CN105357012A - Authentication method for mobile application not depending on local private key - Google Patents
Authentication method for mobile application not depending on local private key Download PDFInfo
- Publication number
- CN105357012A CN105357012A CN201510703772.6A CN201510703772A CN105357012A CN 105357012 A CN105357012 A CN 105357012A CN 201510703772 A CN201510703772 A CN 201510703772A CN 105357012 A CN105357012 A CN 105357012A
- Authority
- CN
- China
- Prior art keywords
- mobile applications
- authenticate key
- key
- subprogram
- authentication method
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention discloses an authentication method for a mobile application not depending on a local private key. The authentication method comprises the following steps: sampling a program file of the mobile application, and generating a sampled content into a legal CPU (Central Processing Unit) instruction according to a specific instruction template, so as to synthesize an authentication key of the mobile application and generate a subprogram; and finally, executing the authentication key subprogram and performing a hash operation on an execution result, and finishing the authentication to the mobile application by a cloud service platform. The method does not need to store the authentication key of the mobile application at a mobile terminal, and the authentication key which is consistent to the cloud service platform is generated at a mobile application side by adopting a manner of dynamic operation application, so that the problem of compatibility consistency of storing the authentication key by the mobile application by adopting Secure Element (SE) hardware can be avoided, and the problem that the authentication key stored by software is vulnerable can be avoided.
Description
Technical field
The invention belongs to Mobile solution field, be specifically related to a kind of authentication method to mobile applications not relying on local key.
Background technology
In daily life, user often uses the mobile applications that mobile terminal is installed to complete certain behavior or to reach certain effect, such as, use mobile payment program to perform payment, i.e. so-called mobile payment.The mobile applications be protected concerning this kind of use safety sexual needs, the certification of cloud service platform to mobile applications is important and an aspect of comparison basis.
Certification is carried out to mobile applications, mainly in order to prevent the source code of the mobile applications on mobile terminal to be maliciously tampered, or in order to prevent non-legally, the program of counterfeit uses as legal mobile applications.
Existing method of mobile applications being carried out to certification, normally performs based on to whole program files of mobile applications (referred to as " based on the certification of full text part Hash ") that Hash operation carrys out certification.The method use whole program files of mobile applications, there is the time of implementation of Hash operation long problem.In addition, when performing based on the Hash certification of full text part, malicious attacker can not go to read the code run, but the source code of reading without the program file distorted of detouring, this reading way that detours, the method based on the certification of full text part Hash is existed program file is maliciously tampered may.
When service platform carries out certification to mobile applications beyond the clouds, usually key can be used.Existing, authenticate key stores with the form of static data usually, and the key data no matter stored is complete or fragment type, even if be encrypted it, is also easy to make key tracked and replace.Particularly in mobile payment field, the safety issue of use safety element (SE) storage key is the key problem about mobile applications safety, although use the safety element relying on hardware supports to carry out storage key have fail safe highly, but financial institution, between equipment manufacturers and operator to the contention of safety element control, make the serious bar blocking in whole market, promote difficulty very large.Such as, apple pays the safety element that (ApplePay) uses, and is the improvement on a kind of hardware, cannot be used in market in the storage IOS mobile phone having comparatively early hardware version.Even based on the safety approach of hardware SE, neither overall safety, industry has the example of bypass attack, Brute Force, and safety is relative to cracking for the cost that must pay.
Based on the safety approach of software, as HCE scheme, provide a kind of new security framework, but it is server or realize SE function in local application beyond the clouds, imagination space is too large, and lacks concrete implementation and describe.Equally, HCE scheme still cannot contain storage IOS mobile phone, and HCE scheme is to the authentication mechanism of mobile applications, is still a weakness in whole scheme.The HCE scheme dominated by bank announced at present, solve only the Communication Security Problem of data pipe, not yet solves the authentication question of APP itself.
Use software storage key not yet can reach the wind control grade of more than EAL4+ at present.The technology of Software hardening design product is originally in high speed development, and along with the maturation of early stage DEX file encryption mode, the intensity adding shell also can be more and more higher, but the progress of exuviating technology is not a halfpenny the worse.Reinforcing product manufacturer watchman's wooden clapper watchman's wooden clapper, like encryption, Baidu, logical pair of shield product all have an open record crack record.
Summary of the invention
The technical problem to be solved in the present invention is to provide a kind of authentication method to mobile applications not relying on local key, the program file of this authentication method to mobile applications is sampled, the content of sampling is generated legal cpu instruction according to specific command template, thus the authenticate key of synthesis mobile applications generates subprogram, finally adopt and perform this authenticate key subprogram and the mode of execution result being carried out to Hash operation, complete the certification of cloud service platform to mobile applications.The method does not need the authenticate key in mobile terminal storing mobile application program, and adopt the mode of dynamic operation program to produce the authenticate key consistent with cloud service platform at mobile applications end, thus avoid mobile applications employing safety element (SecureElement, SE) hardware store authenticate key compatible consistency problem, and to avoid by the vulnerable problem of software authentication storage key.
For solving the problems of the technologies described above, the present invention adopts following technical scheme:
Do not rely on the authentication method to mobile applications of local key, for cloud service platform, certification carried out to the mobile applications arranged on mobile terminals, comprise the following steps:
S10, when mobile applications runs for the first time,
S101, samples to the sampled population of mobile applications, carries out coding obtain address sequence to the address of each sampling individuality that sampling selects;
S102, content under each for address sequence address is generated cpu instruction according to certain command template, the authenticate key cpu instruction of generation being synthesized mobile applications under the further configuration of a certain operational factor generates subprogram, perform this authenticate key generate subprogram and carry out Hash operation to its execution result, generate the authenticate key of mobile applications, the multiple authenticate keys corresponding to multiple values of operational factor form authenticate key sequence;
S103, is encrypted address sequence, and the address sequence encrypted is stored in mobile terminal;
S104, is sent to cloud service platform by the clear crytpographic key of address sequence, operational factor sequence and authenticate key sequence;
S20, during mobile applications follow-up operation,
S201, mobile applications receives cloud service platform and uses the clear crytpographic key that initial session key sends and the operational factor of a certain value chosen arbitrarily from operational factor sequence;
S202, mobile applications is decrypted the address sequence encrypted and obtains address sequence;
S203, reads the content at address sequence each element address place and generates corresponding cpu instruction, and synthesis secret generating subprogram also generates authenticate key after execution;
S204, cloud service platform sends random number to mobile applications, obtains encrypted result and be back to cloud service platform after encryption;
S205, cloud service platform completes final authentication according to encrypted result.
In one preferred embodiment, in S101, described sampled population comprises so library file, dex file, resource file and main all effective informations of joining file one or a combination set of.
In one preferred embodiment, increase and belong to vulnerable, distort, add the sampling individuality of the code of shell, data and Configuration Type and account for sampled population ratio, or increase the sampling individuality be positioned at close to the position of maximum address end, lowest address end and account for sampled population ratio, or increase to be positioned at and be convenient to identify that the sampling individuality at position of the similarities and differences accounts for sampled population ratio.
In one preferred embodiment, in S102, described command template is a series of configuration files of configuration for carrying out instruction, specification and filtration.
In one preferred embodiment, described cpu instruction comprises data processing instructions, internal storage access instruction, jump instruction, and wherein data processing instructions has and accounts for the highest ratio.
In one preferred embodiment, wall scroll cpu instruction is admitted to instruction filter after generating, whether accident can be produced when running according to this cpu instruction of context determination during dynamic operation, if this cpu instruction can produce accident when running, instruction filter can revise this cpu instruction till it is legal automatically by certain rule.
In one preferred embodiment, operational factor is the version number that authenticate key generates subprogram.
In one preferred embodiment, operational factor is the configuration parameter that authenticate key generates subprogram.
In one preferred embodiment, described configuration parameter is loop configuration parameter, branch configuration parameter or recurrence configuration parameter, command template Release parameter, and the value of different operational factors corresponds to different authenticate keys and generates subprogram; The authenticate key generated after the authenticate key generation subprogram activation of corresponding different operational factor is different.
In one preferred embodiment, in S102, perform this authenticate key generate subprogram and carry out Hash operation to its execution result, the authenticate key generating mobile applications is specially, after performing authenticate key generation subprogram, Hash operation is carried out to the value of readable register all in CPU, or Hash operation is carried out to the value in the value of readable register all in CPU and partial memory, thus generate authenticate key.
In one preferred embodiment, in S201, initial session key generates from SSL or by cloud service platform other the convenient authentication method that mobile applications carries out.
In one preferred embodiment, when being synthesized authenticate key by many cpu instructions and generating subprogram, can according to certain rules the instruction block formed by part cpu instruction be done branch, circulate or do recurrence.
In one preferred embodiment, mobile applications is when running for the first time, the value all to operational factor travels through to form operational factor sequence, thus generating set and the authenticate key sequence that authenticate key generates subprogram, operational factor sequence, authenticate key generate the set of subprogram and the respective element of authenticate key sequence three exists one-to-one relationship.
In one preferred embodiment, when each follow-up operation of mobile applications carries out certification to it, cloud service platform chooses an operational factor for this certification randomly from operational factor sequence, only generates an authenticate key and generate subprogram during each follow-up operation of mobile applications.
In one preferred embodiment, the different values of operational factor correspond to different command template, when each follow-up operation of mobile applications performs certification, cloud service platform, according to the value of operational factor being sent to mobile applications, sends corresponding command template and generates subprogram to mobile applications to generate authenticate key.
In one preferred embodiment, the hash algorithm that Hash operation uses is MD2, MD4, MD5, SHA-1, the close algorithm of state or other hash algorithms.
The present invention is adopted to have following beneficial effect:
1, the authentication method of the embodiment of the present invention adopts dynamic key production mechanism, decreases the dependence of the SE to example, in hardware in mobile terminal.
2, the authentication method authenticate key that dynamic operation goes out in each mobile applications of the embodiment of the present invention is usually different, and each mobile applications is that the authenticate key that dynamic operation goes out is usually also different in certification each time.
3, the authentication method of the embodiment of the present invention, adopts the mode of sampling (such as random sampling etc.) to choose program file needed for certification or other effective informations, with the randomness of sampling or Unpredictability to improve the fail safe of certification.
4, the authentication method of the embodiment of the present invention is only when first time operation and initial launch, and the data interaction amount between cloud service platform and mobile applications is larger; And when follow-up operation, data interaction amount is between the two less, and have terseness and the feature such as efficient concurrently.
5, the authentication method of the embodiment of the present invention, to adopt when contract authenticate key generates subprogram part instructs Kuai Zuo branch, circulate or do the mode of recurrence, and increase by the value of configuration change operational factor randomness and the unpredictability that authenticate key generates subprogram, thus generate the authenticate key of the different operational factor of correspondence needed for certification in the mode of dynamic operation program.
6, the authentication method of the embodiment of the present invention, authenticate key needed for only just generating when needing to perform certification, and do not need to be stored in mobile client for a long time, therefore the risk that the static storage mode that the dynamic generating mode of this authenticate key can evade authenticate key is brought.
7, the authentication method of the embodiment of the present invention, choose content with random sampling pattern and generate executable random cpu instruction sequence according to command template, authentication authorization and accounting secret generating subprogram, the original program file shielding newly-generated stochastic instruction sequence and mobile applications contacting in terms of content, make the generating mode of authenticate key and content more be difficult to prediction, thus prevent from authenticate key to be stolen and identify distorting equivalent risk to the program file of mobile applications.
Accompanying drawing explanation
Fig. 1 is the authenticating step flow chart performed when running for the first time of mobile applications;
Authenticating step flow chart performed when Fig. 2 is mobile applications follow-up operation;
Fig. 3 is instruction generation and the program synthesis block diagram that authenticate key generates subprogram.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, be clearly and completely described the technical scheme in the embodiment of the present invention, obviously, described embodiment is the present invention's part embodiment, instead of whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtained under creative work prerequisite, belong to the scope of protection of the invention.
Terminological interpretation:
Mobile payment, refers to and allows user to use its mobile terminal (normally mobile phone, now also can be described as mobile-phone payment) consumed commodity or service to be carried out to a kind of method of service of account payment.
Mobile applications, refers to installation application program on mobile terminals, needs to run this application program when performing mobile payment.
Cloud service platform, refers to the online service system of mobile applications.
The authentication method of cloud service platform of the present invention to mobile applications relates to two basic operation phase of mobile applications, is respectively first and runs and follow-up operation.Wherein, run for the first time, refer to after registration mobile applications is installed on mobile terminals in a kind of embodiment, the operation first of automatically actuated mobile applications; In another kind of embodiment, first operation refers to the installation and operation of mobile applications itself.Follow-up operation then refers to the program that on mobile terminal, mounted mobile applications is started at from the operation next time run first and runs, such as, in a kind of embodiment, mobile applications is mobile payment program, now, the program operation the etc. when follow-up operation of mobile payment program comprises program operation when carrying out mobile payment and binds bank card.In addition, some core datas used when cloud service platform carries out certification to the mobile applications that mobile terminal is installed when the first operation of mobile applications is intended to generate follow-up operation.
The present invention is intended to openly a kind of authentication method to mobile applications not relying on local key, belongs to the legitimacy certification of cloud service platform to mobile applications.Now be described specifically for the identifying procedure involved by mobile applications first operation on mobile terminals and follow-up operation or factor.See Fig. 1 and Fig. 2, shown in authenticating step flow chart performed when performed authenticating step flow chart and mobile applications follow-up operation when being respectively first operation,
S10, runs for the first time,
Between mobile applications beyond the clouds on service platform and mobile terminal, the communication of setting up based on PKI (PublicKeyInfrastructure, PKIX) technology connects.
S101, to all effective informations of the vital document in the whole program package of mobile applications (such as so library file, dex file, resource file and main all effective informations of joining file one of them or its combination, sampled population is formed by it) sample, same, the methods of sampling that this sampling adopts also can be random sampling, systematic sampling or the sampling of probability proportion scale etc.
S102, each individual content of sampling sampling selected generates cpu instruction according to certain command template, and encodes to the address of each sampling individuality that sampling selects thus obtain address sequence SOURCE_ADDR_SET.Wherein, command template is a series of configuration files, for carrying out the configuration of instruction, specification and filtration.Address sequence SOURCE_ADDR_SET is under the further configuration of a certain operational factor para, the authenticate key cpu instruction that content under each address generates being synthesized mobile applications generates subprogram func, thus the also corresponding authenticate key of this operational factor para generates subprogram func, the value of different secret generating subprogram func has been corresponding different operational factor para.Perform this authenticate key generate subprogram func and carry out Hash operation to its execution result, the authenticate key key_app of mobile applications can be generated.
The synthesis flow that authenticate key generates subprogram func is controlled by operational factor sequence PARA_SET, operational factor sequence PARA_SET is made up of multiple values of operational factor para, and the different values of operational factor para correspond to different secret generating subprogram func.Multiple authenticate key key_app corresponding to multiple values (or operational factor sequence PARA_SET) of operational factor para form authenticate key sequence KEY_SET; Correspondingly, the set FUNC_SET of operational factor sequence PARA_SET is corresponding one group of authenticate key generates subprogram func, and correspondence authenticate key sequence KEY_SET.
S103, mobile applications is encrypted address sequence SOURCE_ADDR_SET and the address sequence E_SOURCE_ADDR_SET encrypted is stored in mobile terminal.
S104, mobile applications by the clear crytpographic key decrypt of the address sequence E_SOURCE_ADDR_SET encrypted, operational factor sequence PARA_SET and authenticate key sequence KEY_SET according in advance and cloud service platform arrange machine-processed scrambling, break up after be sent to cloud service platform, descrambling, splicing and recovery can go out original contents after cloud service platform receives this batch data.
Operational factor para can be interpreted as that authenticate key generates the version number of subprogram.Preferably, also operational factor para can be interpreted as the configuration parameter of authenticate key subprogram, such as, operational factor PARA_SET can characterize following several configuration parameter:
1) loop configuration parameter
In corresponding programming by number of cycles and according to condition circulate, loop configuration parameter can comprise cycle-index and cycling condition.
2) branch configuration parameter
The execution of program branches structure selects execution route according to certain condition, and branch configuration parameter can comprise the Rule of judgment such as logic OR Relationship Comparison.
3) recurrence configuration parameter
Recursive algorithm is a kind of process calling self algorithm directly or indirectly, and recurrence configuration parameter can comprise recurrence border (end) condition.
When being synthesized authenticate key by many cpu instructions and generating subprogram func, can according to certain rules the instruction block formed by part cpu instruction be done branch, circulate or do recurrence.The value of different operational factor para corresponds to the rear authenticate key key_app difference generated of authenticate key generation subprogram func operation of different authenticate key generation subprogram func, corresponding different operational factor para.
S20, follow-up operation
S201, cloud service platform use initial session key by the operational factor para scrambling of clear crytpographic key decrypt and a certain value chosen arbitrarily from operational factor sequence PARA_SET, break up after be sent to mobile applications, namely mobile applications receives the operational factor of the clear crytpographic key that cloud service platform uses initial session key to send and a certain value chosen arbitrarily from operational factor sequence; Wherein, initial session key from SSL (SecureSocketsLayer, SSL), or can be generated other the convenient authentication method that mobile applications carries out by cloud service platform.
S202, mobile applications descrambling, splicing and recovery go out clear crytpographic key decrypt and operational factor para, then use clear crytpographic key decrypt be decrypted the address sequence E_SOURCE_ADDR_SET encrypted thus obtain address sequence SOURCE_ADDR_SET.
S203, the code content that the address place representated by each element that mobile applications one by one reads address sequence SOURCE_ADDR_SET stores, and according to command template, the code content read out being converted to executable cpu instruction respectively, the authenticate key then each cpu instruction being synthesized mobile applications generates subprogram func.Namely address sequence SOURCE_ADDR_SET is moved application program after usage and deletes, and only stores the address sequence E_SOURCE_ADDR_SET encrypted in mobile applications.Perform this authenticate key and generate subprogram func, after being finished, Hash operation is carried out to its execution result.Herein and the execution authenticate key that relates to above generate subprogram func and Hash operation carried out to its execution result, generate authenticate key key_app, comprise: after performing authenticate key generation subprogram func, Hash operation is carried out to the value of readable register all in CPU, or Hash operation is carried out to the value in the value of readable register all in CPU and partial memory, thus generate authenticate key key_app.
The different values of operational factor para correspond to different command template, when each follow-up operation of mobile applications performs certification, cloud service platform, according to the value of operational factor para being sent to mobile applications, sends corresponding command template and generates subprogram func to mobile applications to generate authenticate key.
The description of the operational factor para herein used during follow-up operation can with reference to above to the description of the operational factor para used during initial launch, same, flow process and the description thereof of synthesizing authenticate key generation subprogram func herein during follow-up operation also can with reference to above.When operational factor para is characterized by the configuration parameter of authenticate key generation subprogram, operational factor para may affect the state such as program structure, execution sequence that authenticate key generates subprogram.Such as, when operational factor para is characterized by cycle-index, certain Loop (circulation) link that authenticate key generates in subprogram will perform specific number of times according to operational factor para, the difference of operational factor para can make authenticate key generate the execution result difference of subprogram func, thus finally calculates different authenticate keys.Moreover such as, when operational factor is characterized by branch configuration parameter, authenticate key generates subprogram func and runs will obtain different execution results according to different individual paths.
This shows, the authenticate key that different operational factor para is corresponding different generates subprogram execution result, thus the different authenticate key key_app of correspondence, cloud service platform stores or authenticate key key_app by calculating corresponding different operational factor para.Similarly, namely operational factor para may be moved application program deletion after usage.
Be passed to the operational factor para of mobile applications from cloud service platform and also may include other additional informations, such as, other additional informations can be specific instruction, for replacing a certain in authenticate key subprogram func or some instruction; Other additional informations also can be operand, for replacing the operand of a certain in authenticate key subprogram func or some instruction.
S204, cloud service platform sends a random number random to mobile applications, mobile applications uses authenticate key key_app to be encrypted computing to random number random and obtains encrypted result e_key_app, and is uploaded by encrypted result e_key_app and be back to cloud service platform;
S205, cloud service platform usually judges whether pass through the certification of mobile applications according in encrypted result e_key_app and authenticate key sequence KEY_SET to the unit for operational factor para.
So far, the identifying procedure of cloud service platform to mobile applications is finished, if cloud service platform judges to pass through the certification of mobile applications according to encrypted result e_key_app, cloud service platform and mobile applications are according to key key_app session key generation key_session, and with this, service platform and mobile applications proceed follow-up session between the two beyond the clouds.Session key key_session can be used for being encrypted the session content between cloud service platform and mobile applications.
Service platform is in the identifying procedure of mobile applications beyond the clouds, the synthesis that authenticate key generates subprogram relates to following content: read in also order arrangement in one piece of continuous print internal memory according to address sequence SOURCE_ADDR_SET concentrated for the content (32 or 64) of the address place storage represented by its all elements, and be legal cpu instruction by the content translation corresponding with each element.Although the data content of the program file that the element of address sequence SOURCE_ADDR_SET is corresponding (dex file, resource file or main join file etc.) and primary cpu instruction are also uncorrelated, but command template or filter auxiliary under, the probability that the content corresponding with each element is translated into legal cpu instruction is very high.Meanwhile, obvious illegal instruction can be filtered out, such as, cause the unknowable jump instruction of execution result, understand accessing operation system data and the instruction causing system to drop by the wayside, etc.
The generating principle of cpu instruction legal in the embodiment of the present invention is similar to the process generating instruction in the random test of cpu instruction rank, as shown in Figure 3, authenticate key generates the instruction generation of subprogram and program synthesis block diagram generally includes following components: instruction database, command template, instruction generate engine, instruction simulation, instruction filter, program synthesis.Wherein, instruction database comprises the code line (instruction) of the vital document in the whole program package of mobile applications, vital document such as so library file, dex file, resource file and main join file one of them or its combination; Command template is a series of configuration files, for carrying out configuration and the specification of instruction; Instruction generates engine for generating corresponding instruction, and instruction generates engine effectively can support that the instruction under configuration file constraint generates; Instruction simulation is for simulating the instruction of execution generation and providing execution result; According to the execution result that instruction simulation provides, instruction filter judges whether the instruction generated can cause exception, if can cause abnormal, abandon this instruction; Program synthesis is used for the legal instruction composition command sequence that will generate, authentication authorization and accounting secret generating subprogram.
The content individual according to sampling generates the cpu instruction (depending on 32bit instruction set or 64bit instruction set) of 32bit or 64bit, in this generative process, instruction generates engine and the segmentation of the operator specified in content and instruction masterplate individual for sampling, source register, address register is matched, according to certain rules, generate corresponding cpu instruction, corresponding cpu instruction comprise data processing instructions, internal storage access instruction, jump instruction etc. and ratio shared by data processing instructions for the highest.
Wall scroll cpu instruction can be admitted to instruction filter after generating, and whether can produce accident when running according to this cpu instruction of context determination during dynamic operation; If this cpu instruction can produce accident when running, instruction filter can revise this cpu instruction till it is legal automatically by certain rule; By the detection of instruction filter, the authenticate key synthesized by wall scroll cpu instruction generates subprogram func can run out legal result.
It is the CPU executable program that of being formed by random sampling or the important procedure file of otherwise sampling in the whole program package of mobile applications is special that the present invention uses the authenticate key that is made up of cpu instruction to generate subprogram, and when performing certification Dynamic Execution.Because the Memorydump (memory capturing) after shelling makes static code not have secret to say, need to generate the Dynamic Execution of subprogram with authenticate key and evade the risk that static analysis brings, certification is once perform, and various forms of program is distorted and can be subject to effective suppression.
It is the performed cpu instruction sequence generated by command template that authenticate key of the present invention generates subprogram, newly-generated cpu instruction sequence and the original program file of mobile applications in terms of content or other aspects do not exist and express or implicit contacting, thus hacker or other malice are distorted people and according to original program file prediction or cannot be inferred the generating code authenticate key, more cannot know by inference and authenticate key itself.In the present invention, authenticate key dynamically generates when each certification, compares and stores with static data form, and the way that dynamic operation generates authenticate key is safer, meanwhile, the reliability of certification is ensured in the mode of " dual random " (random sampling and random number).
In the present invention, the certification of cloud service platform to mobile applications is the means using authenticate key as certification, some characteristic relations relevant to authenticate key are to the safety in utilization of mobile applications and reliability, wherein, authentication method of the present invention comprises following several aspect about the characteristic of authenticate key:
1) add and crack the difficulty of authenticate key and the complexity of authenticate key
In the present invention, authenticate key is generated by the code of Dynamic Execution, but not stores in the mode of static encryption, adds authenticate key and cracks barrier.If the data of authenticate key as static state stored, the data no matter stored are complete or fragment type, even if add overstocked, are also easy to tracked and replace.The authenticate key of dynamic generation can prevent the Memorydump after shelling to be subject to the attack of zjDroid or dextractor.In authenticate key generative process, need to use some inputs (such as operational factor para) coming from cloud service platform, generate the legitimacy of subprogram for validation verification key.When malice cracks authenticate key and dynamic-configuration or follows the trail of original program, once carry out some amendment to original program, with regard to likely distorting generating subprogram for the synthesis of authenticate key, the authenticate key finally calculated being changed, thus causes certification not passed through.If the CPU access instruction that reasonable employment generates, the effect of sample range being carried out secondary expansion can be realized.
2) randomness is increased in the mode of authenticate key to random number encryption
Although authentication method of the present invention is main authentication means with authenticate key, used by authenticate key in conjunction with random number, the randomness that random number self is had imparts this identifying procedure.Such as, randomness is embodied in: random number can be associated with the installation of mobile applications or running time, also can pay the utmost attention to and call or utilize the probabilistic random number of hardware.
3) increase " unpredictability " that authenticate key generates
Can generate in subprogram at authenticate key and arrange some parallel branchs, each branch can calculate an authenticate key result result, and when certification, which bar branch of choice for use is decided by cloud service platform transmission data.Also can generate in subprogram at authenticate key and implant some circulation or recurrence, the number of times performing circulation or recurrence when certification sends data by cloud service platform and decides.Some data that certainly can not be used to can also be inserted in original program bag, and allow these data selectedly get when sampling, mobile applications does some when can not fix and automatically upgrades, upgrade these with less than data, even make the authenticate key produced with Mobile phone also can be different along with renewal.
4) the anti-monitoring of key is increased
After authenticate key produces, cloud service platform can carry out certification to mobile applications in time, and then generates the session key needed for follow-up operation, and authenticate key can abandon, dynamically generate when needed again after generating by session key.
The certification of mobile applications when follow-up operation not necessarily needs to perform at once after login mobile applications, and runs when can be arranged in the mobile applications free time, and can repeatedly run, and can improve response speed when logging in mobile applications like this.
Cover the whole program package of mobile applications for synthesis authenticate key generates subprogram and the sampling carried out or at least cover so library file, dex file, resource file and mainly join the vital documents such as file, thus the risk that the program file that is not sampled is tampered can be reduced by the method increasing sampling density and extensive sampling scope, and improve the reliability of operation result.When sampling, can strengthen the sampling density of the non-sensitive part in mobile applications, wherein, the example and the object thereof that strengthen the non-sensitive part of sampling density are: rights management (distorting authority for preventing hacker); Branch instruction (preventing hacker from directly distorting important judgement); IO output order (preventing hacker from adding the printings such as printf/logCat).
Should be appreciated that exemplary embodiment as herein described is illustrative and nonrestrictive.And, can by each embodiment about each feature or in description be applicable to other similar characteristics in other embodiments or in.Each process step order of the present invention is nonrestrictive, can change, or increase or delete step according to practical application or sight to flow process sequence of steps.
Although describe one or more embodiment of the present invention by reference to the accompanying drawings, it should be understood by one skilled in the art that when not departing from the spirit and scope of the present invention limited by claims, the change of various forms and details can be made.
Claims (16)
1. do not rely on the authentication method to mobile applications of local key, for cloud service platform, certification carried out to the mobile applications arranged on mobile terminals, it is characterized in that, comprise the following steps:
S10, when mobile applications runs for the first time,
S101, samples to the sampled population of mobile applications, carries out coding obtain address sequence to the address of each sampling individuality that sampling selects;
S102, content under each for address sequence address is generated cpu instruction according to certain command template, the authenticate key cpu instruction of generation being synthesized mobile applications under the further configuration of a certain operational factor generates subprogram, perform this authenticate key generate subprogram and carry out Hash operation to its execution result, generate the authenticate key of mobile applications, the multiple authenticate keys corresponding to multiple values of operational factor form authenticate key sequence;
S103, is encrypted address sequence, and the address sequence encrypted is stored in mobile terminal;
S104, is sent to cloud service platform by the clear crytpographic key of address sequence, operational factor sequence and authenticate key sequence;
S20, during mobile applications follow-up operation,
S201, mobile applications receives cloud service platform and uses the clear crytpographic key that initial session key sends and the operational factor of a certain value chosen arbitrarily from operational factor sequence;
S202, mobile applications is decrypted the address sequence encrypted and obtains address sequence;
S203, reads the content at address sequence each element address place and generates corresponding cpu instruction, and synthesis secret generating subprogram also generates authenticate key after execution;
S204, cloud service platform sends random number to mobile applications, obtains encrypted result and be back to cloud service platform after encryption;
S205, cloud service platform completes final authentication according to encrypted result.
2. according to authentication method according to claim 1, it is characterized in that, in S101, described sampled population comprises so library file, dex file, resource file and main all effective informations of joining file one or a combination set of.
3. according to authentication method according to claim 1, it is characterized in that, increase and belong to vulnerable, distort, add the sampling individuality of the code of shell, data and Configuration Type and account for sampled population ratio, or increase the sampling individuality be positioned at close to the position of maximum address end, lowest address end and account for sampled population ratio, or increase to be positioned at and be convenient to identify that the sampling individuality at position of the similarities and differences accounts for sampled population ratio.
4. according to authentication method according to claim 1, it is characterized in that, in S102, described command template is a series of configuration files of configuration for carrying out instruction, specification and filtration.
5. according to authentication method according to claim 1, it is characterized in that, described cpu instruction comprises data processing instructions, internal storage access instruction, jump instruction, and wherein data processing instructions has and accounts for the highest ratio.
6. according to the arbitrary described authentication method of claim 1 to 5, it is characterized in that, wall scroll cpu instruction is admitted to instruction filter after generating, whether accident can be produced when running according to this cpu instruction of context determination during dynamic operation, if this cpu instruction can produce accident when running, instruction filter can revise this cpu instruction till it is legal automatically by certain rule.
7. according to authentication method according to claim 6, it is characterized in that, operational factor is the version number that authenticate key generates subprogram.
8. according to authentication method according to claim 6, it is characterized in that, operational factor is the configuration parameter that authenticate key generates subprogram.
9. according to authentication method according to claim 8, it is characterized in that, described configuration parameter is loop configuration parameter, branch configuration parameter or recurrence configuration parameter, command template Release parameter, and the value of different operational factors corresponds to different authenticate keys and generates subprogram; The authenticate key generated after the authenticate key generation subprogram activation of corresponding different operational factor is different.
10. according to authentication method according to claim 1, it is characterized in that, in S102, perform this authenticate key generate subprogram and carry out Hash operation to its execution result, the authenticate key generating mobile applications is specially, and after performing authenticate key generation subprogram, carries out Hash operation to the value of readable register all in CPU, or Hash operation is carried out to the value in the value of readable register all in CPU and partial memory, thus generate authenticate key.
11., according to authentication method according to claim 1, is characterized in that, in S201, initial session key generates from SSL or by cloud service platform other the convenient authentication method that mobile applications carries out.
12., according to authentication method according to claim 1, is characterized in that, when being synthesized authenticate key by many cpu instructions and generating subprogram, can according to certain rules the instruction block formed by part cpu instruction be done branch, circulate or do recurrence.
13. according to authentication method according to claim 1, it is characterized in that, mobile applications is when running for the first time, the value all to operational factor travels through to form operational factor sequence, thus generating set and the authenticate key sequence that authenticate key generates subprogram, operational factor sequence, authenticate key generate the set of subprogram and the respective element of authenticate key sequence three exists one-to-one relationship.
14. according to authentication method according to claim 1, it is characterized in that, when each follow-up operation of mobile applications carries out certification to it, cloud service platform chooses an operational factor for this certification randomly from operational factor sequence, only generates an authenticate key and generate subprogram during each follow-up operation of mobile applications.
15. according to authentication method according to claim 1, it is characterized in that, the different values of operational factor correspond to different command template, when each follow-up operation of mobile applications performs certification, cloud service platform, according to the value of operational factor being sent to mobile applications, sends corresponding command template and generates subprogram to mobile applications to generate authenticate key.
16., according to authentication method according to claim 1, is characterized in that, the hash algorithm that Hash operation uses is MD2, MD4, MD5, SHA-1, the close algorithm of state or other hash algorithms.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510703772.6A CN105357012A (en) | 2015-10-26 | 2015-10-26 | Authentication method for mobile application not depending on local private key |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510703772.6A CN105357012A (en) | 2015-10-26 | 2015-10-26 | Authentication method for mobile application not depending on local private key |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN105357012A true CN105357012A (en) | 2016-02-24 |
Family
ID=55332891
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510703772.6A Pending CN105357012A (en) | 2015-10-26 | 2015-10-26 | Authentication method for mobile application not depending on local private key |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105357012A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106651363A (en) * | 2016-12-28 | 2017-05-10 | 飞天诚信科技股份有限公司 | Hardware wallet and hardware wallet holder identity verification method |
| CN107911393A (en) * | 2017-12-28 | 2018-04-13 | 北京明朝万达科技股份有限公司 | A kind of data safety management system and method |
| CN110647410A (en) * | 2019-09-25 | 2020-01-03 | 广州河东科技有限公司 | Inter-process data transmission method and device, electronic equipment and storage medium |
| CN110740036A (en) * | 2019-10-31 | 2020-01-31 | 广州知弘科技有限公司 | Anti-attack data confidentiality method based on cloud computing |
| CN111917680A (en) * | 2019-05-07 | 2020-11-10 | 中国移动通信集团湖南有限公司 | Encryption system, method, server and storage medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1731460A (en) * | 2005-07-01 | 2006-02-08 | 潘铁军 | A mobile payment system based on distributed cipher key and encryption method |
| CN101765105A (en) * | 2009-12-17 | 2010-06-30 | 北京握奇数据系统有限公司 | Method for realizing communication encryption as well as system and mobile terminal therefor |
| CN102571340A (en) * | 2010-12-23 | 2012-07-11 | 普天信息技术研究院有限公司 | Certificate authentication device as well as access method and certificate update method thereof |
| CN103530775A (en) * | 2012-09-28 | 2014-01-22 | 深圳市家富通汇科技有限公司 | Method and system for providing controllable trusted service manager |
| CN103685138A (en) * | 2012-08-30 | 2014-03-26 | 卓望数码技术（深圳）有限公司 | Method and system for authenticating application software of Android platform on mobile internet |
| CN104166914A (en) * | 2014-08-20 | 2014-11-26 | 武汉天喻信息产业股份有限公司 | Secure system and method based on secure element and applied to host card emulation technology |
| US20150227916A1 (en) * | 2012-09-12 | 2015-08-13 | Cellum Global Innovációs És Szolgáltató Zrt. | Application system for mobile payment and method for providing and using mobile means for payment |
-
2015
- 2015-10-26 CN CN201510703772.6A patent/CN105357012A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1731460A (en) * | 2005-07-01 | 2006-02-08 | 潘铁军 | A mobile payment system based on distributed cipher key and encryption method |
| CN101765105A (en) * | 2009-12-17 | 2010-06-30 | 北京握奇数据系统有限公司 | Method for realizing communication encryption as well as system and mobile terminal therefor |
| CN102571340A (en) * | 2010-12-23 | 2012-07-11 | 普天信息技术研究院有限公司 | Certificate authentication device as well as access method and certificate update method thereof |
| CN103685138A (en) * | 2012-08-30 | 2014-03-26 | 卓望数码技术（深圳）有限公司 | Method and system for authenticating application software of Android platform on mobile internet |
| US20150227916A1 (en) * | 2012-09-12 | 2015-08-13 | Cellum Global Innovációs És Szolgáltató Zrt. | Application system for mobile payment and method for providing and using mobile means for payment |
| CN103530775A (en) * | 2012-09-28 | 2014-01-22 | 深圳市家富通汇科技有限公司 | Method and system for providing controllable trusted service manager |
| CN104166914A (en) * | 2014-08-20 | 2014-11-26 | 武汉天喻信息产业股份有限公司 | Secure system and method based on secure element and applied to host card emulation technology |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106651363A (en) * | 2016-12-28 | 2017-05-10 | 飞天诚信科技股份有限公司 | Hardware wallet and hardware wallet holder identity verification method |
| CN106651363B (en) * | 2016-12-28 | 2020-06-02 | 飞天诚信科技股份有限公司 | Hardware wallet and holder identity verification method thereof |
| CN107911393A (en) * | 2017-12-28 | 2018-04-13 | 北京明朝万达科技股份有限公司 | A kind of data safety management system and method |
| CN107911393B (en) * | 2017-12-28 | 2019-01-25 | 北京明朝万达科技股份有限公司 | A kind of data safety management system and method |
| CN111917680A (en) * | 2019-05-07 | 2020-11-10 | 中国移动通信集团湖南有限公司 | Encryption system, method, server and storage medium |
| CN110647410A (en) * | 2019-09-25 | 2020-01-03 | 广州河东科技有限公司 | Inter-process data transmission method and device, electronic equipment and storage medium |
| CN110740036A (en) * | 2019-10-31 | 2020-01-31 | 广州知弘科技有限公司 | Anti-attack data confidentiality method based on cloud computing |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Kannengießer et al. | Trade-offs between distributed ledger technology characteristics | |
| KR102609061B1 (en) | Blockchain transaction security technique based on undetermined data | |
| US11038689B2 (en) | Efficient block chain generation | |
| AU2012205457B2 (en) | System and method for tamper-resistant booting | |
| DK1479187T4 (en) | MANAGEMENT OF ACCESS LEVELS IN PHONES USING CERTIFICATES | |
| CN102760219B (en) | A kind of Android platform software protection system, method and apparatus | |
| US7886355B2 (en) | Subsidy lock enabled handset device with asymmetric verification unlocking control and method thereof | |
| CN106991298B (en) | Access method of application program to interface, authorization request method and device | |
| TW201741956A (en) | Implementing logic gate functionality using a blockchain | |
| CN109583885A (en) | Bout controls rewritable block chain | |
| CN105357012A (en) | Authentication method for mobile application not depending on local private key | |
| US20170116410A1 (en) | Software protection | |
| CN108199852A (en) | A kind of method for authenticating, right discriminating system and computer readable storage medium | |
| CN101199159A (en) | Secure boot | |
| CN109614769A (en) | The secure operating system starting encapsulated according to reference platform inventory and data | |
| CN111314066B (en) | Block chain-based data transfer method, terminal and computer-readable storage medium | |
| CN101282220B (en) | Information safety equipment for reinforcing key use security as well as implementing method thereof | |
| CN113112354A (en) | Transaction processing method of block chain network, block chain network and storage medium | |
| CN113595731A (en) | Protection method and device for shared link and computer readable storage medium | |
| CN105243320A (en) | Authentication method of cloud service platform on mobile application program | |
| Wu et al. | A cloud-user access control mechanism based on data masking | |
| CN109523258A (en) | POS client public key safety certifying method, device and terminal device | |
| Ahola | Implementing Ethereum blockchain to RGCE cyber range | |
| Zheng et al. | BSHUNTER: Detecting and Tracing Defects of Bitcoin Scripts | |
| US20230401312A1 (en) | Data security in a metaverse environment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20160224 |