WO2020177116A1 - Procédé et appareil d'identification d'application de contrefaçon - Google Patents

Procédé et appareil d'identification d'application de contrefaçon Download PDF

Info

Publication number
WO2020177116A1
WO2020177116A1 PCT/CN2019/077311 CN2019077311W WO2020177116A1 WO 2020177116 A1 WO2020177116 A1 WO 2020177116A1 CN 2019077311 W CN2019077311 W CN 2019077311W WO 2020177116 A1 WO2020177116 A1 WO 2020177116A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
app
service
server
identified
Prior art date
Application number
PCT/CN2019/077311
Other languages
English (en)
Chinese (zh)
Inventor
李多显
何钢杰
钟文国
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201980066172.XA priority Critical patent/CN112805702A/zh
Priority to PCT/CN2019/077311 priority patent/WO2020177116A1/fr
Publication of WO2020177116A1 publication Critical patent/WO2020177116A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • the embodiments of this application relate to the field of security technologies, and in particular to a method and device for identifying counterfeit APPs.
  • servers of third-party application stores such as servers corresponding to APP stores, identify counterfeit apps.
  • the server identifies the APP based on the Android package (APK) file of the APP, extracting the feature vector of the APK file or adding monitoring features to the APK file, etc.
  • APIK Android package
  • the above method of identifying counterfeit APPs is suitable for the identification of counterfeit APPs by third-party app stores.
  • the service server only provides services for specific apps and does not want to be accessed by other apps.
  • the server corresponding to Huawei share APP only provides services for Huawei share APP.
  • the server of the third-party application store recognizes that an APP is a legitimate APP, but the APP is illegal to the business server, the APP is downloaded to the terminal device and accesses the business server, causing security risks; or, if An APP is a counterfeit APP, but the server of a third-party application store does not recognize that the APP is a counterfeit APP, and the APP is downloaded to the terminal device and accessed to the service server, which also causes security risks.
  • the embodiments of this application provide a method and device for identifying counterfeit APPs. After a user downloads an APP on a terminal device and uses the APP to interact with a service server, the service server performs counterfeit recognition of the APP to prevent the service server from providing services for the counterfeit APP , To ensure the security of the business server.
  • an embodiment of the present application provides a method for identifying a counterfeit APP, which can be applied to a server or a chip of the server.
  • the method is described below by taking the application to the server as an example.
  • the method includes: the server sends a first random number to the terminal device; the server receives the certificate chain and signature data sent by the terminal device, and the certificate in the certificate chain includes the application APP to be identified
  • the service certificate carries the package name of the APP to be recognized and the fingerprint of the first signature certificate of the APP to be recognized.
  • the signature data is obtained by the terminal device using the private key corresponding to the service certificate to encrypt the first random number; the server uses the certificate chain and The signature data determines whether the service certificate is the service certificate of the APP to be identified; if the service certificate is the service certificate of the APP to be identified, the server determines whether the APP to be identified is a counterfeit APP based on the package name and the fingerprint of the first signature certificate.
  • the certificate chain and signature data are sent to the service server. The service server verifies that each certificate in the certificate chain is legal and the service certificate is pending.
  • the server judges whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data, including: the server uses the public key of the service certificate to decrypt the signature data to obtain a random number, which is called the first Two random numbers. Then, the server compares whether the first random number and the second random number are the same. If the first random number is the same as the second random number, the server determines that the service certificate is the service certificate of the APP to be identified; if the first random number is If the number is different from the second random number, the server determines that the service certificate is not the service certificate of the APP to be identified. Using this method, the server determines whether the service certificate is the service certificate of the APP.
  • the certificate in the certificate chain also includes the root certificate of the terminal device and the device certification authority CA certificate.
  • the trusted certificate level on the server is the root certificate.
  • the server judges whether the certificate in the certificate chain is legal, including: Determine whether the root certificate is legal, then determine whether the device certificate is legal, and finally determine whether the business certificate is legal. In the process of verifying the validity of the certificate chain, the server judges whether there is a root certificate in the certificate chain in the trusted root certificate set stored locally. If the root certificate in the certificate chain is included in the trusted root certificate set, the server considers the root The certificate is credible.
  • the server considers the root certificate in the certificate chain to be untrustworthy; after that, the server uses the public key of the root certificate to decrypt the device CA certificate to obtain a hash value and use the hash carried in the device CA certificate Algorithm, to perform a hash operation on the content of the device CA certificate to obtain another hash value. If the two hash values are the same, the server considers the device CA certificate legal, otherwise, the server considers the device CA certificate illegal; Use the public key of the device CA certificate to decrypt the service certificate to obtain a hash value. Use the hash algorithm carried in the service certificate to hash the content of the service certificate to obtain another hash value.
  • the server If the value is the same, the server considers the business certificate to be legal; anyway, the server considers the business certificate to be illegal. This solution is adopted to achieve the purpose of verifying the legality of the certificates in the certificate chain when the trusted certificate level on the service server is the root certificate.
  • the certificate in the certificate chain also includes the device authorized CA certificate of the terminal device, the trusted certificate level on the server is the device CA certificate, and the server determines whether the certificate in the certificate chain is legal, including: the server determines the pre-deployment In the trusted CA certificate set, whether there is a device CA certificate in the certificate chain; if there is a device CA certificate in the certificate chain in the CA certificate set, the server uses the public key of the device CA certificate to decrypt the business certificate, and obtain a ha Ultimately, use the hash algorithm carried in the business certificate to hash the content of the business certificate to obtain another hash value. If the two hash values are the same, the server considers the business certificate legal; anyway, the server considers the business The certificate is invalid.
  • This solution is adopted to achieve the purpose of verifying the legality of the certificates in the certificate chain when the trusted certificate level on the service server is the device CA certificate.
  • the server determines whether the app to be identified is a counterfeit app based on the package name and the fingerprint of the first signature certificate, including: if the service certificate is the service of the app to be identified Certificate, the server compares the first signature certificate fingerprint corresponding to the package name in the certificate chain with the second signature certificate fingerprint stored when the genuine APP corresponding to the package name is registered on the server; if the first signature certificate fingerprint is compared with the second signature certificate fingerprint If the fingerprints of the signature certificate are not the same, the server determines that the APP to be identified is a counterfeit APP. Using this scheme, the server realizes the purpose of counterfeiting the app to be identified based on the package name and the fingerprint of the signature certificate.
  • an embodiment of the present application provides a method for identifying a counterfeit application APP.
  • the method can be applied to a terminal device or a chip in the terminal device.
  • the method is described below by taking an application to a terminal device as an example.
  • the method includes: the terminal device sends to the server a request message for establishing a link between the APP to be identified and the server; the terminal receives a verification message sent by the server to verify the APP to be identified, and The verification message contains the first random number; the terminal device sends the certificate chain and signature data to the server, the signature data is obtained by encrypting the first random number with the private key corresponding to the APP to be identified; the terminal receiving server treats identification according to the certificate chain and the signature data APP verifies whether it is the result of counterfeiting APP.
  • the certificate chain and signature data are sent to the service server.
  • the service server verifies that each certificate in the certificate chain is legal and the service certificate is pending.
  • After identifying the APP’s own service certificate compare whether the signature certificate fingerprint corresponding to the package name in the service certificate is the same as the pre-stored signature certificate fingerprint corresponding to the package name, so as to identify whether the APP to be identified is a counterfeit APP and avoid the service server
  • Counterfeit APP provides services to improve business security.
  • the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.
  • the certificate chain contains the service certificate of the app to be identified, and the service certificate carries the package name of the app to be identified and the fingerprint of the first signature certificate of the app to be identified;
  • the terminal receiving server verifies the app to be identified according to the certificate chain and signature data Whether it is the result of a counterfeit APP, including the counterfeit identification result obtained by the terminal device receiving server matching the fingerprint of the second visa certificate corresponding to the package name registration of the APP with the fingerprint of the first signature certificate; if the matching is successful, the counterfeiting result indicates The APP is not a counterfeit APP, or if the matching fails, the counterfeit identification result indicates that the APP is a counterfeit APP.
  • this scheme it is possible to identify whether the APP to be identified is a counterfeit APP, to prevent the service server from providing services for the counterfeit APP, and to improve business security.
  • the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect legitimate users’ business
  • the terminal device before the terminal device sends the certificate chain and signature data to the server, it also includes: the terminal device uses the device CA certificate to issue a service certificate for the app to be identified, and the content of the service certificate includes the package name of the app to be identified and the app to be identified The fingerprint of the first signature certificate.
  • the terminal device uses the device CA certificate to issue a service certificate for the APP to be identified.
  • the business certificate is generated and managed for the certificate management service of the terminal device, and the certificate management service is located in the Framework layer of the system of the terminal device. Using this kind of scheme, realize the purpose of setting up certificate management service on terminal equipment.
  • the service certificate also includes the public key of the APP to be identified, and the public key corresponds to the private key that encrypts the first random number. This solution is adopted to realize the purpose of checking whether the service certificate is the service certificate of the APP to be identified.
  • the operating system of the terminal equipment includes the rich execution environment REE operating system and the trusted execution environment TEE operating system.
  • the terminal equipment uses the equipment CA certificate to issue service certificates for the APP to be identified, including: the terminal equipment runs on the REE
  • the client application CA on the operating system sends a service certificate application request message to the trusted application TA running on the TEE operating system; the terminal device controls the TA to use the device CA certificate to issue a service certificate for the APP to be identified.
  • the terminal device controls the TA to use the device CA certificate to issue a service certificate for the APP to be identified.
  • an embodiment of the present application provides a server, including:
  • the receiver is configured to receive a certificate chain and signature data sent by a terminal device.
  • the certificate in the certificate chain includes a service certificate of the application to be identified, and the service certificate carries the package name of the to-be-identified APP and the to-be-identified application.
  • the processor is configured to determine, according to the certificate chain and the signature data, whether the service certificate is the service certificate of the APP to be identified; if the service certificate is the service certificate of the APP to be identified, then The package name and the fingerprint of the first signature certificate are used to determine whether the APP to be identified is a counterfeit APP.
  • the processor is configured to determine whether the certificate in the certificate chain is legal, and if the certificate in the certificate chain is legal, then according to the public key carried by the service certificate in the certificate chain , Decrypt the signature data to obtain a second random number; determine whether the first random number is the same as the second random number, and if the first random number is the same as the second random number, determine the The service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not the same, it is determined that the service certificate is not the service certificate of the APP to be identified.
  • the certificate in the certificate chain further includes the root certificate of the terminal device and the device certification authority CA certificate
  • the processor is used to determine a set of pre-deployed trusted root certificates, Whether there is a root certificate in the certificate chain, if the root certificate in the certificate chain exists in the root certificate set, use the public key carried by the root certificate to decrypt the device CA contained in the certificate chain Certificate, obtain a first hash value, and perform a hash operation on the device CA certificate according to the hash algorithm carried in the device CA certificate to obtain a second hash value, if the first hash value and the If the second hash value is the same, it is determined that the device CA certificate is a legal certificate, and the service certificate is decrypted according to the public key carried in the device CA certificate to obtain the third hash value, and the third hash value is obtained according to the public key carried in the service certificate.
  • a hash algorithm is to perform a hash operation on the business certificate to obtain a fourth hash value, and if the third hash value
  • the certificate in the certificate chain also includes the device authorization CA certificate of the terminal device, and the processor is configured to determine whether the pre-deployed set of trusted CA certificates exists.
  • the device CA certificate in the certificate chain if the device CA certificate in the certificate chain exists in the CA certificate set, the public key carried in the trusted device CA certificate is used to decrypt the service certificate to obtain the third hash value , Performing a hash operation on the service certificate according to the hash algorithm carried in the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determining all
  • the business certificate mentioned is a legal certificate.
  • the processor is configured to, if the service certificate is the service certificate of the APP to be identified, determine the APP to be identified according to the package name and the fingerprint of the first signature certificate Whether it is a counterfeit APP, including: if the service certificate is the service certificate of the APP to be identified, determining the second signature certificate fingerprint according to the package name, and storing the package name and the second signature certificate fingerprint Correspondence, determine whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are the same, and if the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, determine that the APP to be identified is a counterfeit APP.
  • the server is a business server or a device CA server.
  • an embodiment of the present application provides a terminal device, including:
  • a sender used to send a request message for establishing a link between the application APP to be identified and the server to the server;
  • a receiver configured to receive a verification message sent by the server for verifying the APP to be identified, where the verification message includes a first random number
  • the transmitter is further configured to send a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number with a private key corresponding to the first APP;
  • the receiver is further configured to receive the result of the server verifying whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data.
  • the certificate chain includes a service certificate of the APP to be identified, and the service certificate carries the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified, and the receiving A device for receiving the counterfeit recognition result obtained by matching the second visa certificate fingerprint corresponding to the APP package name registration with the first signature certificate fingerprint by the server; if the matching is successful, the counterfeiting result It is indicated that the APP is not a counterfeit APP, or if the matching fails, the counterfeit recognition result indicates that the APP is a counterfeit APP.
  • the terminal device further includes: a processor, configured to use the device CA certificate to sign the APP to be identified before the sender sends the certificate chain and the signature data to the server A service certificate, where the content of the service certificate includes the package name of the APP to be identified and the first signature certificate fingerprint of the APP to be identified.
  • the service certificate is generated and managed for the certificate management service of the terminal device, and the certificate management service is located in the framework layer of the system of the terminal device.
  • the service certificate further includes a public key of the APP to be identified, and the public key corresponds to a private key that encrypts the first random number.
  • the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the terminal device further includes a processor;
  • the transmitter is configured to send a service certificate application request message to a trusted application TA running on the TEE operating system through the client application CA running on the REE operating system;
  • the processor is configured to control the TA to use the device CA certificate to issue the service certificate for the APP to be identified.
  • the embodiments of the present application provide a computer program product containing instructions, which when run on a processor, enable the processor computer to execute the method in the first aspect or various possible implementations of the first aspect .
  • embodiments of the present application provide a computer program product containing instructions, which when run on a processor, enable the processor to execute the foregoing second aspect or the methods in various possible implementation manners of the second aspect.
  • an embodiment of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when the computer-readable storage medium runs on a processor, the processor executes the first aspect or the first aspect.
  • an embodiment of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, which when run on a processor, causes the processor to execute the second aspect or the second aspect described above Of the various possible implementation methods.
  • an embodiment of the present application provides a chip.
  • the chip system includes a processor and may also include a memory, which is used to implement the foregoing first aspect or the methods in various possible implementation manners of the first aspect.
  • an embodiment of the present application provides a chip.
  • the chip system includes a processor and may also include a memory, which is used to implement the foregoing second aspect or the methods in various possible implementation manners of the second aspect.
  • an embodiment of the present application also provides a counterfeit APP identification system, including a server implemented in any possible manner such as the third aspect or the third aspect, and any of the fourth aspect or the fourth aspect Possible ways to implement terminal equipment.
  • the counterfeit APP identification method, server, and terminal device provided by the embodiments of this application.
  • the certificate chain and signature data are sent to the service server before the service interaction with the service server, and the service server checks the certificate chain
  • the service certificate is the service certificate of the APP to be identified, compare the signature certificate fingerprint corresponding to the package name in the service certificate and the pre-stored signature certificate fingerprint corresponding to the package name to identify the Identify whether the APP is a counterfeit APP, prevent the service server from providing services for the counterfeit APP, and improve business security.
  • this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.
  • FIG. 1A is a schematic diagram of a network architecture applicable to a counterfeit APP identification method provided by an embodiment of the application;
  • FIG. 1B is a schematic diagram of a network architecture applicable to another counterfeit APP identification method provided by an embodiment of the application;
  • FIG. 2 is a flowchart of a method for identifying a counterfeit APP according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a structure applicable to a counterfeit APP identification method provided by an embodiment of the application
  • Figure 4 is a flowchart of another counterfeit APP identification method provided by an embodiment of the present application.
  • FIG. 5 is a flow chart of certificate issuance used by the counterfeit APP identification method provided by the embodiment of the application.
  • FIG. 6 is a schematic diagram of a passing scenario of counterfeit detection in a counterfeit APP identification method provided by an embodiment of the present application
  • FIG. 7 is a schematic structural diagram of a server provided by an embodiment of the application.
  • FIG. 8 is a schematic structural diagram of a terminal device provided by an embodiment of this application.
  • FIG. 9 is a schematic structural diagram of another server provided by an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of another terminal device provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of an APP identification system according to an embodiment of the application.
  • the APP is identified by extracting the feature vector of the APK file of the APP or adding monitoring features to the APK file. This identification method is suitable for the application market to detect the counterfeit APP.
  • some business servers only provide services for specific apps. Taking the APP specifically for Huawei APP, such as Huawei share as an example, a function of Huawei share is to share photos. When traveling, users can share photos with relatives and friends through Huawei share. When sharing photos, the user’s terminal device needs to connect to the service server through Huawei share, and share the photos to relatives and friends through the service server.
  • the service server refers to the server used to provide services for Huawei share.
  • the counterfeit APP illegally uses the service server, that is, the service server is easily attacked by the counterfeit APP.
  • the embodiment of the present application provides a counterfeit APP identification method.
  • the service server After the user downloads the APP on the terminal device (hereinafter referred to as the APP to be identified), when the APP interacts with the service server, the service server performs the application Counterfeit identification, to prevent business servers from providing services for counterfeit apps, and improve security.
  • the terminal device is a device that can provide users with voice and/or data connectivity, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem.
  • the terminal device can communicate with one or more core networks via the radio access network (RAN).
  • the terminal device can be a mobile terminal device, such as a mobile phone (or “cellular” phone) and a mobile terminal device.
  • the computer for example, may be a portable, pocket-sized, handheld, built-in computer or vehicle-mounted mobile device, which exchanges language and/or data with the wireless access network.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • handheld devices with wireless communication functions computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminals in the future 5G network or future evolution of public land mobile communication networks
  • public land mobile network public land mobile network
  • terminal equipment in the PLMN which is not limited in the embodiment of the present application.
  • Terminal equipment can also be called system, subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, Remote terminal equipment (remote terminal), access terminal equipment (access terminal), user terminal equipment (user terminal), user agent (user agent), user equipment (user device), or user equipment (user equipment).
  • the server refers to a business server or a device CA server.
  • the business server refers to an APP used to provide services for one or some genuine apps.
  • the device CA server is a server that has a trusted certificate list deployed. When only the business server is deployed in the network architecture, a list of trusted certificates is deployed on the business server, the genuine APP is registered on the business server, and the business server is responsible for verifying the validity of the certificate chain, determining whether the business certificate is the business certificate of the APP, and Counterfeit APP recognition.
  • the genuine APP can be registered on the business server, the trusted certificate list is deployed on the business server, and the latest trusted certificate list is periodically obtained from the device CA server, which is the responsibility of the business server Certificate chain legitimacy verification, judgment of whether the business certificate is an APP business certificate, and counterfeit APP identification; or, a genuine APP can be registered on the business server, but the trusted certificate list is not deployed on the business server, and the device CA server is responsible for the certificate chain
  • the business server is responsible for the counterfeit identification of the legality inspection and whether the business certificate is the business certificate of the APP; or, the genuine APP is registered on the device CA server, and the device CA server is responsible for the legality inspection of the certificate chain and whether the business certificate is the APP
  • the service certificate judgment and counterfeit APP identification, and the service server only plays a role of transparent transmission and forwarding.
  • Figure 1A and Figure 1B please refer to Figure 1A and Figure 1B.
  • FIG. 1A is a schematic diagram of a network architecture applicable to a counterfeit APP identification method provided by an embodiment of the application.
  • This scenario includes a terminal device and a business server.
  • a network connection is established between the terminal device and the business server.
  • the business server is a server for one or some genuine APPs.
  • the R&D personnel need to Register the genuine APP on the business server and save the correspondence between the signature certificate fingerprint of the genuine APP and the package name; at the same time, the business server stores the set of trusted certificates required to verify the validity of the certificate chain, such as the trusted root A collection of certificates or a collection of trusted device certification authority (CA) certificates.
  • CA trusted device certification authority
  • the terminal device can use the APP to use the functions provided by the service server.
  • the APP is downloaded and installed on the terminal device, and the APP is started.
  • the business server performs counterfeit identification on the APP to be identified according to the certificate chain, the business certificate of the APP to be identified, etc., where the business certificate of the APP to be identified carries the package name and signature certificate fingerprint of the APP to be identified. For example, if the app to be identified is a Huawei share, the user does not know that the Huawei share is a genuine Huawei share or a counterfeit Huawei share.
  • the service server will identify the app to be identified. If it is identified as genuine Huawei share, the app to be identified uses the functions provided by the service server, such as remotely sharing photos, files and other data with other users. If the service server identifies it as a counterfeit app, it will refuse the app to be identified to use the functions provided by the service server.
  • the terminal device, the service server, and the genuine APP are from the same manufacturer.
  • the embodiments of the present application are not limited.
  • the terminal device and the service server are from the same manufacturer, and the genuine APP is developed by a third party, and the service server provides an interface for the genuine APP developed by the third party to access.
  • FIG. 1B is a schematic diagram of a network architecture applicable to another counterfeit APP identification method provided by an embodiment of the application. 1B, this scenario includes a terminal device, a business server, and an authentication and authorization server. A network connection is established between the terminal device and the business server, and a network connection is established between the business server and the authentication and authorization server.
  • the business server is a server for one or some genuine APPs. When the genuine APP is released, the R&D staff stores the correspondence between the signature certificate fingerprint of the genuine APP and the package name on the authentication authorization server.
  • the certification authority server stores a set of trusted certificates required to verify the validity of the certificate chain, such as a trusted root certificate set or a trusted device certification authority (CA) certificate set.
  • CA trusted device certification authority
  • the APP to be recognized is downloaded and installed on the terminal device, the APP to be recognized is started, and the certificate chain, etc. is sent to the service server.
  • the service server sends the received certificate chain, etc. to the authentication and authorization server, and the authentication and authorization server performs the verification on the APP. Counterfeit identification.
  • the device CA server can only store a set of trusted certificates.
  • the developer stores the signature certificate fingerprint, package name, and the correspondence between the signature certificate fingerprint and package name of the genuine APP on the business server, and the business server receives the certificate chain and After the data is signed, the certificate chain and signature data are sent to the device CA server.
  • the device CA server verifies the validity of the certificate chain and whether the business certificate in the certificate chain is an APP certificate. Only the certificates in the certificate chain are legal. And only when the service certificate is the service certificate of the APP, the service server performs counterfeit identification of the APP according to the package name in the service certificate and the fingerprint of the first signature certificate.
  • counterfeit APPs are not limited to APPs implanted with malicious code or advertising information and illegal APPs developed by criminals.
  • the counterfeit APP in the embodiment of this application is relative.
  • the service server only provides services for APP1
  • the legitimate APP downloaded and installed on the terminal device includes APP1, APP2, and APP3. Since APP2 and APP3 are not the APPs corresponding to the service server, For the business server, the APP2 and APP3 are also counterfeit APPs.
  • the terminal device, the service server, and the genuine APP can be from the same manufacturer or different manufacturers.
  • the terminal device injects a trusted root, such as a root certificate and/or a device CA certificate, when the terminal device is generated, where the device CA certificate is issued by the root certificate.
  • a trusted root such as a root certificate and/or a device CA certificate
  • the terminal device can use the device CA certificate to issue a service certificate for the app to be identified.
  • the certificates described in the embodiments of this application such as root certificates, device CA certificates, service certificates, etc., each certificate has a key pair, the key pair includes a public key and a private key, the public key is carried in the certificate, The private key is stored in the secure storage partition of the terminal device.
  • FIG. 1A is a flowchart of a method for identifying counterfeit APPs provided in an embodiment of the present application. This embodiment compares the counterfeit APP described in this application from the perspective of the interaction between the service server and the terminal device. The identification method is explained.
  • This embodiment includes:
  • the terminal sends a request message for establishing a link between the application APP to be identified and the server to the server.
  • the terminal device downloads and installs the APP, starts the APP, which is referred to as the APP to be identified below, and the terminal device sends a link establishment request to the service server for the APP.
  • the server sends the first random number to the terminal device.
  • the service server is a server for a certain genuine APP, and the user expects that the service server can only provide services for the genuine APP, and does not want to be provided by other apps.
  • the R&D personnel register the genuine APP on the service server and save the corresponding relationship between the signature certificate fingerprint of the genuine APP and the package name; at the same time, the service server stores the certificates required for the legality check of the certificate chain.
  • a set of trusted certificates such as a trusted root certificate set or a trusted device certification authority (CA) certificate set.
  • CA trusted device certification authority
  • the terminal device sends a link establishment request to the service server, and the service server sends the link establishment request to the device CA server, triggering the device CA server to send the first random number.
  • the terminal device uses the private key corresponding to the service certificate of the APP to be identified to encrypt the first random number to obtain signature data.
  • the terminal device uses the private key corresponding to the service certificate of the APP to be identified to encrypt the first random number.
  • the terminal device uses secure hash algorithm 256 (SHA256) and secure hash algorithm 384 (secure hash algorithm 384, SHA384) or secure hash algorithm 512 (secure hash algorithm 512, SHA512) etc. encrypt the first random number to obtain signature data.
  • secure hash algorithm 256 SHA256
  • secure hash algorithm 384 secure hash algorithm 384, SHA384
  • secure hash algorithm 512 secure hash algorithm 512, SHA512
  • the terminal device sends the signature data and certificate chain to the server.
  • the certificate chain carries the service certificate of the APP to be identified, and the service certificate carries the package name of the APP to be identified and the first signature certificate fingerprint of the APP to be identified.
  • the terminal device sends the signature data and the certificate chain to the server; correspondingly, the server receives the signature data and the certificate chain.
  • the server judges whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data.
  • this step includes two stages: In the first stage, the business server verifies the certificates in the certificate chain according to the pre-stored trusted certificates, and judges each certificate in the certificate chain. Whether it is legal; if the business server determines that each certificate in the certificate chain is legal, it enters the second stage: the business server uses the public key carried by the business certificate in the certificate chain to decrypt the signature data to determine whether the business certificate is for the app to be identified Service certificate. If the service certificate is the service certificate of the APP to be identified, step 106 is executed; if the service certificate is not the service certificate of the APP to be identified, step 108 is executed.
  • the certificate chain includes the root certificate, the device CA certificate and the business certificate. Since the certificate is issued at the first level, for example, the device CA certificate of the terminal device is issued using the root certificate of the terminal device, and the service certificate of the APP to be identified is issued by the terminal device using the device CA certificate. Therefore, the service server determines the certificate chain When each certificate in is valid, first determine whether the root certificate is valid, then determine whether the device certificate is valid, and finally determine whether the business certificate is valid. During the verification of the validity of the certificate chain, the business server determines whether there is a root certificate in the certificate chain in the trusted root certificate set stored locally.
  • the business server If the root certificate in the certificate chain is included in the trusted root certificate set, the business server The root certificate is considered to be credible. On the contrary, the business server considers the root certificate in the certificate chain to be untrusted; after that, the business server uses the public key of the root certificate to decrypt the device CA certificate to obtain a hash value and use the device CA certificate The carried hash algorithm performs a hash operation on the content of the device CA certificate to obtain another hash value.
  • the business server considers the device CA certificate to be legal, otherwise, the business server considers the device CA certificate Illegal; later, the service server uses the public key of the device CA certificate to decrypt the service certificate to obtain a hash value, and uses the hash algorithm carried in the service certificate to hash the content of the service certificate to obtain another hash value If the two hash values are the same, the business server considers the business certificate legal; anyway, the business server considers the business certificate illegal.
  • the service server when the service server judges whether the service certificate is the service certificate of the APP to be identified, it uses the public key of the service certificate to decrypt the signature data to obtain a random number, which is called the second random number below. Then, the service server compares Whether the first random number and the second random number are the same, if the first random number is the same as the second random number, the service server determines that the service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not If the same, the service server determines that the service certificate is not the service certificate of the APP to be recognized.
  • the service server determines whether the APP to be identified is a counterfeit APP to be identified according to the package name and the fingerprint of the first signature certificate.
  • step 102 it can be known that a genuine APP needs to be registered with the service server before being released, so that the correspondence between the package name of the genuine APP and the fingerprint of the signature certificate is stored on the service server. Therefore, in this step, the service server compares the first signature certificate fingerprint corresponding to the package name in the certificate chain with the second signature certificate fingerprint stored when the genuine APP corresponding to the package name is registered on the server to determine the APP to be identified Whether it is a counterfeit APP, if the APP to be identified is not a counterfeit APP, step 107 is executed; if the APP to be identified is a counterfeit APP, step 108 is executed.
  • the service server sends the recognition result to the terminal device, and the recognition result is used to indicate that the APP to be recognized is a genuine APP, and performs business interaction with the terminal device.
  • the service server recognizes the result to the terminal device, and the recognition result is used to indicate that the APP to be recognized is a counterfeit APP and refuses to conduct business interaction with the terminal device for the APP.
  • the counterfeit APP is relative to the service server, and the counterfeit APP includes the counterfeit APP in the conventional sense and some genuine APPs.
  • the counterfeit APP includes the counterfeit APP in the conventional sense and some genuine APPs.
  • APP1 and APP2 are counterfeit apps in the normal sense.
  • Counterfeit apps in the normal sense refer to all apps except genuine apps, including counterfeit apps that can be detected by the servers of third-party app stores.
  • the server of the third-party application product failed to detect, but it is actually a counterfeit APP;
  • APP3 is a genuine APP, but it is not registered on the service server. Therefore, for the service server, APP3 is also a counterfeit APP.
  • the certificate chain and signature data are sent to the business server before the business interaction with the business server, and the business server verifies that each certificate in the certificate chain is legal .
  • the service certificate is the service certificate of the APP to be identified, compare the signature certificate fingerprint corresponding to the package name in the service certificate and the pre-stored signature certificate fingerprint corresponding to the package name to identify whether the APP to be identified is counterfeit APP, to prevent business servers from providing services for counterfeit APPs, and improve business security.
  • the business server can only provide services for a certain number of users at the same time, this application can prevent illegal users from accessing the business server through counterfeit APPs, and can protect the business of legitimate users.
  • the terminal device may be a terminal device of any operating system, such as a terminal device of an Apple operating system, a terminal device of an Android operating system, and so on.
  • the terminal uses the device CA certificate stored on the terminal device to issue a service certificate for the APP to be identified.
  • the above-mentioned counterfeit APP identification method will be described in detail.
  • FIG. 3 is a schematic diagram of a structure applicable to a counterfeit APP identification method provided by an embodiment of the application.
  • the terminal device is called the end side
  • the service server and the device CA server are deployed on the cloud side
  • the operating system of the terminal device includes a trusted execution environment (trusted execution environment, TEE) rich execution environment ( rich execution environment, REE)
  • TEE is responsible for handling matters that require high security protection, such as secret key storage, encryption and decryption, fingerprint recognition, etc.
  • REE is a common operating system, such as Android Android system, iOS Apple system, etc., exists in REE
  • a client application (CA) that provides certificate services for the APP
  • TA trusted application
  • APP includes but is not limited to APP to be identified.
  • REE and TEE respectively include an application layer, a framework layer, a kernel layer, and a hardware layer from top to bottom.
  • the REE of the terminal device can provide a certificate management service, which is located in the REE framework (Android framework) layer, and is used to provide key and certificate management related functions for the APP to be identified.
  • REE framework Android framework
  • the certificate management service can at least realize the following three functions: 1) Before the terminal device leaves the factory, use the certificate management service to transfer the production line certificate , That is, the root certificate and the device CA certificate are injected into the terminal device; 2) Support the generation of service certificates, that is, the terminal device uses the device CA certificate to issue service certificates for the APP to be identified; 3) Supports trusted authentication based on the service key, that is, the service server initiates When the identity is challenged, the terminal device uses the certificate management service to encrypt the first random number sent by the service server with the private key corresponding to the service certificate to obtain the signature data.
  • the manufacturer presets and saves the root certificate and device CA certificate in the secure storage partition of the terminal equipment, such as replay protect memory block (RPMB), RPMB
  • RPMB replay protect memory block
  • the data in the PRMB cannot be modified. Even if the user restores the factory settings to the terminal device, the data in the PRMB cannot be deleted.
  • the app to be identified After the app to be identified is downloaded and installed on the terminal device, when the user clicks to start the app to be identified, the app to be identified applies to the CA for a business certificate, and the CA obtains the package name and the waiting list of the app to be identified through the Android system. Identify the fingerprint of the first signature certificate of the APP, and then send a certificate application request to the TA to apply for a service certificate for the APP to be identified. After receiving the application request, the TA uses the device CA certificate to issue a service certificate for the APP to be identified, and records the package name of the APP to be identified and the fingerprint of the first signature certificate in the service certificate. After the service certificate is generated, it is kept in the secure storage partition of the terminal device, such as in a secure file system (SFS). The data in the SFS can be deleted when the app to be identified is uninstalled or the terminal device is restored to its factory settings.
  • SFS secure file system
  • the terminal device initiates an establishment request for the APP to be identified to the service server, and the service server initiates an identity authentication challenge, so that the service server performs counterfeit identification of the APP to be identified.
  • Fig. 4 is a flowchart of another counterfeit APP identification method provided in an embodiment of the present application.
  • the APP to be identified and the certificate management service are both loaded on the terminal device, and the trusted root certificate set is deployed on the business server.
  • the business server regularly obtains the certificate revocation list from the device CA server.
  • the letter certificate is updated, this embodiment includes:
  • the service server obtains the root certificate of the terminal device.
  • the business server obtains the root certificate of the terminal device offline, or the business server interacts with the device CA server to obtain the root certificate of the terminal device.
  • the service server sends a certificate revocation list request to the device CA server.
  • the device CA server sends a response message to the service server, where the response message carries the certificate revocation list.
  • the service server periodically sends a certificate revocation list request to the device CA server to request the latest certificate revocation list (Certificate Revocation List, CRL) to update the locally deployed trusted certificate.
  • CRL Certificate Revocation List
  • the terminal device sends a link establishment request to the service server for the APP to be identified.
  • the terminal device when the APP to be identified is started, the terminal device initiates a link establishment request to the service server for the APP to be identified.
  • the service server initiates identity authentication to the terminal device, and the identity authentication carries the first random number.
  • the service server sends identity authentication to the terminal device for the APP to be identified.
  • the terminal device sends a certificate application request to the TA through the CA to apply for a service certificate for the APP to be identified.
  • the terminal device uses the device CA certificate to issue a service certificate for the APP to be identified.
  • the device CA certificate is issued by the root certificate, and the service certificate is issued by the device CA certificate.
  • FIG. 5 is a flow chart of certificate issuance used in the counterfeit APP identification method provided by the embodiment of the present application.
  • the root certificate and the device CA certificate are also called the terminal device production line preset certificates. These two certificates are injected into the terminal device before the terminal device leaves the factory, and will not be restored because the terminal device Value or uninstall the app to be recognized and delete it. After the terminal device leaves the factory, the user loads the APP to be identified on the terminal device. When the APP to be identified is started, the terminal device uses the device CA certificate to issue a service certificate for the APP to be identified. The following table lists the details of the business certificate.
  • the terminal device uses the private key corresponding to the service certificate to encrypt the first random number to obtain signature data.
  • the terminal device sends the signature data and certificate chain to the CA through the TA.
  • the terminal device sends the signature data and the certificate chain to the service server.
  • the certificate chain includes root certificates, device CA certificates, and business certificates.
  • the service server judges whether the certificates in the certificate chain are legal. If all the certificates in the certificate chain are legal, perform step 212; if a certain level of certificate in the certificate chain is illegal, perform step 215.
  • the service server sequentially determines whether the root certificate, the device CA certificate, and the service certificate are legal during the certificate chain verification process.
  • the business server determines whether there is a root certificate in the certificate chain in the pre-deployed set of trusted root certificates. If there is a root certificate in the certificate chain in the pre-deployed set of trusted root certificates, it indicates that there is a root certificate in the certificate chain.
  • the root certificate of is the trusted root certificate of the business server and is a legal certificate. If the root certificate in the certificate chain does not exist in the pre-deployed trusted root certificate set, it means that the root certificate in the certificate chain is not a trusted root certificate for the business server, but an illegal certificate.
  • the service server uses the public key of the root certificate to decrypt the device CA certificate contained in the certificate chain to obtain the first hash value, and then according to the device CA certificate
  • the carried hash algorithm performs a hash operation on the device CA certificate to obtain the second hash value.
  • the service server judges whether the first hash value and the second hash value are the same. If the first hash value and the second hash value are the same, it means that the device CA certificate is a legal device CA certificate. If the second hash value is not the same, it indicates that the device CA certificate is an illegal device CA certificate.
  • the service server decrypts the service certificate according to the public key carried by the device CA certificate to obtain the third hash value, and then, according to the hash algorithm carried by the service certificate, The business certificate performs a hash operation to obtain the fourth hash value.
  • the business server judges whether the third hash value and the fourth hash value are the same. If the third hash value and the fourth hash value are the same, the business certificate is valid. If the third hash value and the fourth hash value are not The same means that the business certificate is illegal.
  • hash operation on the certificate refers to the hash operation on one or more attribute information in the certificate.
  • the service server judges whether the service certificate is the service certificate of the APP to be recognized. If the service certificate is the service certificate of the APP to be recognized, step 213 is executed; if the service certificate is not the service certificate of the APP to be recognized, step 215 is executed.
  • the service server decrypts the signature data according to the public key carried in the service certificate in the certificate chain to obtain the second random number. Then, the service server determines the second random number and the value sent in step 205 Whether the first random number is the same, if the first random number and the second random number are the same, the service server determines that the service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not the same, the service server Make sure that the service certificate is not the service certificate of the APP to be identified.
  • the service server determines whether the APP to be identified is a counterfeit APP according to the package name and the fingerprint of the first signature certificate. If the APP to be identified is not a counterfeit APP, execute step 214; if the APP to be identified is a counterfeit APP, execute step 215.
  • each APP has a package name and a signature certificate fingerprint.
  • the Android APP Take the Android APP as an example. After the R&D staff develops the APP, they will sign the apk file when packaging and generating the Android package (APK). The signature mechanism is used to ensure the legality of the apk file and the uniqueness of the app. For later app upgrades, etc.
  • the R&D personnel register on the service server, and store the correspondence between the package name and the fingerprint of the signature certificate on the service server.
  • the service server determines that the service certificate is a service certificate issued by the terminal device for the APP to be recognized, then in this step, the service server determines the second signature certificate fingerprint according to the package name of the APP to be recognized, and judges the first Whether the fingerprint of the signature certificate and the fingerprint of the second signature certificate are the same; if the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, the service server determines that the APP to be identified is a counterfeit APP; if the fingerprint of the first signature certificate and the second signature If the certificate fingerprints are the same, the service server determines that the APP to be identified is a genuine APP.
  • the service server sends a recognition result to the terminal device, where the recognition result is used to indicate that the APP to be recognized is a genuine APP, and performs business interaction with the terminal device for the APP to be recognized.
  • the service server sends a recognition result to the terminal device, where the recognition result is used to indicate that the APP to be recognized is a counterfeit APP, and refuses to conduct business interaction with the terminal device for the APP to be recognized.
  • a set of trusted root certificates is deployed on the business server, and the certificates in the certificate chain include root certificates, device CA certificates, and business certificates as examples to describe the counterfeit APP identification method in detail.
  • the embodiments of this application are not limited.
  • the device CA certificate may also be deployed on the service server.
  • the certificates in the certificate chain only include the device CA certificate and the service certificate.
  • Fig. 6 is a schematic diagram of a passing scenario of counterfeit detection in a counterfeit APP identification method provided by an embodiment of the present application. This embodiment includes:
  • the R&D personnel register the genuine APP on the business server, and the business server stores the package name of the genuine APP, the fingerprint of the signature certificate, and the correspondence between the package name and the fingerprint of the signature certificate.
  • the package name of a genuine APP is com.xxx.app1
  • the fingerprint of the signature certificate is 111111.
  • the package name is located in a file of the installation package, such as the androidManifest.xml file; the signature certificate fingerprint is stored in the signature certificate of the installation package.
  • the installation package will be deleted, but before the APP is uninstalled, the terminal device can obtain the package name and signature certificate from the REE operating system.
  • the package name of the APP to be identified is the same as the package name of the genuine APP, but the terminal device does not know whether the APP to be identified is a genuine APP or a counterfeit APP.
  • the terminal device determines that the signature certificate fingerprint of the APP to be identified is 111111; when the APP to be identified is a counterfeit APP, the developer cannot obtain the signature certificate fingerprint of the genuine APP, therefore, the APP to be identified
  • the signature certificate fingerprint of is different from the signature certificate fingerprint of the genuine APP, for example, 222222.
  • the terminal device uses the device CA certificate to issue a service certificate for the APP to be identified.
  • the service certificate includes the package name of the APP to be identified and the fingerprint of the first signature certificate.
  • the terminal device initiates a link establishment request to the service server for the APP to be identified.
  • the service server sends the first random number to the terminal device.
  • the terminal device sends the signature data and the certificate chain to the service server.
  • the terminal device uses the private key of the service certificate to encrypt the first random number, and after obtaining the signature data, sends the certificate chain and the signature data to the service server.
  • the service server verifies whether the certificate in the certificate chain is legal. If the certificate chain is legal, it determines whether the service certificate is the service certificate of the APP. If the service certificate is the service certificate of the APP to be identified, it judges whether the APP is a counterfeit APP.
  • the service server first verifies whether each certificate in the certificate chain is legal through the certificate chain, and whether the service certificate is the APP's own service certificate. If each service certificate in the certificate chain is legal and the service certificate is the APP's own service certificate, the service server obtains the package name of the app to be identified and the fingerprint of the first signature certificate from the service certificate, and determines the second signature certificate fingerprint based on the package name Finally, verify whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate stored in advance on the service server are the same. If they are the same, it is determined that the APP to be identified is a genuine APP; if they are not the same, the APP to be identified is considered to be a counterfeit APP.
  • the service server considers the APP to be identified as Genuine APP.
  • the fingerprint of the second signature certificate is 222222 in this step, and the fingerprint of the first signature certificate is different from the fingerprint of the first signature certificate obtained by the terminal device from the installation package of the APP to be identified, the service server considers the fingerprint to be identified APP is a counterfeit APP.
  • FIG. 7 is a schematic structural diagram of a server provided by an embodiment of the application.
  • the server 100 may include:
  • the transmitter 11 is configured to send the first random number to the terminal device
  • the receiver 12 is configured to receive a certificate chain and signature data sent by a terminal device.
  • the certificate in the certificate chain includes the service certificate of the application to be identified, and the service certificate carries the package name of the APP to be identified and the Identifying the fingerprint of the first signature certificate of the APP, the signature data is obtained by encrypting the first random number by the terminal device using the private key corresponding to the service certificate;
  • the processor 13 is configured to determine, according to the certificate chain and the signature data, whether the service certificate is the service certificate of the APP to be identified; if the service certificate is the service certificate of the APP to be identified, then The package name and the fingerprint of the first signature certificate are used to determine whether the APP to be identified is a counterfeit APP.
  • the processor 13 is configured to determine whether the certificate in the certificate chain is legal, and if the certificate in the certificate chain is legal, then according to the public certificate carried in the business certificate in the certificate chain. Key, decrypt the signature data to obtain a second random number; determine whether the first random number is the same as the second random number, and if the first random number is the same as the second random number, determine all The service certificate is the service certificate of the APP to be identified; if the first random number and the second random number are not the same, it is determined that the service certificate is not the service certificate of the APP to be identified.
  • the certificate in the certificate chain further includes the root certificate of the terminal device and the device certification authority CA certificate
  • the processor 13 is configured to determine the set of pre-deployed trusted root certificates , Whether there is a root certificate in the certificate chain, if there is a root certificate in the certificate chain in the root certificate set, use the public key carried by the root certificate to decrypt the device included in the certificate chain CA certificate to obtain a first hash value, and perform a hash operation on the device CA certificate according to the hash algorithm carried in the device CA certificate to obtain a second hash value, if the first hash value is If the second hash value is the same, it is determined that the device CA certificate is a legal certificate, and the service certificate is decrypted according to the public key carried in the device CA certificate to obtain the third hash value, which is carried according to the service certificate.
  • the certificate in the certificate chain also includes the device authorization CA certificate of the terminal device, and the processor 13 is configured to determine whether all of the pre-deployed trusted CA certificate sets exist.
  • the device CA certificate in the certificate chain if the device CA certificate in the certificate chain exists in the CA certificate set, use the public key carried in the trusted device CA certificate to decrypt the service certificate to obtain the third hash Value, perform a hash operation on the service certificate according to the hash algorithm carried in the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determine The business certificate is a legal certificate.
  • the processor 13 is configured to, if the service certificate is the service certificate of the APP to be identified, judge the to-be-identified app according to the package name and the fingerprint of the first signature certificate Whether the APP is a counterfeit APP, including: if the service certificate is the service certificate of the APP to be identified, determining the second signature certificate fingerprint according to the package name, and storing the package name and the second signature certificate fingerprint To determine whether the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are the same. If the fingerprint of the first signature certificate and the fingerprint of the second signature certificate are not the same, it is determined that the APP to be identified is Counterfeit APP.
  • the server is a business server or a device CA server.
  • FIG. 8 is a schematic structural diagram of a terminal device provided by an embodiment of the application.
  • the terminal device 200 may include:
  • the sender 21 is configured to send to the server a request message for establishing a link between the application APP to be identified and the server;
  • the receiver 22 is configured to receive a verification message sent by the server for verifying the APP to be identified, where the verification message includes a first random number;
  • the transmitter 21 is further configured to send a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number with the private key corresponding to the APP to be identified;
  • the receiver 22 is further configured to receive the result of the server verifying whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data.
  • the certificate chain includes a service certificate of the APP to be identified, and the service certificate carries the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified, and the receiving The device 22 is configured to receive the counterfeit identification result obtained by the server matching the fingerprint of the second visa certificate corresponding to the package name registration of the APP with the fingerprint of the first signature certificate; if the matching is successful, the counterfeit The result indicates that the APP is not a counterfeit APP, or if the matching fails, the counterfeit recognition result indicates that the APP is a counterfeit APP.
  • the terminal device 100 further includes: a processor 23, configured to use the device CA certificate before the transmitter 21 sends the certificate chain and signature data to the server
  • the service certificate is issued for the APP to be identified, and the content of the service certificate includes the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified.
  • the service certificate is generated and managed for the certificate management service of the terminal device, and the certificate management service is located in the framework layer of the system of the terminal device.
  • the service certificate further includes a public key of the APP to be identified, and the public key corresponds to a private key that encrypts the first random number.
  • the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the transmitter 21 is used to pass a client running on the REE operating system
  • the application CA sends a service certificate application request message to the trusted application TA running on the TEE operating system;
  • the processor 23 is configured to control the TA to use the device CA certificate to issue the service certificate for the APP to be identified.
  • Fig. 9 is a schematic structural diagram of another server provided by an embodiment of the application.
  • the server 300 may include: a processor 31, a transceiver 32, and a memory 33; the transceiver 32 is used to send and receive data; the memory 33 is used to store instructions; the processor 31 is used to instruct The instructions in the memory 33 cause the server to execute the counterfeit APP identification method applied to the server as described above.
  • FIG. 10 is a schematic structural diagram of another terminal device provided by an embodiment of this application.
  • the terminal device 400 may include: a processor 41, a transceiver 42, and a memory 43; the transceiver 42 is used to send and receive data; the memory 43 is used to store instructions; the processor 41 is used to instruct The instructions in the memory 43 cause the terminal device to execute the counterfeit APP identification method applied to the terminal device as described above.
  • FIG. 11 is a schematic structural diagram of an APP identification system according to an embodiment of the application.
  • the counterfeit APP identification system 1000 provided in this embodiment includes a server 100 as shown in FIG. 7 and at least one terminal device 200 as shown in FIG. 8.
  • the method provided in the embodiments of the present application is mainly introduced from the perspective of interaction between the terminal device and the server. It can be understood that, in order for the terminal device and the server to implement each function in the method provided in the above embodiments of the present application, the terminal device and the server include hardware structures and/or software modules corresponding to each function.
  • the terminal device and the server include hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • the embodiment of the present application may divide the terminal device and the server into functional modules according to the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • plural herein refers to two or more.
  • the term “and/or” in this article is only an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, exist alone B these three situations.
  • the character "/" in this article generally indicates that the associated objects before and after are in an "or” relationship; in the formula, the character "/" indicates that the associated objects before and after are in a "division" relationship.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not be implemented in this application.
  • the implementation process of the example constitutes any limitation.
  • the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory. (volatile memory), such as random-access memory (random-access memory, RAM).
  • the memory is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the memory in the embodiments of the present application may also be a circuit or any other device capable of realizing a storage function, for storing program instructions and/or data.
  • the disclosed device and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be other division methods for example, multiple units or components may be It can be combined or integrated into another device, or some features can be omitted or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate parts may or may not be physically separate.
  • the parts displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the methods provided in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software When implemented by software, it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, a server, a terminal, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, SSD).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

Des modes de réalisation de la présente invention concernent un procédé d'identification d'application de contrefaçon, un serveur, et un dispositif terminal. Le procédé consiste : après qu'une application à identifier sur un dispositif terminal démarre et avant l'exécution d'une interaction de service avec un serveur de service, à envoyer une chaîne de certificats et des données de signature au serveur de service; après avoir vérifié que chaque certificat dans la chaîne de certificats est valide et qu'un certificat de service est le certificat de service de l'application à identifier, à comparer, au moyen du serveur de service, une empreinte de certificat de signature correspondant à un nom de paquet dans le certificat de service avec une empreinte de certificat de signature pré-stockée correspondant au nom de paquet afin de déterminer si les empreintes sont similaires, ce qui permet d'identifier si l'application à identifier est une application de contrefaçon, et par conséquent d'empêcher le serveur de service de servir une application de contrefaçon et d'améliorer la sécurité du service. De plus, si le serveur de service ne peut servir qu'une quantité spécifique d'utilisateurs à la fois, au moyen de la présente invention, un utilisateur illégal peut être empêché d'accéder au serveur de service au moyen d'une application de contrefaçon, ce qui peut garantir le service d'un utilisateur légitime.
PCT/CN2019/077311 2019-03-07 2019-03-07 Procédé et appareil d'identification d'application de contrefaçon WO2020177116A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201980066172.XA CN112805702A (zh) 2019-03-07 2019-03-07 仿冒app识别方法及装置
PCT/CN2019/077311 WO2020177116A1 (fr) 2019-03-07 2019-03-07 Procédé et appareil d'identification d'application de contrefaçon

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/077311 WO2020177116A1 (fr) 2019-03-07 2019-03-07 Procédé et appareil d'identification d'application de contrefaçon

Publications (1)

Publication Number Publication Date
WO2020177116A1 true WO2020177116A1 (fr) 2020-09-10

Family

ID=72337231

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/077311 WO2020177116A1 (fr) 2019-03-07 2019-03-07 Procédé et appareil d'identification d'application de contrefaçon

Country Status (2)

Country Link
CN (1) CN112805702A (fr)
WO (1) WO2020177116A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120090711A (ko) * 2011-02-08 2012-08-17 (주)바이너리소프트 모바일 단말용 애플리케이션 위변조 검증 시스템 및 방법
CN104657634A (zh) * 2015-02-28 2015-05-27 百度在线网络技术（北京）有限公司 盗版应用的识别方法和装置
CN107480519A (zh) * 2017-08-04 2017-12-15 深圳市金立通信设备有限公司 一种识别风险应用的方法及服务器
CN108229131A (zh) * 2016-12-14 2018-06-29 中国移动通信集团设计院有限公司 仿冒app识别方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103685138B (zh) * 2012-08-30 2016-12-21 卓望数码技术（深圳）有限公司 移动互联网上的Android平台应用软件的认证方法和系统
CN106487511B (zh) * 2015-08-27 2020-02-04 阿里巴巴集团控股有限公司 身份认证方法及装置
CN108199830A (zh) * 2017-12-22 2018-06-22 沈阳通用软件有限公司 基于证书严格管控Android应用程序合法的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120090711A (ko) * 2011-02-08 2012-08-17 (주)바이너리소프트 모바일 단말용 애플리케이션 위변조 검증 시스템 및 방법
CN104657634A (zh) * 2015-02-28 2015-05-27 百度在线网络技术（北京）有限公司 盗版应用的识别方法和装置
CN108229131A (zh) * 2016-12-14 2018-06-29 中国移动通信集团设计院有限公司 仿冒app识别方法及装置
CN107480519A (zh) * 2017-08-04 2017-12-15 深圳市金立通信设备有限公司 一种识别风险应用的方法及服务器

Also Published As

Publication number Publication date
CN112805702A (zh) 2021-05-14

Similar Documents

Publication Publication Date Title
JP6262278B2 (ja) アクセス制御クライアントの記憶及び演算に関する方法及び装置
US9864608B2 (en) Client authentication during network boot
US9281949B2 (en) Device using secure processing zone to establish trust for digital rights management
US9867043B2 (en) Secure device service enrollment
CA2616358C (fr) Mises a jour de logiciels securises
JP2017050875A (ja) 複数のアクセス制御クライアントをサポートするモバイル装置、及び対応する方法
US20080077592A1 (en) method and apparatus for device authentication
US10609070B1 (en) Device based user authentication
US20080189695A1 (en) Updating of Data Instructions
WO2019085531A1 (fr) Procédé et dispositif d'authentification de connexion de réseau
EP3248360A1 (fr) Systèmes et procédés de communication sécurisée à chemin sécurisé
CN111209558B (zh) 基于区块链的物联网设备身份认证方法以及系统
JP2011507091A (ja) モバイル・コンピューティング装置上のソフトウェア・アプリケーションを管理するための方法およびシステム
US11665532B2 (en) Securing private wireless gateways
WO2019071650A1 (fr) Procédé de mise à niveau d'une application dans un élément de sécurité, et dispositif associé
CN112765684A (zh) 区块链节点终端管理方法、装置、设备及存储介质
JP2017152880A (ja) 認証システム、鍵処理連携方法、および、鍵処理連携プログラム
CN113614720A (zh) 一种动态配置可信应用程序访问控制的装置和方法
TWI469655B (zh) 電子存取用戶端之大規模散佈之方法及裝置
WO2020177116A1 (fr) Procédé et appareil d'identification d'application de contrefaçon
CN114143198B (zh) 固件升级的方法
US20220350586A1 (en) Methods of Distributing Software/Firmware Updates
AU2011202785B2 (en) Secure software updates

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19917774

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19917774

Country of ref document: EP

Kind code of ref document: A1