Patent Description:
Existing operating systems may include an open system and a closed system. In the open system such as an Android (Android) system, many permissions and interfaces are opened, and the open system is in a cooperative relationship with other related parties such as a software/hardware vendor, a device manufacturer, and a telecommunications operator, to form an open ecosystem in a mobile industry. The software vendor develops various types of application software by using Java as a part for programming. Java is a programming language with a cross-platform capability, and causes no exclusive right obstacle that impedes innovation in the mobile industry. Currently, there is no protection mechanism for an Android application, and there are many Android application stores and many channels. Consequently, a developed original application has relatively low security, and stability of a software industry chain ecosystem is relatively poor. In the closed system such as an iOS system, when jailbreaking in an iOS system in a terminal succeeds, a software protection mechanism of the iOS system becomes invalid, that is, an application in the terminal can be copied, modified, and pirated, and therefore security of a developed original application is reduced and stability of a software industry chain ecosystem is reduced.

<CIT> discloses a mobile terminal and application providing method for the same whereby the method provides a requested application using an application package installer having multiple pieces of signature information. The application providing method comprises: obtaining an application package installer containing multiple pieces of signature information; determining whether signature information corresponding to the mobile terminal is present in the multiple pieces of signature information; and generating, when signature information corresponding to the mobile terminal is present, a signed application package based on the corresponding signature information.

<CIT> discloses a method, system and computer program product for controlling the installation of applications on a user terminal. In one aspect, a catalogue server identifies a first and a second installation control setting corresponding to a first and a second application on the basis of user identification data from a data store comprising entries for a plurality of applications and their corresponding installation control settings. Subsequently, the catalogue server determines installation control data for at least one of the first and second application on the basis of the first and the second installation control setting. The determined installation control data is transmitted to the user terminal for controlling installation of at least one of the first and the second application.

The present invention provides application protection method of claim <NUM> and <NUM>, a terminal of claim <NUM> and an application management server of claim <NUM>, so that application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved. Preferred implementation manners are disclosed in the dependent claims.

In the embodiments of the present invention, a terminal sends an application download request for a target application to an application management server, so that the application management server compiles an application installation package of the target application according to terminal identification information of the terminal that is carried in the application download request. Then, the terminal receives the compiled application installation package sent by the application management server, and installs, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

To describe the technical solutions in the embodiments of the present invention more clearly, the following briefly describes the accompanying drawings required for describing the embodiments.

The following clearly and completely describes the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are merely some but not all of the embodiments of the present invention. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

The embodiments of the present invention disclose an application protection method. A terminal sends an application download request for a target application to an application management server, and the application download request carries terminal identification information which identify a unique terminal, so that the application management server compiles an application installation package of the target application according to the terminal identification information. Then, the terminal receives the compiled application installation package sent by the application management server, and installs, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information. The runtime environment is obtained by compiling a preset intermediate file according to the terminal identification information, and the preset intermediate file includes a runtime (Runtime) file and a framework file (Framework). Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

The terminal identification information mentioned in the embodiments of the present invention may be used to identify a unique terminal. The terminal identification information includes but is not limited to one or more of an EMMC ID (Embedded Multimedia Card Identity, embedded multimedia card identity), a global unique hardware identity of an EMMC flash, a <NUM>-bit hexadecimal value), a baseband ID (Baseband Identity, baseband chip hardware identity, a baseband chip hardware identity of a mobile phone, a <NUM>-bit hexadecimal value), an IMEI (International Mobile Equipment Identity, international mobile equipment identity, an "electronic serial number" that includes a <NUM>-digit number), or an MEID (Mobile Equipment Identifier Identity, mobile equipment identifier, a global unique <NUM>-bit mobile equipment identifier).

In the embodiments of the present invention, after the application management server compiles the application installation package of the target application according to the terminal identification information, the compiled application installation package can be installed only in the runtime environment that is based on the terminal identification information, so as to generate a dedicated installation package and improve application security. Even if another terminal obtains the compiled application installation package, the another terminal cannot locally install the application installation package or obtain an original application installation package according to the compiled application installation package, and further cannot modify or pirate the application installation package.

In the embodiments of the present invention, the terminal may include a personal computer, an intelligent mobile phone (such as an Android mobile phone or an iOS mobile phone), a tablet computer, a palmtop computer, a mobile Internet device (MID, Mobile Internet Device), a wearable intelligent device, or the like. This is not specifically limited in the embodiments of the present invention.

Referring to <FIG> is a schematic flowchart of an application protection method according to an embodiment of the present invention. As shown in the figure, the application protection method in this embodiment of the present invention may include the following steps.

Receive an application download request that is for a target application and that is sent by a terminal.

An application management server may receive the application download request that is for the target application and that is sent by the terminal. The application download request may carry terminal identification information of the terminal.

Compile an application installation package of the target application according to terminal identification information.

The application management server may compile the application installation package of the target application according to the terminal identification information, to generate a dedicated installation package corresponding to the terminal identification information. Compared with a manner in which a terminal receives an application installation package that is of a target application and that is fed back by an application management server according to an application download request, and compiles the application installation package of the target application according to terminal identification information, in a manner in which an application management server compiles an application installation package of a target application in the cloud according to terminal identification information, because a compilation algorithm is stored in the cloud, a user cannot obtain the compilation algorithm or obtain an original application installation package according to the compiled application installation package, so that application security is higher. The application installation package of the target application is compiled in the cloud, so that system performance of the terminal can be improved. The compilation algorithm is stored in the cloud, so that when the compilation algorithm is updated, a compilation algorithm stored in the application management server can be directly updated and a compilation algorithm stored in each terminal does not need to be updated, and updating efficiency is higher.

In an optional embodiment, the application management server may obtain a hash (hash) value of the terminal identification information, and compile the application installation package of the target application according to the hash value. Compilation refers to converting a source program wrote by using an advanced program design language into a target program represented by using a machine language.

Further optionally, the application management server may compile the application installation package of the target application according to the hash value, and generate an ABI (Application Binary Interface, application binary interface) corresponding to the hash value. The ABI describes an underlying interface between an application program and an OS (Operating System, operating system), and relates to all aspects of the application program, such as a format of a target file, a function call convention, and how to call a system. The ABI can enable the application program to run in an operating system that supports the ABI, and the application program does not need to be modified. The ABI may include a link address of the application installation package of the target application and a symbol table name of the application installation package of the target application. The application program is generally developed in a modular manner, and modules are generally classified according to functions, for example, a. c file or a. cpp file is a compilation unit, that is, a module, and a. o target file is generated after compilation. To finally generate an executable file, a static library, or a dynamic-link library, all compilation units need to be combined together according to a specific convention, and this combination process is referred to as linking. All the compilation units are corresponding to one link address. A function and data are identified by using a symbol. Generally, symbols are classified into a global symbol and a static symbol. The global symbol can be referenced by another module, and the static symbol can be referenced only in a current module. When each module is compiled, a symbol table needs to be created. The symbol table includes a symbol (an export symbol) that is in the current module and that can be referenced by another module, and further includes a symbol (an import symbol, that is, an undefined symbol) that is referenced in the current module but is defined in another module. All symbol tables are corresponding to one symbol table name.

Further optionally, the application management server may separately adjust the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value. In this embodiment of the present invention, an existing compilation algorithm is adjusted. In the existing compilation algorithm, application installation packages, obtained by different terminals, of target applications have a same link address and a same symbol table name. In this embodiment of the present invention, the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application are adjusted according to the hash value of the terminal identification information, and application installation packages, obtained by different terminals, of target applications have different link addresses and different symbol table names, so that a dedicated installation package corresponding to the terminal identification information is generated.

Further optionally, the application management server may perform an exclusive OR operation on the link address of the application installation package of the target application and the hash value, to generate a link address of the compiled application installation package. The symbol table name of the application installation package of the target application is a character string not a number. Therefore, the exclusive OR operation cannot be directly performed on the symbol table name and the hash value. The application management server may encode the symbol table name of the application installation package of the target application by means of, for example, Base64 encoding (a manner in which a character string can be encoded into binary data), and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled application installation package.

In an optional embodiment, after compiling the application installation package of the target application according to the terminal identification information, the application management server may encrypt the compiled application installation package. In this embodiment of the present invention, application security can be further improved.

Further optionally, the application management server may determine a class constructor in the compiled application installation package and encrypt the determined class constructor. The class constructor refers to defining an initiated state when a class object is created. In a runtime process of the application installation package, the class constructor is executed more than <NUM> times, and there is a relatively few quantity of execution times. The class constructor is encrypted instead of all functions, so that processing efficiency can be improved.

Further optionally, the application management server may encrypt the class constructor according to a preset public key.

Send the compiled application installation package to the terminal, so that the terminal installs the target application in a runtime environment that is based on the terminal identification information.

The application management server may send the compiled application installation package to the terminal, so that the terminal installs the target application in the runtime environment that is based on the terminal identification information. The runtime environment is obtained by the terminal by compiling a preset intermediate file of the terminal according to the terminal identification information, and the preset intermediate file may include a runtime file and a framework file. Any application program needs to be supported by Runtime during runtime. The Runtime includes a function and a class library. The Framework includes a group of components, stipulates an application architecture, illustrates a whole design, dependency between coordinated members, responsibility allocation, and a control procedure, and provides a context (Context) relationship for member reuse. Before the terminal is delivered, the runtime environment may be obtained by compiling the preset intermediate file according to the terminal identification information. The compiled application installation package is obtained by performing compilation according to the terminal identification information, and the runtime environment of the terminal is obtained by compiling the preset intermediate file according to the terminal identification information, so that another terminal cannot install and run the foregoing compiled application installation package, and a dedicated application installation package is used by a specific terminal.

In an optional embodiment, after encrypting the compiled application installation package, the application management server may send the compiled and encrypted application installation package to the terminal, so that after the terminal installs the target application in the runtime environment, the terminal decrypts the compiled and encrypted application installation package according to a private key preset in a TrustZone (an architecture solution of a security chip, including a hardware security module such as a SIM (Subscriber Identity Module, subscriber identity module) card or an SoC (System-on-a-Chip, System-On-a-Chip)), and runs the target application. The TrustZone is a secure method in an operating system range. For a large quantity of applications on a high-performance computing platform, the TrustZone may include secure payment, DRM (Digital Rights Management, digital rights management), an enterprise service, and a Web-based service, and may protect peripheral devices such as a secure memory, an encryption block, a keyboard, and a screen from software attack. The private key is stored in the TrustZone, so that secrecy performance of the private key can be improved, and further, application security is improved.

In the application protection method shown in <FIG>, an application download request that is for a target application and that is sent by a terminal is received, an application installation package of the target application is compiled according to terminal identification information carried in the application download request, and the compiled application installation package is sent to the terminal, so that the terminal installs the target application in a runtime environment that is based on the terminal identification information, and the runtime environment is obtained by the terminal by compiling a preset intermediate file of the terminal according to the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

Referring to <FIG> is a schematic flowchart of an application protection method according to another embodiment of the present invention. As shown in the figure, the application protection method in this embodiment of the present invention may include the following steps.

Send an application download request for a target application to an application management server, where the application download request carries terminal identification information of a terminal, so that the application management server compiles an application installation package of the target application according to the terminal identification information.

The terminal may send the application download request for the target application to the application management server, and the application download request carries the terminal identification information of the terminal, so that the application management server compiles the application installation package of the target application according to the terminal identification information.

In an optional embodiment, before sending the application download request for the target application to the application management server, the terminal may compile a preset intermediate file according to the terminal identification information preset in a TrustZone. The compiled intermediate file constitutes a runtime environment that is based on the terminal identification information. The preset intermediate file may include a runtime file and a framework file.

The TrustZone is a secure method in an operating system range. The terminal identification information and a compilation algorithm are stored in the TrustZone, so that secrecy performance of the compilation algorithm can be improved, and further, security of the compiled preset intermediate file is improved.

Further optionally, the terminal may obtain a hash value of the terminal identification information, and compile the preset intermediate file according to the hash value.

Further optionally, the terminal may compile an ABI of the preset intermediate file according to the hash value, and generate an ABI corresponding to the hash value.

Further optionally, the terminal may separately adjust a link address and a symbol table name of the preset intermediate file according to the hash value. In this embodiment of the present invention, an existing compilation algorithm is adjusted. In the existing compilation algorithm, preset intermediate files in different terminals have a same link address and a same symbol table name. In this embodiment of the present invention, the link address of the preset intermediate file and the symbol table name of the preset intermediate file are adjusted according to the hash value of the terminal identification information, and compiled preset intermediate files in different terminals have different link addresses and different symbol table names, so that the runtime environment corresponding to the terminal identification information is constituted.

Further optionally, the terminal may perform an exclusive OR operation on the link address of the preset intermediate file and the hash value, to generate a link address of the compiled preset intermediate file. The symbol table name of the preset intermediate file is a character string not a number. Therefore, the exclusive OR operation cannot be directly performed on the symbol table name and the hash value. The terminal may encode the symbol table name of the preset intermediate file by means of, for example, Base64 encoding, and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled preset intermediate file.

In an optional embodiment, the terminal may send the application download request to the application management server, so that the application management server compiles the application installation package of the target application according to the terminal identification information, and the application management server encrypts the compiled application installation package. In this embodiment of the present invention, application security can be further improved.

Further optionally, the application management server may encrypt the compiled application installation package according to a preset public key.

Receive the compiled application installation package sent by the application management server.

The terminal may receive the compiled application installation package sent by the application management server.

In an optional embodiment, after the application management server encrypts the compiled application installation package, the terminal may receive the compiled and encrypted application installation package sent by the application management server.

Install, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information.

The terminal may install, according to the compiled application installation package, the target application in the runtime environment that is based on the terminal identification information.

In an optional embodiment, after receiving the compiled and encrypted application installation package, the terminal may install the target application in the runtime environment that is based on the terminal identification information, decrypt the compiled and encrypted application installation package according to a private key preset in the TrustZone, and run the target application. In this embodiment of the present invention, the private key is stored in the TrustZone, so that the private key is avoided from software attack, secrecy performance of the private key can be improved, and further, application security is improved.

In the application protection method shown in <FIG>, an application download request for a target application is sent to an application management server, and the application download request carries terminal identification information of a terminal, so that the application management server compiles an application installation package of the target application according to the terminal identification information, and feeds back the compiled application installation package. According to the compiled application installation package, the target application is installed in a runtime environment that is based on the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

A terminal sends an application download request for a target application to an application management server, where the application download request carries terminal identification information of the terminal.

The terminal may send the application download request for the target application to the application management server, and the application download request may carry the terminal identification information of the terminal.

The application management server compiles an application installation package of the target application according to the terminal identification information.

After receiving the terminal identification information, the application management server may compile the application installation package of the target application according to the terminal identification information, to generate a dedicated installation package corresponding to the terminal identification information.

In an optional embodiment, the application management server may obtain a hash value of the terminal identification information, and compile the application installation package of the target application according to the hash value.

Further optionally, the application management server may compile the application installation package of the target application according to the hash value, and generate an ABI corresponding to the hash value. The ABI may include a link address of the application installation package of the target application and a symbol table name of the application installation package of the target application.

Further optionally, the application management server may separately adjust the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value.

Further optionally, the application management server may perform an exclusive OR operation on the link address of the application installation package of the target application and the hash value, to generate a link address of the compiled application installation package. The application management server may encode the symbol table name of the application installation package of the target application by means of, for example, Base64 encoding, and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled application installation package.

The application management server sends the compiled application installation package to the terminal.

The application management server may send the compiled application installation package to the terminal.

The terminal installs the target application in a runtime environment that is based on the terminal identification information.

The terminal may install, according to the compiled application installation package, the target application in the runtime environment that is based on the terminal identification information. The runtime environment is obtained by the terminal by compiling a preset intermediate file of the terminal according to the terminal identification information, and the preset intermediate file may include a runtime file and a framework file.

Optionally, the terminal may obtain a hash value of the terminal identification information, and compile the preset intermediate file according to the hash value. Further optionally, the terminal may compile the preset intermediate file according to the hash value, and generate an ABI corresponding to the hash value. The ABI may include a link address and a symbol table name of the preset intermediate file.

Further optionally, the terminal may separately adjust the link address of the preset intermediate file and the symbol table name of the preset intermediate file according to the hash value.

Further optionally, the terminal may perform an exclusive OR operation on the link address of the preset intermediate file and the hash value, to generate a link address of the compiled preset intermediate file. The terminal may encode the symbol table name of the preset intermediate file by means of, for example, Base64 encoding, and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled preset intermediate file.

In the application protection method shown in <FIG>, a terminal sends an application download request for a target application to an application management server, and the application download request carries terminal identification information of the terminal. The application management server compiles an application installation package of the target application according to the terminal identification information, and sends the compiled application installation package to the terminal. The terminal installs the target application in a runtime environment that is based on the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

A terminal sends an application download request for a target application to an application management server, where the application download request carries terminal identification information of the terminal.

The application management server compiles an application installation package of the target application according to the terminal identification information.

Further optionally, the application management server may separately adjust the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value. Specifically, the application management server may perform an exclusive OR operation on the link address of the application installation package of the target application and the hash value, to generate a link address of the compiled application installation package. The application management server may encode the symbol table name of the application installation package of the target application by means of, for example, Base64 encoding, and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled application installation package.

The application management server encrypts the compiled application installation package.

After compiling the application installation package of the target application according to the terminal identification information, the application management server may encrypt the compiled application installation package.

Optionally, the application management server may determine a class constructor in the compiled application installation package and encrypt the determined class constructor. The class constructor refers to defining an initiated state when a class object is created. In a runtime process of the application installation package, the class constructor is executed more than <NUM> times, and there is a relatively few quantity of execution times. The class constructor is encrypted instead of all functions, so that processing efficiency can be improved.

The application management server sends the compiled and encrypted application installation package to the terminal.

After encrypting the compiled application installation package, the application management server may send the compiled and encrypted application installation package to the terminal.

The terminal installs the target application in a runtime environment that is based on the terminal identification information.

After receiving the compiled and encrypted application installation package, the terminal may install the target application in the runtime environment that is based on the terminal identification information. The runtime environment is obtained by the terminal by compiling a preset intermediate file of the terminal according to the terminal identification information, and the preset intermediate file may include a runtime file and a framework file.

The terminal decrypts the compiled and encrypted application installation package according to a private key preset in a TrustZone, and runs the target application.

After installing the compiled and encrypted application installation package, the terminal may decrypt the compiled and encrypted application installation package according to the private key preset in the TrustZone, and run the target application.

In the application protection method shown in <FIG>, a terminal sends an application download request for a target application to an application management server, and the application download request carries terminal identification information of the terminal. The application management server compiles an application installation package of the target application according to the terminal identification information, encrypts the compiled application installation package, and sends the compiled and encrypted application installation package to the terminal. The terminal installs the target application in a runtime environment that is based on the terminal identification information, decrypts the compiled and encrypted application installation package according to a private key preset in a TrustZone, and runs the target application. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

An embodiment of the present invention further provides a computer storage medium. The computer storage medium may store a program. When the program is executed, some or all of steps of the application protection method described in the method embodiment shown in the foregoing <FIG>, <FIG>, or <FIG> are included.

An embodiment of the present invention further provides a computer storage medium. The computer storage medium may store a program. When the program is executed, some or all of steps of the application protection method described in the method embodiment shown in any one of the foregoing <FIG> are included.

Referring to <FIG> is a schematic structural diagram of an application management server according to an embodiment of the present invention. The application management server may be configured to implement some or all of steps of the application protection method in the method embodiment shown in <FIG>, <FIG>, or <FIG>. The application management server may include at least a receiving unit <NUM>, a compilation unit <NUM>, and a sending unit <NUM>.

The receiving unit <NUM> is configured to receive an application download request that is for a target application and that is sent by a terminal. The application download request may carry terminal identification information of the terminal.

The compilation unit <NUM> is configured to compile an application installation package of the target application according to the terminal identification information.

The sending unit <NUM> is configured to send the compiled application installation package to the terminal, so that the terminal installs the target application in a runtime environment that is based on the terminal identification information. The runtime environment is obtained by the terminal by compiling a preset intermediate file of the terminal according to the terminal identification information, and the preset intermediate file includes a runtime file and a framework file.

In an optional implementation manner, the compilation unit <NUM> is specifically configured to: obtain a hash value of the terminal identification information, and compile the application installation package of the target application according to the hash value.

Further optionally, when compiling the application installation package of the target application according to the hash value, the compilation unit <NUM> is specifically configured to: compile the application installation package of the target application according to the hash value, and generate an ABI corresponding to the hash value. The ABI may include a link address of the application installation package of the target application and a symbol table name of the application installation package of the target application.

Further optionally, when generating the ABI corresponding to the hash value, the compilation unit <NUM> is specifically configured to separately adjust the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value.

Further optionally, when separately adjusting the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value, the compilation unit <NUM> is specifically configured to: perform an exclusive OR operation on the link address of the application installation package of the target application and the hash value, to generate a link address of the compiled application installation package; encode the symbol table name of the application installation package of the target application; and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled application installation package. For example, the compilation unit <NUM> may encode the symbol table name of the application installation package of the target application by means of Base64 encoding. The encoded symbol table name is a string of numbers not a character string, so that the exclusive OR operation is performed on the symbol table name and the hash value of the terminal identification information.

In an optional implementation manner, the application management server in this embodiment of the present invention may further include:
an encryption unit <NUM>, configured to: after the compilation unit <NUM> compiles the application installation package of the target application according to the terminal identification information, encrypt the compiled application installation package.

The sending unit <NUM> is specifically configured to send the compiled and encrypted application installation package to the terminal, so that after the terminal installs the target application in the runtime environment, the terminal decrypts the compiled and encrypted application installation package according to a private key preset in a TrustZone, and runs the target application.

In this embodiment of the present invention, application security can be further improved.

Further optionally, when encrypting the compiled application installation package, the encryption unit <NUM> is specifically configured to: determine a constructor function in the compiled application installation package, and encrypt the constructor function.

Further optionally, the encryption unit <NUM> is configured to encrypt the class constructor according to a preset public key.

In the application management server shown in <FIG>, a receiving unit <NUM> receives an application download request that is for a target application and that is sent by a terminal, and the application download request carries terminal identification information of the terminal; a compilation unit <NUM> compiles an application installation package of the target application according to the terminal identification information; and a sending unit <NUM> sends the compiled application installation package to the terminal, so that the terminal installs the target application in a runtime environment that is based on the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

Referring to <FIG> is a schematic structural diagram of an application management server according to another embodiment of the present invention. The application management server provided in this embodiment of the present invention may be configured to implement the method implemented in the embodiment of the present invention shown in the foregoing <FIG>, <FIG>, or <FIG>. For ease of description, only parts related to this embodiment of the present invention are shown. For technical details that are not disclosed, refer to the embodiment of the present invention shown in <FIG>, <FIG>, or <FIG>.

As shown in <FIG>, the application management server may include at least one processor <NUM> such as a CPU, at least one network interface <NUM>, a memory <NUM>, and at least one communications bus <NUM>. The communications bus <NUM> is configured to implement a connection and communication between these components. Optionally, the network interface <NUM> may include a standard wired interface and a wireless interface (for example, a Wi-Fi interface). The memory <NUM> may include a high-speed RAM memory, and may further include a non-volatile memory (non-volatile memory), for example, at least one disk memory. Optionally, the memory <NUM> may include at least one storage apparatus that is away from the foregoing processor <NUM>. For the processor <NUM>, reference may be made to the application management server shown in <FIG>. The memory <NUM> stores a group of program code, and the processor <NUM> invokes the program code stored in the memory <NUM>, and is configured to perform the following operations:.

In an optional implementation manner, that the processor <NUM> compiles the application installation package of the target application according to the terminal identification information may be specifically:.

Further optionally, that the processor <NUM> compiles the application installation package of the target application according to the hash value may be specifically:
compiling the application installation package of the target application according to the hash value, and generating an ABI corresponding to the hash value, where the ABI may include a link address of the application installation package of the target application and a symbol table name of the application installation package of the target application.

Further optionally, that the processor <NUM> generates the ABI corresponding to the hash value may be specifically:
separately adjusting the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value.

Further optionally, that the processor <NUM> separately adjusts the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value may be specifically:.

In an optional implementation manner, after compiling the application installation package of the target application according to the terminal identification information, the processor <NUM> may further perform the following operations:.

Further optionally, that the processor <NUM> encrypts the compiled application installation package may be specifically:
determining a class constructor in the compiled application installation package, and encrypting the class constructor.

Further optionally, that the processor <NUM> encrypts the class constructor may be specifically:
encrypting the class constructor according to a preset public key.

Specifically, the application management server described in this embodiment of the present invention may be configured to implement a part or all of the procedure of the application protection method embodiment described in <FIG>, <FIG>, or <FIG>.

Referring to <FIG> is a schematic structural diagram of a terminal according to an embodiment of the present invention. The terminal may be configured to implement some or all of steps of the application protection methods in the method embodiments shown in <FIG>. The terminal may include at least a sending unit <NUM>, a receiving unit <NUM>, and an installation unit <NUM>.

The sending unit <NUM> is configured to send an application download request for a target application to an application management server, and the application download request carries terminal identification information of the terminal, so that the application management server compiles an application installation package of the target application according to the terminal identification information.

The receiving unit <NUM> is configured to receive the compiled application installation package sent by the application management server.

The installation unit <NUM> is configured to install, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information, and the runtime environment is obtained by compiling a preset intermediate file according to the terminal identification information, and the preset intermediate file includes a runtime file and a framework file.

In an optional implementation manner, the terminal in this embodiment of the present invention may further include:
a compilation unit <NUM>, configured to: before the sending unit <NUM> sends the application download request for the target application to the application management server, compile the preset intermediate file according to the terminal identification information preset in a TrustZone, where the compiled intermediate file constitutes the runtime environment that is based on the terminal identification information.

Further optionally, the compilation unit <NUM> is specifically configured to: before the sending unit <NUM> sends the application download request for the target application to the application management server, obtain a hash value of the terminal identification information, and compile the preset intermediate file according to the hash value.

Further optionally, when compiling the preset intermediate file according to the hash value, the compilation unit <NUM> is specifically configured to: compile the preset intermediate file according to the hash value, and generate an ABI corresponding to the hash value.

Further optionally, when generating the ABI corresponding to the hash value, the compilation unit <NUM> is specifically configured to separately adjust a link address and a symbol table name of the preset intermediate file according to the hash value.

In this embodiment of the present invention, an existing compilation algorithm is adjusted. In the existing compilation algorithm, preset intermediate files in different terminals have a same link address and a same symbol table name. In this embodiment of the present invention, the link address of the preset intermediate file and the symbol table name of the preset intermediate file are adjusted according to the hash value of the terminal identification information, and compiled preset intermediate files in different terminals have different link addresses and different symbol table names, so that the runtime environment corresponding to the terminal identification information is constituted.

Further optionally, when separately adjusting the link address of the preset intermediate file and the symbol table name of the preset intermediate file according to the hash value, the compilation unit <NUM> is specifically configured to: perform an exclusive OR operation on the link address of the preset intermediate file and the hash value, to generate a link address of the compiled intermediate file; encode the symbol table name of the preset intermediate file; and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled intermediate file. For example, the compilation unit <NUM> may encode the symbol table name of the preset intermediate file by means of Base64 encoding. The encoded symbol table name is a string of numbers not a character string, so that the exclusive OR operation is performed on the symbol table name and the hash value.

In an optional implementation manner, the sending unit <NUM> is specifically configured to send the application download request to the application management server, so that the application management server compiles the application installation package of the target application according to the terminal identification information, and the application management server encrypts the compiled application installation package.

The receiving unit <NUM> is specifically configured to receive the compiled and encrypted application installation package sent by the application management server.

Further optionally, the terminal in this embodiment of the present invention may further include:.

In this embodiment of the present invention, the private key is stored in the TrustZone, so that the private key is avoided from software attack, secrecy performance of the private key can be improved, and further, application security is improved.

In the terminal shown in <FIG>, a sending unit <NUM> sends an application download request for a target application to an application management server, and the application download request carries terminal identification information of the terminal, so that the application management server compiles an application installation package of the target application according to the terminal identification information; a receiving unit <NUM> receives the compiled application installation package sent by the application management server; and an installation unit <NUM> installs, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

Referring to <FIG> is a schematic structural diagram of a terminal according to another embodiment of the present invention. The terminal provided in this embodiment of the present invention may be configured to implement the methods implemented in the embodiments of the present invention shown in the foregoing <FIG>. For ease of description, only parts related to this embodiment of the present invention are shown. For technical details that are not disclosed, refer to the embodiments of the present invention shown in <FIG>.

As shown in <FIG>, the terminal may include at least one processor <NUM> such as a CPU, at least one network interface <NUM>, a user interface <NUM>, a memory <NUM>, and at least one communications bus <NUM>. The communications bus <NUM> is configured to implement a connection and communication between these components. Optionally, the network interface <NUM> may include a standard wired interface and a wireless interface (for example, a WI-FI interface). The user interface <NUM> may include a display and a keyboard. Optionally, the user interface <NUM> may further include a standard wired interface and a wireless interface. The memory <NUM> may include a high-speed RAM memory, and may further include a non-volatile memory, for example, at least one disk memory. Optionally, the memory <NUM> may include at least one storage apparatus that is away from the foregoing processor <NUM>. For the processor <NUM>, reference may be made to the terminal shown in <FIG>. The memory <NUM> stores a group of program code, and the processor <NUM> invokes the program code stored in the memory <NUM>, and is configured to perform the following operations:.

In an optional implementation manner, before sending, by using the network interface <NUM>, the application download request for the target application to the application management server, the processor <NUM> may further perform the following operation:
compiling the preset intermediate file according to the terminal identification information preset in a TrustZone, where the compiled intermediate file constitutes the runtime environment that is based on the terminal identification information, and the preset intermediate file may include a runtime file and a framework file.

Further optionally, that the processor <NUM> compiles the preset intermediate file according to the terminal identification information preset in the TrustZone may be specifically:.

Further optionally, that the processor <NUM> compiles the preset intermediate file according to the hash value may be specifically:
compiling the preset intermediate file according to the hash value, and generating an ABI corresponding to the hash value.

Further optionally, that the processor <NUM> generates the ABI corresponding to the hash value may be specifically:
separately adjusting a link address and a symbol table name of the preset intermediate file according to the hash value.

Further optionally, that the processor <NUM> separately adjusts the link address of the preset intermediate file and the symbol table name of the preset intermediate file according to the hash value may be specifically:.

In an optional implementation manner, that the processor <NUM> sends the application download request for the target application to the application management server may be specifically:
sending the application download request to the application management server, so that the application management server compiles the application installation package of the target application according to the terminal identification information, and the application management server encrypts the compiled application installation package.

Further, that the processor <NUM> receives the compiled application installation package sent by the application management server may be specifically:
receiving the compiled and encrypted application installation package sent by the application management server.

Further optionally, after installing the target application in the runtime environment that is based on the terminal identification information, the processor <NUM> may be further configured to perform the following operations:.

Specifically, the terminal described in this embodiment of the present invention may be configured to implement a part or all of the procedure of the application protection method embodiments described in <FIG>.

Referring to <FIG> is a schematic structural diagram of an application protection system according to an embodiment of the present invention. As shown in the figure, the application protection system in this embodiment of the present invention may include at least an application management server <NUM> and a terminal <NUM>.

The terminal <NUM> is configured to send an application download request for a target application to the application management server <NUM>, and the application download request carries terminal identification information of the terminal.

The application management server <NUM> is configured to compile an application installation package of the target application according to the terminal identification information.

The terminal <NUM> is further configured to: receive the compiled application installation package sent by the application management server <NUM>; and install, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information. The runtime environment is obtained by the terminal <NUM> by compiling a preset intermediate file of the terminal <NUM> according to the terminal identification information, and the preset intermediate file includes a runtime file and a framework file.

In an optional embodiment, the application management server <NUM> may obtain a hash value of the terminal identification information, and compile the application installation package of the target application according to the hash value.

Further optionally, the application management server <NUM> may compile the application installation package of the target application according to the hash value, and generate an ABI corresponding to the hash value. The ABI may include a link address of the application installation package of the target application and a symbol table name of the application installation package of the target application.

Further optionally, the application management server <NUM> may separately adjust the link address of the application installation package of the target application and the symbol table name of the application installation package of the target application according to the hash value.

Further optionally, the application management server <NUM> may perform an exclusive OR operation on the link address of the application installation package of the target application and the hash value, to generate a link address of the compiled application installation package. The application management server <NUM> may encode the symbol table name of the application installation package of the target application by means of, for example, Base64 encoding, and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled application installation package.

In an optional embodiment, before installing the compiled application installation package, the terminal <NUM> may compile the preset intermediate file according to the terminal identification information preset in a TrustZone, and the compiled preset intermediate file constitutes the runtime environment that is based on the terminal identification information.

Further optionally, the terminal <NUM> may obtain a hash value of the terminal identification information, and compile the preset intermediate file according to the hash value. Further optionally, the terminal <NUM> may compile the preset intermediate file according to the hash value, and generate an ABI corresponding to the hash value. The ABI may include a link address and a symbol table name of the preset intermediate file.

Further optionally, the terminal <NUM> may separately adjust the link address of the preset intermediate file and the symbol table name of the preset intermediate file according to the hash value.

Further optionally, the terminal <NUM> may perform an exclusive OR operation on the link address of the preset intermediate file and the hash value, to generate a link address of the compiled preset intermediate file. The terminal <NUM> may encode the symbol table name of the preset intermediate file by means of, for example, Base64 encoding, and perform an exclusive OR operation on the encoded symbol table name and the hash value, to generate a symbol table name of the compiled preset intermediate file.

In an optional embodiment, after compiling the application installation package of the target application according to the terminal identification information, the application management server <NUM> may encrypt the compiled application installation package.

The terminal <NUM> receives the compiled and encrypted application installation package sent by the application management server <NUM>.

After installing the target application in the runtime environment, the terminal <NUM> decrypts the compiled and encrypted application installation package according to a private key preset in the TrustZone and runs the target application.

Further optionally, the application management server <NUM> may determine a class constructor in the compiled application installation package and encrypt the determined class constructor. The class constructor refers to defining an initiated state when a class object is created. In a runtime process of the application installation package, the class constructor is executed more than <NUM> times, and there is a relatively few quantity of execution times. The class constructor is encrypted instead of all functions, so that processing efficiency can be improved.

Further optionally, the application management server <NUM> may encrypt the class constructor according to a preset public key.

Optionally, after installing the encrypted application installation package, the terminal <NUM> may decrypt the compiled and encrypted application installation package according to a private key preset in the TrustZone, and run the target application.

In the application protection system shown in <FIG>, a terminal <NUM> sends an application download request for a target application to an application management server <NUM>, and the application download request carries terminal identification information of the terminal; the application management server <NUM> compiles an application installation package of the target application according to the terminal identification information, and sends the compiled application installation package to the terminal <NUM>; and the terminal <NUM> installs, according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information. Therefore, application security can be effectively improved and stability of a software industry chain ecosystem can be effectively improved.

A person of ordinary skill in the art may understand that all or some of the processes of the methods in the embodiments may be implemented by a computer program instructing relevant hardware. The program may be stored in a computer readable storage medium. When the program runs, the processes of the methods in the embodiments are performed. The foregoing storage medium may include: a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM).

It should be noted that, in the foregoing embodiments, the description of each embodiment has respective focuses. For a part that is not described in detail in an embodiment, reference may be made to related descriptions in other embodiments. In addition, a person skilled in the art should also understand that the embodiments described in this specification are all embodiments, and the related actions and units are not necessarily mandatory to the present invention.

Claim 1:
An application protection method, comprising:
sending (S201) an application download request for a target application to an application management server, wherein the application download request carries terminal identification information which identify a unique terminal;
receiving (S202) the compiled application installation package sent by the application management server, wherein the application installation package is compiled according to the terminal identification information carried in the application downloads request; and
installing (S203), according to the compiled application installation package, the target application in a runtime environment that is based on the terminal identification information, wherein the runtime environment is obtained by compiling a preset intermediate file according to the terminal identification information, and the preset intermediate file comprises a runtime file and a framework file wherein the compiled preset intermediate file constitutes the runtime environment that is based on the terminal identification information,
wherein the compiling the preset intermediate file according to the terminal identification information preset in an architecture solution comprises:
obtaining a hash value of the terminal identification information; and
compiling the preset intermediate file according to the hash value, and generating an application binary interface, ABI, corresponding to the hash value.