Detailed Implementation

[0092] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0093] The following explanations of some terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0094] (1) Trusted Execution Environment (TEE) and Rich Execution Environment (REE):

[0095] TEE (Transfer Element) is commonly used for Digital Rights Management (DRM), mobile payments, and sensitive data protection. TEE has the following security features: it is protected by hardware mechanisms; applications running on the REE can only communicate with the TEE through specific entry points; the TEE can access the memory associated with the REE, but the REE cannot access the memory associated with the TEE; and it has the ability to resist certain hardware-based abnormal behaviors, meaning that the code and data in the TEE cannot usually be cracked, modified, or obtained from the outside.

[0096] REE is a universal operating environment for all mobile devices, supporting a large number of applications and various complex functions to meet diverse user needs, such as multimedia playback, web browsing, and office applications.

[0097] (2) Client App (CA) and Trusted App (TEE App, TA):

[0098] CA is a client application running in REE. CA can use the TEE Client API to access the security services provided by TA running on TEE. CA can act as a bridge between REE and TEE.

[0099] TA is a trusted application running on TEE that can provide security services such as digital certificate application and application, personalized operation of user passwords and biometrics, data encryption and decryption, and security authentication.

[0100] (3) Public-key encryption algorithm (Rivest-Shamir-Adleman, RSA):

[0101] RSA is an asymmetric encryption algorithm that uses a public-private key pair, where the public key is used to encrypt data and the private key is used to decrypt data. The private key cannot be derived from the public key.

[0102] (4) Software Development Kit (SDK):

[0103] An SDK is a set of tools, libraries, documentation, and sample code provided by mobile phone manufacturers to help developers develop, optimize, and integrate applications on their specific brand of mobile phones. By using the SDK, developers can fully leverage the hardware capabilities, system features, and services provided by the mobile phone manufacturer, thereby improving application performance, user experience, and functionality.

[0104] It should be noted that the embodiments of this application involve data operations such as sending and receiving security assessment instructions or security assessment data. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0105] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0106] The application areas of the evaluation method for the operating environment provided in the embodiments of this application will be briefly introduced below.

[0107] With the continuous development of technology, a wide variety of applications can be installed on more and more client devices. These applications run in the normal operating environment provided by the device, such as REE.

[0108] However, on the one hand, devices manufactured by different manufacturers may have different hardware differences such as different processor architectures, screen resolutions, sensor types and numbers; on the other hand, the operating system versions of REE in different devices may also differ. Furthermore, the operating systems of REE in devices manufactured by different manufacturers may also have software differences such as varying degrees of customization and modification of the original operating system.

[0109] This fragmentation of REE operating systems across different devices makes it difficult to implement unified management and security measures. For example, a vulnerability patch for a specific version of the REE operating system on one device may not be promptly adaptable to other types of devices.

[0110] On the other hand, security flaws in the operating system code can be easily exploited to gain high-level access to the operating system or to execute abnormal behavior. As technology evolves, new security flaws in the operating system may be constantly discovered, and the speed at which these flaws are fixed may not keep up with the rate at which they are discovered, posing security risks to devices running the operating system.

[0111] In practical applications, some applications (such as payment or financial applications) and some functions provided by applications (such as payment functions in game applications or transaction functions in instant messaging applications) require the REE (Reliable Internet Provider) environment to operate. Otherwise, abnormal situations such as damage or theft of account data or application development data may occur. Therefore, please refer to... Figure 1A When a client starts an application or executes a function within an application, the server can first evaluate the application's runtime environment. If the evaluation indicates that data security is high, the server can then instruct the client to continue starting the application or executing the function.

[0112] In related technologies, the evaluation method for the operating environment is usually as follows: Please refer to [reference needed]. Figure 1B In the normal operating environment provided by the client, an evaluation application is installed, and the functions provided by the evaluation application are used to evaluate the normal operating environment. For example, it evaluates whether the high-level access permissions of the operating system of the normal operating environment have been granted, whether root tools for granting high-level access permissions are installed in the normal operating environment, and whether hook tools for inserting additional code during application execution are installed, etc.

[0113] However, since evaluation applications still run in a normal operating environment and still need to call the resources provided by the normal operating environment to execute the functions provided by the evaluation applications, there are still security risks in using evaluation applications to evaluate the operating environment.

[0114] For example, an abnormal account can exploit code vulnerabilities in a normal operating system to gain high-level access to that operating system, thereby allowing it to tamper with the evaluation process and results of evaluation applications.

[0115] For example, abnormal accounts can use hook tools to intercept evaluation commands and modify the program to return evaluation results indicating high data security.

[0116] It is evident that data security is low during the evaluation process of the operating environment under related technologies.

[0117] To address the issue of low data security during the evaluation of runtime environments, this application proposes a method for evaluating runtime environments. In this method, a server sends a security evaluation command to a first application, which then forwards the command to a second application. The first application runs in a runtime environment to be evaluated provided by a client; the second application runs in a trusted runtime environment provided by the client. The runtime environment to be evaluated and the trusted runtime environment are located in different hardware regions, and data communication between these different hardware regions is achieved through the first application. The server receives evaluation response data reported by the first application, which carries system data of the runtime environment to be evaluated collected by the second application based on the security evaluation command. Based on the system data, the server performs a security evaluation of the runtime environment to be evaluated and obtains the evaluation result.

[0118] Based on the same inventive concept, this application also proposes a method for evaluating a runtime environment. This method does not involve a server; instead, a first application sends a security evaluation command to a second application, enabling the second application to collect system data from the runtime environment to be evaluated based on the security evaluation command. The second application runs in a trusted runtime environment provided by the client. The runtime environment to be evaluated and the trusted runtime environment are located in different hardware regions, and data communication between these different hardware regions is achieved through the first application. The first application receives evaluation response data sent by the second application, which carries system data. Based on the system data, the first application performs a security evaluation of the runtime environment to be evaluated and obtains the evaluation result.

[0119] In this embodiment, because the operating environment to be evaluated and the trusted operating environment are located in different hardware areas, the trusted operating environment is physically isolated from the operating environment to be evaluated. The trusted operating environment is not affected by security vulnerabilities in the operating environment to be evaluated, resulting in very high data security. Therefore, by leveraging the characteristics of the trusted operating environment, such as the inability to crack, modify, or obtain code and data from the outside, a security assessment of the operating environment to be evaluated provided by the client can be performed based on the trusted operating environment provided by the client, thereby improving data security during the assessment process. Furthermore, collecting system data based on the trusted operating environment ensures the security of system data during the collection process, thus enhancing data security during the operating environment assessment process.

[0120] Furthermore, security assessments can be performed without installing other applications in the operating environment to be assessed, thus avoiding the problem of unreliable assessment results caused by security vulnerabilities in the operating environment to be assessed, thereby improving data security during the assessment process of the operating environment.

[0121] Furthermore, any third application running in the environment to be evaluated can use the evaluation method provided in the embodiments of this application to evaluate the environment to be evaluated. It is not necessary to pre-build a security evaluation process in each third application, which reduces the development difficulty of the third application running in the environment to be evaluated and improves the applicability of the operating system that provides the environment to be evaluated and the trusted operating environment.

[0122] The following describes the application scenarios of the evaluation method for the operating environment provided in this application.

[0123] Please refer to Figure 1C This is a schematic diagram illustrating an application scenario of the evaluation method for the operating environment provided in this application. The application scenario includes a server 101 and a client 102, which can communicate with each other. The communication method can be wired, such as through a network cable or serial cable; or wireless, such as through Bluetooth or Wi-Fi. No specific limitation is imposed.

[0124] Client 102 generally refers to devices with both normal and trusted operating environments, and capable of installing applications in the normal operating environment, such as terminal devices, third-party applications accessible by terminal devices, or web pages accessible by terminal devices. Server 101 generally refers to devices with data processing capabilities, such as terminal devices or servers.

[0125] Terminal devices include, but are not limited to, mobile phones, computers, smart medical devices, smart home appliances, vehicle terminals, or aircraft. Servers include, but are not limited to, cloud servers, local servers, or associated third-party servers. Both client 101 and server 102 can use cloud computing to reduce the use of local computing resources; similarly, they can also use cloud storage to reduce the use of local storage resources.

[0126] As one embodiment, the server 101 and the client 102 can be the same device, or they can be different devices, or they can be different devices with some modules shared, etc., and there are no specific restrictions.

[0127] In response to a startup operation triggered for a third application, client 102 generates an application startup command. When server 101 detects that client 102 has generated an application startup command for a third application, it generates a security assessment command to perform a security assessment on the runtime environment to be assessed provided by client 102. Server 101 sends the security assessment command to a first application in client 102, causing the first application to forward the security assessment command to a second application. The second application collects system data of the runtime environment to be assessed based on the security assessment command and sends this system data to the first application, enabling the first application to report the system data to server 101 through client 102.

[0128] Based on the received system data, server 101 performs a security assessment on the operating environment to be evaluated and obtains the assessment results. Server 101 sends the assessment results to client 102. Based on the received assessment results, client 102 determines that there are no anomalies in the operating environment to be evaluated and then starts the third application.

[0129] The following is based on Figure 1C The evaluation method for the operating environment provided in the embodiments of this application will be described in detail below. Please refer to... Figure 2 This is a flowchart illustrating an evaluation method for the operating environment provided in an embodiment of this application.

[0130] S201, the server sends a security assessment command to the first application.

[0131] The server is the device used for security assessment. It can be a server other than the servers associated with each third application installed on the client, or the server associated with any of the third applications installed on the client, etc. There are no specific restrictions.

[0132] Security assessment commands are used to instruct the client to perform a security assessment of the runtime environment to determine its trustworthiness. Security assessment commands can take various forms, such as protocol messages, network messages, and electrical signals; there are no specific restrictions.

[0133] The first application is the application running in the evaluation environment provided by the client. The client also provides a trusted environment. The evaluation environment and the trusted environment are located in different hardware regions, thus achieving physical isolation between them. The client can be divided into multiple hardware regions. In addition to the hardware regions where the evaluation environment and the trusted environment are located, it can also contain other hardware regions, which are not limited here.

[0134] The first application can serve as a communication bridge between the hardware region where the operating environment to be evaluated is located and any other hardware region, enabling data communication between the hardware regions. Alternatively, the first application can simply serve as a communication bridge between the hardware region where the operating environment to be evaluated is located and the hardware region where the trusted operating environment is located, enabling data communication between these two hardware regions, etc., without any specific limitations. For example, when the operating environment to be evaluated is an REE, the first application is a CA running in the REE.

[0135] A second application can run within a Trusted Environment (TEE). This second application can provide security services such as authentication and encryption / decryption. For example, when the TEE is a Trusted Environment, the second application is the TA within the TEE.

[0136] Because the second application is a trusted application running within a trusted operating environment, it can obtain data from any hardware region on the client. For example, it can obtain hardware information about the hardware region where the operating environment to be evaluated is located, as well as relevant operating system data within that environment. Therefore, collecting system data from the operating environment to be evaluated through the second application does not require passing through the operating environment itself, ensuring the security of data collection.

[0137] The first application can use the access interface (such as the TEEClient API) configured by the client manufacturer for the trusted operating environment to realize data communication with the trusted operating environment. This access interface can be linked to the second application, for example, to access the security service functions provided by the second application, without any specific restrictions.

[0138] In the evaluation environment provided by the client, only the first application can call the access interface, and other applications have no way of knowing about the access interface. For example, the first application may be configured by the client's manufacturer in the evaluation environment, so the access interface can be configured in the first application, or the access interface can be called only by the first application.

[0139] The client-provided evaluation environment can also run at least one third-party application. This third-party application can be an object using the client and installed on the client itself; it can also be pre-installed on the client by the client's manufacturer, etc., with no specific restrictions. Different third-party applications can be applications developed by different application developers, or applications with different functions, such as instant messaging applications, photo-taking applications, video playback applications, shopping applications, payment applications, etc., with no specific restrictions.

[0140] Since the third application itself runs in the environment to be evaluated, its process of collecting system data is also susceptible to abnormal behavior, which makes the data collection process still vulnerable to security risks. In this embodiment, by using the characteristics of the first and second applications pre-built into the client, the use of the third application (such as an evaluation application developed by a third-party platform) is skipped to collect system data and perform security evaluation, which can effectively ensure the data security during the evaluation.

[0141] Please refer to Figure 3A This is a schematic diagram of a hardware structure for a portion of the hardware in a client application. Within the client, hardware technologies (such as ARM TrustZone technology) can be used to divide the hardware into multiple hardware zones based on the processor, memory, and peripherals. These zones are physically isolated from each other. At least one of these hardware zones can be configured with a Trusted Execution Environment (TEE) to perform specific high-security operations within the client, such as payment operations, client authentication, or digital rights management. Another at least one hardware zone can be configured with an evaluation-oriented execution environment (REE) to install a variety of applications on the client, providing diverse functionalities such as camera functionality, instant messaging, and video browsing.

[0142] In this embodiment, two hardware regions are used as an example for description. One hardware region is configured with a trusted operating environment, and the other hardware region is configured with an operating environment to be evaluated. Other cases are not listed here.

[0143] Please refer to Figure 3B This diagram illustrates the relationship between a first application, a second application, and multiple third applications running on a client. The client provides an evaluation runtime environment and a trusted runtime environment. The first application runs in the evaluation runtime environment and is used for data communication with the second application running in the trusted runtime environment. The first and second applications cannot be installed by the object using the client; instead, they can be set up in the client at the factory, or automatically loaded from network resources when the client first starts, etc., without specific restrictions.

[0144] After the client is shipped, users can install multiple third-party applications on the operating system of the runtime environment to be evaluated provided by the client during actual use. These third-party applications do not have the ability to communicate with the second application, so they can only obtain system data of the runtime environment to be evaluated based on their own code. During this data collection process, there is still a security risk of being affected by abnormal behavior. Therefore, in this embodiment, we break away from the conventional thinking that when the third application needs to conduct a security assessment of the runtime environment, it should conduct the security assessment itself. Instead, we use the first and second applications built into the client to complete the task. This not only simplifies the process of developing a security assessment process for the third application, but also improves the data security during the security assessment.

[0145] There are several ways for the server to obtain security assessment instructions. Two of them will be introduced below as examples. Other methods will not be listed here.

[0146] Method 1:

[0147] Because some third-party applications or certain functions within third-party applications need to run in a secure environment, the client can generate security assessment instructions when launching a third-party application or in response to a triggering operation targeting a function within a third-party application.

[0148] The client sends a security assessment command to the server, and the server receives the security assessment command sent by the client.

[0149] Method 2:

[0150] In the client's runtime environment to be evaluated, a security evaluation policy can be set. The security evaluation policy can be used to periodically send security evaluation requests to the server. After receiving the security evaluation request sent by the client, the server generates a security evaluation instruction based on the security evaluation request.

[0151] Because some third-party applications or certain functions within third-party applications require a secure runtime environment, security assessment policies can also be used to intercept operations and generate security assessment requests when a third-party application is launched or in response to a triggered operation targeting a function within a third-party application. The client sends a security assessment request to the server, and the server, upon receiving the request, generates security assessment instructions based on the request.

[0152] Please refer to Figure 4A This is a schematic diagram illustrating the interaction between the server and the client.

[0153] S41, after the server receives the security assessment instruction, it sends the security assessment instruction to the first application in the client, and the first application receives the security assessment instruction sent by the server.

[0154] S42, the first application forwards a security assessment instruction to the second application in the client, and the second application receives the security assessment instruction forwarded by the first application.

[0155] S43, after receiving the security assessment instruction from the first application, the second application collects system data of the operating environment to be assessed based on the security assessment instruction. The system data will be described later and will not be repeated here.

[0156] S44, the second application sends evaluation response data carrying system data to the first application, and the first application receives the evaluation response data.

[0157] S45, the first application reports the evaluation response data to the server, and the server receives the evaluation response data reported by the first application.

[0158] S46, the server performs a security assessment of the operating environment to be evaluated based on system data, and obtains the assessment results.

[0159] As one embodiment, the security assessment instruction may also carry at least one encoding parameter for encoding the system data collected by the second application, so as to improve the data security of the system data during transmission.

[0160] When a security assessment command carries multiple encoding parameters, the collected system data can be encoded sequentially using these parameters. If each of the multiple encoding parameters is associated with a priority, then only at least one encoding parameter whose priority meets the priority condition can be selected to encode the collected system data sequentially, and so on. There are no specific restrictions.

[0161] The following section will use two of the encoding parameters as examples to introduce the concepts; other encoding parameters will not be listed here.

[0162] Encoding parameter 1: First public key

[0163] The server can pre-store a first public-private key pair, which includes a first public key and a first private key. This first public-private key pair can be generated by the server; it can also be generated by a key generation device and sent to the server, etc., without specific restrictions. The first public-private key pair can be generated based on a symmetric encryption strategy, or it can be generated based on an asymmetric encryption strategy, etc., without specific restrictions.

[0164] To further enhance data security during the security assessment process, a first public key can be included in the security assessment command. This allows the second application on the client side to obtain the first public key and, based on it, encrypt the collected system data of the operating environment to be assessed. The server can then decrypt the data using the first private key to verify its security during transmission. Various encryption algorithms exist, such as RSA, which will not be listed here. The following example illustrates one encryption process.

[0165] For example, the first public key is denoted as (e, n), where n is the product of two 2048-bit prime numbers, and e is the Euler's totient function with respect to n. The result of the calculation is a coprime integer less than n, which is the Euler's totient function. The calculation result; Euler's totient function represents the number of positive integers less than or equal to n that are relatively prime to n, for example, e is 65537(2). 16 +1). The system data m is encrypted using the first public key, denoted as m. e mod n yields the encrypted system data c; mod represents the modulo operation.

[0166] Encoding parameter 2: Check value

[0167] The server can include a verification value in the security assessment command. The verification value can be generated by the server or other devices based on a preset value generation strategy. The verification value can be a random number or a value obtained after performing a series of calculations on a preset number, depending on the value generation strategy.

[0168] The verification value can be generated when the security assessment command is generated, or it can be generated in advance for the client or a third-party application and then stored on the server, etc. There are no restrictions on the specifics.

[0169] Therefore, the second application in the client can obtain the verification value carried by the security assessment command and merge the system data and the verification value. For example, by splicing the system data and the verification value, the server can determine the data security of the system data during the transmission process by whether the verification value has been tampered with.

[0170] Please refer to Figure 4B and Figure 4C This is a schematic diagram and principle diagram of the interaction between the server and the client.

[0171] S401, the server generates a security assessment instruction based on the first public key ServerPublicKey and the verification value Nonce.

[0172] For example, the server organizes the data identifiers of the system data to be obtained into a JSON format string, and encapsulates this string, the first public key ServerPublicKey, and the verification value Nonce into a message packet. The packet can be encapsulated using a specific protocol format, such as binary protocol or JSON format, so that security assessment instructions can be obtained.

[0173] S402, the server sends a security assessment instruction to the first application in the client. The first application receives the security assessment instruction sent by the server. The security assessment instruction carries the first public key ServerPublicKey and the verification value Nonce.

[0174] For example, the server can establish a connection with the first application through a network protocol (HTTP or HTTPS). After a Transport Layer Security Handshake (TLS), the server can send a security assessment instruction to the first application. The first application can receive the security assessment instruction sent by the server by continuously monitoring a specific port.

[0175] S403, the first application forwards a security assessment instruction to the second application in the client. The second application receives the security assessment instruction forwarded by the first application. The security assessment instruction carries the first public key ServerPublicKey and the verification value Nonce.

[0176] The server sends a security assessment instruction to the first application. The first application receives the security assessment instruction sent by the server and forwards the security assessment instruction to the second application. After receiving the security assessment instruction forwarded by the first application, the second application can collect system data of the operating system of the environment to be assessed based on the security assessment instruction, and return the corresponding assessment data to the first application. Please refer to the introduction in S202 below.

[0177] S202, Receive evaluation response data reported by the first application.

[0178] After receiving the security assessment command, the second application collects system data of the operating environment to be assessed based on the command. This ensures that the assessment response data reported by the first application to the server carries the system data of the operating environment to be assessed collected by the second application based on the security assessment command. The system data represents the system status of the operating system (such as Android) in the operating environment to be assessed.

[0179] The second application can collect the corresponding system status simultaneously or sequentially according to the security assessment instructions. If the security assessment instructions do not explicitly indicate the system status to be collected, the second application can randomly collect at least one system status. If each system status is associated with a status importance, and the higher the status importance, the higher the environmental security of the system status and the operating environment to be assessed, then the second application can collect at least one system status according to the status importance associated with each system status, etc., without any specific restrictions.

[0180] System status can contain at least one type of status information. The following section will introduce four of them as examples. Other status information will not be listed here.

[0181] Status Information 1: System Integrity Verification Field

[0182] The system integrity verification field indicates whether the operating system has been tampered with or is running normally. It can be obtained by the operating system periodically checking whether the specified configuration data has been modified and updated during operation. The specified configuration data can include software code for the operating system, critical system files of the operating system, and hardware-related settings of the hardware area where the operating environment to be evaluated is located, etc. There are no specific restrictions.

[0183] Status Information 2: Version Identifier

[0184] Version identifiers are used to uniquely identify the system version of an operating system. Different system versions contain different vulnerability patches, which means that different system versions may have different security vulnerabilities.

[0185] Status Message 3: Developer Permission Status

[0186] The developer permission status indicates whether permissions to modify data within the operating system have been granted. The developer permission status can also be the Bootloader status, which represents the first piece of software code that runs after the client starts. The primary task of this first piece of software code is to initialize hardware areas, preparing for the loading and execution of the operating system kernel.

[0187] When the bootloader is locked, only vendor-certified operating system images or software packages from production clients are allowed to be loaded in the runtime environment being evaluated. For example, some smartphone manufacturers lock the bootloader to prevent unauthorized, untested operating systems from being flashed, thus avoiding potential security vulnerabilities and compatibility issues.

[0188] When the Bootloader is in the unlocked state, it allows loading custom operating system images or making lower-level system modifications in the runtime environment to be evaluated, thereby bypassing the restrictions of production client vendors and customizing the runtime environment to be evaluated for the client according to requirements.

[0189] Status Information 4: Client Device Identifier

[0190] Device identifiers are used to uniquely identify the device to which the hardware region of the operating environment or trusted operating environment to be evaluated belongs, i.e., the client. Different types of clients may have varying degrees of customization and modification to the native operating system, which may result in different device identifiers having different security vulnerabilities.

[0191] System data containing at least one of the aforementioned status information can reflect the data security of the operating environment to be evaluated from different perspectives. For example, the second application can collect system integrity verification fields and package them as system data; the second application can collect version identifiers and package them as system data, etc.

[0192] For example, the second application can collect system integrity verification fields and version identifiers, concatenate the collected system integrity verification fields and version identifiers, and package them into system data; for example, the second application can collect developer permission status and version identifiers, concatenate the collected developer permission status and version identifiers, and package them into system data; for example, the second application can collect system integrity verification fields and developer permission status, concatenate the collected system integrity verification fields and developer permission status, and package them into system data; for example, the second application can collect developer permission status and client device identifiers, concatenate the collected developer permission status and client device identifiers, and package them into system data, etc.

[0193] For example, the second application can collect system integrity verification fields, version identifiers, and client device identifiers, concatenate the collected system integrity verification fields, version identifiers, and client device identifiers, and package them into system data; for example, the second application can collect developer permission status, client device identifiers, and version identifiers, concatenate the collected developer permission status, client device identifiers, and version identifiers, and package them into system data; for example, the second application can collect system integrity verification fields, version identifiers, and developer permission status, concatenate the collected system integrity verification fields, version identifiers, and developer permission status, and package them into system data, etc.

[0194] For example, the second application can collect integrity verification fields, version identifiers, developer permission status, and client device identifiers, concatenate these data, and package them into system data.

[0195] By combining multiple status information as system data, the server can comprehensively conduct a security assessment of the operating environment to be evaluated, improve the accuracy of the assessment, and avoid data security issues.

[0196] Please refer to Figure 5A and Figure 5B This is a schematic diagram and principle diagram of the interaction between the server and the client.

[0197] S51, the second application collects system data of the operating environment to be evaluated by calling the device interface based on the collection target indicated by the security assessment command.

[0198] The target data collection includes at least one of the aforementioned status information.

[0199] The device interface is configured for the client and is used to establish a data transmission channel between the client and the operating system in the runtime environment to be evaluated. For example, the device interface can be the SDK provided by the manufacturer that generates the client, etc. There are no specific restrictions.

[0200] By using a second application to call the device interface to collect system data of the operating environment to be evaluated, the data collection process is completed in a trusted operating environment, ensuring the data security of the system data collection process and helping to improve the accuracy of the operating environment evaluation.

[0201] S52, the second application generates evaluation response data based on the collected system data.

[0202] The second application can directly use the system data as the evaluation response data; or, since the security evaluation instruction can also carry at least one encoding parameter, the second application can also encode the system data based on at least one encoding parameter carried in the security evaluation instruction after obtaining the system data to obtain the evaluation response data.

[0203] The following example uses three encoding methods to illustrate the encoding process of the second application. Other encoding methods will not be listed here.

[0204] Encoding Method 1: First Public Key

[0205] Based on the previous introduction, the security assessment command can carry a first public key. Therefore, after obtaining the system data, the second application can use the first public key carried in the security assessment command to encrypt the system data and obtain the encrypted system data.

[0206] The second application can use the encrypted system data as evaluation response data; it can also be combined with other encoding methods to continue encoding, for example, using the first public key to encrypt the concatenated data of the system data and the trusted signature introduced later to obtain evaluation response data, etc., without any specific restrictions.

[0207] Since the first public key is sent to the second application by the server along with the security assessment command, when the server fails or needs to be replaced by a backup server, no modification is required to the assessment process of the operating environment provided in this application embodiment. This improves the assessment flexibility of the operating environment without adding communication signaling to send the first public key.

[0208] Encoding Method 2: Check Value

[0209] Based on the preceding introduction, the security assessment command can carry a checksum. Therefore, after obtaining the system data, the second application can use the concatenated data of the system data and the checksum carried in the security assessment command as the assessment response data. Alternatively, it can combine other encoding methods to further encode the data. For example, it can use the first public key to encrypt the concatenated data of the system data and the checksum to obtain the assessment response data. Or, it can package the concatenated data of the system data, the checksum, and the trusted signature described later into the assessment response data, etc. There are no specific restrictions.

[0210] Since the checksum is generated by the server, the server sends the checksum to the second application, which then encodes the system data based on the checksum to obtain the evaluation response data. During this process, if any step is affected by abnormal behavior, the checksum may be tampered with or time out. The server can then extract a reference value from the evaluation response data. If this reference value is the checksum generated by the server, it indicates that there was no abnormal behavior during transmission, ensuring data transmission security. If the extracted reference value is not only the checksum but also within its validity period, it further confirms that there was no abnormal behavior during transmission, effectively guaranteeing data transmission security.

[0211] Encoding Method 3: Second Private Key

[0212] The second application can pre-store the second private key from the second public-private key pair. This second public-private key pair is generated for the client based on a key generation strategy. Different clients have different second public-private key pairs, achieving one key per device, which can greatly increase the security of system data transmission. The second public-private key pair can be generated by the second application, or it can be generated by another device and then the second private key is sent to the second application, etc., without any specific restrictions.

[0213] After obtaining the system data, the second application can use the second private key to sign the system data, obtaining a trusted signature. The second application can then use the trusted signature as evaluation response data; alternatively, it can combine it with other encoding methods for further encoding. For example, it can use the first public key to encrypt the concatenated data of system data, trusted signature, and verification value to obtain evaluation response data; or it can package the concatenated data of system data, trusted signature, and verification value into evaluation response data, etc., without any specific restrictions.

[0214] Since the second private key in the second public-private key pair can be configured for the client before it leaves the factory, and each device has its own unique key, other devices cannot obtain this second private key. This makes the trusted signature obtained by the second private key highly secure. Therefore, by carrying a trusted signature, the security of system data transmission can be effectively guaranteed.

[0215] Please refer to Figure 5C This is a flowchart illustrating a process for generating evaluation response data.

[0216] S501, the second application performs a hash operation on the concatenated data of system data and check value based on a preset hash algorithm to obtain hash data.

[0217] S502, the second application signs the hash data based on the second private key to obtain a trusted signature.

[0218] S503, the second application, based on the first public key, encrypts system data, checksums, and trusted signatures to obtain evaluation response data.

[0219] S53, the second application sends evaluation response data to the first application, and the first application receives the evaluation response data sent by the second application.

[0220] S54, the first application reports the evaluation response data to the server, and the server receives the evaluation response data reported by the first application.

[0221] After the server obtains the assessment response data carrying system data, it can extract the system data from the assessment response data for security assessment. Please refer to S203 for further details.

[0222] S203, based on system data, performs a security assessment of the operating environment to be evaluated and obtains the assessment results.

[0223] After receiving the assessment response data, the server can perform a security assessment on the operating environment to be assessed based on the system data it carries, and obtain the assessment results. As mentioned earlier, the system data can contain at least one system state. Therefore, the server can perform the security assessment based on a preset reference state for each system state, and obtain the assessment results.

[0224] When a system state in the system data does not match its corresponding reference state, it indicates that there is an anomaly in the operating environment to be evaluated, and an anomaly assessment result is obtained; when every system state in the system data matches its corresponding reference state, it indicates that there is no anomaly in the operating environment to be evaluated, and a security assessment result is obtained.

[0225] As one embodiment, when at least one of the following conditions is determined based on system data, an anomaly assessment result is obtained, indicating that the operating environment to be assessed is abnormal; when at least one of the following conditions is determined based on system data, a security assessment result is obtained, indicating that the operating environment to be assessed is not abnormal.

[0226] Scenario 1:

[0227] If the system integrity verification field is preset with a reference value, then if the field value of the system integrity verification field does not match the reference value, it indicates that the operating system has been tampered with or is not operating normally, and an anomaly assessment result can be obtained.

[0228] Scenario 2:

[0229] The default reference state for developer permissions is locked. If the developer permissions are unlocked, meaning the developer permissions do not match the locked state, it indicates that loading a custom operating system image or making lower-level system modifications is allowed in the runtime environment to be evaluated. This suggests a security risk such as abnormal modification of the operating system in the runtime environment to be evaluated, and thus an abnormal evaluation result can be obtained.

[0230] Scenario 3:

[0231] The preset reference state for version identifiers is multiple reference identifiers. Each reference identifier comes from multiple reference versions released for the operating system, and the time interval between the release time and the current time is within a preset time period. In other words, each reference identifier comes from multiple recently released reference versions.

[0232] If the version identifier does not match any of the reference identifiers, it indicates that the operating system version of the environment to be evaluated is too old and has many unpatched vulnerabilities, thus resulting in an abnormal evaluation result.

[0233] Scenario 4:

[0234] If the device identifier is preset to a reference number, which represents a common device, then if the client's device identifier does not match the reference number, it indicates that the client type is relatively niche and may have some uncommon security vulnerabilities, thus obtaining an anomaly assessment result.

[0235] As can be seen, security assessments of the operating environment can be conducted from different perspectives depending on the specific circumstances, allowing for the selection of different security assessment processes based on the actual application scenario. Alternatively, a combination of multiple scenarios can be used for security assessments, some of which are listed below.

[0236] For example, an anomaly assessment result is obtained when the value of the system integrity verification field does not match the reference value, and the developer's permission status is unlocked; another example, an anomaly assessment result is obtained when the value of the system integrity verification field does not match the reference value, and the version identifier does not match any of the reference identifiers; another example, an anomaly assessment result is obtained when the developer's permission status is unlocked, and the version identifier does not match any of the reference identifiers; another example, an anomaly assessment result is obtained when the client's device identifier does not match the reference number, and the value of the system integrity verification field does not match the reference value; another example, an anomaly assessment result is obtained when the developer's permission status is unlocked, and the version identifier does not match any of the reference identifiers, and the value of the system integrity verification field does not match the reference value; another example, an anomaly assessment result is obtained when the value of the system integrity verification field does not match the reference value, the developer's permission status is unlocked, and the version identifier does not match any of the reference identifiers, and the client's device identifier does not match the reference number.

[0237] Multiple scenarios can each be associated with anomaly probabilities. When the sum of the anomaly probabilities of the scenarios reaches an anomaly threshold, an anomaly assessment result is obtained. For example, scenario one has an anomaly probability of 70%, scenario two has an anomaly probability of 65%, scenario three has an anomaly probability of 10%, and scenario four has an anomaly probability of 15%; the anomaly threshold is 70%. Therefore, if scenario one is met, an anomaly assessment result can be obtained directly; if scenarios two and three are met, an anomaly assessment result is obtained; if scenarios two and four are met, an anomaly assessment result is obtained; if scenarios three and four are met, a security assessment result is obtained, and so on, without specific limitations.

[0238] By considering various scenarios and perspectives, a safety assessment of the operating environment can be conducted, thereby improving the comprehensiveness of the safety assessment and ultimately enhancing its accuracy.

[0239] As one embodiment, when the evaluation response data is obtained by the second application using at least one encoding method, the evaluation response data can be considered as being generated by the second application combining system data and at least one type of data to be verified, with one encoding parameter corresponding to one type of data to be verified. One type of data to be verified can be one of the following: a first public key, a reference value, and a trusted signature.

[0240] Therefore, before conducting a security assessment, at least one type of data to be verified is extracted from the assessment response data. After verifying at least one type of data, a security assessment is then performed on the operating environment to be assessed based on the system data to obtain the assessment results.

[0241] By verifying at least one piece of data to be verified, the security of system data during transmission can be guaranteed, further improving the accuracy of security assessment and achieving the goal of improving the accuracy of operating environment assessment.

[0242] As one embodiment, if at least one piece of data to be verified includes a first public key, and the first public key comes from a first public-private key pair stored on the server, for example, after encoding by the second application using encoding method one, it can be shown that at least one piece of data to be verified includes the first public key. Then, after extracting at least one piece of data to be verified from the evaluation response data, the evaluation response data can be decrypted based on the first private key in the first public-private key pair. When the decryption is successful, it is determined that the verification of one piece of data to be verified has passed.

[0243] If the first private key can be successfully decrypted, it means that the first public key has not been tampered with during the transmission from the server to the second application, which can guarantee the data security of the evaluation response data to a certain extent.

[0244] As an example, if at least one piece of data to be verified includes a parameter value, for example, after encoding using encoding method two in the second application, it can be said that at least one piece of data to be verified includes a parameter value. Since it is not yet certain whether the verification value has been tampered with, it is not yet certain whether the parameter value is the verification value.

[0245] After extracting at least one type of data to be verified from the evaluation response data, the time when the parameter value extracted from the evaluation response data was obtained can be acquired. If the parameter value matches the pre-stored verification value, and the time interval between the value generation time and the value acquisition time associated with the verification value is within a preset time range, it is determined that one type of data to be verified has passed the verification. The verification value is generated by the server based on a preset value generation strategy.

[0246] When the parameter value matches the verification value, it indicates that the security assessment data has not been tampered with during the transmission from the second application to the server. At the same time, the parameter value is still within the verifiable period of the verification value (i.e., within the preset time range), which indicates that the security assessment data has not been stolen during the transmission from the second application to the server. This double verification confirms the data security of the security assessment data.

[0247] As one embodiment, if at least one piece of data to be verified includes a trusted signature, for example, after encoding by encoding method three in the second application, it can be shown that at least one piece of data to be verified includes a trusted signature, then after extracting at least one piece of data to be verified from the evaluation response data, the client's device identifier is extracted from the system data.

[0248] From the mapping relationship between each reference code and each second public key pre-stored on the server, the reference code that matches the device identifier is used as the device code, and the second public key corresponding to the device code is obtained. The device code is used to uniquely identify the device to which the hardware region of the trusted operating environment belongs, and the second public key corresponding to the device code comes from the second public-private key pair preset for the second application.

[0249] Based on the second public key corresponding to the device code, the trusted signature is verified. If the verification is successful, it is determined that the verification of a certain type of data to be verified has passed.

[0250] Based on the preceding explanation, since the second private key is unique to each device, even if the TEE of other devices is compromised, it will not significantly affect all devices of the same model or even all related devices, thus providing good security. If the second application uses the second private key for signing, it includes device identifiers in addition to system data. Therefore, using a unique device key to encrypt and anonymize the device identifiers protects the privacy and security of client users.

[0251] As one implementation, during signature verification, parameter values ​​can be extracted from the assessment response data. These parameter values ​​are obtained based on the verification value carried by the security assessment command. The parameter value can be the verification value itself; if the parameter value is tampered with, then the parameter value and the verification value will be different. The verification value is generated by the server based on a preset value generation strategy.

[0252] When the trusted signature is successfully decrypted based on the second public key corresponding to the device code, hash data is obtained. This hash data can be obtained by the second application performing a hash operation on the concatenated data of system data and verification value based on a preset hash algorithm.

[0253] Based on a pre-stored hash algorithm, a hash operation is performed on the concatenated data of system data and parameter values ​​to obtain the signature verification data. If the signature verification data and the hash data match, it indicates that the evaluation response data has not been tampered with, thus confirming successful verification of the trusted signature.

[0254] The following example illustrates the runtime environment assessment method provided in this application, using a scenario where a security assessment instruction is obtained by executing a function response to a transfer function (i.e., a specified function) triggered by a banking application (i.e., a third-party application) in the runtime environment to be assessed provided by the client. Please refer to [link / reference]. Figure 6A and Figure 6B .

[0255] S601, the third application in the client sends a security assessment request to the server, and the server receives the security assessment request sent by the third application.

[0256] S602, the server generates a verification value based on a preset value generation strategy.

[0257] S603: The server generates a security assessment instruction based on the security assessment request, the first public key, and the verification value.

[0258] S604, the server sends a security assessment instruction to the first application (CA) in the client, and the first application receives the security assessment instruction sent by the server.

[0259] S605, the first application forwards a security assessment instruction to the second application (TA), and the second application receives the security assessment instruction forwarded by the first application.

[0260] S606, the second application calls the SDK to collect system data, including system integrity verification fields, bootloader status, the system version identifier of the operating system (such as Android) in the environment to be evaluated, and the device identifier of the client.

[0261] S607, the second application uses the second private key to sign system data and verification values ​​to obtain a trusted signature.

[0262] S608, the second application, based on the first public key, encrypts system data, checksums, and trusted signatures to obtain evaluation response data.

[0263] S609, the second application sends evaluation response data to the first application, and the first application receives the evaluation response data sent by the second application.

[0264] S610, the first application reports the evaluation response data to the server, and the server receives the evaluation response data reported by the first application.

[0265] S611: When the server successfully decrypts the evaluation response data based on the first private key, it obtains system data, parameter values, and a trusted signature.

[0266] S612, the server extracts the device identifier from the system data and obtains the second public key corresponding to the device identifier from the pre-stored mapping relationship.

[0267] S613, when the server successfully verifies the trusted signature based on the obtained second public key and determines that the parameter value matches the verification value, it performs a security assessment on the operating environment to be evaluated based on system data and obtains the assessment result.

[0268] S614, if the server determines that the evaluation result indicates that there is no anomaly in the operating environment to be evaluated, it returns an environment security indication to the third application; if the server determines that the evaluation result indicates that there is anomaly in the operating environment to be evaluated, it returns an environment anomaly indication to the third application.

[0269] S615, when the third application receives an environmental security indication, it executes the specified function (such as a money transfer function); when it receives an environmental anomaly indication, it displays a function execution failure prompt.

[0270] Based on the same inventive concept, a security assessment can also be conducted by the first application; please refer to [reference needed]. Figure 7A .

[0271] S71, the first application sends a security assessment instruction to the second application, so that the second application can collect system data of the operating environment to be assessed based on the security assessment instruction.

[0272] The second application runs in a trusted operating environment provided by the client; the operating environment to be evaluated and the trusted operating environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application.

[0273] S72 receives evaluation response data sent by the second application, the evaluation response data carrying system data.

[0274] S73 performs a security assessment of the operating environment to be evaluated based on system data and obtains the assessment results.

[0275] As one embodiment, if the security assessment instruction originates from a third application running in the environment to be assessed, and the security assessment instruction is generated by the first application in response to the third application performing an operation triggered for a specified function, then, after obtaining the assessment result, if the assessment result indicates that there are no anomalies in the environment to be assessed, an environment security indication is generated. The environment security indication is then sent to the third application so that the third application executes the specified function based on the environment security indication.

[0276] The following example illustrates the evaluation method for the runtime environment provided in this application, using the example of obtaining a security assessment instruction in response to a launch operation triggered by a game application (i.e., a third-party application). Please refer to [link / reference]. Figure 7B .

[0277] S701, when the first application (CA) detects a launch operation triggered for the game application, it generates a verification value based on a preset value generation strategy.

[0278] S702 generates a security assessment instruction based on the pre-stored first public key and verification value.

[0279] S703, the first application sends a security assessment instruction to the second application (TA), and the second application receives the security assessment instruction sent by the first application.

[0280] S704, the second application calls the SDK to collect system data, including system integrity verification fields, bootloader status, the system version identifier of the operating system (such as Android) in the environment to be evaluated, and the device identifier of the client.

[0281] S705, the second application generates evaluation response data based on system data (the process of generating evaluation response data can be referred to the previous introduction, and will not be repeated here).

[0282] S706, the second application sends evaluation response data to the first application, and the first application receives the evaluation response data sent by the second application.

[0283] S707, the first application, based on the pre-stored first private key, obtains system data, parameter values, and a trusted signature when it successfully decrypts the evaluation response data.

[0284] S708: When the first application successfully verifies the trusted signature based on the pre-stored second public key and determines that the parameter value matches the verification value, it performs a security assessment on the operating environment to be evaluated based on system data and obtains the assessment result.

[0285] S709, if the first application determines that the evaluation result indicates that there is no anomaly in the operating environment to be evaluated, it returns an environmental safety indication to the third application; if the evaluation result indicates that there is an anomaly in the operating environment to be evaluated, it returns an environmental anomaly indication to the third application.

[0286] The S710 allows a third-party application (i.e., a game application) to launch when it receives a security indication; conversely, it prevents the launch of the third-party application when it receives an abnormal indication. This helps prevent cheating and resource farming in the game application, thus improving the gaming experience.

[0287] Based on the same inventive concept, embodiments of this application provide an operating environment evaluation device, applied to a server, capable of realizing the functions corresponding to the aforementioned operating environment evaluation method. Please refer to... Figure 8A The device includes a transceiver module 81 and a processing module 82, wherein:

[0288] Transceiver module 81: Used to send a security assessment instruction to the first application, so that the first application forwards the security assessment instruction to the second application; wherein, the first application runs in the evaluation environment provided by the client; the second application runs in the trusted environment provided by the client; the evaluation environment and the trusted environment are located in different hardware areas, and the different hardware areas communicate with each other through the first application;

[0289] The transceiver module 81 is also used to: receive evaluation response data reported by the first application; wherein the evaluation response data carries system data of the operating environment to be evaluated collected by the second application based on the security evaluation command;

[0290] Processing module 82: Used to perform a security assessment of the operating environment to be evaluated based on system data and obtain the assessment results.

[0291] In one possible embodiment, the evaluation response data is generated by a second application combining system data and at least one type of data to be verified; then the processing module 82 is specifically used for:

[0292] Extract at least one piece of data to be verified from the evaluation response data;

[0293] After at least one piece of data to be verified passes the verification, a security assessment is performed on the operating environment to be evaluated based on the system data, and the assessment results are obtained.

[0294] In one possible embodiment, at least one piece of data to be verified includes: a first public key; the first public key comes from a first public-private key pair stored on the server; then the processing module 82 is further configured to:

[0295] After extracting at least one type of data to be verified from the evaluation response data, when the evaluation response data is successfully decrypted based on the first private key in the first public-private key pair, it is determined that the verification of one type of data to be verified has passed.

[0296] In one possible embodiment, at least one piece of data to be verified includes: parameter values; then the processing module 82 is specifically used for:

[0297] After extracting at least one data to be verified from the evaluation response data, the time when the value of the parameter extracted from the evaluation response data is obtained is acquired.

[0298] If the parameter value matches the pre-stored verification value, and the time interval between the value generation time and the value acquisition time associated with the verification value is within the preset time range, it is determined that the verification of a type of data to be verified has passed; wherein, the verification value is generated by the server based on the preset value generation strategy.

[0299] In one possible embodiment, at least one piece of data to be verified includes: a trusted signature; then the processing module 82 is specifically used for:

[0300] After extracting at least one piece of data to be verified from the evaluation response data, the client's device identifier is extracted from the system data;

[0301] In the pre-stored mapping relationship between each reference code and each second public key, the reference code that matches the device identifier is used as the device code, and the second public key corresponding to the device code is obtained; wherein, the device code is used to uniquely represent the device to which the hardware region of the trusted operating environment belongs; the second public key corresponding to the device code comes from the second public-private key pair preset for the second application;

[0302] When the trusted signature is successfully verified based on the second public key corresponding to the device code, it is determined that the verification of one type of data to be verified has passed.

[0303] In one possible embodiment, the processing module 82 is specifically used for:

[0304] Parameter values ​​are extracted from the assessment response data. These parameter values ​​are obtained based on the verification values ​​carried by the security assessment instructions. The verification values ​​are generated by the server based on a preset value generation strategy.

[0305] When the trusted signature is successfully decrypted based on the second public key corresponding to the device code, hash data is obtained; the hash data is obtained by performing a hash operation on the concatenated data of system data and verification value based on a preset hash algorithm.

[0306] Based on the pre-stored hash algorithm, the concatenated data of system data and parameter values ​​is hashed to obtain the signature verification data;

[0307] When the signature verification data and hash data match, it is determined that the trusted signature verification was successful.

[0308] In one possible embodiment, the system data includes at least one of: a system integrity verification field, a developer permission status, and a version identifier of the system version of the operating system running in the environment to be evaluated;

[0309] The system integrity verification field is updated by the operating system periodically checking whether the specified configuration data has been modified during operation; the developer permission status indicates whether the permission to modify data with the operating system has been authorized.

[0310] In one possible embodiment, the processing module 82 is specifically used for:

[0311] An anomaly assessment result is obtained when at least one of the following conditions is identified based on system data; wherein, the anomaly assessment result indicates that the operating environment to be assessed is abnormal; the conditions include:

[0312] The values ​​of the system integrity verification field do not match the preset reference values ​​for the system integrity verification field;

[0313] Developer privileges are currently unlocked.

[0314] The version identifier does not match any of the obtained reference identifiers; each reference identifier comes from multiple reference versions released for the operating system, and the time interval between the release time and the current time is within a preset time period.

[0315] Based on the same inventive concept, embodiments of this application provide an operating environment evaluation device, applied to a client, capable of realizing the functions corresponding to the aforementioned operating environment evaluation method. Please refer to... Figure 8B The device includes a transceiver module 801 and a processing module 802, wherein:

[0316] Transceiver module 801: Used for the first application to send a security assessment command to the second application, so that the second application can collect system data of the operating environment to be assessed based on the security assessment command; wherein, the first application runs in the operating environment to be assessed provided by the client; the second application runs in the trusted operating environment provided by the client; the operating environment to be assessed and the trusted operating environment are located in different hardware areas, and data communication between different hardware areas is carried out by the first application or the second application calling the transceiver module;

[0317] The transceiver module 801 is also used for: the first application receiving evaluation response data sent by the second application; wherein the evaluation response data carries system data;

[0318] Processing module 802: Used by the first application to perform a security assessment on the operating environment to be evaluated based on system data, and obtain the assessment results.

[0319] In one possible embodiment, the security assessment instruction comes from a third application running in the environment to be assessed. The security assessment instruction is generated by the third application in response to a function execution operation triggered for a specified function.

[0320] The processing module 802 is also used for:

[0321] After obtaining the assessment results, if the assessment results indicate that there are no anomalies in the operating environment to be assessed, an environmental safety indication is generated;

[0322] Send an environment security instruction to a third application so that the third application can perform a specified function based on the environment security instruction.

[0323] Based on the same inventive concept, embodiments of this application provide an operating environment evaluation device, applied to a client, capable of realizing the functions corresponding to the aforementioned operating environment evaluation method. Please refer to... Figure 8C The device includes a transceiver module 8001 and a processing module 8002, wherein:

[0324] Transceiver module 8001: Used for the second application to receive security assessment instructions from the first application; wherein, the first application runs in the evaluation environment provided by the client; the second application runs in the trusted environment provided by the client; the evaluation environment and the trusted environment are located in different hardware areas, and data communication between the different hardware areas is performed by calling the transceiver module through the first application or the second application;

[0325] Processing module 8002: Used by the second application to collect system data of the operating environment to be evaluated based on security assessment instructions;

[0326] The transceiver module 8001 is also used for: sending evaluation response data carrying system data from the second application to the first application, so that the first application forwards the evaluation response data to the server, and the server performs a security evaluation of the operating environment to be evaluated based on the system data to obtain the evaluation result.

[0327] In one possible embodiment, the processing module 8002 is specifically used for:

[0328] Based on the data collection targets indicated by the security assessment instructions, the device interface is invoked to collect system data of the operating environment to be assessed;

[0329] The data collection targets include at least one of the following: system integrity verification field, developer permission status, and version identifier of the operating system running in the environment to be evaluated; the system integrity verification field is updated by the operating system periodically checking whether the specified configuration data has been modified during operation; the developer permission status indicates whether the permission to modify data for the operating system has been authorized; the device interface is configured for the client and is used to establish a data transmission channel between the client and the operating system.

[0330] Based on the same inventive concept, embodiments of this application provide an operating environment evaluation system, including a server and a client, capable of implementing the functions corresponding to the aforementioned operating environment evaluation method. Please continue to refer to... Figure 1C .

[0331] Please refer to Figure 9 This is a computer device 900 provided in the embodiments of this application. The computer device 900 can, for example, be... Figure 1C The client 102 or server 101 in the system. The current and historical versions of the data storage program and the application software corresponding to the data storage program can be installed on a computer device 900, which includes a processor 980 and a memory 920. In some embodiments, the computer device 900 may include a display unit 940, which includes a display panel 941 for displaying a user-interactive interface, etc.

[0332] In one possible embodiment, the display panel 941 may be configured in the form of a liquid crystal display (LCD) or an organic light-emitting diode (OLED).

[0333] The processor 980 is used to read a computer program and then execute the methods defined by the computer program. For example, the processor 980 reads a data storage program or file, thereby running the data storage program on the computer device 900 and displaying the corresponding interface on the display unit 940. The processor 980 may include one or more general-purpose processors, and may also include one or more digital signal processors (DSPs) for performing related operations to implement the technical solutions provided in the embodiments of this application.

[0334] The memory 920 generally includes main memory and secondary storage. Main memory can be random access memory (RAM), read-only memory (ROM), and cache, etc. Secondary storage can be a hard disk, optical disk, USB flash drive, floppy disk, or magnetic tape drive, etc. The memory 920 is used to store computer programs and other data. The computer programs include applications corresponding to each client, and other data may include data generated after the operating system or applications are run, including system data (e.g., operating system configuration parameters) and user data. In this embodiment, the computer program is stored in the memory 920, and the processor 980 executes the computer program in the memory 920 to implement any of the methods described in the preceding figures.

[0335] The aforementioned display unit 940 is used to receive input digital information, character information, or contact touch operations / non-contact gestures, and to generate signal inputs related to user settings and function control of the computer device 900. Specifically, in this embodiment, the display unit 940 may include a display panel 941. The display panel 941, for example, is a touch screen, which can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or on the display panel 941), and drive corresponding connection devices according to a pre-set program.

[0336] In one possible embodiment, the display panel 941 may include two parts: a touch detection device and a touch controller. The touch detection device detects the player's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller. The touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 980. It can also receive and execute commands from the processor 980.

[0337] The display panel 941 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 940, in some embodiments, the computer device 900 may also include an input unit 930. The input unit 930 may include an image input device 931 and other input devices 932, wherein the other input devices may include, but are not limited to, one or more of the following: a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), a trackball, a mouse, and a joystick.

[0338] As one embodiment, the display unit 940 can present the game process of the target game in video form based on the game video stream, and use preset timbre to broadcast the game commentary text in audio form.

[0339] In addition to the above, the computer device 900 may also include a power supply 990 for powering other modules, an audio circuit 960, a near-field communication module 970, and an RF circuit 910. The computer device 900 may also include one or more sensors 950, such as an accelerometer, a light sensor, and a pressure sensor. The audio circuit 960 specifically includes a speaker 961 and a microphone 962, for example, the computer device 900 can use the microphone 962 to collect the user's voice and perform corresponding operations.

[0340] As one embodiment, the number of processors 980 can be one or more, and the processors 980 and the memory 920 can be coupled together or relatively independent.

[0341] As one example, Figure 9 The processor 980 in the middle can be used to implement, for example Figure 8A The transceiver module 81 and processing module 82 in the middle can also be used to implement, for example Figure 8B The transceiver module 801 and processing module 802 in the middle can also be used to implement, for example Figure 8C The functions of the transceiver module 8001 and the processing module 8002 in the middle.

[0342] As one example, Figure 9 The processor 980 in the text can be used to implement the functions of the server or terminal devices discussed above.

[0343] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by a computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the computer program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0344] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of software products, for example, through computer program products. These computer program products are stored in a storage medium and include computer programs used to cause a computer device to execute all or part of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0345] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for evaluating an operating environment, characterized in that, Applied to the server side, including: A security assessment instruction is sent to a first application, which then forwards the security assessment instruction to a second application. The first application runs in a client-provided environment to be assessed, and the second application runs in a client-provided trusted environment. The environment to be assessed and the trusted environment are located in different hardware regions, and data communication between these different hardware regions is achieved through the first application. Receive the evaluation response data reported by the first application; wherein the evaluation response data carries system data of the operating environment to be evaluated collected by the second application based on the security evaluation command; Based on the system data, a security assessment is performed on the operating environment to be evaluated, and the assessment results are obtained.

2. The method according to claim 1, characterized in that, The evaluation response data is generated by the second application in combination with the system data and at least one type of data to be verified. The process of performing a security assessment on the operating environment to be evaluated based on the system data, and obtaining the assessment results, includes: Extract at least one data to be verified from the evaluation response data; After the at least one piece of data to be verified passes the verification, a security assessment is performed on the operating environment to be evaluated based on the system data to obtain the assessment result.

3. The method according to claim 2, characterized in that, The at least one piece of data to be verified includes: a first public key; the first public key comes from a first public-private key pair stored on the server; After extracting the at least one data to be verified from the evaluation response data, the method further includes: When the evaluation response data is successfully decrypted based on the first private key in the first public-private key pair, it is determined that the verification of one type of data to be verified has passed.

4. The method according to claim 2, characterized in that, The at least one piece of data to be verified includes: parameter values; after extracting the at least one piece of data to be verified from the evaluation response data, it further includes: Obtain the time when the parameter value is extracted from the evaluation response data; When the parameter value matches the pre-stored verification value, and the time interval between the value generation time associated with the verification value and the value acquisition time is within a preset time range, it is determined that the verification of one type of data to be verified has passed; wherein, the verification value is generated by the server based on a preset value generation strategy.

5. The method according to claim 2, characterized in that, The at least one piece of data to be verified includes: a trusted signature; after extracting the at least one piece of data to be verified from the evaluation response data, it further includes: Extract the client's device identifier from the system data; In the pre-stored mapping relationship between each reference code and each second public key, the reference code that matches the device identifier is used as the device code, and the second public key corresponding to the device code is obtained; wherein, the device code is used to uniquely represent the device to which the hardware region of the trusted operating environment belongs; the second public key corresponding to the device code comes from the second public-private key pair preset for the second application; When the trusted signature is successfully verified based on the second public key corresponding to the device code, it is determined that the verification of one type of data to be verified has passed.

6. The method according to claim 5, characterized in that, The successful verification of the trusted signature based on the second public key corresponding to the device encoding includes: Parameter values ​​are extracted from the evaluation response data; wherein the parameter values ​​are obtained based on the verification value carried by the security evaluation command, and the verification value is generated by the server based on a preset value generation strategy; When the trusted signature is successfully decrypted based on the second public key corresponding to the device code, hash data is obtained; wherein, the hash data is obtained by performing a hash operation on the concatenated data of the system data and the verification value based on a preset hash algorithm; Based on the pre-stored hash algorithm, a hash operation is performed on the concatenated data of the system data and the parameter values ​​to obtain the signature verification data; When the signature verification data and the hash data match, it is determined that the trusted signature verification was successful.

7. The method according to any one of claims 1 to 6, characterized in that, The system data includes at least one of the following: system integrity verification field, developer permission status, and version identifier of the operating system running in the environment to be evaluated; The system integrity verification field is updated by the operating system periodically checking whether the specified configuration data has been modified during operation; the developer permission status indicates whether the permission to modify data for the operating system has been authorized.

8. The method according to claim 7, characterized in that, The process of performing a security assessment on the operating environment to be evaluated based on the system data, and obtaining the assessment results, includes: An anomaly assessment result is obtained when at least one of the following conditions is determined based on the system data; wherein the anomaly assessment result indicates that the operating environment to be assessed is abnormal; the various conditions include: The value of the system integrity verification field does not match the preset reference value for the system integrity verification field; The developer permissions are currently unlocked. The version identifier does not match any of the obtained reference identifiers; wherein, each reference identifier comes from a plurality of reference versions released for the operating system, and the time interval between the release time and the current time is within a preset time period.

9. A method for evaluating an operating environment, characterized in that, Applied to a first application, which runs in a runtime environment provided by the client for evaluation; including: A security assessment instruction is sent to a second application, which then collects system data of the operating environment to be assessed based on the security assessment instruction; wherein the second application runs in a trusted operating environment provided by the client; the operating environment to be assessed and the trusted operating environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application; Receive evaluation response data sent by the second application; wherein the evaluation response data carries the system data; Based on the system data, a security assessment is performed on the operating environment to be evaluated, and the assessment results are obtained.

10. The method according to claim 9, characterized in that, The security assessment instruction comes from a third application running in the environment to be assessed. The security assessment instruction is generated by the third application in response to a function execution operation triggered for a specified function. After obtaining the evaluation results, the process also includes: When the evaluation result indicates that there are no anomalies in the operating environment to be evaluated, an environmental safety indication is generated; The environmental security instruction is sent to the third application so that the third application performs the specified function based on the environmental security instruction.

11. A method for evaluating an operating environment, characterized in that, Applied to a second application, which runs in a trusted runtime environment provided by the client; including: The system receives a security assessment instruction from a first application; wherein the first application runs in the evaluation environment provided by the client; the evaluation environment and the trusted environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application. Based on the security assessment instructions, system data of the operating environment to be assessed is collected; An evaluation response data carrying the system data is sent to the first application, so that the first application forwards the evaluation response data to the server. The server then performs a security evaluation on the operating environment to be evaluated based on the system data and obtains the evaluation result.

12. The method according to claim 11, characterized in that, The process of collecting system data from the operating environment to be evaluated based on the security assessment instructions includes: Based on the data collection target indicated by the security assessment instruction, the device interface is invoked to collect system data of the operating environment to be assessed; The data collection targets include at least one of the following: a system integrity verification field, a developer permission status, and a version identifier of the operating system running in the environment to be evaluated; the system integrity verification field is updated by periodically checking whether the specified configuration data has been modified during the operation of the operating system; the developer permission status indicates whether the data modification permission for the operating system has been authorized; the device interface is configured for the client and is used to establish a data transmission channel between the client and the operating system.

13. An operating environment evaluation device, characterized in that, Applied to the server side, including: Transceiver module: used to send a security assessment instruction to a first application, so that the first application forwards the security assessment instruction to a second application; wherein, the first application runs in a runtime environment to be assessed provided by the client; the second application runs in a trusted runtime environment provided by the client; the runtime environment to be assessed and the trusted runtime environment are located in different hardware regions, and the different hardware regions communicate with each other through the first application; The transceiver module is further configured to: receive evaluation response data reported by the first application; wherein the evaluation response data carries system data of the operating environment to be evaluated collected by the second application based on the security evaluation command; Processing module: Used to perform a security assessment on the operating environment to be evaluated based on the system data, and obtain the assessment results.

14. An operating environment evaluation device, characterized in that, Applied to the client side, including: Transceiver module: Used for a first application to send a security assessment command to a second application, so that the second application can collect system data of the operating environment to be assessed based on the security assessment command; wherein, the first application runs in the operating environment to be assessed provided by the client; the second application runs in a trusted operating environment provided by the client; the operating environment to be assessed and the trusted operating environment are located in different hardware areas, and the different hardware areas communicate with each other by calling the transceiver module through the first application or the second application; The transceiver module is further configured to: receive evaluation response data sent by the second application from the first application; wherein the evaluation response data carries the system data; Processing module: Used by the first application to perform a security assessment on the operating environment to be evaluated based on the system data, and obtain the assessment result.

15. An operating environment evaluation device, characterized in that, Applied to the client side, including: Transceiver module: used for the second application to receive security assessment instructions from the first application; wherein, the first application runs in the evaluation environment provided by the client; the second application runs in the trusted environment provided by the client; the evaluation environment and the trusted environment are located in different hardware regions, and the different hardware regions communicate with each other by calling the transceiver module through the first application or the second application; Processing module: used by the second application to collect system data of the operating environment to be evaluated based on the security assessment instructions; The transceiver module is further configured to: send evaluation response data carrying the system data to the first application, so that the first application forwards the evaluation response data to the server, and the server performs a security evaluation on the operating environment to be evaluated based on the system data to obtain the evaluation result.

16. An evaluation system for an operating environment, characterized in that, It includes a server and a client; the server includes the apparatus as described in claim 13, and the client includes the apparatus as described in claim 14 or 15.

17. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method as described in any one of claims 1 to 12.

18. A computer device, characterized in that, include: Memory, used to store computer programs; A processor is configured to invoke a computer program stored in the memory and execute the method as described in any one of claims 1 to 12 according to the obtained computer program.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that causes a computer to perform the method as described in any one of claims 1 to 12.

Images