Application installing method, application providing method, and related apparatus

Abstract

The present application provides an application installing method, an application providing method, and a related apparatus. A terminal device sends a first request to a server, wherein the first request is used for requesting to acquire a first application installation package. The server may generate a working key of a first application, and sends the working key and a ciphertext of the first application installation package to the terminal device. The terminal device saves the working key of the first application, and installs the first application on the basis of the ciphertext of the first application installation package. In the process, when transmitting the first application installation package between the server and the terminal device, the transmission is performed in an encrypted manner, and the terminal device does not decrypt the first application during installation of the first application, thereby effectively ensuring the code security of the first application. Additionally, the server does not save the working key of the first application, thereby avoiding leakage of the working key saved by the server and further ensuring the code security of the first application.

Description

Application installation method and application providing method and related device

[0001] Cross-reference to Related Applications

[0002] This application claims priority to the Chinese Patent Application No. 202411335243.0, filed on September 23, 2024, and entitled "An Application Installation Method and an Application Providing Method", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the technical field of computers, and in particular, to an application installation method and an application providing method and related device. BACKGROUND

[0004] With the rapid development of mobile Internet, an installation package of an application (APP) is usually published on an application distribution platform, and a terminal device that needs to install the application can download the installation package of the application from the application distribution platform through a network, and then install the application on the terminal device based on the installation package of the application.

[0005] Currently, a malicious user can obtain the source code of the application from the installation package of the application, copy and distribute the source code of the application without authorization, and even find and exploit code vulnerabilities to steal user data and assets by analyzing the source code. Therefore, how to securely and efficiently protect the confidentiality of the application is a problem to be solved. SUMMARY

[0006] The present application provides an application installation method and an application providing method and related device, which can improve the protection of the confidentiality of the application.

[0007] In a first aspect, the present application provides an application installation method, which can be executed by a terminal device, a chip, a chip system or a circuit in the terminal device. The application installation method can include: sending, by the terminal device, a first request to a server, wherein the first request is used to request to obtain a first application installation package; receiving, by the terminal device, a working key of the first application and a secret text of the first application installation package sent by the server; the secret text of the first application installation package is obtained by encrypting the first application installation package using the working key; saving, by the terminal device, the working key of the first application; and installing, by the terminal device, the first application based on the secret text of the first application installation package.

[0008] In the present application, when the server transmits the installation package of the first application to the terminal device, the transmission is performed in an encryption mode, and the ciphertext of the first application installation package is transmitted, so that the code of the first application can be prevented from being leaked. Moreover, the terminal device installs the first application based on the ciphertext of the first application installation package, and the first application is not decrypted during the installation, so that the code security of the first application can be effectively guaranteed.

[0009] In an optional implementation, after the first application is installed, the terminal device can load the ciphertext of the code file of the first application in response to a start application operation, decrypt the ciphertext of the code file by using the working key of the first application to obtain the code of the first application, and run the code of the first application.

[0010] In the above implementation, when the first application is started, the terminal device loads the ciphertext of the code file of the first application, and then decrypts the ciphertext of the code file by using the working key of the first application to run the code of the first application. After the first application is installed, the terminal device stores the ciphertext of the code file of the first application, so that the code of the first application can be prevented from being leaked on the terminal side.

[0011] In an optional implementation, when the working key of the first application is saved, the terminal device can encrypt the working key of the first application by using a storage key, and save the encrypted working key ciphertext. Before the working key of the first application is decrypted, the terminal device can decrypt the working key ciphertext to obtain the working key of the first application.

[0012] In the above implementation, when the working key of the first application is saved, the terminal device encrypts the working key of the first application by using a storage key, so that the security of the working key of the first application in the storage process of the terminal device is improved.

[0013] In a second aspect, the present application provides an application providing method, which can be executed by a server, a chip, a chip system or a circuit in the server. The application providing method can include: receiving, by the server, a first request sent by a terminal device, wherein the first request is used to request to obtain a first application installation package; generating, by the server, a working key of the first application; sending, by the server, the working key of the first application to the terminal device; sending, by the server, a ciphertext of the first application installation package to the terminal device, wherein the ciphertext of the first application installation package is obtained by encrypting the first application installation package by using the working key.

[0014] In the present application, the working key of the first application program is not saved in the server, but the working key of the first application program is generated after receiving the first request sent by the terminal device, and is sent to the terminal device, so that the working key saved in the server is avoided to be leaked, and the code security of the first application program is further ensured.

[0015] In an optional implementation, when the working key of the first application program is generated, the server can generate the working key of the first application program based on key derivation material of the first application program; the key derivation material includes random code, encryption algorithm and application information of the first application program.

[0016] In an optional implementation, before receiving the first request sent by the terminal device, the server can also receive the first application program installation package; the code file in the first application program installation package is encrypted by using the working key of the first application program to obtain ciphertext of the first application program installation package; and the ciphertext of the first application program installation package is saved.

[0017] In a third aspect, the present application provides an application program installation device, which can be applied to a terminal device, and the application program installation device can include:

[0018] The request sending module is configured to send a first request to a server; the first request is used to request to obtain a first application program installation package;

[0019] The receiving module is configured to receive the working key of the first application program and the ciphertext of the first application program installation package sent by the server; the ciphertext of the first application program installation package is obtained by encrypting the first application program installation package by using the working key;

[0020] The key saving module is configured to save the working key of the first application program;

[0021] The program installation module is configured to install the first application program based on the ciphertext of the first application program installation package.

[0022] In an optional implementation, the application program installation device can further include:

[0023] The program running module is configured to load the ciphertext of the code file of the first application program in response to a start application operation; the ciphertext of the code file is decrypted by using the working key of the first application program to obtain the code of the first application program; and the code of the first application program is run.

[0024] In an optional implementation, the key saving module can be specifically configured to encrypt the working key of the first application program by using the storage key, and save the encrypted working key ciphertext;

[0025] The program running module can also be configured to decrypt the working key ciphertext to obtain the working key of the first application before decrypting the code file of the first application using the working key of the first application.

[0026] In a fourth aspect, the present application provides an application providing apparatus, which can be applied to a server. The application providing apparatus can include:

[0027] The request receiving module is configured to receive a first request sent by a terminal device, wherein the first request is used to request to obtain a first application installation package.

[0028] The key generating module is configured to generate a working key of the first application.

[0029] The key sending module is configured to send the working key of the first application to the terminal device.

[0030] The installation package sending module is configured to send the ciphertext of the first application installation package to the terminal device, wherein the ciphertext of the first application installation package is obtained by encrypting the first application installation package using the working key.

[0031] In an optional implementation, the key generating module can be specifically configured to generate the working key of the first application based on key derivation material of the first application, wherein the key derivation material includes a random code, an encryption algorithm and application information of the first application.

[0032] In an optional implementation, the application providing apparatus can further include:

[0033] The installation package encrypting module is configured to receive the first application installation package, encrypt a code file in the first application installation package using the working key of the first application to obtain the ciphertext of the first application installation package, and save the ciphertext of the first application installation package.

[0034] In a fifth aspect, the present application provides a terminal device, which includes a processor and a memory. The processor is configured to execute instructions stored in the memory, so that the terminal device executes any method provided in the first aspect.

[0035] In a sixth aspect, the present application provides a server, which includes a processor and a memory. The processor is configured to execute instructions stored in the memory, so that the server executes any method provided in the second aspect.

[0036] In a seventh aspect, the present application provides a computer readable storage medium, which stores computer executable instructions. The computer executable instructions are used to make a computer execute any method provided in the first aspect.

[0037] In an eighth aspect, an embodiment of the present application provides a computer readable storage medium, wherein computer executable instructions are stored in the computer readable storage medium, and the computer executable instructions are used for causing a computer to execute any method provided in the second aspect.

[0038] In a ninth aspect, an embodiment of the present application provides a computer program product, comprising computer executable instructions, and the computer executable instructions are used for causing a computer to execute any method provided in the first aspect.

[0039] In a tenth aspect, an embodiment of the present application provides a computer program product, comprising computer executable instructions, and the computer executable instructions are used for causing a computer to execute any method provided in the first aspect.

[0040] The technical effects that can be achieved by any one of the third aspect to the tenth aspect can refer to the description of beneficial effects of the first aspect or the second aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0041] FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present application;

[0042] FIG. 2 is an interaction flow diagram between a terminal device and a server according to an embodiment of the present application;

[0043] FIG. 3 is an interaction flow diagram between an application shelf module and an application encryption module in a key derivation material generation process according to an embodiment of the present application;

[0044] FIG. 4 is an interaction flow diagram between an application shelf module and an application encryption module in an application program encryption process according to an embodiment of the present application;

[0045] FIG. 5 is an interaction flow diagram between multiple modules in an application program providing process according to an embodiment of the present application;

[0046] FIG. 6 is an interaction flow diagram between multiple modules in a working key providing process of an application program according to an embodiment of the present application;

[0047] FIG. 7 is a flow diagram of an application program running process according to an embodiment of the present application;

[0048] FIG. 8 is an interaction flow diagram between multiple modules in a terminal device in an application program running process according to an embodiment of the present application;

[0049] FIG. 9 is a schematic diagram of an application program installation process according to an embodiment of the present application;

[0050] FIG. 10 is a schematic diagram of internal structures of a terminal device and a server according to an embodiment of the present application;

[0051] FIG. 11 is a schematic diagram of a structure of an application installation apparatus according to an embodiment of the present application;

[0052] FIG. 12 is a schematic diagram of another application installation apparatus according to an embodiment of the present application;

[0053] FIG. 13 is a schematic diagram of an application providing apparatus according to an embodiment of the present application;

[0054] FIG. 14 is a schematic diagram of another application providing apparatus according to an embodiment of the present application;

[0055] FIG. 15 is a schematic diagram of a structure of a terminal device according to an embodiment of the present application;

[0056] FIG. 16 is a schematic diagram of a structure of a server according to an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. The terms used in the embodiment part of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0058] In the embodiments of the present application, "a plurality of" means two or more, and therefore, "a plurality of" can also be understood as "at least two" in the embodiments of the present application. "At least one" can be understood as one or more, for example, one, two or more. For example, "including at least one" means including one, two or more, and does not limit which ones are included, for example, including at least one of A, B and C means that the included can be A, B, C, A and B, A and C, B and C, or A and B and C. "And / or" describes the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character " / ", if not specially stated, generally represents an "or" relationship between the front and rear associated objects.

[0059] Unless otherwise stated, the ordinal numbers "first", "second", and the like mentioned in the embodiments of the present application are used to distinguish a plurality of objects, and are not used to limit the order, time sequence, priority or importance of the plurality of objects.

[0060] The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0061] The application program providing method and the application program installation method provided by the embodiments of the present application can be applied to the application scenario shown in FIG. 1. The terminal device 100 in the communication system shown in FIG. 1 can be understood as a terminal device of a user, and the server 200 is installed with an application distribution platform server 210, which can provide installation packages of a plurality of application programs. The terminal device 100 is installed with an application distribution platform client 110, and the terminal device 100 can be connected with the server 200 through a communication network, and the terminal device 100 can obtain the installation package of the application program to be installed from the server 200 through the application distribution platform client 110.

[0062] The server 200 can connect a plurality of terminal devices through a communication network, and the server 200 can include one or more cloud servers, and the server 200 can be a server cluster. The application distribution platform server 210 installed on the server 200 can be connected with the terminal device operated by the user through the Internet, and can provide the installation package of a plurality of application programs for tenants, and the installation package of a plurality of application programs can be stored in the storage device corresponding to the application distribution platform server 210, and the storage device can be located in one or more cloud servers of the server 200. The user can download the installation package of the application program from the application distribution platform server 210 through the application distribution platform client 110 installed in the terminal device 100, so as to install the corresponding application program on the terminal device 100. The terminal device 100 can be a smart phone, a tablet computer, a notebook computer, a smart television, a vehicle-mounted central control screen, an ink screen, a watch, a bracelet, a printer, a desktop computer and other smart terminal devices capable of installing mobile applications.

[0063] The application scenario shown in FIG. 1 is only an example and does not limit the application scenario of the present application. The application program installation method and the application program providing method provided by the embodiments of the present application can also be applied to other scenarios.

[0064] In the above scenario, the terminal device can download the installation package of the application program from the server through the network, and then install the application program on the terminal device based on the installation package of the application program. In this process, a malicious user can obtain the source code of the application program from the installation package of the application program, copy and distribute the source code of the application program without authorization, and even find and exploit code vulnerabilities to steal user data and assets by analyzing the source code.

[0065] Based on this, the application provides an application installation method and an application providing method. When a first application needs to be installed, a terminal device can send a first request to a server, and the first request is used to request a first application installation package. The server receives the first request sent by the terminal device, generates a working key of the first application, and sends the working key of the first application and ciphertext of the first application installation package to the terminal device. The ciphertext of the first application installation package is obtained by encrypting the first application installation package by using the working key. The terminal device receives the working key of the first application and the ciphertext of the first application installation package sent by the server, saves the working key of the first application, and installs the first application based on the ciphertext of the first application installation package. In the above process, when the server and the terminal device transmit the first application installation package, the transmission is performed in an encrypted manner. The terminal device installs the first application based on the ciphertext of the first application installation package, and the first application is not decrypted during installation, which can effectively guarantee the code security of the first application. Meanwhile, the working key of the first application is not saved in the server, but is generated after the server receives the first request sent by the terminal device, and is sent to the terminal device, which can avoid the leakage of the working key saved in the server, and further guarantee the code security of the first application.

[0066] FIG. 2 exemplarily shows an interaction process between a terminal device and a server in a process in which the terminal device downloads and installs an application. As shown in FIG. 2, the process can include the following steps:

[0067] S201, the server receives a first application installation package.

[0068] The first application can be any application. When a developer of the first application needs to publish the first application, the developer can send an installation package of the first application to the server through a terminal device of the developer. An application distribution platform server is arranged on the server, and the server can receive the installation package of the first application sent by the terminal device of the developer through the application distribution platform server.

[0069] S202, the server generates a working key of the first application, and encrypts code files in the first application installation package by using the working key of the first application, to obtain ciphertext of the first application installation package.

[0070] S203, the server saves the ciphertext of the first application installation package.

[0071] The server or a storage device corresponding to the server stores the key derivation material of the first application, and a working key of the first application can be generated based on the key derivation material of the first application. For example, the server is provided with an application shelf module and an application encryption module, or in other words, the application distribution platform server is provided with an application shelf module and an application encryption module. In the process of storing the key derivation material of the first application, the interaction process of the application shelf module and the application encryption module is shown in FIG. 3, which can include the following steps:

[0072] S301, the application shelf module generates initial key derivation material based on the application identifier and version information of the first application.

[0073] After receiving the installation package of the first application, the application shelf module can obtain the application identifier and version information of the first application, and the application identifier of the first application can be the package name of the first application or the name of the first application. The application shelf module can generate the initial key derivation material of the first application based on the application identifier and version information of the first application.

[0074] S302, the application shelf module sends the initial key derivation material to the application encryption module.

[0075] The application shelf module submits the initial key derivation material of the first application to the application encryption module, and the initial key derivation material of the first application includes the application identifier and version information of the first application.

[0076] S303, the application encryption module updates the initial key derivation material based on the random code to obtain the key derivation material of the first application.

[0077] The application encryption module receives the initial key derivation material of the first application sent by the application shelf module, and generates a random code for the first application. The random code can also be referred to as a secure random code, and the application encryption module can generate different random codes for different applications and different versions of the same application. The application encryption module can update the initial key derivation material of the first application, add the random code, the encryption algorithm suite name and the version information in the initial key derivation material of the first application, and obtain the key derivation material of the first application.

[0078] S304, the application encryption module saves the key derivation material of the first application to the database.

[0079] The database can be set in the server or the storage device corresponding to the server.

[0080] After the key derivation material of the first application is saved to the database, the server can generate a working key of the first application based on the key derivation material of the first application. In the process of generating the working key of the first application, the interaction process of the application shelf module and the application encryption module is shown in FIG. 4, which can include the following steps:

[0081] S401. The application shelf module sends an application encryption task to the application encryption module.

[0082] After receiving the installation package of the first application, the application shelf module can generate an application encryption task, and send the application encryption task to the application encryption module, the application encryption task carrying the application identifier and version information of the first application, for indicating to encrypt the installation package of the first application.

[0083] S402. The application encryption module obtains the key derivation material of the first application based on the received application encryption task.

[0084] The application encryption module receives the application encryption task sent by the application shelf module, and obtains the application identifier and version information of the first application from the application encryption task; and reads the key derivation material of the first application from the database according to the application identifier and version information of the first application.

[0085] S403. The application encryption module generates the working key of the first application based on the key derivation material of the first application.

[0086] In some embodiments, the application encryption module of the server further stores a master key, which can be pre-installed in the application encryption module and is a global configuration item, and the master keys of different applications can be the same. The application encryption module can use the master key and the key derivation material of the first application to generate the working key of the first application.

[0087] S404. The application encryption module encrypts the code file in the installation package of the first application using the working key of the first application.

[0088] For example, the application encryption module can save the installation package of the first application to a local directory, parse the installation package of the first application, extract the code file to be encrypted from the installation package of the first application, and encrypt the code file using the working key of the first application to synthesize the ciphertext of the installation package of the first application.

[0089] S405. The application encryption module sends the ciphertext of the installation package of the first application to the application shelf module.

[0090] S406, the application shelf module saves the ciphertext of the first application installation package to the application shelf and publishes.

[0091] In the embodiments of the present application, the encryption algorithm suite version information and the random code are recorded in the key derivation material of the application program, so that the working key of each version of each application program is unique, and the risk of working key collision is eliminated. In step S403, the working key of the application program is derived in real time through the key derivation material and the cryptographic algorithm, so that the working key of the application program is stored free of charge, and the risk of sensitive data leakage is avoided. In step S404, the code file of the application program is encrypted, the confidentiality of the code information of the application program is protected, and the code file of the application program is encrypted and stored and transmitted without the risk of key information asset leakage.

[0092] After saving and publishing the ciphertext of the first application installation package, if a user needs to install the first application program on a terminal device, the application distribution platform server can execute step S204 to download the first application installation package from the application distribution platform server.

[0093] S204, the terminal device sends a first request to the server.

[0094] The application distribution platform client is installed on the terminal device, and when a user needs to install the first application program on the terminal device, the user can open the application distribution platform client on the terminal device, select the first application program, and the terminal device receives the operation of the user selecting the first application program, generates a first request, and sends the first request to the server. The first request includes the application identifier and version information of the first application program, and is used to request to obtain the installation package of the first application program.

[0095] S205, the server sends the ciphertext of the first application installation package to the terminal device.

[0096] S206, the terminal device installs the first application program based on the ciphertext of the first application installation package.

[0097] In some embodiments, the first request can include a metadata acquisition request and an installation package acquisition request. The application management module is set in the operating system of the terminal device, and the application management module can also be referred to as a bundle manage service (BMS). The application distribution platform server on the server is provided with an application distribution module and an application shelf module. In the process of downloading the installation package of the first application program by the terminal device, the interaction process between the modules is shown in FIG. 5, which can include the following steps:

[0098] S501, the application distribution platform client sends a metadata acquisition request to the application distribution module.

[0099] When the user needs to install the first application on the terminal device, the application distribution platform client in the terminal device can send a metadata acquisition request to the application distribution module, the metadata acquisition request including the application identifier and version information of the first application, for requesting to acquire the application distribution metadata of the first application.

[0100] S502, the application distribution module sends the application distribution metadata of the first application to the application distribution platform client.

[0101] The application distribution module in the server can acquire the application distribution metadata of the first application based on the application identifier and version information of the first application carried in the metadata acquisition request after receiving the metadata acquisition request sent by the application distribution platform client of the terminal device, and send the application distribution metadata of the first application to the application distribution platform client of the terminal device. The application distribution metadata of the first application includes the application identifier and version information, signature and download address of the first application.

[0102] S503, the application distribution platform client sends an installation package acquisition request to the application shelf module.

[0103] The application distribution platform client of the terminal device can send an installation package acquisition request to the application shelf module based on the download address in the application distribution metadata of the first application after receiving the application distribution metadata of the first application sent by the application distribution module, and the installation package acquisition request is used to request to acquire the installation package of the first application.

[0104] S504, the application shelf module sends the ciphertext of the installation package of the first application to the application distribution platform client.

[0105] The application shelf module in the server can acquire the encrypted installation package of the first application based on the download address carried in the installation package acquisition request after receiving the installation package acquisition request sent by the application distribution platform client of the terminal device, and send the encrypted installation package of the first application to the application distribution platform client of the terminal device. This process can be implemented by using content delivery network (CDN) acceleration service.

[0106] S505, the application distribution platform client verifies the ciphertext of the installation package of the first application.

[0107] The application distribution platform client of the terminal device can verify the integrity of the encrypted installation package of the first application by using the signature of the first application after receiving the encrypted installation package of the first application sent by the application shelf module, and if the verification is passed, step S506 is executed.

[0108] S506, the application distribution platform client sends an application installation command to the application management module.

[0109] S507, the application management module performs an operation of installing the first application program.

[0110] The application distribution platform client can call the application management module in the operating system of the terminal device to install the first application program. The application management module receives the application installation command sent by the application distribution platform client, the application installation command instructs the application management module to install the first application program, and the application management module can install the first application program based on the installation package encrypted by the working key. The code file of the first application program is not decrypted during installation, and the code file of the first application program remains in an encrypted state after installation is completed.

[0111] The server can also perform step S207 after receiving the first request sent by the terminal device.

[0112] S207, the server generates a working key of the first application program.

[0113] S208, the server sends the working key of the first application program to the terminal device.

[0114] S209, the terminal device saves the working key of the first application program.

[0115] In some embodiments, the first request can also include a working key acquisition request. The operating system of the terminal device also includes a key service module, which can be a key service application programming interface (application programming interface, API). In the process of the terminal device acquiring the working key of the first application program, the interaction process between the modules is as shown in FIG. 6, which can include the following steps:

[0116] S601, the application distribution platform client sends a certificate acquisition request to the key service module.

[0117] The certificate acquisition request is used to request to acquire the device certificate of the terminal device.

[0118] S602, the key service module sends the device certificate to the application distribution platform client.

[0119] The key service module in the operating system of the terminal device receives the certificate obtaining request sent by the application distribution platform client, reads the encrypted device certificate from a trusted execution environment (TEE), which is a secure area and can be implemented by a software and hardware method. For example, the TEE can be a secure chip arranged in the terminal device. After reading the encrypted device certificate, the key service module decrypts the encrypted device certificate and sends the decrypted device certificate to the application distribution platform client.

[0120] S603, the application distribution platform client sends a key obtaining request to the key service module.

[0121] The public key obtaining request is used to request to obtain the public and private key pair of the terminal device.

[0122] S604, the key service module creates a public and private key pair of the terminal device.

[0123] The key service module receives the public key obtaining request sent by the application distribution platform client, creates a public and private key pair of the terminal device, which can be an elliptic curve cryptography (ECC) public and private key pair, including a private key of the terminal device and a public key of the terminal device, wherein the public key of the terminal device refers to an ECC public key, and hereinafter the public key of the terminal device refers to the ECC public key.

[0124] S605, the key service module sends the public key of the terminal device to the application distribution platform client.

[0125] S606, the application distribution platform client sends a working key obtaining request to the application distribution module.

[0126] After the application distribution platform client of the terminal device obtains the device certificate and the public key of the terminal device derived by the key service module from the key service module, the application distribution platform client sends a working key obtaining request to the application distribution module in the server, and the working key obtaining request carries the device certificate and the public key of the terminal device derived by the key service module, as well as the application identifier and version information of the first application program.

[0127] S607, the application distribution module verifies the device certificate carried in the working key obtaining request.

[0128] The application distribution module in the server receives the working key obtaining request sent by the key service module, extracts the device certificate from the working key obtaining request, verifies the device certificate, and determines the legality of the device certificate. If the verification is passed, step S608 is performed.

[0129] S608, the application distribution module sends a key query request to the application encryption module.

[0130] The key query request carries the public key of the terminal device derived by the key service module, and the application identifier and version information of the first application program.

[0131] S609, the application encryption module obtains the key derivation material of the first application program based on the received key query request.

[0132] The application encryption module receives the key query request sent by the application distribution module, obtains the application identifier and version information of the first application program from the key query request, and reads the key derivation material of the first application program from the database according to the application identifier and version information of the first application program. The key derivation material of the first application program includes a random code, an encryption algorithm, and application information of the first application program, and the application information of the first application program includes the application identifier and version information of the first application program.

[0133] S610, the application encryption module generates a working key of the first application program based on the key derivation material of the first application program.

[0134] In some embodiments, the application encryption module of the server also stores a master key, which can be pre-installed in the application encryption module and is a global configuration item. The master keys of different application programs can be the same. The application encryption module can use the master key and the key derivation material of the first application program to generate the working key of the first application program.

[0135] S611, the application encryption module creates a public-private key pair of the server, and generates a transmission key based on the public key of the terminal device and the private key of the server.

[0136] The public-private key pair of the server can also be an ECC public-private key pair. After the application encryption module creates the public-private key pair of the server, it can obtain the public key of the terminal device from the key query request and generate the transmission key based on the public key of the terminal device and the private key of the server.

[0137] S612, the application encryption module encrypts the working key of the first application program using the transmission key to obtain an encrypted working key.

[0138] S613, the application encryption module sends the public key of the server and the encrypted working key to the application distribution module.

[0139] S614, the application distribution module sends the public key of the server and the encrypted working key to the application distribution platform client.

[0140] The application distribution module in the server sends the public key of the server and the encrypted working key to the application distribution platform client in the terminal device.

[0141] S615, the application distribution platform client sends the public key of the server and the encrypted working key to the key service module.

[0142] S616, the key service module decrypts the encrypted working key by using the public key of the server and the private key of the terminal device to obtain the working key of the first application program.

[0143] Illustratively, the key service module can generate a transmission key based on the public key of the server and the private key of the terminal device, decrypt the encrypted working key by using the transmission key to obtain the plaintext of the working key of the first application program.

[0144] S617, the key service module saves the working key of the first application program to the TEE.

[0145] When saving the working key of the first application program, to ensure security, the terminal device can encrypt the working key of the first application program by using a storage key, and save the ciphertext of the working key of the first application program. The storage key can be pre-stored in the TEE of the terminal device, and before saving the working key of the first application program, the storage key can be read from the TEE, the working key of the first application program is encrypted by using the storage key, and then the ciphertext of the working key of the first application program is saved to the TEE.

[0146] After the above process, the terminal device completes the download and installation of the first application program. The execution order between the steps in the above process can be changed, for example, steps S207-S209 can also be executed before step S205. The execution order between the steps is not limited in the embodiments of the application.

[0147] The embodiments of the application can ensure that the terminal device initiating the request is trusted and the legality of the request source by verifying the device certificate of the terminal device, and can realize the secure transmission of the working key of the application program by encrypting the transmission of the working key. The working key of the application program is stored in the TEE security chip of the terminal device, which realizes the chip-level security and improves the security of the storage of sensitive data of the terminal device. The code of the application program installed in the terminal device is in an encrypted state and is not decrypted, which can realize the confidentiality of the code of the application program on the terminal device.

[0148] After the installation of the first application program is completed, when the user starts the first application program, the terminal device performs the operations as shown in FIG. 7, including starting the next step as follows:

[0149] S701, the terminal device loads the code file of the first application program in response to the starting application operation.

[0150] After the first application is installed, an icon of the first application can be displayed on a desktop of the terminal device, and the user can start the first application by clicking the icon of the first application. The terminal device receives the operation of the user clicking the icon of the first application, and loads a code file of the first application in response to the start application operation.

[0151] S702, the terminal device decrypts the code file of the first application by using the working key of the first application to obtain the code of the first application.

[0152] The terminal device obtains the saved working key of the first application, and decrypts the code file of the first application by using the working key of the first application to obtain the code of the first application.

[0153] S703, the terminal device runs the code of the first application.

[0154] In some embodiments, the terminal device is provided with a process management module, a virtual file subsystem, a kernel decryption module and a key service module. In the process of starting the first application, the interaction process between the modules is as shown in FIG. 8, including the following steps:

[0155] S801, the process management module starts the first application in response to the start application operation.

[0156] S802, the process management module sends a code acquisition request to the virtual file subsystem.

[0157] The code acquisition request carries an application identifier of the first application.

[0158] S803, the virtual file subsystem reads the ciphertext of the code file of the first application.

[0159] The virtual file subsystem receives the code acquisition request sent by the process management module, and reads the ciphertext of the code file of the first application based on the application identifier of the first application carried in the code acquisition request.

[0160] S804, the virtual file subsystem sends a decryption request to the kernel decryption module.

[0161] The decryption request carries the application identifier of the first application.

[0162] S805, the kernel decryption module sends a key acquisition request to the key service module.

[0163] The key acquisition request carries the application identifier of the first application.

[0164] S806, the key service module reads the working key of the first application program.

[0165] The key service module receives the key acquisition request sent by the kernel decryption module, reads the working key of the first application program from the TEE based on the application identifier of the first application program carried in the key acquisition request, and the TEE acquires the ciphertext of the working key of the first application program. The ciphertext of the working key of the first application program is obtained by encrypting the working key of the first application program by the TEE using the storage key. The TEE decrypts the working key of the first application program using the storage key, and the key service module obtains the decrypted working key of the first application program.

[0166] S807, the key service module sends the working key of the first application program to the kernel decryption module.

[0167] S808, the kernel decryption module decrypts the ciphertext of the code file of the first application program using the working key of the first application program.

[0168] S809, the kernel decryption module sends the plaintext of the code file of the first application program to the virtual file subsystem.

[0169] S810, the virtual file subsystem sends the plaintext of the code file of the first application program to the process management module.

[0170] S811, the process management module runs the code of the first application program based on the plaintext of the code file of the first application program.

[0171] The process management module runs the code of the first application program based on the received plaintext of the code file of the first application program.

[0172] In the embodiments of the present application, the terminal device obtains the working key of the application program in the kernel, and decrypts the working key of the application program in the TEE. The sensitive data is protected by strong confidentiality in the kernel, and the code file of the application program is decrypted in real time in the kernel of the operating system. The security of the code of the application program during running is realized.

[0173] The above process is shown in FIG. 9. When the developer submits the installation package of the application program to the application distribution platform, the application encryption module of the application distribution platform server encrypts the executable code of the application program to generate an encrypted installation package of the application program. The application distribution platform distributes the encrypted installation package of the application program and the working key of the application program to the terminal device of the user, and the code decryption is performed in the terminal device. Finally, the whole-link confidentiality protection of the application program is realized.

[0174] In some embodiments, as shown in FIG. 10, the application distribution platform server 210 on the server 200 is mainly used for deriving the working key of the application, encrypting the code file of the application, managing the application distribution metadata of the listed application, distributing the application distribution metadata of the application, the working key of the application to the application distribution platform client, and distributing the installation package of the application to the application distribution platform client.

[0175] The application encryption module 211, the application shelf module 212 and the application distribution module 213 are arranged in the application distribution platform server 210. The application encryption module 211 is used to extract the code file to be encrypted from the installation package of the application, create the key derivation material of the application, derive the working key of the application, and encrypt the code file of the application using the derived working key. The application shelf module 212 is used to generate the initial key derivation material based on the application information of the application, and save and publish the secret text of the application installation package. The application distribution module 213 is used to distribute the application distribution metadata of the application, the working key of the application to the application distribution platform client, and distribute the installation package of the application to the application distribution platform client.

[0176] The application distribution platform client 110 on the terminal device 100 is mainly used for downloading the installation package of the application, obtaining the working key of the application, and saving the working key to the TEE of the terminal device. The operating system 120 is installed in the terminal device 100, and the application management module 121, the virtual file subsystem 122, the key service module 123 and the kernel decryption module 124 are arranged in the operating system 120.

[0177] The application management module 121 is mainly used for installation and uninstallation of the application; the virtual file subsystem 122 is mainly used for loading the code file of the application from the read-only memory (ROM) of the terminal device; the key service module 123 is mainly used for key life cycle management, providing key saving, key query, key deletion, key check, and accessing the TEE interface; and the kernel decryption module 124 is mainly used for reading the working key of the application, decrypting the code file of the application. The TEE in the terminal device 100 can be used to save sensitive confidential information such as device certificates and working keys of the application.

[0178] The embodiments of the present application are used for solving the working key protection problem of an application program and the code running performance problem of an encrypted code file of the application program. The embodiments of the present application reduce the encrypted content and the performance consumption caused by decryption at the running time of the application program by encrypting only the binary code in the execution file of the application program, i.e., the executable file of the application program. When a terminal device requests to obtain the working key of a certain application program, the server generates the working key of the application program in real time through key derivation materials, realizes the storage-free of the working key, and eliminates the security risk of leaking the working key from the server. The terminal device and the server negotiate the working key and the transmission key in real time, and protect the working key by using the transmission key, realizing the secure transmission of the working key between the server and the terminal device. The terminal device stores the working key of the application program in the TEE of the terminal device, realizing the secure storage of the working key in the terminal device. The installation package of the application program stored by the server and the application program installed on the terminal device are both encrypted binary codes, realizing the confidentiality protection of the code file of the application program.

[0179] The embodiments of the present application also provide an application program installation apparatus, which can be applied to a terminal device. In some embodiments, as shown in FIG. 11, the application program installation apparatus 1100 can include a request sending module 1101, a receiving module 1102, a key saving module 1103 and a program installation module 1104. The application program installation apparatus 1100 can be used to realize the functions of the above-mentioned method embodiments, and thus can realize the beneficial effects possessed by the above-mentioned method embodiments.

[0180] The request sending module 1101 can be used to send a first request to a server; the first request is used to request to obtain a first application program installation package. The receiving module 1102 can be used to receive the working key of the first application program and the ciphertext of the first application program installation package sent by the server; the ciphertext of the first application program installation package is obtained by encrypting the first application program installation package by using the working key. The key saving module 1103 can be used to save the working key of the first application program. The program installation module 1104 can be used to install the first application program based on the ciphertext of the first application program installation package.

[0181] In some embodiments, as shown in FIG. 12, the application program installation apparatus 1100 can further include a program running module 1201, which can be used to load the ciphertext of the code file of the first application program in response to a start application operation; decrypt the ciphertext of the code file by using the working key of the first application program to obtain the code of the first application program; and run the code of the first application program.

[0182] In some embodiments, the key storage module 1103 can be configured to encrypt the working key of the first application by using the storage key, and store the encrypted working key ciphertext. The program running module 1201 can also be configured to decrypt the working key ciphertext to obtain the working key of the first application before decrypting the code file of the first application by using the working key of the first application.

[0183] The request sending module 1101, the receiving module 1102, the key storage module 1103, the program installation module 1104 and the program running module 1201 can be implemented by software or hardware. In the embodiments of the present application, each functional module can be integrated in one processor, or each module can be physically independent, or two or more modules can be integrated in one module. The integrated module can be implemented in the form of hardware or software functional module.

[0184] It should be noted that, in some embodiments, the request sending module 1101 can be configured to perform any step of the application installation method, the receiving module 1102 can also be configured to perform any step of the application installation method, the key storage module 1103 can be configured to perform any step of the application installation method, the program installation module 1104 can be configured to perform any step of the application installation method, and the program running module 1201 can be configured to perform any step of the application installation method. The steps implemented by the request sending module 1101, the receiving module 1102, the key storage module 1103, the program installation module 1104 and the program running module 1201 can be specified as needed, and the request sending module 1101, the receiving module 1102, the key storage module 1103, the program installation module 1104 and the program running module 1201 can implement different steps of the application installation method to realize the functions of the application installation device. The application installation device 1100 can also use more or fewer functional modules to realize the functions of the application installation device 1100.

[0185] The embodiments of the present application also provide an application providing device, which can be applied to a server, which can be a cloud server, and the cloud server can be a computing device cluster including a plurality of computing devices. In some embodiments, as shown in FIG. 13, the application providing device 1300 can include a request receiving module 1301, a key generating module 1302, a key sending module 1303 and an installation package sending module 1304. The application providing device 1300 can be configured to implement the functions of the above-mentioned method embodiments, and thus can achieve the beneficial effects of the above-mentioned method embodiments.

[0186] The request receiving module 1301 can be configured to receive a first request sent by a terminal device, where the first request is used to request to obtain a first application installation package. The key generating module 1302 can be configured to generate a working key of the first application. The key sending module 1303 can be configured to send the working key of the first application to the terminal device. The installation package sending module 1304 can be configured to send ciphertext of the first application installation package to the terminal device, where the ciphertext of the first application installation package is obtained by encrypting the first application installation package by using the working key.

[0187] In some embodiments, the key generating module 1302 can be specifically configured to generate the working key of the first application based on key derivation material of the first application, where the key derivation material includes a random code, an encryption algorithm, and application information of the first application.

[0188] In some embodiments, as shown in FIG. 14, the application providing apparatus 1300 can further include an installation package encrypting module 1401, which can be configured to receive the first application installation package, encrypt code files in the first application installation package by using the working key of the first application, and obtain the ciphertext of the first application installation package, and save the ciphertext of the first application installation package.

[0189] In some embodiments, the key saving module 1103 can be specifically configured to encrypt the working key of the first application by using the storage key, and save the ciphertext of the encrypted working key. The program running module 1201 can be further configured to decrypt the working key ciphertext before decrypting the code files of the first application by using the working key of the first application, and obtain the working key of the first application.

[0190] The request receiving module 1301, the key generating module 1302, the key sending module 1303, the installation package sending module 1304, and the installation package encrypting module 1401 can be implemented by software or by hardware. For example, the implementation of the key generating module 1302 is described below. Similarly, the implementation of the request receiving module 1301, the key sending module 1303, the installation package sending module 1304, and the installation package encrypting module 1401 can refer to the implementation of the key generating module 1302.

[0191] As an example of a software functional module, the key generation module 1302 can include code running on a compute instance. The compute instance can include at least one of a physical host (computing device), a virtual machine, a container. Further, the compute instance can be one or more. For example, the key generation module 1302 can include code running on multiple hosts / virtual machines / containers. It is noted that the multiple hosts / virtual machines / containers running the code can be distributed in the same region, or in different regions. Further, the multiple hosts / virtual machines / containers running the code can be distributed in the same availability zone (AZ), or in different AZs, each of which includes one data center or multiple data centers in close geographical proximity. Typically, a region can include multiple AZs.

[0192] Similarly, the multiple hosts / virtual machines / containers running the code can be distributed in the same virtual private cloud (VPC), or in multiple VPCs. Typically, a VPC is set up within a region, and communication between two VPCs in the same region, or between VPCs in different regions, requires a communication gateway in each VPC to enable interconnection between the VPCs.

[0193] As an example of a hardware functional unit, the key generation module 1302 can include at least one computing device, such as a server, etc. Alternatively, the key generation module 1302 can be a device implemented using an application-specific integrated circuit (ASIC), or a programmable logic device (PLD), such as a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0194] The multiple computing devices included in the key generation module 1302 can be distributed in the same region or in different regions. The multiple computing devices included in the key generation module 1302 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the key generation module 1302 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0195] It should be noted that, in some embodiments, the request receiving module 1301 can be configured to perform any of the steps in the application providing method, the key generation module 1302 can be configured to perform any of the steps in the application providing method, the key sending module 1303 can be configured to perform any of the steps in the application providing method, the installation package sending module 1304 can be configured to perform any of the steps in the application providing method, and the installation package encryption module 1401 can be configured to perform any of the steps in the application providing method. The steps to be implemented by the request receiving module 1301, the key generation module 1302, the key sending module 1303, the installation package sending module 1304, and the installation package encryption module 1401 can be specified as needed, and the request receiving module 1301, the key generation module 1302, the key sending module 1303, the installation package sending module 1304, and the installation package encryption module 1401 can implement different steps in the application providing method to achieve the overall function of the application providing apparatus. The application providing apparatus 1300 can also use more or fewer functional modules to achieve the function of the application providing apparatus 1300.

[0196] The various functional modules in the embodiments of the present application can be integrated in one processor, or each module can be physically present alone, or two or more modules can be integrated in one module. The integrated module can be implemented in the form of hardware or in the form of a software functional module.

[0197] The present application also provides a terminal device 1500. As shown in FIG. 15, the terminal device 1500 can be configured to implement the functions of the application installation apparatus in the above embodiments, and includes a bus 1501, a processor 1502, a memory 1503, and a communication interface 1504. The processor 1502, the memory 1503, and the communication interface 1504 communicate through the bus 1501. It should be understood that the present application does not limit the number of processors and memories in the terminal device 1500.

[0198] The bus 1501 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one line is shown in FIG. 15, but it does not mean that there is only one bus or only one type of bus. The bus 1501 can include a path for transmitting information between various components (e.g., the memory 1503, the processor 1502, the communication interface 1504) of the terminal device 1500.

[0199] The processor 1502 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0200] The memory 1503 can include a volatile memory (e.g., a random access memory (RAM)) and / or a non-volatile memory (e.g., a read-only memory (ROM), a floppy disk, a hard disk, or a solid state drive (SSD)).

[0201] The memory 1503 stores executable program codes, and the processor 1502 executes the executable program codes to implement the functions of the aforementioned request sending module 1101, the receiving module 1102, the key saving module 1103, the program installing module 1104, and the program running module 1201, respectively, thereby implementing the application program installing method. That is, the memory 1503 stores instructions for executing the application program installing method.

[0202] The communication interface 1504 uses a transceiver module such as, but not limited to, a network interface card or a transceiver, to implement the communication between the terminal device 1500 and a server or a communication network.

[0203] The application also provides a server 1600. As shown in FIG. 16, the server 1600 can be configured to implement the functions of the application program providing apparatus in the above embodiments, and includes a bus 1601, a processor 1602, a memory 1603, and a communication interface 1604. The processor 1602, the memory 1603, and the communication interface 1604 communicate through the bus 1601. It should be understood that the number of processors and memories in the server 1600 is not limited in the application.

[0204] The bus 1601 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one line is shown in FIG. 16, but it does not mean that there is only one bus or only one type of bus. The bus 1601 can include a path for transmitting information between various components (e.g., the memory 1603, the processor 1602, the communication interface 1604) of the server 1600.

[0205] The processor 1602 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0206] The memory 1603 can include a volatile memory (e.g., a random access memory (RAM)). The processor 1602 can also include a non-volatile memory (e.g., a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD)).

[0207] The executable program code stored in the memory 1603 is executed by the processor 1602 to realize the functions of the aforementioned request receiving module 1301, the key generating module 1302, the key sending module 1303, the installation package sending module 1304 and the installation package encrypting module 1401 respectively, so as to realize the application installation method. That is, the memory 1603 stores instructions for executing the application installation method.

[0208] The communication interface 1604 uses a transceiving module such as, but not limited to, a network interface card and a transceiver to realize the communication between the server 1600 and a server or a communication network.

[0209] In some embodiments, the server can be a cluster of computing devices, and the computing devices in the cluster are connected to each other. The memory in one or more computing devices in the cluster can store the same instructions for executing the application providing method, or the memory in one or more computing devices in the cluster can respectively store partial instructions for executing the application providing method. In other words, the combination of one or more computing devices can collectively execute the instructions for executing the application providing method.

[0210] The embodiments of the present application also provide an application providing system, which can include a terminal device and a server. The terminal device can adopt the structure shown in FIG. 15, and the server can adopt the structure shown in FIG. 16.

[0211] The embodiments of the present application also provide a computer program product containing instructions. The computer program product can be a software or program product containing instructions, which can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, the at least one computing device executes the application installation method.

[0212] The embodiments of the present application also provide a computer program product containing instructions. The computer program product can be a software or program product containing instructions, which can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, the at least one computing device executes the application providing method.

[0213] The embodiments of the present application further provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device that can store the instructions of the application program, and can be a data center or the like data storage device containing one or more available media. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk) and the like. The computer readable storage medium includes instructions for instructing the computing device to execute the application program installation method or for instructing the computing device to execute the application program providing method.

[0214] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An application program installation method characterized by comprising: The method comprises: sending a first request to a server; the first request is used to request a first application installation package; receiving a working key of the first application and a secret text of the first application installation package sent by the server; the secret text of the first application installation package is obtained by encrypting the first application installation package using the working key; saving the working key of the first application; installing the first application based on the secret text of the first application installation package.

2. The method of claim 1, wherein, After the first application is installed, the method further comprises: loading a secret text of a code file of the first application in response to a start application operation; decrypting the secret text of the code file using the working key of the first application to obtain the code of the first application; running the code of the first application.

3. The method of claim 2, wherein, The saving of the working key of the first application comprises: encrypting the working key of the first application using a storage key to save the encrypted working key secret text; Before the decryption of the code file of the first application using the working key of the first application, the method further comprises: decrypting the working key secret text to obtain the working key of the first application.

4. An application providing method characterized by comprising: The method comprises: receiving a first request sent by a terminal device; the first request is used to request a first application installation package; generating a working key of the first application; sending the working key of the first application to the terminal device; sending a secret text of the first application installation package to the terminal device; the secret text of the first application installation package is obtained by encrypting the first application installation package using the working key.

5. The method of claim 4, wherein, The generation of the working key of the first application comprises: generating the working key of the first application based on a key derivation material of the first application; the key derivation material contains a random code, an encryption algorithm and application information of the first application.

6. The method according to claim 4 or 5, characterized in that, Before the receiving of the first request sent by the terminal device, the method further comprises: receiving the first application installation package; encrypting a code file in the first application installation package using the working key of the first application to obtain the secret text of the first application installation package; saving the secret text of the first application installation package.

7. An application installation device characterized by comprising: The device comprises: a request sending module configured to send a first request to a server; the first request is used to request a first application installation package; a receiving module configured to receive a working key of the first application and a secret text of the first application installation package sent by the server; the secret text of the first application installation package is obtained by encrypting the first application installation package using the working key; a key saving module configured to save the working key of the first application; a program installation module configured to install the first application based on the secret text of the first application installation package.

8. The apparatus of claim 7, wherein, The device further comprises: A program running module is configured to, in response to a starting application operation, load a cipher text of a code file of the first application program; decrypt the cipher text of the code file using a working secret key of the first application program to obtain code of the first application program; and run the code of the first application program.

9. An application providing apparatus characterized by comprising: The apparatus comprises: A request receiving module is configured to receive a first request sent by a terminal device; the first request is used to request to obtain a first application program installation package; A secret key generating module is configured to generate a working secret key of the first application program; A secret key sending module is configured to send the working secret key of the first application program to the terminal device; An installation package sending module is configured to send a cipher text of the first application program installation package to the terminal device; the cipher text of the first application program installation package is obtained by encrypting the first application program installation package using the working secret key.

10. The apparatus of claim 9, wherein, The apparatus further comprises: An installation package encrypting module is configured to receive the first application program installation package; encrypt a code file in the first application program installation package using the working secret key of the first application program to obtain a cipher text of the first application program installation package; and save the cipher text of the first application program installation package.

11. A terminal device, comprising: A terminal device comprises a processor and a memory; the processor is configured to execute computer executable instructions stored in the memory, so that the terminal device performs the method according to any one of claims 1 to 3.

12. A server, characterized by A server comprises a processor and a memory; the processor is configured to execute computer executable instructions stored in the memory, so that the server performs the method according to any one of claims 4 to 6.

13. A computer-readable storage medium, characterized in that, A computer readable storage medium stores computer executable instructions, which are used to make a computer perform the method according to any one of claims 1 to 3, or the method according to any one of claims 4 to 6.

14. A computer program product, characterised in that, A computer readable storage medium contains computer executable instructions, which are used to make a computer perform the method according to any one of claims 1 to 3, or the method according to any one of claims 4 to 6.

Images