Application firewall implementation method for embedded device, storage medium, and apparatus

Abstract

The present invention relates to the field of computers. Disclosed are an application firewall implementation method for an embedded device, a storage medium, and an apparatus. The described method comprises: creating an identifier object according to a unique identifier of an application package, and after the application package has been downloaded on an embedded device, registering application package information according to the identifier object; on the basis of an occasion of creation and an environment to which the objects belong, classifying all objects on the embedded device; and accessing an object according to the type of the object, the means by which the object is invoked, and the runtime environment. In the present invention, an identifier object of an application package is used as an environment value of an application object, so that uniqueness is ensured. While running an application or upgrading an application package, firewall inspection may be performed by identifying an object, effectively solving the problem that object access may not match the runtime environment.

Description

Application firewall implementation method, storage medium and device for embedded devices Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method, storage medium and device for realizing an application firewall of an embedded device. Background Art

[0002] For virtual machines supported on embedded devices, such as the Java (an object-oriented programming language) card virtual machine, object access control typically uses the package download sequence ID (code) as its runtime environment. Access control permissions for all objects are determined based on this sequence ID. However, when the virtual machine supports package upgrades, the download sequence ID of the new upgrade package differs from the original package, and existing user data (objects) cannot be modified. This leads to problems with firewall checks on existing objects after the package upgrade. Therefore, there is an urgent need for a better object firewall implementation method.

[0003] Summary of the Invention

[0004] In response to the defects existing in the prior art, the purpose of the present invention is to provide an application firewall implementation method, storage medium and device for embedded devices, which uses the identification object of the application package as the environment value of the application object to ensure uniqueness. The object can be identified to perform firewall checks during the application operation process or the application package upgrade process, effectively solving the problem of possible mismatch between object access and runtime environment.

[0005] To achieve the above objectives, the present invention provides a method for implementing an application firewall in an embedded device, which specifically includes the following steps:

[0006] Create an identification object based on the unique identifier of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device;

[0007] Classify all objects on embedded devices based on when they were created and the environment they belong to;

[0008] Access to objects is achieved based on their type, the way they are called, and the runtime environment.

[0009] Based on the above technical solution, before creating an identification object based on the unique identifier of the application package, the following steps are also included:

[0010] When an embedded device downloads an application package, the operating system of the embedded device checks whether the unique identifier of the application package to be downloaded has been registered on the embedded device:

[0011] If not, create an identification object based on the unique identifier of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device;

[0012] If so, no action will be taken.

[0013] Based on the above technical solution, the steps of classifying all objects on the embedded device according to the creation time and the environment to which they belong include:

[0014] For all objects on the embedded device, objects are divided into runtime environment objects and application objects according to the time when the objects are created and the environment to which the objects belong.

[0015] Based on the above technical solution, for the runtime environment object, specifically:

[0016] A runtime environment object is created through the runtime environment of the operating system of the embedded device, and any application in the operating system can access the runtime environment object;

[0017] Indicates the object context stored in the runtime context object based on the set index value.

[0018] On the basis of the above technical solutions, for the application objects, specifically:

[0019] An application object is created through an application package or an application instance of an application package. The package object created during the application package download process and the instance object created during the application installation or operation process are not application objects.

[0020] An object environment stored in an application object is represented by an object index based on an application package identifier;

[0021] When the application object is not a global reference object, access to the application object is allowed only when the currently executed runtime environment is the system runtime environment or the currently executed runtime environment is the same as the object environment of the application object.

[0022] Based on the above technical solution, the access to the object is achieved based on the type of the object, the way the object is called, and the runtime environment. The specific steps include:

[0023] Based on the type of object, the way the object is called, and the runtime environment, object access types are divided into object-based method calls and object read and write access to achieve access to objects.

[0024] On the basis of the above technical solution, for object-based method calls, specifically:

[0025] When the embedded device supports shared interface methods and the object to be accessed is a shared interface object, determining whether the method called by the object to be accessed is a shared interface method;

[0026] If so, access to the object to be accessed is allowed;

[0027] If not, when the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

[0028] Based on the above technical solution, for read and write access to objects, specifically:

[0029] If the object to be accessed is a runtime environment object, the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

[0030] The present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method for implementing an application firewall of an embedded device are implemented.

[0031] The present invention provides an application firewall implementation device for an embedded device, comprising:

[0032] A creation module, which is used to create an identification object based on the unique identification of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device;

[0033] A classification module, which is used to classify all objects on the embedded device according to the time of creation and the environment they belong to;

[0034] The execution module is used to implement access to objects based on the type of the object, the way the object is called, and the runtime environment.

[0035] Compared with the existing technology, the advantages of the present invention are: by creating an identification object based on the unique identification of the application package, and registering the application package information based on the identification object after the application package is downloaded on the embedded device, all objects on the embedded device are classified according to the time of creation and the environment to which they belong, and finally access to the object is achieved based on the type of the object, the way the object is called and the runtime environment, and the identification object of the application package is used as the environment value of the application object to ensure uniqueness. The object can be identified for firewall inspection during the application operation process or the application package upgrade process, which effectively solves the problem that there may be a mismatch between object access and the runtime environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] FIG1 is a flow chart of a method for implementing an application firewall for an embedded device according to an embodiment of the present invention;

[0038] FIG2 is a schematic structural diagram of an apparatus for implementing an application firewall of an embedded device according to the present invention. DETAILED DESCRIPTION

[0039] An embodiment of the present invention provides a method for implementing an application firewall for an embedded device. The method creates an identification object based on the unique identifier of an application package, registers application package information based on the identification object after the application package is downloaded to the embedded device, classifies all objects on the embedded device according to the time of creation and the environment to which they belong, and finally implements access to the object based on the object type, the method in which the object is called, and the runtime environment. The identification object of the application package is used as the environment value of the application object to ensure uniqueness. The object can be identified for firewall checks during the application operation process or the application package upgrade process, effectively solving the problem of possible mismatch between object access and the runtime environment. The embodiment of the present invention also provides a non-transitory computer-readable storage medium and an application firewall implementation device for an embedded device.

[0040] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0041] 1 , an embodiment of the present invention provides a method for implementing an application firewall in an embedded device, which specifically includes the following steps:

[0042] S1: Create an identification object based on the unique identifier of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device;

[0043] In the present invention, before creating an identification object based on the unique identifier of the application package, the following steps are further included:

[0044] When an embedded device downloads an application package, the operating system of the embedded device checks whether the unique identifier of the application package to be downloaded has been registered on the embedded device:

[0045] If not, create an identification object based on the unique identifier of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device;

[0046] If so, no action will be taken.

[0047] That is, before an embedded device such as a smart card or security module downloads an application package, the operating system of the embedded device checks whether the unique identifier of the application package to be downloaded (i.e., application identifier, referred to as AID) has been registered on the embedded device. If not, the operating system uses the unique identifier of the application package to create an identification object, and after the application package is successfully downloaded, the identification object is used to register the application package information. S2: All objects on the embedded device are classified according to the creation time and the environment to which they belong;

[0048] In the present invention, all objects on the embedded device are classified according to the creation time and the environment to which they belong. The specific steps include: for all objects on the embedded device, according to the creation time of the object and the environment to which the object belongs, the objects are divided into runtime environment objects and application objects.

[0049] That is, all objects on the embedded device are divided into two types: runtime environment objects and application objects.

[0050] For runtime environment objects, specifically:

[0051] A runtime environment object is created through the runtime environment of the operating system of the embedded device, and any application in the operating system can access the runtime environment object;

[0052] The object environment stored in the runtime environment object is represented based on the set index value, that is, the object environment stored in the runtime environment object is represented by a special index value (such as 0x0000, etc.). The identification object created in step S1 belongs to the runtime environment object.

[0053] In the present invention, the application objects are specifically:

[0054] An application object is created through an application package or an application instance of an application package. The package object created during the application package download process and the instance object created during the application installation or operation process are not application objects.

[0055] An object environment stored in an application object is represented by an object index based on an application package identifier;

[0056] When the application object is not a global reference object, access to the application object is allowed only when the currently executed runtime environment is the system runtime environment or the currently executed runtime environment is the same as the object environment of the application object.

[0057] Application objects are created by application packages or application instances within them. If an application object is not a globally referenced object, access is permitted only when the current runtime environment is the system runtime environment, or when the current runtime environment is the same as the application object's object environment. Package objects created during application package download and instance objects created during application installation or execution are all considered application objects. The object environment stored within an application object is the identifying object index of the package.

[0058] S3: Access to objects is based on the type of object, how the object is called, and the runtime environment.

[0059] In the present invention, access to an object is achieved based on the type of the object, the way the object is called, and the runtime environment. The specific steps include:

[0060] Based on the type of object, the way the object is called, and the runtime environment, object access types are divided into object-based method calls and object read and write access to achieve access to objects.

[0061] In the present invention, for object-based method calls, specifically:

[0062] When the embedded device supports shared interface methods and the object to be accessed is a shared interface object, determining whether the method called by the object to be accessed is a shared interface method;

[0063] If so, access to the object to be accessed is allowed;

[0064] If not, when the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

[0065] That is, when the embedded device supports shared interface methods, if the object to be accessed is a shared interface object and the called method is a shared interface method, access to the object to be accessed is allowed. If the called method is not a shared interface method, access to the object to be accessed is allowed only when the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed.

[0066] In the present invention, for the read and write access of an object, specifically:

[0067] If the object to be accessed is a runtime environment object, the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

[0068] That is, if the object to be accessed is a runtime environment object, access to the object to be accessed is allowed; if the currently executed runtime environment is the system runtime environment, access to the object to be accessed is allowed; if the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

[0069] The method for implementing an application firewall for an embedded device in an embodiment of the present invention creates an identification object based on the unique identification of an application package, registers application package information based on the identification object after the application package is downloaded on the embedded device, classifies all objects on the embedded device according to the time of creation and the environment to which they belong, and finally implements access to the object based on the type of the object, the way the object is called, and the runtime environment. The identification object of the application package is used as the environment value of the application object to ensure uniqueness. The object can be identified for firewall inspection during the application operation process or the application package upgrade process, effectively solving the problem of possible mismatch between object access and the runtime environment.

[0070] In one possible implementation, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, the readable storage medium being located in a PLC (Programmable Logic Controller) controller, and the readable storage medium storing a computer program that, when executed by a processor, implements the following steps of the method for implementing an application firewall for an embedded device:

[0071] Create an identification object based on the unique identifier of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device;

[0072] Classify all objects on embedded devices based on when they were created and the environment they belong to;

[0073] Access to objects is achieved based on their type, the way they are called, and the runtime environment.

[0074] The storage medium can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or device.

[0075] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0076] Computer program code for performing the operations of the present invention can be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0077] 2 , an embodiment of the present invention provides an apparatus for implementing an application firewall for an embedded device, including a creation module, a classification module, and an execution module.

[0078] The creation module is used to create an identification object based on the unique identifier of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device; the classification module is used to classify all objects on the embedded device according to the time of creation and the environment to which they belong; the execution module is used to implement access to the object based on the type of the object, the way the object is called, and the runtime environment.

[0079] The foregoing is merely a list of specific embodiments of the present application, intended to enable those skilled in the art to understand or implement the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the broadest scope consistent with the principles and novel features of the present application.

[0080] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as combinations of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the block diagram.

Claims

1. A method for implementing an application firewall of an embedded device, characterized in that: The specific steps include: Create an identification object based on the unique identification of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device; Classify all objects on embedded devices according to when they were created and the environment they belong to; Access to objects is achieved based on the type of object, the way the object is called, and the runtime environment.

2. The method for implementing an application firewall of an embedded device as claimed in claim 1, characterized in that: Before creating an identity object based on the unique identity of the application package, it also includes: When an embedded device downloads an application package, the operating system of the embedded device checks whether the unique identifier of the application package to be downloaded has been registered on the embedded device: If not, create an identification object based on the unique identification of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device; If so, no processing is done.

3. The method for implementing an application firewall of an embedded device as claimed in claim 1, characterized in that: The steps of classifying all objects on the embedded device according to the creation time and the environment to which they belong include: For all objects on the embedded device, according to the time when the object is created and the environment to which the object belongs, the objects are divided into runtime environment objects and application objects.

4. The method for implementing an application firewall of an embedded device as claimed in claim 3, characterized in that: For runtime environment objects, specifically: A runtime environment object is created through the runtime environment of the operating system of the embedded device, and any application in the operating system can access the runtime environment object; Represents the object context stored in the runtime context object based on the set index value.

5. The method for implementing an application firewall of an embedded device as claimed in claim 3, characterized in that: For application objects, specifically: An application object is created through an application package or an application instance of an application package, and neither the package object created during the download of the application package nor the instance object created during the installation or operation of the application is an application object; An object environment stored in an application object is represented by an object index based on an application package identifier; When the application object is not a global reference object, access to the application object is allowed only if the currently executing runtime environment is the system runtime environment, or the currently executing runtime environment is the same as the object environment of the application object.

6. The method for implementing an application firewall of an embedded device as claimed in claim 3, characterized in that: The access to the object is realized based on the type of the object, the way the object is called, and the runtime environment, and the specific steps include: Based on the type of object, the way the object is called, and the runtime environment, object access types are divided into object-based method calls and object read and write access to achieve access to objects.

7. The method for implementing an application firewall of an embedded device as claimed in claim 3, characterized in that: For object-based method calls, specifically: When the embedded device supports shared interface methods and the object to be accessed is a shared interface object, determining whether the method called by the object to be accessed is a shared interface method; If so, access to the object to be accessed is allowed; If not, when the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

8. A method for implementing an application firewall of an embedded device as claimed in claim 3, characterized in that: For read and write access to objects, specifically: If the object to be accessed is a runtime environment object, the currently executed runtime environment is the system runtime environment, or the currently executed runtime environment is the same as the object environment of the object to be accessed, access to the object to be accessed is allowed.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for implementing an application firewall of an embedded device as claimed in any one of claims 1 to 8 are implemented.

10. An application firewall implementation device for an embedded device, characterized in that: include: A creation module, which is used to create an identification object based on the unique identification of the application package, and register the application package information based on the identification object after the application package is downloaded on the embedded device; A classification module, which is used to classify all objects on the embedded device according to the time of creation and the environment they belong to; The execution module is used to implement access to the object based on the type of the object, the way the object is called, and the runtime environment.

Images