diff --git a/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.cpp b/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.cpp
index 410408bebdc46acdf66bf3aeaac84aff456fb54b..1e81fa00860d96739505e9959b2af1b2761fe6ba 100644
--- a/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.cpp
+++ b/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.cpp
@@ -16,6 +16,7 @@
 #include "bundle_mgr_proxy.h"
 
 #include "account/account_delegate.h"
+#include "common_utils.h"
 #include "datashare_errno.h"
 #include "datashare_radar_reporter.h"
 #include "if_system_ability_manager.h"
@@ -114,6 +115,23 @@ int BundleMgrProxy::GetBundleInfoFromBMS(
     return E_OK;
 }
 
+int BundleMgrProxy::GetBundleInfoFromBMSWithCheck(
+    const std::string &bundleName, int32_t userId, BundleConfig &bundleConfig, int32_t appIndex)
+    {
+    int res = GetBundleInfoFromBMS(bundleName, userId, bundleConfig, appIndex);
+    if (res != E_OK) {
+        return res;
+    }
+    // Not allow normal app visit normal app.
+    if (!DataShareThreadLocal::IsFromSystemApp() && !bundleConfig.isSystemApp) {
+        ZLOGE("Not allow normal app visit normal app, bundle:%{public}s, callingPid:%{public}d",
+            bundleName.c_str(), IPCSkeleton::GetCallingPid());
+        return E_NOT_SYSTEM_APP;
+    }
+
+    return E_OK;
+}
+
 std::pair<int, std::string> BundleMgrProxy::GetCallerAppIdentifier(
     const std::string &bundleName, int32_t userId)
 {
@@ -199,6 +217,7 @@ std::pair<int, BundleConfig> BundleMgrProxy::ConvertToDataShareBundle(AppExecFwk
         return std::make_pair(err, bundleConfig);
     }
     bundleConfig.extensionInfos = extensionInfos;
+    bundleConfig.isSystemApp = bundleInfo.applicationInfo.isSystemApp;
     return std::make_pair(E_OK, bundleConfig);
 }
 
diff --git a/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.h b/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.h
index 71bcc496eb74f059dc2830fcd47a6aaa767bb735..80c054f8a405519493aa4ae8fd79e43a67148da6 100644
--- a/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.h
+++ b/services/distributeddataservice/service/data_share/common/bundle_mgr_proxy.h
@@ -57,6 +57,7 @@ struct ExtensionAbilityInfo {
 struct BundleConfig {
     std::string name;
     bool singleton = false;
+    bool isSystemApp = false;
     std::vector<HapModuleInfo> hapModuleInfos;
     std::vector<ExtensionAbilityInfo> extensionInfos;
 };
@@ -67,6 +68,8 @@ public:
     static std::shared_ptr<BundleMgrProxy> GetInstance();
     int GetBundleInfoFromBMS(const std::string &bundleName, int32_t userId,
         BundleConfig &bundleConfig, int32_t appIndex = 0);
+    int GetBundleInfoFromBMSWithCheck(const std::string &bundleName, int32_t userId,
+        BundleConfig &bundleConfig, int32_t appIndex = 0);
     void Delete(const std::string &bundleName, int32_t userId, int32_t appIndex);
     sptr<IRemoteObject> CheckBMS();
     std::pair<int, std::string> GetCallerAppIdentifier(const std::string &bundleName, int32_t userId);
diff --git a/services/distributeddataservice/service/data_share/common/common_utils.cpp b/services/distributeddataservice/service/data_share/common/common_utils.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..deeab89cba0a01c3516b8f121b8a9bc15e5b4f91
--- /dev/null
+++ b/services/distributeddataservice/service/data_share/common/common_utils.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "CommonUtils"
+#include "common_utils.h"
+
+#include "accesstoken_kit.h"
+#include "config_factory.h"
+#include "log_print.h"
+#include "tokenid_kit.h"
+
+namespace OHOS::DataShare {
+
+bool& DataShareThreadLocal::GetFromSystemApp()
+{
+    static thread_local bool isFromSystemApp = true;
+    return isFromSystemApp;
+}
+
+void DataShareThreadLocal::SetFromSystemApp(bool isFromSystemApp)
+{
+    GetFromSystemApp() = isFromSystemApp;
+}
+
+bool DataShareThreadLocal::IsFromSystemApp()
+{
+    return GetFromSystemApp();
+}
+
+void DataShareThreadLocal::CleanFromSystemApp()
+{
+    SetFromSystemApp(true);
+}
+
+bool CheckSystemAbility(uint32_t tokenId)
+{
+    Security::AccessToken::ATokenTypeEnum tokenType =
+        Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
+    return (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
+        tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL);
+}
+
+// GetTokenType use tokenId, and IsSystemApp use fullTokenId, these are different
+bool CheckSystemCallingPermission(uint32_t tokenId, uint64_t fullTokenId)
+{
+    if (CheckSystemAbility(tokenId)) {
+        return true;
+    }
+    // IsSystemAppByFullTokenID here is not IPC
+    return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(fullTokenId);
+}
+
+} // namespace OHOS::DataShare
diff --git a/services/distributeddataservice/service/data_share/common/common_utils.h b/services/distributeddataservice/service/data_share/common/common_utils.h
new file mode 100644
index 0000000000000000000000000000000000000000..1b8379dc7fdb2f7329ceaac9acabeda848921454
--- /dev/null
+++ b/services/distributeddataservice/service/data_share/common/common_utils.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef DATASHARESERVICE_COMMON_UTILS_H
+#define DATASHARESERVICE_COMMON_UTILS_H
+
+#include <cinttypes>
+#include <string>
+
+namespace OHOS::DataShare {
+struct DataShareThreadLocal {
+    static bool& GetFromSystemApp();
+    static void SetFromSystemApp(bool isFromSystemApp);
+    static bool IsFromSystemApp();
+    static void CleanFromSystemApp();
+};
+
+bool CheckSystemAbility(uint32_t tokenId);
+
+bool CheckSystemCallingPermission(uint32_t tokenId, uint64_t fullTokenId);
+
+} // namespace OHOS::DataShare
+#endif // DATASHARESERVICE_COMMON_UTILS_H
diff --git a/services/distributeddataservice/service/data_share/common/scheduler_manager.cpp b/services/distributeddataservice/service/data_share/common/scheduler_manager.cpp
index 79ca80155a6e32bfd36ac2af3417040ab57d13b1..edd06fb061f5dc455085d2ed06dd9311219c0a64 100644
--- a/services/distributeddataservice/service/data_share/common/scheduler_manager.cpp
+++ b/services/distributeddataservice/service/data_share/common/scheduler_manager.cpp
@@ -87,6 +87,13 @@ void SchedulerManager::Stop(const Key &key)
 
 void SchedulerManager::Enable(const Key &key, int32_t userId, const DistributedData::StoreMetaData &metaData)
 {
+    Template tpl;
+    if (!TemplateManager::GetInstance().Get(key, userId, tpl) ||
+        tpl.scheduler_.empty() || tpl.scheduler_.find(REMIND_TIMER_FUNC) == std::string::npos) {
+        ZLOGE("find template scheduler failed, %{public}s, %{public}" PRId64 ", %{public}s",
+            DistributedData::Anonymous::Change(key.uri).c_str(), key.subscriberId, key.bundleName.c_str());
+        return;
+    }
     bool isTimerStopped = false;
     {
         std::lock_guard<std::mutex> lock(mutex_);
diff --git a/services/distributeddataservice/service/data_share/data_provider_config.cpp b/services/distributeddataservice/service/data_share/data_provider_config.cpp
index e713b4acb9a0df4e915dab75eff1218e662fa404..3a54e912413548c10733beed03d1f3e96c84999a 100644
--- a/services/distributeddataservice/service/data_share/data_provider_config.cpp
+++ b/services/distributeddataservice/service/data_share/data_provider_config.cpp
@@ -20,10 +20,16 @@
 
 #include "accesstoken_kit.h"
 #include "account/account_delegate.h"
+#include "config_factory.h"
+#include "config_factory.h"
 #include "datashare_errno.h"
 #include "hap_token_info.h"
+#include "ipc_skeleton.h"
+#include "ipc_skeleton.h"
 #include "log_print.h"
 #include "strategies/general/load_config_common_strategy.h"
+#include "tokenid_kit.h"
+#include "tokenid_kit.h"
 #include "uri_utils.h"
 #include "utils/anonymous.h"
 
@@ -61,7 +67,7 @@ std::pair<int, BundleConfig> DataProviderConfig::GetBundleInfo()
         }
         providerInfo_.bundleName = uriConfig_.pathSegments[0];
     }
-    auto ret = BundleMgrProxy::GetInstance()->GetBundleInfoFromBMS(
+    auto ret = BundleMgrProxy::GetInstance()->GetBundleInfoFromBMSWithCheck(
         providerInfo_.bundleName, providerInfo_.visitedUserId, bundleInfo, providerInfo_.appIndex);
     return std::make_pair(ret, bundleInfo);
 }
@@ -155,7 +161,7 @@ int DataProviderConfig::GetFromExtension()
         return E_URI_NOT_EXIST;
     }
     BundleConfig bundleInfo;
-    auto ret = BundleMgrProxy::GetInstance()->GetBundleInfoFromBMS(
+    auto ret = BundleMgrProxy::GetInstance()->GetBundleInfoFromBMSWithCheck(
         providerInfo_.bundleName, providerInfo_.visitedUserId, bundleInfo, providerInfo_.appIndex);
     if (ret != E_OK) {
         ZLOGE("BundleInfo failed! bundleName: %{public}s", providerInfo_.bundleName.c_str());
@@ -225,6 +231,30 @@ std::pair<int, DataProviderConfig::ProviderInfo> DataProviderConfig::GetProvider
         GetMetaDataFromUri();
         return std::make_pair(ret, providerInfo_);
     }
+    if (ret != E_URI_NOT_EXIST) {
+        return std::make_pair(ret, providerInfo_);
+    }
+    auto fullTokenId = IPCSkeleton::GetCallingFullTokenID();
+    Security::AccessToken::HapTokenInfo tokenInfo;
+    auto result = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(IPCSkeleton::GetCallingTokenID(), tokenInfo);
+    if (!Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(fullTokenId)
+        || (result == Security::AccessToken::RET_SUCCESS && !IsInExtList(tokenInfo.bundleName))) {
+        ZLOGE("The URI in the extension, is not allowed for silent access.! ret: %{public}d, bundleName: %{public}s,"
+            "uri: %{public}s", ret, tokenInfo.bundleName.c_str(), providerInfo_.uri.c_str());
+        return std::make_pair(ret, providerInfo_);
+    }
+    if (ret != E_URI_NOT_EXIST) {
+        return std::make_pair(ret, providerInfo_);
+    }
+    auto fullTokenId = IPCSkeleton::GetCallingFullTokenID();
+    Security::AccessToken::HapTokenInfo tokenInfo;
+    auto result = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(IPCSkeleton::GetCallingTokenID(), tokenInfo);
+    if (!Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(fullTokenId)
+        || (result == Security::AccessToken::RET_SUCCESS && !IsInExtList(tokenInfo.bundleName))) {
+        ZLOGE("The URI in the extension, is not allowed for silent access.! ret: %{public}d, bundleName: %{public}s,"
+            "uri: %{public}s", ret, tokenInfo.bundleName.c_str(), providerInfo_.uri.c_str());
+        return std::make_pair(ret, providerInfo_);
+    }
     ret = GetFromExtension();
     if (ret != E_OK) {
         ZLOGE("Get providerInfo failed! ret: %{public}d, uri: %{public}s",
@@ -232,4 +262,14 @@ std::pair<int, DataProviderConfig::ProviderInfo> DataProviderConfig::GetProvider
     }
     return std::make_pair(ret, providerInfo_);
 }
+
+bool DataProviderConfig::IsInExtList(const std::string &bundleName)
+{
+    DataShareConfig *config = ConfigFactory::GetInstance().GetDataShareConfig();
+    if (config == nullptr) {
+        return true;
+    }
+    std::vector<std::string>& extNames = config->dataShareExtNames;
+    return std::find(extNames.begin(), extNames.end(), bundleName) != extNames.end();
+}
 } // namespace OHOS::DataShare
diff --git a/services/distributeddataservice/service/data_share/data_provider_config.h b/services/distributeddataservice/service/data_share/data_provider_config.h
index 6b2770dfe192333d919beb169443e5489ecdb6ea..4c1e26fe7c93ddd4606e455795b80b1811d7ba83 100644
--- a/services/distributeddataservice/service/data_share/data_provider_config.h
+++ b/services/distributeddataservice/service/data_share/data_provider_config.h
@@ -63,6 +63,7 @@ private:
     int GetFromExtensionProperties(const ProfileInfo &profileInfo, const std::string &moduleName);
     void GetMetaDataFromUri();
     std::pair<int, BundleConfig> GetBundleInfo();
+    bool IsInExtList(const std::string &bundleName);
     enum class PATH_PARAM : int32_t {
         BUNDLE_NAME = 0,
         MODULE_NAME,
diff --git a/services/distributeddataservice/service/data_share/data_share_profile_config.cpp b/services/distributeddataservice/service/data_share/data_share_profile_config.cpp
index 9787d9df1dc7c2db46c955850895215c386a399c..d12ec3d1bbe3a9ad36f5bf1bbe5751c292575bca 100644
--- a/services/distributeddataservice/service/data_share/data_share_profile_config.cpp
+++ b/services/distributeddataservice/service/data_share/data_share_profile_config.cpp
@@ -275,9 +275,9 @@ bool DataShareProfileConfig::GetProfileInfo(const std::string &calledBundleName,
 {
     BundleConfig bundleInfo;
     // profile is the same when app clone
-    if (BundleMgrProxy::GetInstance()->GetBundleInfoFromBMS(calledBundleName,
+    if (BundleMgrProxy::GetInstance()->GetBundleInfoFromBMSWithCheck(calledBundleName,
         currentUserId, bundleInfo) != E_OK) {
-        ZLOGE("data share GetBundleInfoFromBMS failed! bundleName: %{public}s, currentUserId = %{public}d",
+        ZLOGE("data share GetBundleInfoFromBMSWithCheck failed! bundleName: %{public}s, currentUserId = %{public}d",
               calledBundleName.c_str(), currentUserId);
         return false;
     }
diff --git a/services/distributeddataservice/service/data_share/data_share_service_impl.cpp b/services/distributeddataservice/service/data_share/data_share_service_impl.cpp
index 93f4e572bab29d1984cf14115befeba2c8223f32..6bb1f5a8886a1d0dff2a7ff8b99b586974ec4711 100644
--- a/services/distributeddataservice/service/data_share/data_share_service_impl.cpp
+++ b/services/distributeddataservice/service/data_share/data_share_service_impl.cpp
@@ -24,6 +24,7 @@
 #include "app_connect_manager.h"
 #include "common_event_manager.h"
 #include "common_event_support.h"
+#include "concurrent_task_client.h"
 #include "data_ability_observer_interface.h"
 #include "data_share_profile_config.h"
 #include "dataobs_mgr_client.h"
@@ -83,11 +84,17 @@ public:
 void DataShareServiceImpl::SystemAbilityStatusChangeListener::OnAddSystemAbility(
     int32_t systemAbilityId, const std::string &deviceId)
 {
-    if (systemAbilityId != COMMON_EVENT_SERVICE_ID) {
-        return;
-    }
-    ZLOGI("Common event service start. saId:%{public}d", systemAbilityId);
-    InitSubEvent();
+    ZLOGI("saId:%{public}d", systemAbilityId);
+    if (systemAbilityId == COMMON_EVENT_SERVICE_ID) {
+        InitSubEvent();
+    } else if (systemAbilityId == CONCURRENT_TASK_SERVICE_ID) {
+        std::unordered_map<std::string, std::string> payload;
+        // get current thread pid
+        payload["pid"] = std::to_string(getpid());
+        // request qos auth for current pid
+        OHOS::ConcurrentTask::ConcurrentTaskClient::GetInstance().RequestAuth(payload);
+    }
+    return;
 }
 
 DataShareServiceImpl::Factory::Factory()
@@ -589,6 +596,7 @@ int32_t DataShareServiceImpl::OnBind(const BindInfo &binderInfo)
     DBDelegate::SetExecutorPool(binderInfo.executors);
     HiViewAdapter::GetInstance().SetThreadPool(binderInfo.executors);
     SubscribeCommonEvent();
+    SubscribeConcurrentTask();
     SubscribeTimeChanged();
     SubscribeChange();
     ZLOGI("end");
@@ -606,6 +614,17 @@ void DataShareServiceImpl::SubscribeCommonEvent()
     systemManager->SubscribeSystemAbility(COMMON_EVENT_SERVICE_ID, callback);
 }
 
+void DataShareServiceImpl::SubscribeConcurrentTask()
+{
+    sptr<ISystemAbilityManager> systemManager = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
+    if (systemManager == nullptr) {
+        ZLOGE("System mgr is nullptr");
+        return;
+    }
+    sptr<SystemAbilityStatusChangeListener> callback(new SystemAbilityStatusChangeListener());
+    systemManager->SubscribeSystemAbility(CONCURRENT_TASK_SERVICE_ID, callback);
+}
+
 void DataShareServiceImpl::SubscribeChange()
 {
     EventCenter::GetInstance().Subscribe(RemoteChangeEvent::RDB_META_SAVE, [this](const Event &event) {
diff --git a/services/distributeddataservice/service/data_share/data_share_service_impl.h b/services/distributeddataservice/service/data_share/data_share_service_impl.h
index e4d0a7d9d5d94a535750aa961947d451d9392512..1b7e57ba65da880c110c8803a07ff766ad1a21b7 100644
--- a/services/distributeddataservice/service/data_share/data_share_service_impl.h
+++ b/services/distributeddataservice/service/data_share/data_share_service_impl.h
@@ -125,6 +125,7 @@ private:
     std::pair<bool, Security::AccessToken::ATokenTypeEnum> GetCallerInfo(std::string &bundleName, int32_t &appIndex);
     int32_t GetBMSAndMetaDataStatus(const std::string &uri, const int32_t tokenId);
     void SubscribeCommonEvent();
+    void SubscribeConcurrentTask();
     static void InitSubEvent();
     void AutoLaunch(const DistributedData::Event &event);
     void SubscribeChange();
diff --git a/services/distributeddataservice/service/data_share/data_share_service_stub.cpp b/services/distributeddataservice/service/data_share/data_share_service_stub.cpp
index c7a43a7a6363d5bdf7efebce1b2ce8e20ce98aa1..a2a9fa4e0c60191bf944cca7434b627d67ec798e 100644
--- a/services/distributeddataservice/service/data_share/data_share_service_stub.cpp
+++ b/services/distributeddataservice/service/data_share/data_share_service_stub.cpp
@@ -18,8 +18,7 @@
 #include "data_share_service_stub.h"
 
 #include <cinttypes>
-#include "accesstoken_kit.h"
-#include "tokenid_kit.h"
+#include "common_utils.h"
 #include "data_share_obs_proxy.h"
 #include "hiview_adapter.h"
 #include "hiview_fault_adapter.h"
@@ -27,10 +26,24 @@
 #include "ishared_result_set.h"
 #include "itypes_util.h"
 #include "log_print.h"
+#include "qos.h"
 #include "utils/anonymous.h"
 
 namespace OHOS {
 namespace DataShare {
+    
+class DataShareServiceStub::QosManager {
+public:
+    QosManager()
+    {
+        // set thread qos QOS_USER_INTERACTIVE
+        QOS::SetThreadQos(QOS::QosLevel::QOS_USER_INTERACTIVE);
+    }
+    ~QosManager()
+    {
+        QOS::ResetThreadQos();
+    }
+};
 bool DataShareServiceStub::CheckInterfaceToken(MessageParcel &data)
 {
     auto localDescriptor = IDataShareService::GetDescriptor();
@@ -327,45 +340,37 @@ int32_t DataShareServiceStub::OnNotifyConnectDone(MessageParcel &data, MessagePa
     return 0;
 }
 
-bool DataShareServiceStub::CheckProxyCallingPermission(uint32_t tokenId)
-{
-    Security::AccessToken::ATokenTypeEnum tokenType =
-        Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
-    return (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
-        tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL);
-}
-
-// GetTokenType use tokenId, and IsSystemApp use fullTokenId, these are different
-bool DataShareServiceStub::CheckSystemUidCallingPermission(uint32_t tokenId, uint64_t fullTokenId)
-{
-    if (CheckProxyCallingPermission(tokenId)) {
-        return true;
-    }
-    // IsSystemAppByFullTokenID here is not IPC
-    return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(fullTokenId);
-}
-
 int DataShareServiceStub::OnRemoteRequest(uint32_t code, MessageParcel &data, MessageParcel &reply)
 {
+    // set thread qos
+    DataShareServiceStub::QosManager qos;
+    // check thread qos
+    QOS::QosLevel curLevel;
+    int qosRet = QOS::GetThreadQos(curLevel);
+
     int tryTimes = TRY_TIMES;
     while (!isReady_.load() && tryTimes > 0) {
         tryTimes--;
         std::this_thread::sleep_for(std::chrono::milliseconds(SLEEP_TIME));
     }
     auto callingPid = IPCSkeleton::GetCallingPid();
-    if (code >= DATA_SHARE_CMD_SYSTEM_CODE) {
-        auto fullTokenId = IPCSkeleton::GetCallingFullTokenID();
-        if (!CheckSystemUidCallingPermission(IPCSkeleton::GetCallingTokenID(), fullTokenId)) {
-            ZLOGE("CheckSystemUidCallingPermission fail, token:%{public}" PRIx64
-                ", callingPid:%{public}d, code:%{public}u", fullTokenId, callingPid, code);
-            return E_NOT_SYSTEM_APP;
-        }
-        code = code - DATA_SHARE_CMD_SYSTEM_CODE;
-    }
+    auto fullTokenId = IPCSkeleton::GetCallingFullTokenID();
+    bool isSystemApp = CheckSystemCallingPermission(IPCSkeleton::GetCallingTokenID(), fullTokenId);
+    DataShareThreadLocal::SetFromSystemApp(isSystemApp);
+    if(code >= DATA_SHARE_CMD_SYSTEM_CODE){
+        if(!isSystemApp){
+            ZLOGE("CheckSystemCallingPermission fail, token:%{public}" PRIx64
+                ", callingPid:%{public}d, code:%{public}u", fullTokenId, callingPid, code);
+            return E_NOT_SYSTEM_APP;
+        }
+        code = code - DATA_SHARE_CMD_SYSTEM_CODE;
+    }
     if (code != DATA_SHARE_SERVICE_CMD_QUERY && code != DATA_SHARE_SERVICE_CMD_GET_SILENT_PROXY_STATUS) {
-        ZLOGI("code:%{public}u, callingPid:%{public}d", code, callingPid);
+        ZLOGI("code:%{public}u, callingPid:%{public}d, qosRet:%{public}d, curLevel:%{public}d",
+            code, callingPid, qosRet, curLevel);
     }
     if (!CheckInterfaceToken(data)) {
+        DataShareThreadLocal::CleanFromSystemApp();
         return DATA_SHARE_ERROR;
     }
     int res = -1;
@@ -384,6 +389,7 @@ int DataShareServiceStub::OnRemoteRequest(uint32_t code, MessageParcel &data, Me
         }
         HiViewAdapter::GetInstance().ReportDataStatistic(callerInfo);
     }
+    DataShareThreadLocal::CleanFromSystemApp();
     return res;
 }
 
diff --git a/services/distributeddataservice/service/data_share/data_share_service_stub.h b/services/distributeddataservice/service/data_share/data_share_service_stub.h
index 8a7653f3f3b0d28d0815d417cf86d3c51d9719f0..a887edb8c652bd682ccbd7acce05188494f6d4bb 100644
--- a/services/distributeddataservice/service/data_share/data_share_service_stub.h
+++ b/services/distributeddataservice/service/data_share/data_share_service_stub.h
@@ -27,6 +27,7 @@ public:
     void SetServiceReady();
 
 private:
+    class QosManager;
     static constexpr std::chrono::milliseconds TIME_THRESHOLD = std::chrono::milliseconds(500);
     static bool CheckInterfaceToken(MessageParcel& data);
     bool CheckProxyCallingPermission(uint32_t tokenId);
diff --git a/services/distributeddataservice/service/data_share/strategies/data_proxy/load_config_from_data_proxy_node_strategy.cpp b/services/distributeddataservice/service/data_share/strategies/data_proxy/load_config_from_data_proxy_node_strategy.cpp
index c796152ca0fcd267f999c1d713a424cecacb7785..1ff753758d612388bb5c945f46026047ef9add4a 100644
--- a/services/distributeddataservice/service/data_share/strategies/data_proxy/load_config_from_data_proxy_node_strategy.cpp
+++ b/services/distributeddataservice/service/data_share/strategies/data_proxy/load_config_from_data_proxy_node_strategy.cpp
@@ -30,9 +30,9 @@ bool LoadConfigFromDataProxyNodeStrategy::operator()(std::shared_ptr<Context> co
         return false;
     }
     context->type = PUBLISHED_DATA_TYPE;
-    if (BundleMgrProxy::GetInstance()->GetBundleInfoFromBMS(
+    if (BundleMgrProxy::GetInstance()->GetBundleInfoFromBMSWithCheck(
         context->calledBundleName, context->currentUserId, context->bundleInfo) != E_OK) {
-        ZLOGE("GetBundleInfoFromBMS failed! bundleName: %{public}s", context->calledBundleName.c_str());
+        ZLOGE("GetBundleInfoFromBMSWithCheck failed! bundleName: %{public}s", context->calledBundleName.c_str());
         context->errCode = E_BUNDLE_NAME_NOT_EXIST;
         return false;
     }
diff --git a/services/distributeddataservice/service/data_share/strategies/data_share/load_config_from_data_share_bundle_info_strategy.cpp b/services/distributeddataservice/service/data_share/strategies/data_share/load_config_from_data_share_bundle_info_strategy.cpp
index 16fe91511f8148f17850e1acccb70dd233a305e5..2b98f63b5282efec7e7f0ce0e51183b81cadd776 100644
--- a/services/distributeddataservice/service/data_share/strategies/data_share/load_config_from_data_share_bundle_info_strategy.cpp
+++ b/services/distributeddataservice/service/data_share/strategies/data_share/load_config_from_data_share_bundle_info_strategy.cpp
@@ -80,9 +80,9 @@ bool LoadConfigFromDataShareBundleInfoStrategy::operator()(std::shared_ptr<Conte
         ZLOGE("LoadConfigFromUri failed! bundleName: %{public}s", context->calledBundleName.c_str());
         return false;
     }
-    if (BundleMgrProxy::GetInstance()->GetBundleInfoFromBMS(
+    if (BundleMgrProxy::GetInstance()->GetBundleInfoFromBMSWithCheck(
         context->calledBundleName, context->currentUserId, context->bundleInfo) != E_OK) {
-        ZLOGE("GetBundleInfoFromBMS failed! bundleName: %{public}s", context->calledBundleName.c_str());
+        ZLOGE("GetBundleInfoFromBMSWithCheck failed! bundleName: %{public}s", context->calledBundleName.c_str());
         return false;
     }
     for (auto const &item : context->bundleInfo.extensionInfos) {