Method and apparatus for application in intelligent terminal device to perform network access

Abstract

The present application discloses a method and apparatus for an application in an intelligent terminal device to perform network access, applied to an intelligent terminal device comprising a system service and a network driver. The method comprises: a system service determining an application network setting type on the basis of the type of a called interface; if the application network setting type is a first type, acquiring network access configuration information in application configuration information; transmitting the network access configuration information as a parameter to a network driver; the network driver configuring the network access configuration information into a filter whitelist rule table; and upon receiving a network connection request initiated by an application, the system service listening for a network response data packet by means of the network driver, and allowing access to a network only when it is determined that an IP address of a responder in the network response data packet is the same as the configured network access configuration information. The present solution enables applications to perform secure operation processing in specified network environments, thereby avoiding risks such as data leakage caused by network security issues.

Description

Method and device for network access by application in intelligent terminal equipment

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority from the Chinese patent application No. 202411112903.9 filed on August 14, 2024, and entitled "Method and device for network access by application in intelligent terminal equipment", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the field of intelligent terminal security, and in particular to a method and device for network access by application in intelligent terminal equipment. BACKGROUND

[0004] An intelligent terminal is a kind of embedded computer system device. With the rapid development of information technology, intelligent terminal products have emerged in the payment field. For example, a smart POS device is an intelligent terminal device that integrates payment, settlement, identification, printing and other functions. The smart POS device provides more efficient and more convenient services by integrating various advanced technologies and software, and brings a new experience to merchants and consumers. The integrated software part includes system software and application software.

[0005] In the prior art, the application software in the intelligent terminal device usually needs to be connected to access the network to complete specific operations. This may cause other applications (malicious software or programs) to obtain operation data through the network, resulting in data leakage. In addition, the application in the intelligent terminal device in the prior art does not have the permission to set the network to be accessed. Therefore, how to solve the problem of data security during the operation of the application software in the intelligent terminal device has become a technical problem to be solved.

[0006] SUMMARY

[0007] To solve the above technical problems, the present application provides a method and device for network access by application in intelligent terminal equipment. The technical solution is as follows:

[0008] According to a first aspect of the present application, a method for network access by application in intelligent terminal equipment is provided, the intelligent terminal equipment comprising a system service and a network driver, and the method comprising:

[0009] Step S1, the system service determines an application network setting type according to an interface type called, and if the application network setting type is a first type, step S2 is executed.

[0010] Step S2, the system service acquires the application configuration information transmitted through the first preset interface called, judges whether there is user firewall permission information according to the application configuration information, if yes, executes step S3, otherwise ends;

[0011] Step S3, the system service acquires the custom IP address list, saves the network access configuration information in the application configuration information into the custom IP address list, and transmits the network access configuration information as a parameter into the network driver;

[0012] Step S4, the network driver configures the network access configuration information into the filtering whitelist rule table through a configuration instruction, and ends;

[0013] The method further comprises:

[0014] Step F1, when the system service receives a network connection request initiated by an application in the intelligent terminal device, the system service listens to network response data packets through the network driver;

[0015] Step F2, when the network driver listens to the network response data packets, the network driver judges whether there is network access configuration information in the filtering whitelist rule table, if yes, executes step F3, otherwise returns the network response data packets to the system service and executes step F4;

[0016] Step F3, the network driver judges whether the IP address of the response party in the network response data packets is the same as the network access configuration information in the filtering whitelist rule table, if yes, returns the network response data packets to the system service and executes step F4, otherwise discards the network response data packets, returns an error to the system service and executes step F5;

[0017] Step F4, the system service returns the network response data packets to the application;

[0018] Step F5, the system service returns an error to the application.

[0019] According to the second aspect of the present application, the embodiments of the present application provide an application network access setting device in an intelligent terminal device, characterized in that the device comprises a system service and a network driver;

[0020] The system service comprises:

[0021] A first determination module is configured to determine an application network setting type according to a called interface type, and trigger a first acquisition and judgment module if the application network setting type is a first type;

[0022] The first obtaining and judging module is configured to obtain application configuration information transmitted through the called interface, and judge whether there is user firewall permission information according to the application configuration information.

[0023] The obtaining and saving module is configured to, when the first obtaining and judging module judges that there is user firewall permission information, obtain a custom IP address list, save network access configuration information in the application configuration information into the custom IP address list, and transmit the network access configuration information as a parameter into the network driver.

[0024] The network driver comprises a configuration module configured to configure the network access configuration information into a filtering whitelist rule table through a configuration instruction.

[0025] The system service further comprises:

[0026] The receiving module is configured to receive a network connection request initiated by an application in the intelligent terminal device, and listen to network response data packets through the network driver when the request is received, and further configured to receive the network response data packets transmitted by the network driver.

[0027] The sending module is configured to return the network response data packets to the application, and further configured to return an error to the application.

[0028] The network driver further comprises:

[0029] The first judging module is configured to listen to the network response data packets, and judge whether there is network access configuration information in the filtering whitelist rule table when the network response data packets are listened to, and if yes, trigger the second judging module, and if not, return the network response data packets to the system service.

[0030] The second judging module is configured to judge whether an IP address of a response party in the network response data packets is the same as the network access configuration information in the filtering whitelist rule table, and if yes, return the network response data packets to the system service, and if not, discard the network response data packets and return an error to the system service.

[0031] According to a third aspect of the present application, an embodiment of the present application provides a computer device, comprising a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to implement the method for network access of an application in an intelligent terminal device according to the first aspect.

[0032] According to a fourth aspect of the present application, an embodiment of the present application provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction is executed by a processor to implement the method for network access of an application in an intelligent terminal device according to the first aspect.

[0033] According to a fifth aspect of the present application, the embodiments of the present application provide a computer program product comprising computer programs / instructions which, when executed by a processor, implement the method for network access of an application in an intelligent terminal device according to the first aspect.

[0034] The technical scheme provided by the embodiments of the present application has at least the following beneficial effects:

[0035] The method and device for network access of an application in an intelligent terminal device provided by the present application enable system services and network drivers to set the network access setting information specified by the application according to the determined network setting type of the application, thereby solving the problem that the application cannot be set for network access due to the lack of permission in the prior art, and achieving the function that the application can be safely accessed and operated in a specified network environment, thereby avoiding the risk of data leakage caused by network security problems. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical scheme in the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0037] FIG. 1 is a flowchart of network setting in the method for network access of an application in an intelligent terminal device according to an embodiment of the present application;

[0038] FIG. 2 is a flowchart of the method for network access of an application in an intelligent terminal device according to an embodiment of the present application;

[0039] FIG. 3 is a flowchart of the method for generating an application to-be-installed APK file in the method for network access of an application in an intelligent terminal device according to an embodiment of the present application;

[0040] FIG. 4 is a flowchart of the method for network access of an application in an intelligent terminal device when the application is first installed according to an embodiment of the present application;

[0041] FIGS. 5A-5B are flowcharts of the method for network access of an application in an intelligent terminal device when the application is upgraded and installed according to an embodiment of the present application;

[0042] FIGS. 6A-6B are flowcharts of the method for network access of an application in an intelligent terminal device when a third-party application calls a POS management service according to an embodiment of the present application;

[0043] Figure 7 is a flow diagram of a method for network access by an application in a smart terminal device according to an embodiment of the present application. DETAILED DESCRIPTION

[0044] For the purpose of making the purpose, technical scheme and advantages of the present application more clear, the following will make further detailed description to the embodiment of the present application in combination with the drawings.

[0045] The following description refers to the accompanying drawings. Unless otherwise noted, like elements in different drawings represent like or similar elements. The following examples of embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0046] For the purpose of making the purpose, technical scheme and advantages of the present application more clear, the following will make further detailed description to the embodiment of the present application in combination with the drawings.

[0047] Embodiment One

[0048] The present embodiment provides a method for network access by an application in a smart terminal device, as shown in Figures 1 and 2, the smart terminal device includes a system service and a network driver, and the method includes:

[0049] Step 101, the system service determines the application network setting type according to the called interface type, and if the application network setting type is the first type, it executes step 102;

[0050] Step 102, the system service obtains the application configuration information transmitted through the called first preset interface, and determines whether there is user firewall permission information according to the application configuration information, and if yes, it executes step 103, and if not, it ends;

[0051] Step 103, the system service obtains the custom IP address list, saves the network access configuration information in the application configuration information into the custom IP address list, and transmits the network access configuration information as a parameter into the network driver;

[0052] Step 104, the network driver configures the network access configuration information into the filtering whitelist rule table through the configuration instruction, and ends;

[0053] The method further includes:

[0054] Step 201, when the system service receives the network connection request initiated by the application in the smart terminal device, the system service listens to the network response data packet through the network driver;

[0055] Step 202, when the network driver listens to the network response data packet, the network driver judges whether there is network access configuration information in the filtering whitelist rule table, if yes, step 203 is executed, otherwise, the network response data packet is returned to the system service, and step 204 is executed;

[0056] Step 203, the network driver judges whether the IP address of the response party in the network response data packet is the same as the network access configuration information in the filtering whitelist rule table, if yes, the network response data packet is returned to the system service, and step 204 is executed, otherwise, the network response data packet is discarded, an error is returned to the system service, and step 205 is executed;

[0057] Step 204, the system service returns the network response data packet to the application;

[0058] Step 205, the system service returns an error to the application.

[0059] An implementable manner, the method further comprises the following steps that when the system service determines that the application network setting type is the second type according to the type of the called interface:

[0060] Step 105, the system service acquires the application configuration information transmitted through the called second preset interface, judges whether there is user firewall permission information according to the application configuration information, if yes, step 106 is executed, otherwise, the process is ended;

[0061] Step 106, the system service acquires the custom IP address list, judges whether there is network access configuration information in the custom IP address list, if yes, the network access configuration information in the custom IP address list is deleted, the network access configuration information is transmitted to the network driver as a parameter, and step 107 is executed, otherwise, the process is ended;

[0062] Step 107, the network driver deletes the network access configuration information from the filtering whitelist rule table through a deletion instruction, and the process is ended;

[0063] Specifically, the system service determines the application network setting type according to the type of the called interface, specifically: when the first preset interface of the system service is called, the system service determines that the application network setting type is the first type, and when the second preset interface of the system service is called, the system service determines that the application network setting type is the second type.

[0064] An implementable manner, the system service comprises a package management service, and before step 101, the following steps are further included:

[0065] Step 1101, the package management service acquires an application to be installed APK file;

[0066] In step 1102, the package management service calls an application programming interface (API) to parse manifest files in an application to-be-installed APK file to obtain configuration startup item information.

[0067] In step 1103, the package management service determines a network access configuration type according to the configuration startup item information, and calls an interface of a system service according to the network access configuration type.

[0068] Specifically, in an implementable manner, in step 1103, the interface of the system service is specifically: the package management service obtains user firewall permission information and network access configuration information in the manifest file, organizes the network access configuration information and the user firewall permission information to obtain application configuration information, and calls the interface of the system service to pass the application configuration information as a parameter.

[0069] Specifically, in an implementable manner, the method further includes generating an application to-be-installed APK file.

[0070] Generating the application to-be-installed APK file is specifically:

[0071] In step D1, a network access configuration type is determined.

[0072] In step D2, configuration startup item information corresponding to the network access configuration type, network access configuration information, and user firewall permission information are written into a manifest file according to a predetermined format to obtain an application to-be-installed APK file.

[0073] Specifically, in an implementable manner, in step 103, before the network access configuration information in the application configuration information is saved into the custom IP address list, the method further includes:

[0074] In step M21, the system service determines whether the network access configuration information exists in the custom IP address list, and if yes, step M22 is performed, and if not, the network access configuration information in the application configuration information is saved into the custom IP address list.

[0075] In step M22, the system service obtains the network access configuration information in the application configuration information, and determines whether the network access configuration information in the custom IP address list is the same as the network access configuration information in the application configuration information, and if yes, the process ends, and if not, step M23 is performed.

[0076] In step M23, the system service deletes the network access configuration information in the custom IP address list from the custom IP address list, passes the network access configuration information in the custom IP address list as a parameter to a network driver, and performs step M24, and saves the network access configuration information in the application configuration information into the custom IP address list.

[0077] Step M24, the network driver deletes the network access configuration information in the custom IP address list from the filter whitelist rule table through a deletion instruction.

[0078] In an embodiment, the intelligent terminal device includes a POS management service.

[0079] Before step 101, the method further includes: determining, by the POS management service, an interface type of a system service according to an interface type called by a third-party application, and calling the interface of the system service according to the determined interface type.

[0080] Specifically, in an embodiment, calling the interface of the system service according to the determined interface type specifically includes: obtaining, by the POS management service, an application package name, organizing network access configuration information and the application package name to obtain application configuration information, and calling the interface of the system service to pass in the application configuration information as a parameter.

[0081] In an embodiment, judging, according to the application configuration information, whether the user firewall permission information exists specifically includes:

[0082] The system service judges, according to the application package name in the application configuration information, whether the user firewall permission information exists.

[0083] In an embodiment, when the system service judges, according to the application configuration information, that the user firewall permission information exists, the method further includes: obtaining, by the system service, signature data in the application configuration information to perform code signature, obtaining network configuration permission if the signature passes, executing step 103, and ending if the signature fails, and the signature data includes specified parameters, a verification key, and signature data.

[0084] In an embodiment, when the intelligent terminal device is powered off, the method further includes: deleting, by the network driver, all network access configuration information in the filter whitelist rule table through a deletion instruction.

[0085] In an embodiment, when the intelligent terminal device is powered on or restarted, the method further includes: obtaining, by the system service, a saved custom IP address list, traversing the custom IP address list, sequentially obtaining network access configuration information in the custom IP address list, and passing in the network access configuration information as a parameter to the network driver to execute step 104.

[0086] In an embodiment, when it is judged, according to the application configuration information, that the user firewall permission information exists in step 102, the method further includes: setting, by the system service, application corresponding firewall permission group information according to the user firewall information in the application configuration information.

[0087] Before step 203, step 202 further comprises: the network driver judges whether the firewall permission information corresponding to the IP address of the responder in the network response data packet is the same as the firewall permission group information in the filtering whitelist rule table, if yes, step 203 is executed, otherwise, an error is returned to the system service, and step 205 is executed.

[0088] The application provides a method for network access of an application in a smart terminal device, a system service determines an application network setting type according to a called interface type, verifies the permission of the application according to a parameter transmitted by the application, and acquires network access setting permission if the verification is passed, and a network driver sets network access setting information specified by the application according to the determined application network setting type, thereby solving the problem that the application cannot set a secure network access due to no permission in the prior art, realizing the function that the application can perform secure access and secure operation processing in a specified network environment, and avoiding the risk of data leakage caused by network security problems.

[0089] Embodiment two

[0090] The application provides a method for network access of an application in a smart terminal device, a system service determines an application network setting type according to a called interface type, verifies the permission of the application according to a parameter transmitted by the application, and acquires network access setting permission if the verification is passed, and a network driver sets network access setting information specified by the application according to the determined application network setting type, thereby solving the problem that the application cannot set a secure network access due to no permission in the prior art, realizing the function that the application can perform secure access and secure operation processing in a specified network environment, and avoiding the risk of data leakage caused by network security problems.

[0091] Step 301, determining a network access configuration type;

[0092] In this embodiment, the network access configuration type includes configuration and deconfiguration.

[0093] Specifically, the network access configuration type is defined as a preset value of configuration startup item information, a first preset value is true, indicating that the network access configuration type is configuration, and a second preset value is false, indicating that the network access configuration type is deconfiguration.

[0094] For example, the configuration startup item is defined as whitelist_enable, and the value corresponding to the configuration startup item whitelist_enable is true.

[0095] Step 302, writing configuration startup item information corresponding to the network access configuration type, network access configuration information and user firewall permission information into a manifest file according to a predetermined format to obtain an application to-be-installed APK file.

[0096] In the embodiment, the network access configuration information comprises an IP address and / or a domain name; the user firewall permission information comprises a user firewall level; first, a preset user firewall level android.permission.CONTROL_FIREWALL_RULED is added in platform.xml and AndroidManifest.xml.

[0097] For example, the IP address is defined as whitelist_ip, and the domain name is defined as whitelist_host; the value corresponding to the IP address whitelist_ip is 192.168.8.102, and the value corresponding to the domain name whitelist_host is www.ftsafe.com; the user firewall permission information is defined as android.permission.CONTROL_FIREWALL_RULED.

[0098] Specifically, APK (Android application package) refers to an Android application package, which is a file format in an Android system. An APK file contains all files of an application, including static resource files (assets), library files (lib), signature files (META-INF), compiled resource files (res), manifest files (AndroidManifest.xml), core code files (classes.Dex), resource mapping files (resources.arsc), and the like. For example, the manifest file is as follows:

[0099] Specifically, the manifest file (AndroidManifest.xml) is a compiled file used to describe manifest information of an application, including important information such as a package name, an application name, permissions, four components of Android, and a version. When an application is packaged, the AndroidManifest.xml file is automatically generated and packaged into an APK file. When the application is installed, the Android system reads the file to determine basic information and permission requirements of the application.

[0100] In an implementable manner, the predetermined format in step 302 is a key-value pair format.

[0101] For example, the configuration startup item information is as follows:

[0102] name: whitelist_enabled value: true / false

[0103] The network access configuration information is as follows:

[0104] name: whitelist_ip value: 192.168.8.102

[0105] name: whitelist_host value: www.ftsafe.com;

[0106] In an implementable manner, the manifest file further includes verification parameters, a key, and signature data.

[0107] The verification parameters can be a random number, and the signature data is obtained by performing MD5 calculation on the verification parameters using the key.

[0108] Further, the method for network access of the application in the intelligent terminal device provided by the embodiments of the present application is shown in FIGS. 4, 5A, and 5B, and the method includes the process of installing the application through the installation package. Before the installation process of the application is performed, the preset interface is written and updated to the Android system. Specifically, the Android system includes a system service (SS) and a network driver. Further, the system service includes a package management service (PKMS) and a first connection service.

[0109] In an implementable manner, as shown in FIG. 4, the network access in the present embodiment is performed during the first installation process of the application. The method specifically includes the following steps.

[0110] Step 401: The package management service acquires the APK file to be installed of the application.

[0111] In the Android system, the package management service is started by the system service when the system is started, and the package management service performs the installation operation of the application.

[0112] Specifically, the system starts the package management service by calling a preset method, and the preset method is PackageManagerService.installPackage.

[0113] In an implementable manner, the application can be installed through the adb install mode.

[0114] Step 402: The package management service calls the first API interface to parse the manifest file in the APK file to be installed of the application, and acquires the configuration startup item information.

[0115] Specifically, the first API interface is install Package().

[0116] In an implementable manner, the first API interface is called to parse the manifest file in the application to-be-installed APK file, specifically, the manifest file in the application to-be-installed APK file is parsed through a function object to obtain configuration startup item information in the manifest file.

[0117] Specifically, the function object is PackageParser.

[0118] In step 403, the package management service determines a network access configuration type according to the configuration startup item information, and if the network access configuration type is configuration, step 404 is performed.

[0119] In an implementable manner, the configuration startup item information is whitelist_enabled, and the first preset value is true.

[0120] Specifically, if the configuration startup item information is the first preset value, it indicates that the network accessed by the application in the terminal device is configured, and after the configuration is completed, only the IP and / or domain name specified in the network access configuration information can be accessed, and other unspecified networks cannot be accessed.

[0121] In step 404, the package management service obtains user firewall permission information and network access configuration information in the manifest file, organizes the network access configuration information and the user firewall permission information to obtain application configuration information, and calls a first preset interface to pass the application configuration information as a parameter into a first connection service.

[0122] In this embodiment, the package management service obtaining the network access configuration information specifically includes: the package management service judging whether an IP address exists in the manifest file, if yes, taking the IP address as the network access configuration information, and if not, obtaining a domain name in the manifest file, parsing the domain name to obtain an IP address, and taking the IP address as the network access configuration information.

[0123] In an implementable manner, before step 404, the package management service further judges whether the manifest file exists user firewall permission information, if yes, adding an application corresponding to the application to-be-installed APK file to a preset permission group, performing step 404, and if not, ending.

[0124] Specifically, adding the application corresponding to the application to-be-installed APK file to the preset permission group specifically includes: adding AID_CONTROL_FIREWALL 1098 in UIDMap and Android_filesystem_config.h.

[0125] Specifically, the first preset interface is CS.addWhitelist.

[0126] Step 405, the first connection service determines the application network setting type as the first type according to the type of the called interface, acquires the application configuration information, and judges whether there is user firewall permission information according to the application configuration information, yes to step 406, otherwise end;

[0127] In an implementable manner, the first connection service includes a network connection service (CS) and a network management service (NMS), and in step 404, the package management service calls the first preset interface to pass the application configuration information as a parameter into the first connection service, specifically, the package management service calls the first preset interface to pass the application configuration information as a parameter into the network connection service;

[0128] Specifically, step 405 is specifically that the network connection service determines the application network setting type as the first type according to the type of the called interface, acquires the application configuration information, and judges whether there is user firewall permission information in the application configuration information, yes to step 406, otherwise end;

[0129] Further, judging whether there is user firewall permission information is specifically judging whether there is a corresponding value of android.permission.CONTROL_FIREWALL_RULED in the application configuration information, if yes, it means that there is user firewall permission information, otherwise there is no user firewall permission information;

[0130] In an implementable manner, when it is judged according to the application configuration information that there is user firewall permission information, it further includes that the system service acquires the signature data in the application configuration information to perform code signature, acquires network configuration permission when the signature passes, executes step 406, reports an error when the signature fails, and ends, the signature data includes a specified parameter, a verification key and signature data;

[0131] Specifically, the system service acquires the signature data in the application configuration information to perform code signature is specifically that the system service acquires the specified parameter, the verification key and the signature data, calculates the first data by the verification key on the specified parameter, judges whether the first data is consistent with the signature data, yes to pass the signature, otherwise the signature fails.

[0132] Step 406, the first connection service acquires the custom IP address list, saves the network access configuration information in the application configuration information into the custom IP address list, and passes the network access configuration information as a parameter into the network driver;

[0133] Specifically, step 406 is specifically: the network connection service acquires a custom IP address list, saves the network access configuration information in the application configuration information into the custom IP address list, calls a first preset method to pass the network access configuration information as a parameter into the network management service, and the network management service calls a second preset method to pass the network access configuration information as a parameter into the network driver;

[0134] Specifically, the first preset method is NMS.enableWhitelist, and the second preset method is INetd.enableWhitelist.

[0135] Step 407, the network driver configures the network access configuration information into the filtering whitelist rule table through a configuration instruction, and ends.

[0136] An implementable manner, step 407 is specifically that the network driver sends a configuration instruction to the network firewall tool, and the network firewall tool configures the incoming network access configuration information into the filtering whitelist rule table after receiving the configuration instruction;

[0137] Specifically, the network driver includes a Netd native service and a firewall controller.

[0138] Further, the network management service calls the second preset method to pass the network access configuration information as a parameter into the network driver is specifically: the network management service calls the second preset method to pass the network access configuration information as a parameter into the Netd native service.

[0139] Further, step 407 is specifically: the Netd native service passes the network access configuration information as a parameter into the firewall controller by calling a third preset method, the firewall controller sends a configuration instruction to the network firewall tool, and the network firewall tool configures the incoming network access configuration information into the filtering whitelist rule table after receiving the configuration instruction.

[0140] Specifically, the Netd native service is NetdNativeService (NNS for short), and the third preset method is FC.enableWhitelist; the firewall controller is Firewall Controller (FC for short); and the configuration instruction is specifically adding the incoming network access configuration information into the filtering whitelist rule table.

[0141] An implementable manner, the network firewall tool executing the configuration instruction specifically uses the technology of a Linux network driver, and is specifically: executing a Linux iptables instruction can add the network access configuration information into the filtering whitelist rule table.

[0142] Specifically, the network firewall tool maintains four tables and five chains, all the data related to the firewall rules are written into the tables and chains, wherein the four tables are filter table (filter white list rule table), nat table (address translation rule table), mangle table (modify data mark bit rule table) and raw table (trace data rule table), and the five chains are INPUT (inbound data filtering), OUT (outbound data filtering), FORWARD (forwarding data filtering), PREROUTING (pre-routing rule) and POSTROUTING (post-routing rule);

[0143] For example, the firewall controller sends iptables-P OUTPUT DROP instruction, the network firewall tool discards all the output data, and sends iptables-P INPUT DROP instruction, the network firewall tool discards all the input data;

[0144] The firewall controller sends iptables-IOUTPUT-s 192.168.8.102-j ACCEPT instruction, the network firewall tool writes IP address 192.168.8.102 into the filter table, indicating that only the output data with IP address 192.168.8.102 is accepted, and sends iptables-I INPUT-s 192.168.8.102-j ACCEPT instruction, indicating that only the input data with IP address 192.168.8.102 is accepted, wherein -I is insertion;

[0145] In an implementable manner, the configuration instruction sent by the network driver includes user firewall permission group information, for example, the configuration instruction is: iptables-IOUTPUT-s 192.168.8.102-uid-owner=1098-j ACCEPT.

[0146] In the embodiment, in an implementable manner, as shown in FIGS. 5A-5B, another method for network access by an application in a smart terminal device is provided, and specifically, the network access in the embodiment is performed during the upgrading process after the application is installed, and the method specifically includes:

[0147] Step 501, the package management service acquires an application to be installed APK file;

[0148] In the Android system, the system starts the package management service (Package Manager Service, abbreviated as PKMS), and performs the upgrading and installation process of the application through the package management service;

[0149] Specifically, the system starts the package management service by calling a preset method, and the preset method is PackageManagerService.updatePackage.

[0150] In an implementable manner, the application can be installed or upgraded by pushing the APK file remotely.

[0151] In step 502, the package management service calls a second API interface to parse the manifest file in the application APK file to be installed to obtain configuration startup item information.

[0152] Specifically, the second API interface is updatePackage().

[0153] In an implementable manner, the second API interface is used to parse the manifest file in the application APK file to be installed, specifically, the function object is used to parse the manifest file in the application APK file to be installed to obtain the configuration startup item information in the manifest file.

[0154] Specifically, the function object is Package Parser.

[0155] In step 503, the package management service determines the network access configuration type according to the configuration startup item information, and if the network access configuration type is configuration, step 504 is performed, and if the network access configuration type is unconfiguration, step 512 is performed.

[0156] In an implementable manner, the configuration startup item information is whitelist_enabled, and the first preset value is true.

[0157] Specifically, if the configuration startup item information is the first preset value, it means that the network accessed by the application in the terminal device is configured, and after the configuration is completed, only the application is allowed to access the specified IP / domain name in the network access configuration information, and other unspecified networks are not accessible.

[0158] In an implementable manner, the configuration startup item information can also be a second preset value; wherein the second preset value is false.

[0159] Specifically, if the configuration startup item information is the second preset value, it means that the network accessed by the application in the terminal device is unconfigured, that is, the application is allowed to access all networks.

[0160] In step 504, the package management service obtains user firewall permission information and network access configuration information in the manifest file, organizes the network access configuration information and the user firewall permission information to obtain application configuration information, and calls a first preset interface to pass the application configuration information as a parameter into a first connection service.

[0161] In the embodiment, the package management service obtaining the network access configuration information specifically includes: the package management service judging whether the IP address exists in the manifest file, if yes, taking the IP address as the network access configuration information, otherwise, obtaining the domain name in the manifest file, resolving the domain name to obtain the IP address, and taking the IP address as the network access configuration information.

[0162] In an implementable mode, before step 504, the package management service further judges whether the user firewall permission information exists in the manifest file, if yes, adding the application corresponding to the application APK file to be installed to the preset permission group, and executing step 504, if not, ending.

[0163] Specifically, adding the application corresponding to the application APK file to be installed to the preset permission group specifically includes: adding AID_CONTROL_FIREWALL 1098 in UIDMap and Android_filesystem_config.h.

[0164] Specifically, the first preset interface is CS.addWhitelist.

[0165] In the embodiment, the first connection service includes: a network connection service and a network management service.

[0166] Specifically, in step 504, the package management service calling the first preset interface and taking the application configuration information as the parameter into the first connection service specifically includes: the package management service calling the first preset interface and taking the application configuration information as the parameter into the network connection service.

[0167] Step 505: the first connection service determines that the application network setting type is the first type according to the called interface type, obtains the application configuration information, judges whether the user firewall permission information exists according to the application configuration information, if yes, executing step 506, if not, ending.

[0168] In the embodiment, the first connection service includes: a network connection service and a network management service.

[0169] Specifically, step 505 specifically includes: the network connection service determining that the application network setting type is the first type according to the called interface type, obtaining the application configuration information, judging whether the user firewall permission information exists, if yes, executing step 506, if not, ending.

[0170] Step 506: the first connection service obtains the custom IP address list, judges whether the network access configuration information exists in the custom IP address list, if yes, executing step 507, if not, executing step 510.

[0171] Specifically, step 506 is specifically: the network connection service acquires the custom IP address list, judges whether the network access configuration information exists in the list, if yes, step 507 is executed, otherwise, step 510 is executed.

[0172] Step 507, the first connection service acquires the network access configuration information in the application configuration information, judges whether the network access configuration information in the custom IP address list is same as the network access configuration information in the application configuration information, if yes, the process is ended, if not, step 508 is executed.

[0173] Specifically, step 507 is specifically: the network connection service acquires the network access configuration information in the application configuration information, judges whether the network access configuration information in the custom IP address list is same as the network access configuration information in the application configuration information, if yes, the process is ended, if not, step 508 is executed.

[0174] Step 508, the first connection service deletes the network access configuration information in the custom IP address list from the custom IP address list, and transmits the network access configuration information in the custom IP address list as a parameter into the network driver, and executes step 509.

[0175] Specifically, step 508 is specifically: the network connection service deletes the network access configuration information in the custom IP address list from the custom IP address list, calls the fourth preset method to transmit the network access configuration information in the custom IP address list as a parameter into the network management service, and the network management service calls the fifth preset method to transmit the network access configuration information in the custom IP address list as a parameter into the network driver.

[0176] Specifically, the fourth preset method is NMS.disableWhitelist, and the fifth preset method is INetd.disableWhitelist.

[0177] Step 509, the network driver deletes the network access configuration information in the custom IP address list from the filtering whitelist rule table through a deletion instruction, and executes step 510.

[0178] In an implementable manner, step 509 is specifically that the network driver sends a deletion instruction to the network firewall tool, and the network firewall tool deletes the network access configuration information in the transmitted custom IP address list from the filtering whitelist rule table after receiving the deletion instruction.

[0179] Specifically, the network driver includes a Netd local service and a firewall controller.

[0180] Further, the network management service calls the sixth preset method to transmit the network access configuration information in the custom IP address list as a parameter into the network driver, specifically: the network management service calls the sixth preset method to transmit the network access configuration information in the custom IP address list as a parameter into the Netd local service;

[0181] Further, the step 509 is specifically: the Netd local service transmits the network access configuration information in the custom IP address list as a parameter into the firewall controller by calling the sixth preset method, the firewall controller sends a deletion instruction to the network firewall tool, and the network firewall tool deletes the network access configuration information in the custom IP address list from the filtering whitelist rule table after receiving the deletion instruction;

[0182] The step 510 is: the first connection service saves the network access configuration information in the application configuration information into the custom IP address list and transmits the network access configuration information in the application configuration information as a parameter into the network driver to execute the step 511.

[0183] Specifically, the step 510 is specifically: the network connection service saves the network access configuration information in the application configuration information into the custom IP address list, calls the first preset method to transmit the network access configuration information as a parameter into the network management service, and the network management service calls the second preset method to transmit the network access configuration information as a parameter into the network driver.

[0184] The first preset method is NMS.enableWhitelist, and the second preset method is INetd.enableWhitelist.

[0185] The step 511 is: the network driver configures the network access configuration information in the application configuration information into the filtering whitelist rule table by a configuration instruction, and the process ends.

[0186] In an implementable manner, the step 511 is specifically: the network driver sends a configuration instruction to the network firewall tool, and the network firewall tool configures the network access configuration information into the filtering whitelist rule table after receiving the configuration instruction.

[0187] Specifically, the network driver includes the Netd local service and the firewall controller.

[0188] Further, the network management service calls the second preset method to transmit the network access configuration information as a parameter into the network driver, specifically: the network management service calls the second preset method to transmit the network access configuration information as a parameter into the Netd local service.

[0189] Further, the step 511 is specifically: the Netd native service transmits the network access configuration information as a parameter into the firewall controller by calling the third preset method, the firewall controller sends a configuration instruction to the network firewall tool, and the network firewall tool configures the transmitted network access configuration information into the filtering whitelist rule table after receiving the configuration instruction;

[0190] Specifically, the Netd native service is NetdNativeService (NNS for short), the third preset method is FC.enableWhitelist, the firewall controller is Firewall Controller (FC for short), and the configuration instruction is specifically adding the transmitted network access configuration information into the filtering whitelist rule table.

[0191] The step 512 is that the package management service acquires the user firewall permission information and the network access configuration information in the manifest file, organizes the network access configuration information and the user firewall permission information to obtain application configuration information, and transmits the application configuration information as a parameter into the first connection service by calling a second preset interface.

[0192] Specifically, the second preset interface is CS.RemoveWhitelist.

[0193] The step 513 is that the first connection service determines that the application network setting type is the second type according to the type of the called interface, acquires the application configuration information, and judges whether the user firewall permission information exists according to the application configuration information, and if yes, the step 514 is executed, and if not, the process is ended.

[0194] In an implementable manner, the first connection service includes a network connection service and a network management service, and in the step 512, the package management service transmits the application configuration information as a parameter into the first connection service by calling the second preset interface, which is specifically: the package management service transmits the application configuration information as a parameter into the network connection service by calling the second preset interface.

[0195] Specifically, the step 513 is that the network connection service determines that the application network setting type is the second type according to the type of the called interface, acquires the application configuration information, and judges whether the user firewall permission information exists in the application configuration information, and if yes, the step 514 is executed, and if not, the process is ended.

[0196] Further, the judgment of whether the user firewall permission information exists in the application configuration information is specifically: whether a corresponding value exists in android.permission.CONTROL_FIREWALL_RULED in the application configuration information, and if yes, it indicates that the user firewall permission information exists, and if not, the user firewall permission information does not exist.

[0197] Step 514, the first connection service acquires the custom IP address list, judges whether the network access configuration information exists in the custom IP address list, if yes, deletes the network access configuration information in the custom IP address list, transmits the network access configuration information as a parameter into the network driver, and executes step 515, otherwise, ends;

[0198] In an implementable mode, step 514 specifically comprises: the first connection service acquires the network access configuration information in the application configuration information, acquires the custom IP address list, judges whether the network access configuration information exists in the custom IP list, if yes, deletes the network access configuration information from the custom IP address list, transmits the network access configuration information as a parameter into the network driver, and executes step 515, otherwise, ends;

[0199] Alternatively, step 514 specifically comprises: the network connection service acquires the custom IP address list, deletes the network access configuration information in the custom IP address list, calls a fourth preset method to transmit the network access configuration information as a parameter into the network management service, and the network management service calls a fifth preset method to transmit the network access configuration information as a parameter into the network driver.

[0200] Specifically, the fourth preset method is NMS.disableWhitelist, and the fifth preset method is INetd.disableWhitelist.

[0201] Step 515, the network driver deletes the network access configuration information from the filtering whitelist rule table through a deletion instruction, and ends.

[0202] In an implementable mode, step 515 specifically comprises: the network driver sends a deletion instruction to the network firewall tool, and the network firewall tool deletes the transmitted network access configuration information from the filtering whitelist rule table after receiving the deletion instruction.

[0203] Specifically, the network driver comprises a Netd local service and a firewall controller.

[0204] Further, the network management service calling a sixth preset method to transmit the network access configuration information as a parameter into the network driver specifically comprises: the network management service calling the sixth preset method to transmit the network access configuration information as a parameter into the Netd local service.

[0205] Further, step 515 specifically comprises: the Netd local service transmits the network access configuration information as a parameter into the firewall controller by calling the sixth preset method, the firewall controller sends a deletion instruction to the network firewall tool, and the network firewall tool deletes the transmitted network access configuration information from the filtering whitelist rule table after receiving the deletion instruction.

[0206] In an implementable manner, when there are multiple IP addresses in the custom IP address list, the network access configuration information is passed into the network driver as a parameter in step 514, which is specifically: traversing the IP addresses, sequentially passing the network access configuration information into the network driver as a parameter, sequentially executing step 515 until the list is empty.

[0207] In an implementable manner, when it is determined according to the application configuration information that there is user firewall permission information, the system service further includes: obtaining signature data in the application configuration information for code signature, and if the signature passes, obtaining network configuration permission, executing steps 510-511, if the signature does not pass, reporting an error and ending, and the signature data includes specified parameters, verification keys and signature data.

[0208] Specifically, the system service obtaining signature data in the application configuration information for code signature is specifically: the system service obtains specified parameters, verification keys and signature data, calculates the specified parameters through the verification keys to obtain first data, determines whether the first data is consistent with the signature data, if yes, the signature passes, the network configuration permission is obtained, otherwise, the signature does not pass, an error is reported and the process ends.

[0209] In this embodiment, in an implementable manner, when the smart terminal device is powered off, the network driver deletes all network access configuration information added in the filtering white list rule table through the network firewall tool.

[0210] In this embodiment, in an implementable manner, when the smart terminal device is powered on and restarted, the system service obtains the saved custom IP address list by calling the CS.systemReady() method, traverses the custom IP address list, sequentially obtains the network access configuration information in the custom IP address list and executes steps 510 to 511.

[0211] The method for an application in a smart terminal device to perform network access provided by the embodiment of the application is suitable for a smart terminal device installed with an Android system, and in the embodiment, the smart terminal device includes an application, and the application in the smart terminal device completes specific user operations by connecting to a network. The scheme sets the access information according to the network access configuration information during installation or upgrade of the application, and realizes the function that the application can perform safe operation processing in a specified network environment, thereby avoiding the risk of data leakage caused by network security problems.

[0212] Embodiment three

[0213] The embodiment three of the application provides a method for network access of an application in a smart terminal device, wherein the embodiment is implemented by an interface function of a third-party application. The method for network access of the application in the smart terminal device provided by the embodiment of the application comprises the following steps: providing an interface function SDK for calling by the third-party application before the method is executed; and writing and updating a preset interface into an Android system of the smart terminal device. Specifically, the smart terminal device comprises a system service and a network driver. The smart terminal device further comprises a POS management service (an application process). Further, the system service comprises a connectivity service (CS) and a network management service (NMS). Further, an ICM interface is defined in the POS management service in advance. The ICM interface comprises a first ICM interface and a second ICM interface. The first ICM interface represents a configuration whitelist, and the second ICM interface represents a whitelist clearing.

[0214] As shown in FIGS. 6A-6B, the method for network access of the application in the smart terminal device provided by the embodiment of the application specifically comprises the following steps:

[0215] When the POS management service is called by the third-party application through the first ICM interface, the POS management service calls a first interface of the system service to execute step 601. When the POS management service is called by the third-party application through the second ICM interface, the POS management service calls a second interface of the system service to execute step 605.

[0216] In the embodiment, the method further comprises the following steps: generating an interface function SDK; the third-party application binds the POS server through an AIDL mode to establish a connection and an initialization operation, and calls the POS server through an interface in the SDK, and transmits an IP address to be configured and application information as parameters; for example, the parameters transmitted when the first interface is called are: enableWhitelist (String IP, String packageName), and the parameters transmitted when the second interface is called are: disableWhitelist (String IP, String packageName).

[0217] Specifically, the first ICM interface is: enable.whitelistFromCustomer, and the second ICM interface is: disable.whitelistFromCustomer.

[0218] Step 601, the POS management service calls a first interface, and transmits network access configuration information and application information input by the third-party application into the system service as application configuration information;

[0219] In this embodiment, the application information is specifically an application package name, for example, String packageName;

[0220] Step 602, the system service determines, according to the type of the called interface, that the application network setting type is a first type, and step 603 is performed;

[0221] In an implementable manner, the system service includes a network connection service and a network management service, and step 601 is specifically that the POS management service calls the first interface, and transmits network access configuration information and application information input by the third-party application into the network connection service as application configuration information;

[0222] Specifically, step 602 is specifically that the network connection service determines, according to the type of the called interface, that the application network setting type is the first type;

[0223] The first preset interface is CS.addWhitelist.

[0224] Step 603, the system service determines, according to the application information, whether the application has user firewall permission information, if yes, acquires a custom IP address list, saves network access configuration information in the application configuration information into the custom IP address list, transmits the network access configuration information into a network driver as a parameter, and step 604 is performed, if not, the method ends;

[0225] In an implementable manner, the system service determines, according to the application information, whether the application has user firewall permission information, specifically that the system service determines, according to the application package name in the application information, whether the application has corresponding user firewall permission information;

[0226] Specifically, step 603 is specifically that the network connection service determines, according to the application information, whether the application has user firewall permission information, if yes, acquires a custom IP address list, saves network access configuration information in the application configuration information into the custom IP address list, calls a first preset method to transmit the network access configuration information into the network management service as a parameter, and the network management service calls a second preset method to transmit the network access configuration information into the network driver as a parameter;

[0227] Specifically, the first preset method is NMS.enableWhitelist, and the second preset method is INetd.enableWhitelist.

[0228] Step 604, the network driver configures the incoming network access configuration information into the filtering whitelist rule table through the configuration instruction, and ends;

[0229] In an implementable manner, step 604 specifically comprises: the network driver sends a configuration instruction to the network firewall tool, and the network firewall tool configures the incoming network access configuration information into the filtering whitelist rule table after receiving the configuration instruction.

[0230] Specifically, the network driver comprises a Netd native service and a firewall controller. Further, the network management service calls a second preset method to input the network access configuration information as a parameter into the network driver, specifically: the network management service calls the second preset method to input the network access configuration information as a parameter into the Netd native service.

[0231] Further, step 604 specifically comprises: the Netd native service inputs the network access configuration information as a parameter into the firewall controller by calling a third preset method, the firewall controller sends a configuration instruction to the network firewall tool, and the network firewall tool configures the incoming network access configuration information into the filtering whitelist rule table after receiving the configuration instruction.

[0232] Specifically, the Netd native service is NetdNativeService (NNS for short), the third preset method is FC.enableWhitelist, the firewall controller is Firewall Controller (FC for short), and the configuration instruction specifically comprises adding the incoming network access configuration information into the filtering whitelist rule table.

[0233] Step 605, the POS management service calls a second interface and inputs the application information input by the third-party application into the system service as application configuration information.

[0234] In an implementable manner, step 605 specifically comprises: the POS management service obtains an application package name, organizes the application package name to obtain application configuration information, and calls a second preset interface of the system service to input the application configuration information as a parameter into the system service.

[0235] Optionally, step 605 specifically comprises: the POS management service obtains an application package name and network access configuration information, organizes the application package name and the network access configuration information to obtain application configuration information, and calls a second interface of the system service to input the application configuration information as a parameter into the system service.

[0236] Step 606, the system service determines that the application network setting type is a second type according to the type of the called interface, and performs step 607.

[0237] In an implementable mode, the system service includes a network connection service and a network management service, and step 605 specifically comprises: the POS management service calling a second interface and transmitting application information input by the third-party application into the network connection service as application configuration information;

[0238] Specifically, step 606 specifically comprises: the network connection service determining the application network setting type as the second type according to the type of the called interface;

[0239] The second preset interface is CS.RemoveWhitelis.

[0240] Step 607: the system service judging whether the application has user firewall permission information according to the application information, and if yes, executing step 608, and if not, ending;

[0241] In an implementable mode, the system service judging whether the application has user firewall permission information according to the application information specifically comprises: the system service judging whether the application has corresponding user firewall permission information according to the application package name in the application information;

[0242] Specifically, step 607 specifically comprises: the network connection service judging whether the application has user firewall permission information according to the application information, and if yes, executing step 608, and if not, ending.

[0243] Step 608: the system service acquiring a custom IP address list and judging whether the custom IP address list has network access configuration information, and if yes, executing step 609, and if not, ending;

[0244] In an implementable mode, the system service judging whether the custom IP address list has network access configuration information specifically comprises: the system service judging whether the custom IP address list has network access configuration information configured by the application, and if yes, executing step 609, and if not, ending;

[0245] Specifically, step 608 specifically comprises: the network connection service acquiring the custom IP address list and judging whether the custom IP address list has an IP address, and if yes, executing step 609, and if not, ending.

[0246] Step 609: the system service deleting network access configuration information in the custom IP address list and transmitting the network access configuration information into a network driver as a parameter to execute step 610;

[0247] Specifically, step 609 specifically comprises: the network connection service deleting network access configuration information in the custom IP address list, calling a fourth preset method to transmit the network access configuration information into the network management service as a parameter, and the network management service calling a fifth preset method to transmit the network access configuration information into the network driver as a parameter;

[0248] Step 610, the network driver deletes the network access configuration information from the filter whitelist rule table through the deletion instruction, and ends.

[0249] In this embodiment, in an implementable manner, step 610 specifically comprises: the network driver sends a deletion instruction to the network firewall tool, and the network firewall tool deletes the incoming network access configuration information from the filter whitelist rule table after receiving the deletion instruction.

[0250] Specifically, the network driver comprises a Netd native service and a firewall controller, and the network management service calls the fifth preset method to pass the network access configuration information as a parameter to the network driver, specifically: the network management service calls the fifth preset method to pass the network access configuration information as a parameter to the Netd native service.

[0251] Further, step 610 specifically comprises: the Netd native service passes the network access configuration information as a parameter to the firewall controller by calling the sixth preset method; the firewall controller sends a deletion instruction to the network firewall tool, and the network firewall tool deletes the incoming network access configuration information from the filter whitelist rule table after receiving the deletion instruction.

[0252] Specifically, the Netd native service is NetdNativeService, the sixth preset method is FC.disableWhitelist, and the firewall controller is Firewall Controller.

[0253] In an implementable manner, the network firewall tool executes the deletion instruction, which specifically uses the technology of the Linux network driver, specifically: executing a Linux iptables instruction can delete the network access configuration information from the filter whitelist rule table.

[0254] For example, the firewall controller sends iptables-D OUTPUT-s 192.168.8.102-j ACCEPT, which can delete the IP address access permission in the filter whitelist rule table, where-D is delete.

[0255] In an implementable manner, the execution instruction sent by the network driver includes user firewall permission information, for example: the execution instruction is iptables-IOUTPUT-s 192.168.8.102-uid-owner=1098-j ACCEPT.

[0256] In an implementable manner, the application configuration information further includes signature verification data, the signature verification data includes a specified parameter, a verification key, and signature data, and when the system service determines that the user firewall permission information exists according to the application configuration information, the system service further includes: the system service acquires the signature verification data in the application configuration information to perform code signature verification, if the signature verification passes, the network configuration permission is acquired, if the signature verification fails, an error is reported, and the process ends.

[0257] Specifically, the system service acquires the signature verification data in the application configuration information to perform code signature verification, specifically: the system service acquires the specified parameter, the verification key, and the signature data, calculates the first data by using the verification key on the specified parameter, determines whether the first data is consistent with the signature data, if yes, the signature verification passes, the network configuration permission is acquired, if not, the signature verification fails, an error is reported, and the process ends.

[0258] The method for an application in a smart terminal device to perform network access provided in the embodiments of the present application is suitable for a smart terminal device installed with an Android system, in the embodiments, the smart terminal device includes a third-party application, the third-party application in the smart terminal device calls a POS management service in the smart terminal device through an interface function SDK to complete a setting operation of the application to access the network, and the system service and the network driver set the network access setting information specified by the application according to a determined network setting type of the application, thereby solving the problem that the application cannot be set to access the network safely due to no permission in the prior art, realizing the function that the application can perform safe operation processing in a specified network environment, and avoiding the risk of data leakage caused by network security problems.

[0259] Embodiment Four

[0260] The method for an application in a smart terminal device to perform network access provided in Embodiment Four of the present application is based on Embodiment One, in the prior art, when an Android application uses a WebView or a Chrome browser to enter a domain name to access the network, or the application directly uses an http request to request a domain name to obtain a response of a server, the Android system performs the following steps:

[0261] 1. The Android system uses DNS to resolve the domain name,

[0262] 2. TCP establishes a connection,

[0263] 3. The client sends an http request,

[0264] 4. The server processes the http request and returns an http data packet,

[0265] 5. The browser parses the http data packet, returns the result to the application program, renders and refreshes the page.

[0266] To adapt the scheme of the present application, as shown in Figure 7, the embodiment four of the present application provides a method for network access by an application in a smart terminal device, which comprises:

[0267] Step 701, the application initiates a network connection request;

[0268] Specifically, the application uses WebView or Chrome browser to enter a domain name to access the network, or directly initiates an http request, and the application can be any application in the smart terminal device.

[0269] Step 702, when the system service receives the network connection request, the network driver listens to the network response data packet;

[0270] Step 703, when the network driver listens to the network response data packet, the IP addresses of the receiver and the responder in the network response data packet are obtained;

[0271] Step 704, the network driver judges whether there is network access configuration information in the filtering whitelist rule table, if yes, step 705 is executed, otherwise, the network response data packet is returned to the system service, and step 706 is executed;

[0272] Step 705, the network driver judges whether the IP address of the responder in the network response data packet is the same as the network access configuration information in the filtering whitelist rule table, if yes, the network response data packet is returned to the system service, and step 706 is executed, otherwise, the network response data packet is discarded, an error is returned to the system service, and step 707 is executed;

[0273] Step 706, the system service returns the network response data packet to the application;

[0274] Step 707, the system service returns an error to the application.

[0275] Specifically, the network driver listens to the network response data packet through the network firewall tool, the main function of the network firewall tool Android iptables is to control the network data packet in and out of the device and forwarding, when the data packet needs to enter the device, or transfer out of the device, it is forwarded and routed by the network driver; the iptables network firewall tool maintains the filtering whitelist rule table, and determines whether the IP address of the receiver in the network response data packet is the same as the network access configuration information in the filtering whitelist rule table according to the filtering whitelist rule table;

[0276] For example, an IP address 192.168.1.131 is configured in the filtering whitelist rule table through the network firewall tool; the network firewall tool listens to network response data packets, obtains the IP address of the responder in the network response data packet, determines whether the IP address of the responder exists in the filtering whitelist rule table, and responds if the IP address exists, and discards the data packet if the IP address does not exist;

[0277] In an implementable manner, the step 102 of the embodiment further includes: the system service sets the firewall permission group information corresponding to the application according to the user firewall information in the application configuration information.

[0278] Specifically, in the embodiment, the network response data packet is listened to by the network driver, and specifically includes: the system service listens to the network response data packet corresponding to the application with the set firewall permission group information through the network driver.

[0279] Specifically, in an implementable manner, the application does not receive a response within a preset time length, an error is prompted, and the process ends.

[0280] The method for network access of an application in a smart terminal device provided in the application sets the network access setting information specified by the application according to the determined application network setting type through the system service and the network driver, solves the problem that the application cannot be set for secure network access due to no permission in the prior art, and realizes the function that the application can be securely accessed and operated in a specified network environment, thereby avoiding the risk of data leakage caused by network security problems.

[0281] The following is an apparatus embodiment of the application, which can be used to execute the method embodiments of the application. For details not disclosed in the apparatus embodiments of the application, reference can be made to the method embodiments of the application.

[0282] An apparatus for network access of an application in a smart terminal device provided in an example embodiment of the application, the apparatus includes a system service and a network driver,

[0283] The system service includes:

[0284] A first determination module is configured to determine the application network setting type according to the called interface type, and trigger a first acquisition judgment module if the application network setting type is a first type.

[0285] The first acquisition judgment module is configured to acquire the application configuration information input through the called interface, and determine whether the user firewall permission information exists according to the application configuration information.

[0286] The obtaining and storing module is configured to, when the first obtaining and judging module judges that there is user firewall permission information, obtain a custom IP address list, store the network access configuration information in the application configuration information into the custom IP address list, and transmit the network access configuration information as a parameter into the network driver;

[0287] The network driver comprises a configuration module configured to configure the network access configuration information into the filtering white list rule table through a configuration instruction.

[0288] In the apparatus, the system service further comprises:

[0289] The receiving module is configured to receive a network connection request initiated by any application in the intelligent terminal device, and listen to network response data packets through the network driver when the request is received, and is further configured to receive the network response data packets transmitted by the network driver.

[0290] The sending module is configured to return the network response data packets to the application, and is further configured to return an error to the application.

[0291] In the apparatus, the network driver further comprises:

[0292] The first judging module is configured to listen to the network response data packets, and judge whether there is an IP address in the filtering white list rule table when the network response data packets are listened to, and if yes, trigger the second judging module, and if not, return the network response data packets to the system service.

[0293] The second judging module is configured to judge whether the IP address of the response party in the network response data packets is the same as the network access configuration information in the filtering white list rule table, and if yes, return the network response data packets to the system service, and if not, discard the network response data packets and return an error to the system service.

[0294] Optionally, the system service further comprises a second obtaining and judging module and an obtaining and deleting module.

[0295] The first determining module is further configured to trigger the second obtaining and judging module if the network setting type of the application is the second type.

[0296] The second obtaining and judging module is configured to obtain the application configuration information transmitted through the called interface, and judge whether there is user firewall permission information according to the application configuration information.

[0297] The obtaining and deleting module is configured to, when the second obtaining and judging module judges that there is user firewall permission information, obtain a custom IP address list, delete the network access configuration information in the custom IP address list, and transmit the network access configuration information as a parameter into the network driver.

[0298] The network driver further comprises a deletion module configured to delete the network access configuration information from the filtering whitelist rule table by a deletion instruction.

[0299] Further, the first determining module is specifically configured to determine the network setting type as the first type when the first preset interface is invoked, and determine the network setting type as the second type when the second preset interface is invoked.

[0300] Optionally, the system service comprises a package management service, and the package management service comprises an obtaining unit, a determining unit and a calling unit.

[0301] The obtaining unit is configured to obtain an application to-be-installed APK file, call an API interface to parse a manifest file in the application to-be-installed APK file, and obtain configuration startup item information.

[0302] The determining unit is configured to determine a network access configuration type according to the configuration startup item information.

[0303] The calling unit is configured to call an interface according to the network access configuration type.

[0304] Further, the calling unit is specifically configured to obtain user firewall permission information and network access configuration information in the manifest file, organize the network access configuration information and the user firewall permission information to obtain application configuration information, and call the interface to input the application configuration information as a parameter.

[0305] Further, the apparatus comprises a generating module configured to generate an application to-be-installed APK file.

[0306] The generating module is specifically configured to determine a network access configuration type, write configuration startup item information, network access configuration information and user firewall permission information corresponding to the network access configuration type according to a predetermined format into a manifest file to obtain the application to-be-installed APK file.

[0307] Optionally, the system service further comprises a judgment deletion module, and the judgment deletion module specifically comprises a first judgment unit, a first obtaining judgment unit and a processing unit.

[0308] The first judgment unit is configured to judge whether the network access configuration information exists in the custom IP address list, and if yes, trigger the first obtaining unit, and if not, trigger the obtaining saving module.

[0309] The first obtaining judgment unit is configured to obtain network access configuration information in the application configuration information, judge whether the network access configuration information in the custom IP address list is same as the network access configuration information in the application configuration information, and if yes, end, and if not, trigger the processing unit.

[0310] The processing unit is configured to delete the network access configuration information in the custom IP address list, pass the network access configuration information in the custom IP address list as a parameter into a network driver, save the network access configuration information in the application configuration information into the custom IP address list, and trigger the deletion module.

[0311] Optionally, the apparatus further comprises a POS management service; the POS management service comprises a second determination module and a calling module;

[0312] The second determination module is configured to determine the interface type of the system service according to the interface type called by the third-party application, and call the interface according to the determined interface type;

[0313] The calling module is configured to call the interface of the system service.

[0314] Further, the calling module is specifically configured to obtain an application package name, organize the network access configuration information and the application package name to obtain the application configuration information, and call the interface of the system service with the application configuration information as a parameter.

[0315] Further, the first obtaining and judging module or the second obtaining and judging module is specifically configured to judge whether the user firewall permission information exists according to the application package name in the application configuration information.

[0316] Optionally, the system service further comprises a signature verification module configured to obtain signature verification data in the application configuration information to perform code signature verification, obtain network configuration permission when the signature verification passes, trigger the obtaining and saving module, and end when the signature verification fails.

[0317] Optionally, the deletion module is specifically configured to delete all the network access configuration information in the filtering whitelist rule table through a deletion instruction when the smart terminal device is powered off.

[0318] Optionally, the system service further comprises a reconfiguration module configured to obtain the saved custom IP address list when the smart terminal device is powered on and restarted, traverse the custom IP address list, sequentially obtain the network access configuration information in the custom IP address list, and pass the network access configuration information as a parameter into the network driver.

[0319] Optionally, the system service further comprises a setting module configured to set the firewall permission group information corresponding to the application according to the user firewall information in the application configuration information when the first obtaining and judging module or the second obtaining and judging module judges that the user firewall permission information exists according to the application configuration information.

[0320] Optionally, the receiving module specifically comprises a listening unit configured to listen to network response data packets.

[0321] The listening unit is configured to listen to a network response data packet corresponding to an application with firewall permission group information.

[0322] It should be noted that the apparatus for enabling an application in a smart terminal device to access a network provided in the above-described embodiments is only used for executing the method for enabling an application in a smart terminal device to access a network, and the division of the above-described function modules is only used as an example in actual application, and the above-described functions can be allocated and completed by different function modules according to actual needs, that is, the internal structure of the device is divided into different function modules to complete all or part of the functions described above. In addition, the apparatus for enabling an application in a smart terminal device to access a network and the method for enabling an application in a smart terminal device to access a network provided in the above-described embodiments belong to the same concept, and the implementation process is embodied in the method embodiments, which will not be described here.

[0323] The serial numbers of the above-described embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0324] The method and apparatus for enabling an application in a smart terminal device to access a network provided in the present application are configured to set the network access setting information specified by the application according to the determined application network setting type by the system service and the network driver, solve the problem that the application cannot be set to access a secure network due to the lack of permission in the prior art, realize the function that the application can access and operate safely in a specified network environment, and avoid the risk of data leakage caused by network security problems.

[0325] The embodiments of the present application further provide a computer device, which comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the method for enabling an application in a smart terminal device to access a network disclosed in any of the preceding embodiments.

[0326] The embodiments of the present application further provide a computer readable storage medium having a computer program / instruction stored thereon, which is executed by a processor to implement the method for enabling an application in a smart terminal device to access a network disclosed in any of the preceding embodiments. The computer readable storage medium can include but is not limited to any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0327] The embodiments of the present application provide a computer program product comprising a computer program / instruction, wherein the computer program / instruction is executed by a processor to implement the method for enabling an application in a smart terminal device to access a network disclosed in any of the preceding embodiments.

[0328] In the present application, the terms "first", "second" and the like are used only for descriptive purposes, and cannot be construed as indicating or implying relative importance or sequence; the term "multiple" refers to two or more, unless otherwise explicitly limited. The term "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist together, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects. The terms "mounting", "connecting", "connecting", "fixing" and the like should be understood in a broad sense, for example, "connecting" can be fixed connection, or detachable connection, or integral connection; "connected" can be directly connected, or indirectly connected through an intermediate medium. For those skilled in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0329] In the description of the present application, it should be understood that the orientation or position relationship indicated by the terms "upper", "lower" and the like is based on the orientation or position relationship shown in the drawings, and is only for the purpose of facilitating the description of the present application and simplifying the description, and does not indicate or imply that the device or unit referred to must have a particular direction, be constructed and operated in a particular orientation, therefore, it cannot be understood as a limitation on the present application.

[0330] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, any equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A method for network access by an application in a smart terminal device, the smart terminal device comprising a system service and a network driver, wherein, The method comprises: Step S1, the system service determines an application network setting type according to a type of an interface called, and executes step S2 if the application network setting type is a first type; Step S2, the system service acquires application configuration information transmitted through a first preset interface called, and judges whether there is user firewall permission information according to the application configuration information, and executes step S3 if yes, otherwise ends; Step S3, the system service acquires a custom IP address list, saves network access configuration information in the application configuration information into the custom IP address list, and transmits the network access configuration information as a parameter into the network driver; Step S4, the network driver configures the network access configuration information into a filtering whitelist rule table through a configuration instruction, and ends; The method further comprises: Step F1, when the system service receives a network connection request initiated by an application in the intelligent terminal device, the system service listens to network response data packets through the network driver; Step F2, when the network driver listens to the network response data packets, the network driver judges whether there is network access configuration information in the filtering whitelist rule table, and executes step F3 if yes, otherwise returns the network response data packets to the system service and executes step F4; Step F3, the network driver judges whether an IP address of a responder in the network response data packets is same as the network access configuration information in the filtering whitelist rule table, and returns the network response data packets to the system service and executes step F4 if yes, otherwise discards the network response data packets, returns an error to the system service and executes step F5; Step F4, the system service returns the network response data packets to the application; Step F5, the system service returns an error to the application.

2. The method of claim 1, wherein, The method further comprises the following steps executed by the system service when the application network setting type is determined as a second type according to a type of an interface called: Step S5, the system service acquires application configuration information transmitted through a second preset interface called, and judges whether there is user firewall permission information according to the application configuration information, and executes step S6 if yes, otherwise ends; Step S6, the system service acquires a custom IP address list, judges whether there is network access configuration information in the custom IP address list, and deletes the network access configuration information in the custom IP address list, transmits the network access configuration information as a parameter into the network driver, and executes step S7 if yes, otherwise ends; Step S7, the network driver deletes the network access configuration information from the filtering whitelist rule table through a deletion instruction, and ends.

3. The method of claim 2, wherein, The system service determines the application network setting type according to a type of an interface called, specifically, when a first preset interface of the system service is called, the system service determines that the application network setting type is the first type, and when a second preset interface of the system service is called, the system service determines that the application network setting type is the second type.

4. The method of claim 1, wherein, The system service includes a package management service, and the step S1 further includes: Step P1, the package management service acquires an application to be installed APK file; Step P2, the package management service calls an API interface to parse a manifest file in the application to be installed APK file, and acquires configuration startup item information; Step P3, the package management service determines a network access configuration type according to the configuration startup item information, and calls an interface of the system service according to the network access configuration type.

5. The method of claim 4, wherein, In the step P3, the interface of the system service is specifically that: the package management service acquires user firewall permission information and network access configuration information in the manifest file, organizes the network access configuration information and the user firewall permission information to obtain application configuration information, and calls the interface of the system service to pass the application configuration information as a parameter.

6. The method of claim 4, wherein, The method further includes generating the application to be installed APK file; The generation of the application to be installed APK file is specifically that: Step D1, determining a network access configuration type; Step D2, writing configuration startup item information corresponding to the network access configuration type, network access configuration information and user firewall permission information into a manifest file according to a predetermined format to obtain the application to be installed APK file.

7. The method of claim 1, wherein, In the step S3, before the network access configuration information in the application configuration information is saved into the custom IP address list, the step S3 further includes: Step M21, the system service determines whether the network access configuration information exists in the custom IP address list, and if yes, step M22 is performed, otherwise, the network access configuration information in the application configuration information is saved into the custom IP address list; Step M22, the system service acquires the network access configuration information in the application configuration information, and determines whether the network access configuration information in the custom IP address list is same as the network access configuration information in the application configuration information, and if yes, the process is ended, and if not, step M23 is performed; Step M23, the system service deletes the network access configuration information in the custom IP address list from the custom IP address list, passes the network access configuration information in the custom IP address list as a parameter into the network driver, performs step M24, and saves the network access configuration information in the application configuration information into the custom IP address list; Step M24, the network driver deletes the network access configuration information in the custom IP address list from the filtering whitelist rule table through a deletion instruction.

8. The method of claim 2, wherein, The intelligent terminal device further includes a POS management service; Before the step S1, the POS management service determines an interface type of calling a system service according to an interface type called by a third-party application, and calls an interface of the system service according to the determined interface type.

9. The method of claim 8, wherein, The interface for calling the system service according to the determined interface type is specifically that the POS management service acquires an application package name, organizes the network access configuration information and the application package name to obtain application configuration information, and calls the interface of the system service to pass the application configuration information as a parameter.

10. The method of claim 9, wherein, The step of judging whether there is user firewall permission information according to the application configuration information is specifically that the system service judges whether there is user firewall permission information according to the application package name in the application configuration information. The system service judges whether there is user firewall permission information according to the application package name in the application configuration information.

11. The method of claim 1, wherein, When it is judged that there is user firewall permission information according to the application configuration information, the method further includes that the system service acquires signature data in the application configuration information to perform code signature, acquires network configuration permission when the signature passes, and executes step S3, and ends when the signature fails. When the intelligent terminal device is powered off, the method further includes that the network driver deletes all the network access configuration information in the filtering whitelist rule table through a deletion instruction.

12. The method of claim 1, wherein, When the intelligent terminal device is powered on and restarted, the method further includes that the system service acquires a saved custom IP address list, traverses the custom IP address list, sequentially acquires network access configuration information in the custom IP address list, and passes the network access configuration information as a parameter into the network driver to execute step S4.

13. The method of claim 1, wherein, In step S2, when it is judged that there is user firewall permission information according to the application configuration information, the system service further sets application corresponding firewall permission group information according to the user firewall information in the application configuration information.

14. The method of claim 1, wherein, The system service listens to network response data packets through the network driver, and the listening specifically includes that the system service listens to network response data packets corresponding to applications with set firewall permission group information through the network driver. The processor executes the computer program to implement:

15. An intelligent terminal device comprising a memory, a processor, and a computer program stored on the memory, wherein, Step S1, determining an application network setting type according to an interface type called, and executing step S2 if the application network setting type is a first type; Step S2, acquiring application configuration information passed in through a called first preset interface, and judging whether there is user firewall permission information according to the application configuration information, and executing step S3 if yes, and ending if no; Step S3, acquiring a custom IP address list, saving network access configuration information in the application configuration information into the custom IP address list, and passing the network access configuration information as a parameter into a network driver; Step S4, configuring the network access configuration information into a filtering whitelist rule table through a configuration instruction, and ending; The processor is further used to implement: Step F1, when the system service receives a network connection request initiated by an application in the intelligent terminal device, listening to network response data packets through the network driver; Step F2, when the network driver listens to the network response data packets, judging whether there is network access configuration information in a filtering whitelist rule table, and executing step F3 if yes, and returning the network response data packets to the system service and executing step F4 if no; Step F3, acquiring a custom IP address list, saving network access configuration information in the application configuration information into the custom IP address list, and passing the network access configuration information as a parameter into a network driver; ​ Step F3, judging whether the IP address of the responder in the network response data packet is same as the network access configuration information in the filtering white list rule table, if yes, returning the network response data packet to the system service, executing step F4, otherwise discarding the network response data packet, returning an error to the system service, and executing step F5; Step F4, returning the network response data packet to the application; Step F5, returning an error to the application.

16. A computer readable storage medium having stored thereon computer programs / instructions, wherein, The computer program / instruction is executed by the processor to implement the method in any one of claims 1 to 14.

17. A computer program product comprising computer programs / instructions, wherein, The computer program / instruction is executed by the processor to implement the method in any one of claims 1 to 14.

Images