WO2020177116A1

WO2020177116A1 - Counterfeit app identification method and apparatus

Info

Publication number: WO2020177116A1
Application number: PCT/CN2019/077311
Authority: WO
Inventors: 李多显; 何钢杰; 钟文国
Original assignee: 华为技术有限公司
Priority date: 2019-03-07
Filing date: 2019-03-07
Publication date: 2020-09-10
Also published as: CN112805702A

Abstract

Provided in embodiments of the present application are a counterfeit app identification method, a server, and a terminal device. The method comprises: after an app to be identified on a terminal device starts up and before performing service interaction with a service server, sending a certificate chain and signature data to the service server; after verifying that each certificate in the certificate chain is valid and that a service certificate is the service certificate of the app to be identified, the service server comparing a signature certificate fingerprint corresponding to a packet name in the service certificate with a pre-stored signature certificate fingerprint corresponding to the packet name to determine whether the fingerprints are the same, thereby identifying whether the app to be identified is a counterfeit app, thus preventing the service server from serving a counterfeit app and improving service security. In addition, if the service server can serve only a specific quantity of users at one time, by means of the present application, an illegal user can be prevented from accessing the service server by means of a counterfeit app, which may guarantee the service of a legitimate user.

Description

Method and device for identifying counterfeit APP

Technical field

The embodiments of this application relate to the field of security technologies, and in particular to a method and device for identifying counterfeit APPs.

Background technique

With the continuous development of technology, various applications (APP) continue to emerge. The attacker decompiles the legitimate APP in the third-party application store, and implants malicious code or advertising information in the legal APP, thereby tampering with the legitimate APP into a counterfeit APP, or the bad elements develop a counterfeit APP and upload the counterfeit APP to the third party. Third party application store. Since ordinary users do not have the ability to identify counterfeit apps, they will download and use these counterfeit apps, causing security risks to users.

In order to prevent counterfeit apps from appearing in third-party application stores, currently, servers of third-party application stores, such as servers corresponding to APP stores, identify counterfeit apps. During the identification process, the server identifies the APP based on the Android package (APK) file of the APP, extracting the feature vector of the APK file or adding monitoring features to the APK file, etc.

The above method of identifying counterfeit APPs is suitable for the identification of counterfeit APPs by third-party app stores. However, in some scenarios, the service server only provides services for specific apps and does not want to be accessed by other apps. For example, the server corresponding to Huawei share APP only provides services for Huawei share APP. If the server of the third-party application store recognizes that an APP is a legitimate APP, but the APP is illegal to the business server, the APP is downloaded to the terminal device and accesses the business server, causing security risks; or, if An APP is a counterfeit APP, but the server of a third-party application store does not recognize that the APP is a counterfeit APP, and the APP is downloaded to the terminal device and accessed to the service server, which also causes security risks.

Summary of the invention

The embodiments of this application provide a method and device for identifying counterfeit APPs. After a user downloads an APP on a terminal device and uses the APP to interact with a service server, the service server performs counterfeit recognition of the APP to prevent the service server from providing services for the counterfeit APP , To ensure the security of the business server.

In the first aspect, an embodiment of the present application provides a method for identifying a counterfeit APP, which can be applied to a server or a chip of the server. The method is described below by taking the application to the server as an example. The method includes: the server sends a first random number to the terminal device; the server receives the certificate chain and signature data sent by the terminal device, and the certificate in the certificate chain includes the application APP to be identified The service certificate carries the package name of the APP to be recognized and the fingerprint of the first signature certificate of the APP to be recognized. The signature data is obtained by the terminal device using the private key corresponding to the service certificate to encrypt the first random number; the server uses the certificate chain and The signature data determines whether the service certificate is the service certificate of the APP to be identified; if the service certificate is the service certificate of the APP to be identified, the server determines whether the APP to be identified is a counterfeit APP based on the package name and the fingerprint of the first signature certificate. Using this method, after the APP to be identified on the terminal device is started, before the service interaction with the service server, the certificate chain and signature data are sent to the service server. The service server verifies that each certificate in the certificate chain is legal and the service certificate is pending. After identifying the APP’s own service certificate, compare whether the signature certificate fingerprint corresponding to the package name in the service certificate is the same as the pre-stored signature certificate fingerprint corresponding to the package name, so as to identify whether the APP to be identified is a counterfeit APP and avoid the service server Counterfeit APP provides services to improve business security. In addition, if the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.

In a feasible design, the server judges whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data, including: the server uses the public key of the service certificate to decrypt the signature data to obtain a random number, which is called the first Two random numbers. Then, the server compares whether the first random number and the second random number are the same. If the first random number is the same as the second random number, the server determines that the service certificate is the service certificate of the APP to be identified; if the first random number is If the number is different from the second random number, the server determines that the service certificate is not the service certificate of the APP to be identified. Using this method, the server determines whether the service certificate is the service certificate of the APP.

In a feasible design, the certificate in the certificate chain also includes the root certificate of the terminal device and the device certification authority CA certificate. The trusted certificate level on the server is the root certificate. The server judges whether the certificate in the certificate chain is legal, including: Determine whether the root certificate is legal, then determine whether the device certificate is legal, and finally determine whether the business certificate is legal. In the process of verifying the validity of the certificate chain, the server judges whether there is a root certificate in the certificate chain in the trusted root certificate set stored locally. If the root certificate in the certificate chain is included in the trusted root certificate set, the server considers the root The certificate is credible. On the contrary, the server considers the root certificate in the certificate chain to be untrustworthy; after that, the server uses the public key of the root certificate to decrypt the device CA certificate to obtain a hash value and use the hash carried in the device CA certificate Algorithm, to perform a hash operation on the content of the device CA certificate to obtain another hash value. If the two hash values are the same, the server considers the device CA certificate legal, otherwise, the server considers the device CA certificate illegal; Use the public key of the device CA certificate to decrypt the service certificate to obtain a hash value. Use the hash algorithm carried in the service certificate to hash the content of the service certificate to obtain another hash value. If the value is the same, the server considers the business certificate to be legal; anyway, the server considers the business certificate to be illegal. This solution is adopted to achieve the purpose of verifying the legality of the certificates in the certificate chain when the trusted certificate level on the service server is the root certificate.

In a feasible design, the certificate in the certificate chain also includes the device authorized CA certificate of the terminal device, the trusted certificate level on the server is the device CA certificate, and the server determines whether the certificate in the certificate chain is legal, including: the server determines the pre-deployment In the trusted CA certificate set, whether there is a device CA certificate in the certificate chain; if there is a device CA certificate in the certificate chain in the CA certificate set, the server uses the public key of the device CA certificate to decrypt the business certificate, and obtain a ha Hopefully, use the hash algorithm carried in the business certificate to hash the content of the business certificate to obtain another hash value. If the two hash values are the same, the server considers the business certificate legal; anyway, the server considers the business The certificate is invalid. This solution is adopted to achieve the purpose of verifying the legality of the certificates in the certificate chain when the trusted certificate level on the service server is the device CA certificate.

In a feasible design, if the service certificate is the service certificate of the app to be identified, the server determines whether the app to be identified is a counterfeit app based on the package name and the fingerprint of the first signature certificate, including: if the service certificate is the service of the app to be identified Certificate, the server compares the first signature certificate fingerprint corresponding to the package name in the certificate chain with the second signature certificate fingerprint stored when the genuine APP corresponding to the package name is registered on the server; if the first signature certificate fingerprint is compared with the second signature certificate fingerprint If the fingerprints of the signature certificate are not the same, the server determines that the APP to be identified is a counterfeit APP. Using this scheme, the server realizes the purpose of counterfeiting the app to be identified based on the package name and the fingerprint of the signature certificate.

In the second aspect, an embodiment of the present application provides a method for identifying a counterfeit application APP. The method can be applied to a terminal device or a chip in the terminal device. The method is described below by taking an application to a terminal device as an example. The method includes: the terminal device sends to the server a request message for establishing a link between the APP to be identified and the server; the terminal receives a verification message sent by the server to verify the APP to be identified, and The verification message contains the first random number; the terminal device sends the certificate chain and signature data to the server, the signature data is obtained by encrypting the first random number with the private key corresponding to the APP to be identified; the terminal receiving server treats identification according to the certificate chain and the signature data APP verifies whether it is the result of counterfeiting APP. Using this method, after the APP to be identified on the terminal device is started, before the service interaction with the service server, the certificate chain and signature data are sent to the service server. The service server verifies that each certificate in the certificate chain is legal and the service certificate is pending. After identifying the APP’s own service certificate, compare whether the signature certificate fingerprint corresponding to the package name in the service certificate is the same as the pre-stored signature certificate fingerprint corresponding to the package name, so as to identify whether the APP to be identified is a counterfeit APP and avoid the service server Counterfeit APP provides services to improve business security. In addition, if the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.

In a feasible design, the certificate chain contains the service certificate of the app to be identified, and the service certificate carries the package name of the app to be identified and the fingerprint of the first signature certificate of the app to be identified; the terminal receiving server verifies the app to be identified according to the certificate chain and signature data Whether it is the result of a counterfeit APP, including the counterfeit identification result obtained by the terminal device receiving server matching the fingerprint of the second visa certificate corresponding to the package name registration of the APP with the fingerprint of the first signature certificate; if the matching is successful, the counterfeiting result indicates The APP is not a counterfeit APP, or if the matching fails, the counterfeit identification result indicates that the APP is a counterfeit APP. Using this scheme, it is possible to identify whether the APP to be identified is a counterfeit APP, to prevent the service server from providing services for the counterfeit APP, and to improve business security. In addition, if the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect legitimate users’ business

In a feasible design, before the terminal device sends the certificate chain and signature data to the server, it also includes: the terminal device uses the device CA certificate to issue a service certificate for the app to be identified, and the content of the service certificate includes the package name of the app to be identified and the app to be identified The fingerprint of the first signature certificate. Using this solution, the terminal device uses the device CA certificate to issue a service certificate for the APP to be identified.

In a feasible design, the business certificate is generated and managed for the certificate management service of the terminal device, and the certificate management service is located in the Framework layer of the system of the terminal device. Using this kind of scheme, realize the purpose of setting up certificate management service on terminal equipment.

In a feasible design, the service certificate also includes the public key of the APP to be identified, and the public key corresponds to the private key that encrypts the first random number. This solution is adopted to realize the purpose of checking whether the service certificate is the service certificate of the APP to be identified.

In a feasible design, the operating system of the terminal equipment includes the rich execution environment REE operating system and the trusted execution environment TEE operating system. The terminal equipment uses the equipment CA certificate to issue service certificates for the APP to be identified, including: the terminal equipment runs on the REE The client application CA on the operating system sends a service certificate application request message to the trusted application TA running on the TEE operating system; the terminal device controls the TA to use the device CA certificate to issue a service certificate for the APP to be identified. With this solution, the terminal device controls the TA to use the device CA certificate to issue a service certificate for the APP to be identified.

In the third aspect, an embodiment of the present application provides a server, including:

A transmitter for sending the first random number to the terminal device;

The receiver is configured to receive a certificate chain and signature data sent by a terminal device. The certificate in the certificate chain includes a service certificate of the application to be identified, and the service certificate carries the package name of the to-be-identified APP and the to-be-identified application. The fingerprint of the first signature certificate of the APP, where the signature data is obtained by encrypting the first random number by the terminal device using the private key corresponding to the service certificate;

The processor is configured to determine, according to the certificate chain and the signature data, whether the service certificate is the service certificate of the APP to be identified; if the service certificate is the service certificate of the APP to be identified, then The package name and the fingerprint of the first signature certificate are used to determine whether the APP to be identified is a counterfeit APP.

In a feasible implementation manner, the processor is configured to determine whether the certificate in the certificate chain is legal, and if the certificate in the certificate chain is legal, then according to the public key carried by the service certificate in the certificate chain , Decrypt the signature data to obtain a second random number; determine whether the first random number is the same as the second random number, and if the first random number is the same as the second random number, determine the The service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not the same, it is determined that the service certificate is not the service certificate of the APP to be identified.

In a feasible implementation manner, the certificate in the certificate chain further includes the root certificate of the terminal device and the device certification authority CA certificate, and the processor is used to determine a set of pre-deployed trusted root certificates, Whether there is a root certificate in the certificate chain, if the root certificate in the certificate chain exists in the root certificate set, use the public key carried by the root certificate to decrypt the device CA contained in the certificate chain Certificate, obtain a first hash value, and perform a hash operation on the device CA certificate according to the hash algorithm carried in the device CA certificate to obtain a second hash value, if the first hash value and the If the second hash value is the same, it is determined that the device CA certificate is a legal certificate, and the service certificate is decrypted according to the public key carried in the device CA certificate to obtain the third hash value, and the third hash value is obtained according to the public key carried in the service certificate. A hash algorithm is to perform a hash operation on the business certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, it is determined that the business certificate is a legal certificate.

In a feasible implementation manner, the certificate in the certificate chain also includes the device authorization CA certificate of the terminal device, and the processor is configured to determine whether the pre-deployed set of trusted CA certificates exists. The device CA certificate in the certificate chain, if the device CA certificate in the certificate chain exists in the CA certificate set, the public key carried in the trusted device CA certificate is used to decrypt the service certificate to obtain the third hash value , Performing a hash operation on the service certificate according to the hash algorithm carried in the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determining all The business certificate mentioned is a legal certificate.

In a possible implementation manner, the processor is configured to, if the service certificate is the service certificate of the APP to be identified, determine the APP to be identified according to the package name and the fingerprint of the first signature certificate Whether it is a counterfeit APP, including: if the service certificate is the service certificate of the APP to be identified, determining the second signature certificate fingerprint according to the package name, and storing the package name and the second signature certificate fingerprint Correspondence, determine whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are the same, and if the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, determine that the APP to be identified is a counterfeit APP.

In a feasible implementation manner, the server is a business server or a device CA server.

In a fourth aspect, an embodiment of the present application provides a terminal device, including:

A sender, used to send a request message for establishing a link between the application APP to be identified and the server to the server;

A receiver, configured to receive a verification message sent by the server for verifying the APP to be identified, where the verification message includes a first random number;

The transmitter is further configured to send a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number with a private key corresponding to the first APP;

The receiver is further configured to receive the result of the server verifying whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data.

In a feasible implementation manner, the certificate chain includes a service certificate of the APP to be identified, and the service certificate carries the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified, and the receiving A device for receiving the counterfeit recognition result obtained by matching the second visa certificate fingerprint corresponding to the APP package name registration with the first signature certificate fingerprint by the server; if the matching is successful, the counterfeiting result It is indicated that the APP is not a counterfeit APP, or if the matching fails, the counterfeit recognition result indicates that the APP is a counterfeit APP.

In a feasible implementation manner, the terminal device further includes: a processor, configured to use the device CA certificate to sign the APP to be identified before the sender sends the certificate chain and the signature data to the server A service certificate, where the content of the service certificate includes the package name of the APP to be identified and the first signature certificate fingerprint of the APP to be identified.

In a feasible implementation manner, the service certificate is generated and managed for the certificate management service of the terminal device, and the certificate management service is located in the framework layer of the system of the terminal device.

In a feasible implementation manner, the service certificate further includes a public key of the APP to be identified, and the public key corresponds to a private key that encrypts the first random number.

In a feasible implementation manner, the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the terminal device further includes a processor;

The transmitter is configured to send a service certificate application request message to a trusted application TA running on the TEE operating system through the client application CA running on the REE operating system;

The processor is configured to control the TA to use the device CA certificate to issue the service certificate for the APP to be identified.

In a fifth aspect, the embodiments of the present application provide a computer program product containing instructions, which when run on a processor, enable the processor computer to execute the method in the first aspect or various possible implementations of the first aspect .

In a sixth aspect, embodiments of the present application provide a computer program product containing instructions, which when run on a processor, enable the processor to execute the foregoing second aspect or the methods in various possible implementation manners of the second aspect.

In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when the computer-readable storage medium runs on a processor, the processor executes the first aspect or the first aspect. Of the various possible implementation methods.

In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, which when run on a processor, causes the processor to execute the second aspect or the second aspect described above Of the various possible implementation methods.

In a ninth aspect, an embodiment of the present application provides a chip. The chip system includes a processor and may also include a memory, which is used to implement the foregoing first aspect or the methods in various possible implementation manners of the first aspect.

In a tenth aspect, an embodiment of the present application provides a chip. The chip system includes a processor and may also include a memory, which is used to implement the foregoing second aspect or the methods in various possible implementation manners of the second aspect.

In the eleventh aspect, an embodiment of the present application also provides a counterfeit APP identification system, including a server implemented in any possible manner such as the third aspect or the third aspect, and any of the fourth aspect or the fourth aspect Possible ways to implement terminal equipment.

The counterfeit APP identification method, server, and terminal device provided by the embodiments of this application. After the APP to be identified on the terminal device is started, the certificate chain and signature data are sent to the service server before the service interaction with the service server, and the service server checks the certificate chain After each certificate in the certificate is legal, and the service certificate is the service certificate of the APP to be identified, compare the signature certificate fingerprint corresponding to the package name in the service certificate and the pre-stored signature certificate fingerprint corresponding to the package name to identify the Identify whether the APP is a counterfeit APP, prevent the service server from providing services for the counterfeit APP, and improve business security. In addition, if the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.

Description of the drawings

FIG. 1A is a schematic diagram of a network architecture applicable to a counterfeit APP identification method provided by an embodiment of the application;

FIG. 1B is a schematic diagram of a network architecture applicable to another counterfeit APP identification method provided by an embodiment of the application;

FIG. 2 is a flowchart of a method for identifying a counterfeit APP according to an embodiment of the present application;

FIG. 3 is a schematic diagram of a structure applicable to a counterfeit APP identification method provided by an embodiment of the application;

Figure 4 is a flowchart of another counterfeit APP identification method provided by an embodiment of the present application;

FIG. 5 is a flow chart of certificate issuance used by the counterfeit APP identification method provided by the embodiment of the application;

FIG. 6 is a schematic diagram of a passing scenario of counterfeit detection in a counterfeit APP identification method provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a server provided by an embodiment of the application;

FIG. 8 is a schematic structural diagram of a terminal device provided by an embodiment of this application;

FIG. 9 is a schematic structural diagram of another server provided by an embodiment of the application;

FIG. 10 is a schematic structural diagram of another terminal device provided by an embodiment of this application;

FIG. 11 is a schematic structural diagram of an APP identification system according to an embodiment of the application.

detailed description

In the current process of identifying counterfeit APPs, the APP is identified by extracting the feature vector of the APK file of the APP or adding monitoring features to the APK file. This identification method is suitable for the application market to detect the counterfeit APP. However, some business servers only provide services for specific apps. Taking the APP specifically for Huawei APP, such as Huawei share as an example, a function of Huawei share is to share photos. When traveling, users can share photos with relatives and friends through Huawei share. When sharing photos, the user’s terminal device needs to connect to the service server through Huawei share, and share the photos to relatives and friends through the service server. The service server refers to the server used to provide services for Huawei share. During the sharing process, because the service server cannot determine whether the Huawei share on the terminal device is counterfeit, the counterfeit APP illegally uses the service server, that is, the service server is easily attacked by the counterfeit APP.

In view of this, the embodiment of the present application provides a counterfeit APP identification method. After the user downloads the APP on the terminal device (hereinafter referred to as the APP to be identified), when the APP interacts with the service server, the service server performs the application Counterfeit identification, to prevent business servers from providing services for counterfeit apps, and improve security.

In the embodiments of the present application, the terminal device is a device that can provide users with voice and/or data connectivity, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. The terminal device can communicate with one or more core networks via the radio access network (RAN). The terminal device can be a mobile terminal device, such as a mobile phone (or “cellular” phone) and a mobile terminal device. The computer, for example, may be a portable, pocket-sized, handheld, built-in computer or vehicle-mounted mobile device, which exchanges language and/or data with the wireless access network. For example, personal communication service (PCS) phone, cordless phone, session initiation protocol (SIP) phone, wireless local loop (WLL) station, personal digital assistant (personal digital assistant, PDA), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminals in the future 5G network or future evolution of public land mobile communication networks (public land mobile network , The terminal equipment in the PLMN), which is not limited in the embodiment of the present application. Terminal equipment can also be called system, subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, Remote terminal equipment (remote terminal), access terminal equipment (access terminal), user terminal equipment (user terminal), user agent (user agent), user equipment (user device), or user equipment (user equipment).

The server refers to a business server or a device CA server. The business server refers to an APP used to provide services for one or some genuine apps. The device CA server is a server that has a trusted certificate list deployed. When only the business server is deployed in the network architecture, a list of trusted certificates is deployed on the business server, the genuine APP is registered on the business server, and the business server is responsible for verifying the validity of the certificate chain, determining whether the business certificate is the business certificate of the APP, and Counterfeit APP recognition. When the business server and the device CA server are deployed in the network architecture at the same time, the genuine APP can be registered on the business server, the trusted certificate list is deployed on the business server, and the latest trusted certificate list is periodically obtained from the device CA server, which is the responsibility of the business server Certificate chain legitimacy verification, judgment of whether the business certificate is an APP business certificate, and counterfeit APP identification; or, a genuine APP can be registered on the business server, but the trusted certificate list is not deployed on the business server, and the device CA server is responsible for the certificate chain The business server is responsible for the counterfeit identification of the legality inspection and whether the business certificate is the business certificate of the APP; or, the genuine APP is registered on the device CA server, and the device CA server is responsible for the legality inspection of the certificate chain and whether the business certificate is the APP The service certificate judgment and counterfeit APP identification, and the service server only plays a role of transparent transmission and forwarding. For example, please refer to Figure 1A and Figure 1B.

FIG. 1A is a schematic diagram of a network architecture applicable to a counterfeit APP identification method provided by an embodiment of the application. Please refer to Figure 1A. This scenario includes a terminal device and a business server. A network connection is established between the terminal device and the business server. The business server is a server for one or some genuine APPs. When the genuine APP is released, the R&D personnel need to Register the genuine APP on the business server and save the correspondence between the signature certificate fingerprint of the genuine APP and the package name; at the same time, the business server stores the set of trusted certificates required to verify the validity of the certificate chain, such as the trusted root A collection of certificates or a collection of trusted device certification authority (CA) certificates. If the genuine APP is downloaded and installed on the terminal device, the terminal device can use the APP to use the functions provided by the service server. For the user, he does not know whether the APP downloaded and installed on the terminal device is a counterfeit APP. Therefore, in this embodiment, the APP is downloaded and installed on the terminal device, and the APP is started. The business server performs counterfeit identification on the APP to be identified according to the certificate chain, the business certificate of the APP to be identified, etc., where the business certificate of the APP to be identified carries the package name and signature certificate fingerprint of the APP to be identified. For example, if the app to be identified is a Huawei share, the user does not know that the Huawei share is a genuine Huawei share or a counterfeit Huawei share. Therefore, after the user activates the Huawei share, the service server will identify the app to be identified. If it is identified as genuine Huawei share, the app to be identified uses the functions provided by the service server, such as remotely sharing photos, files and other data with other users. If the service server identifies it as a counterfeit app, it will refuse the app to be identified to use the functions provided by the service server.

Generally, in the scenario shown in Figure 1A, the terminal device, the service server, and the genuine APP are from the same manufacturer. However, the embodiments of the present application are not limited. For example, the terminal device and the service server are from the same manufacturer, and the genuine APP is developed by a third party, and the service server provides an interface for the genuine APP developed by the third party to access.

FIG. 1B is a schematic diagram of a network architecture applicable to another counterfeit APP identification method provided by an embodiment of the application. 1B, this scenario includes a terminal device, a business server, and an authentication and authorization server. A network connection is established between the terminal device and the business server, and a network connection is established between the business server and the authentication and authorization server. The business server is a server for one or some genuine APPs. When the genuine APP is released, the R&D staff stores the correspondence between the signature certificate fingerprint of the genuine APP and the package name on the authentication authorization server. In addition, the certification authority server stores a set of trusted certificates required to verify the validity of the certificate chain, such as a trusted root certificate set or a trusted device certification authority (CA) certificate set. When the APP to be recognized is downloaded and installed on the terminal device, the APP to be recognized is started, and the certificate chain, etc. is sent to the service server. The service server sends the received certificate chain, etc. to the authentication and authorization server, and the authentication and authorization server performs the verification on the APP. Counterfeit identification. Alternatively, the device CA server can only store a set of trusted certificates. The developer stores the signature certificate fingerprint, package name, and the correspondence between the signature certificate fingerprint and package name of the genuine APP on the business server, and the business server receives the certificate chain and After the data is signed, the certificate chain and signature data are sent to the device CA server. The device CA server verifies the validity of the certificate chain and whether the business certificate in the certificate chain is an APP certificate. Only the certificates in the certificate chain are legal. And only when the service certificate is the service certificate of the APP, the service server performs counterfeit identification of the APP according to the package name in the service certificate and the fingerprint of the first signature certificate.

It should be noted that in the embodiments of this application, counterfeit APPs are not limited to APPs implanted with malicious code or advertising information and illegal APPs developed by criminals. The counterfeit APP in the embodiment of this application is relative. For example, the service server only provides services for APP1, and the legitimate APP downloaded and installed on the terminal device includes APP1, APP2, and APP3. Since APP2 and APP3 are not the APPs corresponding to the service server, For the business server, the APP2 and APP3 are also counterfeit APPs.

In the scenario shown in Figure 1B, the terminal device, the service server, and the genuine APP can be from the same manufacturer or different manufacturers.

In this embodiment of the application, the terminal device injects a trusted root, such as a root certificate and/or a device CA certificate, when the terminal device is generated, where the device CA certificate is issued by the root certificate. After the terminal device leaves the factory, the terminal device can use the device CA certificate to issue a service certificate for the app to be identified. The certificates described in the embodiments of this application, such as root certificates, device CA certificates, service certificates, etc., each certificate has a key pair, the key pair includes a public key and a private key, the public key is carried in the certificate, The private key is stored in the secure storage partition of the terminal device.

In the following, taking the architecture shown in FIG. 1A as an example, the counterfeit APP identification method described in the embodiment of the present application will be described in detail. Exemplarily, refer to Figure 2. Figure 2 is a flowchart of a method for identifying counterfeit APPs provided in an embodiment of the present application. This embodiment compares the counterfeit APP described in this application from the perspective of the interaction between the service server and the terminal device. The identification method is explained. This embodiment includes:

101. The terminal sends a request message for establishing a link between the application APP to be identified and the server to the server.

Exemplarily, the terminal device downloads and installs the APP, starts the APP, which is referred to as the APP to be identified below, and the terminal device sends a link establishment request to the service server for the APP.

102. The server sends the first random number to the terminal device.

Exemplarily, in FIG. 1A, the service server is a server for a certain genuine APP, and the user expects that the service server can only provide services for the genuine APP, and does not want to be provided by other apps. When a genuine APP is released, the R&D personnel register the genuine APP on the service server and save the corresponding relationship between the signature certificate fingerprint of the genuine APP and the package name; at the same time, the service server stores the certificates required for the legality check of the certificate chain. A set of trusted certificates, such as a trusted root certificate set or a trusted device certification authority (CA) certificate set. After receiving the request message, the service server initiates an identity challenge to the terminal device and issues a first random number, which may also be referred to as a challenge; accordingly, the terminal device receives the first random number.

It should be noted that if the device CA server is deployed, in step 101 and step 102, the terminal device sends a link establishment request to the service server, and the service server sends the link establishment request to the device CA server, triggering the device CA server to send the first random number.

103. The terminal device uses the private key corresponding to the service certificate of the APP to be identified to encrypt the first random number to obtain signature data.

In this step, the terminal device uses the private key corresponding to the service certificate of the APP to be identified to encrypt the first random number. For example, the terminal device uses secure hash algorithm 256 (SHA256) and secure hash algorithm 384 (secure hash algorithm 384, SHA384) or secure hash algorithm 512 (secure hash algorithm 512, SHA512) etc. encrypt the first random number to obtain signature data.

104. The terminal device sends the signature data and certificate chain to the server.

Wherein, the certificate chain carries the service certificate of the APP to be identified, and the service certificate carries the package name of the APP to be identified and the first signature certificate fingerprint of the APP to be identified.

In this step, the terminal device sends the signature data and the certificate chain to the server; correspondingly, the server receives the signature data and the certificate chain.

105. The server judges whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data.

Taking the server as the business server in Figure 1A as an example, this step includes two stages: In the first stage, the business server verifies the certificates in the certificate chain according to the pre-stored trusted certificates, and judges each certificate in the certificate chain. Whether it is legal; if the business server determines that each certificate in the certificate chain is legal, it enters the second stage: the business server uses the public key carried by the business certificate in the certificate chain to decrypt the signature data to determine whether the business certificate is for the app to be identified Service certificate. If the service certificate is the service certificate of the APP to be identified, step 106 is executed; if the service certificate is not the service certificate of the APP to be identified, step 108 is executed.

Exemplarily, in the first stage, taking the trusted certificate level as the root certificate as an example, the certificate chain includes the root certificate, the device CA certificate and the business certificate. Since the certificate is issued at the first level, for example, the device CA certificate of the terminal device is issued using the root certificate of the terminal device, and the service certificate of the APP to be identified is issued by the terminal device using the device CA certificate. Therefore, the service server determines the certificate chain When each certificate in is valid, first determine whether the root certificate is valid, then determine whether the device certificate is valid, and finally determine whether the business certificate is valid. During the verification of the validity of the certificate chain, the business server determines whether there is a root certificate in the certificate chain in the trusted root certificate set stored locally. If the root certificate in the certificate chain is included in the trusted root certificate set, the business server The root certificate is considered to be credible. On the contrary, the business server considers the root certificate in the certificate chain to be untrusted; after that, the business server uses the public key of the root certificate to decrypt the device CA certificate to obtain a hash value and use the device CA certificate The carried hash algorithm performs a hash operation on the content of the device CA certificate to obtain another hash value. If the two hash values are the same, the business server considers the device CA certificate to be legal, otherwise, the business server considers the device CA certificate Illegal; later, the service server uses the public key of the device CA certificate to decrypt the service certificate to obtain a hash value, and uses the hash algorithm carried in the service certificate to hash the content of the service certificate to obtain another hash value If the two hash values are the same, the business server considers the business certificate legal; anyway, the business server considers the business certificate illegal.

In the second stage, when the service server judges whether the service certificate is the service certificate of the APP to be identified, it uses the public key of the service certificate to decrypt the signature data to obtain a random number, which is called the second random number below. Then, the service server compares Whether the first random number and the second random number are the same, if the first random number is the same as the second random number, the service server determines that the service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not If the same, the service server determines that the service certificate is not the service certificate of the APP to be recognized.

106. The service server determines whether the APP to be identified is a counterfeit APP to be identified according to the package name and the fingerprint of the first signature certificate.

According to the above step 102, it can be known that a genuine APP needs to be registered with the service server before being released, so that the correspondence between the package name of the genuine APP and the fingerprint of the signature certificate is stored on the service server. Therefore, in this step, the service server compares the first signature certificate fingerprint corresponding to the package name in the certificate chain with the second signature certificate fingerprint stored when the genuine APP corresponding to the package name is registered on the server to determine the APP to be identified Whether it is a counterfeit APP, if the APP to be identified is not a counterfeit APP, step 107 is executed; if the APP to be identified is a counterfeit APP, step 108 is executed.

107. The service server sends the recognition result to the terminal device, and the recognition result is used to indicate that the APP to be recognized is a genuine APP, and performs business interaction with the terminal device.

108. The service server recognizes the result to the terminal device, and the recognition result is used to indicate that the APP to be recognized is a counterfeit APP and refuses to conduct business interaction with the terminal device for the APP.

It should be noted that in the embodiments of the present application, the counterfeit APP is relative to the service server, and the counterfeit APP includes the counterfeit APP in the conventional sense and some genuine APPs. For example, there are three apps: APP1, APP2, and APP3. Among them, APP1 and APP2 are counterfeit apps in the normal sense. Counterfeit apps in the normal sense refer to all apps except genuine apps, including counterfeit apps that can be detected by the servers of third-party app stores. The server of the third-party application product failed to detect, but it is actually a counterfeit APP; APP3 is a genuine APP, but it is not registered on the service server. Therefore, for the service server, APP3 is also a counterfeit APP.

In the counterfeit APP identification method provided by the embodiment of this application, after the APP to be identified on the terminal device is started, the certificate chain and signature data are sent to the business server before the business interaction with the business server, and the business server verifies that each certificate in the certificate chain is legal , And after the service certificate is the service certificate of the APP to be identified, compare the signature certificate fingerprint corresponding to the package name in the service certificate and the pre-stored signature certificate fingerprint corresponding to the package name to identify whether the APP to be identified is counterfeit APP, to prevent business servers from providing services for counterfeit APPs, and improve business security. In addition, if the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.

In the embodiments of this application, the terminal device may be a terminal device of any operating system, such as a terminal device of an Apple operating system, a terminal device of an Android operating system, and so on. After an APP to be recognized is installed on a terminal device of any operating system, the terminal The device uses the device CA certificate stored on the terminal device to issue a service certificate for the APP to be identified. In the following, taking a terminal device with an Android operating system as an example, the above-mentioned counterfeit APP identification method will be described in detail.

FIG. 3 is a schematic diagram of a structure applicable to a counterfeit APP identification method provided by an embodiment of the application. 3, in this embodiment, the terminal device is called the end side, the service server and the device CA server are deployed on the cloud side, and the operating system of the terminal device includes a trusted execution environment (trusted execution environment, TEE) rich execution environment ( rich execution environment, REE), TEE is responsible for handling matters that require high security protection, such as secret key storage, encryption and decryption, fingerprint recognition, etc. REE is a common operating system, such as Android Android system, iOS Apple system, etc., exists in REE A client application (CA) that provides certificate services for the APP, and a trusted application (TA) corresponding to the CA exists in the TEE. Among them, APP includes but is not limited to APP to be identified. In the embodiments of the present application, REE and TEE respectively include an application layer, a framework layer, a kernel layer, and a hardware layer from top to bottom. The REE of the terminal device can provide a certificate management service, which is located in the REE framework (Android framework) layer, and is used to provide key and certificate management related functions for the APP to be identified. In order to meet the business needs of protecting keys based on TEE hardware and realize key attestation, the certificate management service can at least realize the following three functions: 1) Before the terminal device leaves the factory, use the certificate management service to transfer the production line certificate , That is, the root certificate and the device CA certificate are injected into the terminal device; 2) Support the generation of service certificates, that is, the terminal device uses the device CA certificate to issue service certificates for the APP to be identified; 3) Supports trusted authentication based on the service key, that is, the service server initiates When the identity is challenged, the terminal device uses the certificate management service to encrypt the first random number sent by the service server with the private key corresponding to the service certificate to obtain the signature data.

For the above function 1), in the process of manufacturing terminal equipment, the manufacturer presets and saves the root certificate and device CA certificate in the secure storage partition of the terminal equipment, such as replay protect memory block (RPMB), RPMB The data in the PRMB cannot be modified. Even if the user restores the factory settings to the terminal device, the data in the PRMB cannot be deleted.

For the above function 2), after the app to be identified is downloaded and installed on the terminal device, when the user clicks to start the app to be identified, the app to be identified applies to the CA for a business certificate, and the CA obtains the package name and the waiting list of the app to be identified through the Android system. Identify the fingerprint of the first signature certificate of the APP, and then send a certificate application request to the TA to apply for a service certificate for the APP to be identified. After receiving the application request, the TA uses the device CA certificate to issue a service certificate for the APP to be identified, and records the package name of the APP to be identified and the fingerprint of the first signature certificate in the service certificate. After the service certificate is generated, it is kept in the secure storage partition of the terminal device, such as in a secure file system (SFS). The data in the SFS can be deleted when the app to be identified is uninstalled or the terminal device is restored to its factory settings.

For the above function 3), after the APP to be identified is started, the terminal device initiates an establishment request for the APP to be identified to the service server, and the service server initiates an identity authentication challenge, so that the service server performs counterfeit identification of the APP to be identified. For example, refer to Fig. 4, which is a flowchart of another counterfeit APP identification method provided in an embodiment of the present application. Referring to Figure 4, in this embodiment, the APP to be identified and the certificate management service are both loaded on the terminal device, and the trusted root certificate set is deployed on the business server. The business server regularly obtains the certificate revocation list from the device CA server. The letter certificate is updated, this embodiment includes:

201. The service server obtains the root certificate of the terminal device.

In this step, the business server obtains the root certificate of the terminal device offline, or the business server interacts with the device CA server to obtain the root certificate of the terminal device.

202. The service server sends a certificate revocation list request to the device CA server.

203. The device CA server sends a response message to the service server, where the response message carries the certificate revocation list.

In the foregoing steps 202 and 203, the service server periodically sends a certificate revocation list request to the device CA server to request the latest certificate revocation list (Certificate Revocation List, CRL) to update the locally deployed trusted certificate.

204. The terminal device sends a link establishment request to the service server for the APP to be identified.

In this step, when the APP to be identified is started, the terminal device initiates a link establishment request to the service server for the APP to be identified.

205. The service server initiates identity authentication to the terminal device, and the identity authentication carries the first random number.

In this step, the service server sends identity authentication to the terminal device for the APP to be identified.

206. The terminal device sends a certificate application request to the TA through the CA to apply for a service certificate for the APP to be identified.

207. The terminal device uses the device CA certificate to issue a service certificate for the APP to be identified.

In this embodiment of the application, the device CA certificate is issued by the root certificate, and the service certificate is issued by the device CA certificate. Exemplarily, refer to FIG. 5, which is a flow chart of certificate issuance used in the counterfeit APP identification method provided by the embodiment of the present application.

Please refer to Figure 5. In this embodiment, the root certificate and the device CA certificate are also called the terminal device production line preset certificates. These two certificates are injected into the terminal device before the terminal device leaves the factory, and will not be restored because the terminal device Value or uninstall the app to be recognized and delete it. After the terminal device leaves the factory, the user loads the APP to be identified on the terminal device. When the APP to be identified is started, the terminal device uses the device CA certificate to issue a service certificate for the APP to be identified. The following table lists the details of the business certificate.

It should be noted that the above table is only an example, and the content of the business certificate in the embodiment of the application is not limited to this.

208. The terminal device uses the private key corresponding to the service certificate to encrypt the first random number to obtain signature data.

209. The terminal device sends the signature data and certificate chain to the CA through the TA.

210. The terminal device sends the signature data and the certificate chain to the service server.

Among them, the certificate chain includes root certificates, device CA certificates, and business certificates.

211. The service server judges whether the certificates in the certificate chain are legal. If all the certificates in the certificate chain are legal, perform step 212; if a certain level of certificate in the certificate chain is illegal, perform step 215.

Because the certificate is issued at the first level, the service server sequentially determines whether the root certificate, the device CA certificate, and the service certificate are legal during the certificate chain verification process.

First, the business server determines whether there is a root certificate in the certificate chain in the pre-deployed set of trusted root certificates. If there is a root certificate in the certificate chain in the pre-deployed set of trusted root certificates, it indicates that there is a root certificate in the certificate chain. The root certificate of is the trusted root certificate of the business server and is a legal certificate. If the root certificate in the certificate chain does not exist in the pre-deployed trusted root certificate set, it means that the root certificate in the certificate chain is not a trusted root certificate for the business server, but an illegal certificate.

Secondly, if the root certificate in the certificate chain exists in the root certificate set, the service server uses the public key of the root certificate to decrypt the device CA certificate contained in the certificate chain to obtain the first hash value, and then according to the device CA certificate The carried hash algorithm performs a hash operation on the device CA certificate to obtain the second hash value. The service server judges whether the first hash value and the second hash value are the same. If the first hash value and the second hash value are the same, it means that the device CA certificate is a legal device CA certificate. If the second hash value is not the same, it indicates that the device CA certificate is an illegal device CA certificate.

Finally, if the device CA certificate is a legal device CA certificate, the service server decrypts the service certificate according to the public key carried by the device CA certificate to obtain the third hash value, and then, according to the hash algorithm carried by the service certificate, The business certificate performs a hash operation to obtain the fourth hash value. The business server judges whether the third hash value and the fourth hash value are the same. If the third hash value and the fourth hash value are the same, the business certificate is valid. If the third hash value and the fourth hash value are not The same means that the business certificate is illegal.

It should be noted that the above-mentioned hash operation on the certificate refers to the hash operation on one or more attribute information in the certificate.

212. The service server judges whether the service certificate is the service certificate of the APP to be recognized. If the service certificate is the service certificate of the APP to be recognized, step 213 is executed; if the service certificate is not the service certificate of the APP to be recognized, step 215 is executed.

If the certificate chain is valid, in this step, the service server decrypts the signature data according to the public key carried in the service certificate in the certificate chain to obtain the second random number. Then, the service server determines the second random number and the value sent in step 205 Whether the first random number is the same, if the first random number and the second random number are the same, the service server determines that the service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not the same, the service server Make sure that the service certificate is not the service certificate of the APP to be identified.

213. The service server determines whether the APP to be identified is a counterfeit APP according to the package name and the fingerprint of the first signature certificate. If the APP to be identified is not a counterfeit APP, execute step 214; if the APP to be identified is a counterfeit APP, execute step 215.

In the embodiment of this application, each APP has a package name and a signature certificate fingerprint. Take the Android APP as an example. After the R&D staff develops the APP, they will sign the apk file when packaging and generating the Android package (APK). The signature mechanism is used to ensure the legality of the apk file and the uniqueness of the app. For later app upgrades, etc. When the APP is released, the R&D personnel register on the service server, and store the correspondence between the package name and the fingerprint of the signature certificate on the service server.

If in step 209, the service server determines that the service certificate is a service certificate issued by the terminal device for the APP to be recognized, then in this step, the service server determines the second signature certificate fingerprint according to the package name of the APP to be recognized, and judges the first Whether the fingerprint of the signature certificate and the fingerprint of the second signature certificate are the same; if the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, the service server determines that the APP to be identified is a counterfeit APP; if the fingerprint of the first signature certificate and the second signature If the certificate fingerprints are the same, the service server determines that the APP to be identified is a genuine APP.

214. The service server sends a recognition result to the terminal device, where the recognition result is used to indicate that the APP to be recognized is a genuine APP, and performs business interaction with the terminal device for the APP to be recognized.

215. The service server sends a recognition result to the terminal device, where the recognition result is used to indicate that the APP to be recognized is a counterfeit APP, and refuses to conduct business interaction with the terminal device for the APP to be recognized.

It should be noted that, in the above embodiment in FIG. 4, a set of trusted root certificates is deployed on the business server, and the certificates in the certificate chain include root certificates, device CA certificates, and business certificates as examples to describe the counterfeit APP identification method in detail. As explained, however, the embodiments of this application are not limited. In other feasible implementation manners, the device CA certificate may also be deployed on the service server. In this case, the certificates in the certificate chain only include the device CA certificate and the service certificate.

In the following, taking the business server to provide users with data forwarding services and the genuine APP corresponding to the business server to share data with other users through the business server as an example, the above counterfeit APP identification method will be described in detail. For example, see Figure 6.

Fig. 6 is a schematic diagram of a passing scenario of counterfeit detection in a counterfeit APP identification method provided by an embodiment of the present application. This embodiment includes:

301. Register a genuine APP on the business server.

In this step, when the genuine APP is released, the R&D personnel register the genuine APP on the business server, and the business server stores the package name of the genuine APP, the fingerprint of the signature certificate, and the correspondence between the package name and the fingerprint of the signature certificate. For example, the package name of a genuine APP is com.xxx.app1, and the fingerprint of the signature certificate is 111111. Among them, the package name is located in a file of the installation package, such as the androidManifest.xml file; the signature certificate fingerprint is stored in the signature certificate of the installation package. Although most APPs are installed on the terminal device, the installation package will be deleted, but before the APP is uninstalled, the terminal device can obtain the package name and signature certificate from the REE operating system.

302. Install the APP to be identified on the terminal device.

The package name of the APP to be identified is the same as the package name of the genuine APP, but the terminal device does not know whether the APP to be identified is a genuine APP or a counterfeit APP. When the APP to be identified is a genuine APP, the terminal device determines that the signature certificate fingerprint of the APP to be identified is 111111; when the APP to be identified is a counterfeit APP, the developer cannot obtain the signature certificate fingerprint of the genuine APP, therefore, the APP to be identified The signature certificate fingerprint of is different from the signature certificate fingerprint of the genuine APP, for example, 222222.

303. The terminal device uses the device CA certificate to issue a service certificate for the APP to be identified.

Among them, the service certificate includes the package name of the APP to be identified and the fingerprint of the first signature certificate.

304. The terminal device initiates a link establishment request to the service server for the APP to be identified.

305. The service server sends the first random number to the terminal device.

306. The terminal device sends the signature data and the certificate chain to the service server.

In this step, the terminal device uses the private key of the service certificate to encrypt the first random number, and after obtaining the signature data, sends the certificate chain and the signature data to the service server.

307. The service server verifies whether the certificate in the certificate chain is legal. If the certificate chain is legal, it determines whether the service certificate is the service certificate of the APP. If the service certificate is the service certificate of the APP to be identified, it judges whether the APP is a counterfeit APP.

In this step, the service server first verifies whether each certificate in the certificate chain is legal through the certificate chain, and whether the service certificate is the APP's own service certificate. If each service certificate in the certificate chain is legal and the service certificate is the APP's own service certificate, the service server obtains the package name of the app to be identified and the fingerprint of the first signature certificate from the service certificate, and determines the second signature certificate fingerprint based on the package name Finally, verify whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate stored in advance on the service server are the same. If they are the same, it is determined that the APP to be identified is a genuine APP; if they are not the same, the APP to be identified is considered to be a counterfeit APP. For example, if the second signature certificate fingerprint is 111111 in this step, and the first signature certificate fingerprint is the same as the first signature certificate fingerprint obtained by the terminal device from the installation package of the APP to be identified, the service server considers the APP to be identified as Genuine APP. For another example, if the fingerprint of the second signature certificate is 222222 in this step, and the fingerprint of the first signature certificate is different from the fingerprint of the first signature certificate obtained by the terminal device from the installation package of the APP to be identified, the service server considers the fingerprint to be identified APP is a counterfeit APP.

FIG. 7 is a schematic structural diagram of a server provided by an embodiment of the application. The server 100 may include:

The transmitter 11 is configured to send the first random number to the terminal device;

The receiver 12 is configured to receive a certificate chain and signature data sent by a terminal device. The certificate in the certificate chain includes the service certificate of the application to be identified, and the service certificate carries the package name of the APP to be identified and the Identifying the fingerprint of the first signature certificate of the APP, the signature data is obtained by encrypting the first random number by the terminal device using the private key corresponding to the service certificate;

The processor 13 is configured to determine, according to the certificate chain and the signature data, whether the service certificate is the service certificate of the APP to be identified; if the service certificate is the service certificate of the APP to be identified, then The package name and the fingerprint of the first signature certificate are used to determine whether the APP to be identified is a counterfeit APP.

In a feasible implementation manner, the processor 13 is configured to determine whether the certificate in the certificate chain is legal, and if the certificate in the certificate chain is legal, then according to the public certificate carried in the business certificate in the certificate chain. Key, decrypt the signature data to obtain a second random number; determine whether the first random number is the same as the second random number, and if the first random number is the same as the second random number, determine all The service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not the same, it is determined that the service certificate is not the service certificate of the APP to be identified.

In a feasible implementation manner, the certificate in the certificate chain further includes the root certificate of the terminal device and the device certification authority CA certificate, and the processor 13 is configured to determine the set of pre-deployed trusted root certificates , Whether there is a root certificate in the certificate chain, if there is a root certificate in the certificate chain in the root certificate set, use the public key carried by the root certificate to decrypt the device included in the certificate chain CA certificate to obtain a first hash value, and perform a hash operation on the device CA certificate according to the hash algorithm carried in the device CA certificate to obtain a second hash value, if the first hash value is If the second hash value is the same, it is determined that the device CA certificate is a legal certificate, and the service certificate is decrypted according to the public key carried in the device CA certificate to obtain the third hash value, which is carried according to the service certificate. The hash algorithm for performing a hash operation on the business certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, it is determined that the business certificate is a legal certificate.

In a feasible implementation manner, the certificate in the certificate chain also includes the device authorization CA certificate of the terminal device, and the processor 13 is configured to determine whether all of the pre-deployed trusted CA certificate sets exist. The device CA certificate in the certificate chain, if the device CA certificate in the certificate chain exists in the CA certificate set, use the public key carried in the trusted device CA certificate to decrypt the service certificate to obtain the third hash Value, perform a hash operation on the service certificate according to the hash algorithm carried in the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determine The business certificate is a legal certificate.

In a feasible implementation manner, the processor 13 is configured to, if the service certificate is the service certificate of the APP to be identified, judge the to-be-identified app according to the package name and the fingerprint of the first signature certificate Whether the APP is a counterfeit APP, including: if the service certificate is the service certificate of the APP to be identified, determining the second signature certificate fingerprint according to the package name, and storing the package name and the second signature certificate fingerprint To determine whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are the same. If the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, it is determined that the APP to be identified is Counterfeit APP.

For the implementation principles and technical effects of the server provided in the embodiment of the present application, reference may be made to the foregoing method embodiment, which will not be repeated here.

FIG. 8 is a schematic structural diagram of a terminal device provided by an embodiment of the application. The terminal device 200 may include:

The sender 21 is configured to send to the server a request message for establishing a link between the application APP to be identified and the server;

The receiver 22 is configured to receive a verification message sent by the server for verifying the APP to be identified, where the verification message includes a first random number;

The transmitter 21 is further configured to send a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number with the private key corresponding to the APP to be identified;

The receiver 22 is further configured to receive the result of the server verifying whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data.

In a feasible implementation manner, the certificate chain includes a service certificate of the APP to be identified, and the service certificate carries the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified, and the receiving The device 22 is configured to receive the counterfeit identification result obtained by the server matching the fingerprint of the second visa certificate corresponding to the package name registration of the APP with the fingerprint of the first signature certificate; if the matching is successful, the counterfeit The result indicates that the APP is not a counterfeit APP, or if the matching fails, the counterfeit recognition result indicates that the APP is a counterfeit APP.

8 again, in a possible implementation manner, the terminal device 100 further includes: a processor 23, configured to use the device CA certificate before the transmitter 21 sends the certificate chain and signature data to the server The service certificate is issued for the APP to be identified, and the content of the service certificate includes the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified.

In a feasible implementation manner, the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the transmitter 21 is used to pass a client running on the REE operating system The application CA sends a service certificate application request message to the trusted application TA running on the TEE operating system;

The processor 23 is configured to control the TA to use the device CA certificate to issue the service certificate for the APP to be identified.

Fig. 9 is a schematic structural diagram of another server provided by an embodiment of the application. The server 300 may include: a processor 31, a transceiver 32, and a memory 33; the transceiver 32 is used to send and receive data; the memory 33 is used to store instructions; the processor 31 is used to instruct The instructions in the memory 33 cause the server to execute the counterfeit APP identification method applied to the server as described above.

FIG. 10 is a schematic structural diagram of another terminal device provided by an embodiment of this application. The terminal device 400 may include: a processor 41, a transceiver 42, and a memory 43; the transceiver 42 is used to send and receive data; the memory 43 is used to store instructions; the processor 41 is used to instruct The instructions in the memory 43 cause the terminal device to execute the counterfeit APP identification method applied to the terminal device as described above.

FIG. 11 is a schematic structural diagram of an APP identification system according to an embodiment of the application. Referring to FIG. 9, the counterfeit APP identification system 1000 provided in this embodiment includes a server 100 as shown in FIG. 7 and at least one terminal device 200 as shown in FIG. 8.

In addition, on the basis of the above-mentioned counterfeit APP identification method, the embodiments of this application also provide:

A computer-readable storage medium with a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the counterfeit APP identification method applied to the server as above is executed.

A computer-readable storage medium in which a computer program is stored, and when the computer program is executed by a processor, the counterfeit APP identification method applied to a terminal device as described above is executed.

A chip with a computer program stored on the chip, and when the computer program is executed by a processor, the counterfeit APP identification method applied to the server as described above is executed.

A chip with a computer program stored on the chip, and when the computer program is executed by a processor, the counterfeit APP identification method applied to a terminal device as described above is executed.

In the above-mentioned embodiments provided in the present application, the method provided in the embodiments of the present application is mainly introduced from the perspective of interaction between the terminal device and the server. It can be understood that, in order for the terminal device and the server to implement each function in the method provided in the above embodiments of the present application, the terminal device and the server include hardware structures and/or software modules corresponding to each function. Those skilled in the art should easily realize that in combination with the algorithm steps of the examples described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

The embodiment of the present application may divide the terminal device and the server into functional modules according to the foregoing method examples. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.

The term "plurality" herein refers to two or more. The term "and/or" in this article is only an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone B these three situations. In addition, the character "/" in this article generally indicates that the associated objects before and after are in an "or" relationship; in the formula, the character "/" indicates that the associated objects before and after are in a "division" relationship.

It can be understood that the various numerical numbers involved in the embodiments of the present application are only for easy distinction for description, and are not used to limit the scope of the embodiments of the present application.

It can be understood that, in the embodiments of the present application, the size of the sequence numbers of the foregoing processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not be implemented in this application. The implementation process of the example constitutes any limitation.

It is understandable that, in the embodiment of the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory. (volatile memory), such as random-access memory (random-access memory, RAM). The memory is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory in the embodiments of the present application may also be a circuit or any other device capable of realizing a storage function, for storing program instructions and/or data.

Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be allocated as needed. It is completed by different functional modules, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

In the several embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be It can be combined or integrated into another device, or some features can be omitted or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate. The parts displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

The methods provided in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, a server, a terminal, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, SSD).

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any change or replacement within the technical scope disclosed in this application shall be covered by the protection scope of this application . Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

A method for identifying counterfeit APP, which is characterized in that it includes:

The server sends the first random number to the terminal device;

The server receives the certificate chain and signature data sent by the terminal device. The certificate in the certificate chain includes the service certificate of the application to be identified, and the service certificate carries the package name of the APP to be identified and the name of the APP to be identified. A fingerprint of the first signature certificate, where the signature data is obtained by encrypting the first random number by the terminal device using the private key corresponding to the service certificate;

The server determines whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data;

If the service certificate is the service certificate of the APP to be identified, the server determines whether the APP to be identified is a counterfeit APP according to the package name and the fingerprint of the first signature certificate.
The method according to claim 1, wherein the server judging whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data comprises:

The server judges whether the certificate in the certificate chain is legal;

If the certificate in the certificate chain is valid, the server decrypts the signature data according to the public key carried in the service certificate in the certificate chain to obtain a second random number;

The server judges whether the first random number is the same as the second random number;

If the first random number and the second random number are the same, the server determines that the service certificate is the service certificate of the APP to be identified;

If the first random number and the second random number are not the same, the server determines that the service certificate is not the service certificate of the APP to be identified.
The method according to claim 1 or 2, wherein the certificate in the certificate chain further includes the root certificate of the terminal device and the device certification authority CA certificate, and the server determines whether the certificate in the certificate chain is Legal, including:

The server determines whether there is a root certificate in the certificate chain in the set of pre-deployed trusted root certificates;

If the root certificate in the certificate chain exists in the root certificate set, the server uses the public key carried in the root certificate to decrypt the device CA certificate included in the certificate chain to obtain the first hash value ；

The server performs a hash operation on the device CA certificate according to the hash algorithm carried in the device CA certificate to obtain a second hash value;

If the first hash value and the second hash value are the same, the server determines that the device CA certificate is a valid certificate, and decrypts the service certificate according to the public key carried in the device CA certificate, Get the third hash value;

The server performs a hash operation on the service certificate according to the hash algorithm carried in the service certificate to obtain a fourth hash value;

If the third hash value and the fourth hash value are the same, the server determines that the service certificate is a legal certificate.
The method according to claim 1 or 2, wherein the certificate in the certificate chain further includes the device authorization CA certificate of the terminal device, and the server determines whether the certificate in the certificate chain is legal, including:

The server determines whether the device CA certificate in the certificate chain exists in the set of pre-deployed trusted CA certificates;

If the device CA certificate in the certificate chain exists in the CA certificate set, the server uses the public key carried in the trusted device CA certificate to decrypt the service certificate to obtain a third hash value;

The server performs a hash operation on the service certificate according to the hash algorithm carried in the service certificate to obtain a fourth hash value;

If the third hash value and the fourth hash value are the same, the server determines that the service certificate is a legal certificate.
The method according to any one of claims 1 to 4, wherein if the service certificate is the service certificate of the APP to be identified, the server uses the package name and the fingerprint of the first signature certificate, Determining whether the APP to be identified is a counterfeit APP includes:

If the service certificate is the service certificate of the APP to be identified, the server determines the second signature certificate fingerprint according to the package name, and the server stores the correspondence between the package name and the second signature certificate fingerprint relationship;

The server judges whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are the same;

If the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, the server determines that the APP to be identified is a counterfeit APP.
A method for identifying counterfeit apps, which is characterized in that the method includes:

The terminal device sends a request message for establishing a link between the application APP to be identified and the server to the server;

Receiving, by the terminal, a verification message sent by the server for verifying the APP to be identified, where the verification message includes a first random number;

Sending, by the terminal device, a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number with the private key corresponding to the APP to be identified;

The terminal receives the result of the server verifying whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data.
The method according to claim 6, wherein the certificate chain includes a service certificate of the APP to be recognized, and the service certificate carries the package name of the APP to be recognized and the first signature certificate of the APP to be recognized Fingerprint; the terminal receiving the result of the server verifying whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data includes:

The terminal device receives the counterfeit identification result obtained by matching the second visa certificate fingerprint corresponding to the package name registration of the APP by the server with the fingerprint of the first signature certificate; if the matching is successful, the counterfeiting result indicates The APP is not a counterfeit APP, or if the matching fails, the counterfeit recognition result indicates that the APP is a counterfeit APP.
The method according to claim 6 or 7, wherein before the terminal device sends the certificate chain and the signature data to the server, the method further comprises:

The terminal device uses the device CA certificate to issue the service certificate for the APP to be identified, and the content of the service certificate includes the package name of the APP to be identified and the first signature certificate fingerprint of the APP to be identified.
The method according to claim 8, wherein the business certificate is generated and managed for the certificate management service of the terminal device, and the certificate management service is located at the framework layer of the system of the terminal device.
The method according to claim 8 or 9, wherein the service certificate further includes a public key of the APP to be identified, and the public key corresponds to a private key that encrypts the first random number.
The method according to any one of claims 8 to 10, wherein the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the terminal device uses the device CA certificate as The issuance of the service certificate by the APP to be identified includes:

The terminal device sends a service certificate application request message to the trusted application TA running on the TEE operating system through the client application CA running on the REE operating system;

The terminal device controls the TA to use the device CA certificate to issue the service certificate for the APP to be identified.
A server, characterized by comprising: a processor, a transceiver and a memory;

The transceiver is used to send and receive data;

The memory is used to store instructions;

The processor is configured to instruct the instructions in the memory to enable the server to execute the method according to claims 1 to 5.
A terminal device, characterized by comprising: a processor, a transceiver and a memory;

The transceiver is used to send and receive data;

The memory is used to store instructions;

The processor is configured to instruct the instructions in the memory to enable the terminal device to execute the method according to claims 6-11.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program as described in any one of claims 1 to 5 is executed. Counterfeit APP identification method.
A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program described in any one of claims 6 to 11 is executed Counterfeit APP identification method.
A chip, characterized in that a computer program is stored on the chip, and when the computer program is executed by a processor, the counterfeit APP identification method according to any one of claims 1 to 5 is executed.
A chip, characterized in that a computer program is stored on the chip, and when the computer program is executed by a processor, the counterfeit APP identification method according to any one of claims 6 to 11 is executed.
A counterfeit APP identification system, characterized by comprising the server according to any one of claims 12 to 17, and at least one terminal device according to any one of claims 18 to 23.