CN107169320A - Method of calibration and device - Google Patents

Method of calibration and device Download PDF

Info

Publication number
CN107169320A
CN107169320A CN201710262176.8A CN201710262176A CN107169320A CN 107169320 A CN107169320 A CN 107169320A CN 201710262176 A CN201710262176 A CN 201710262176A CN 107169320 A CN107169320 A CN 107169320A
Authority
CN
China
Prior art keywords
application
api
specific api
apk
signature file
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201710262176.8A
Other languages
Chinese (zh)
Inventor
王乐
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Xiaomi Mobile Software Co Ltd
Original Assignee
Beijing Xiaomi Mobile Software Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Xiaomi Mobile Software Co Ltd filed Critical Beijing Xiaomi Mobile Software Co Ltd
Priority to CN201710262176.8A priority Critical patent/CN107169320A/en
Publication of CN107169320A publication Critical patent/CN107169320A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12Protecting executable software
    • G06F21/121Restricting unauthorised execution of programs

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

The disclosure is directed to method of calibration and device.This method includes:Call authority information to be packaged in the APK of application specific API, complete the statement of the application for special access right;The call request that the application is directed to the specific API is monitored in system operation;When monitoring that the application is directed to specific API call request, inquired about from the APK of the application and authority information is called to the specific API, authority information is called to the specific API if inquiring, allows to call the specific API, otherwise forbids calling the specific API.The technical scheme will allow the specific API called to be packaged among the APK of application, and operationally for specific API Calls, corresponding API be inquired about in the APK for removing caller, so as to reach the purpose accurately controlled.

Description

Method of calibration and device
Technical field
This disclosure relates to electronic device field, more particularly to method of calibration and device.
Background technology
Android (Android) system possesses installation kit (Android Package, APK) signature check mechanism, the signature machine System is a kind of mode that Android system is used for identifying developer's identity, for protecting application program updating, supporting application program mould Block and provide control of authority for the data sharing and code of application program.
The content of the invention
The embodiment of the present disclosure provides method of calibration and device.The technical scheme is as follows:
According to the first aspect of the embodiment of the present disclosure there is provided a kind of method of calibration, including:
Call authority information to be packaged in the installation kit APK of application application-specific DLL API, complete pin Statement to the application of special access right;
The call request that the application is directed to the specific API is monitored in system operation;
When monitoring that the application is directed to specific API call request, inquired about from the APK of the application to the spy That determines API calls authority information, and authority information is called to the specific API if inquiring, and allows to call described specific API, otherwise forbids calling the specific API.
The technical scheme provided by this disclosed embodiment can include the following benefits:The specific API that calls will be allowed It is packaged among the APK of application, and operationally for specific API Calls, corresponding API is inquired about in the APK for removing caller, so that Reach the purpose accurately controlled.
In one embodiment, it is described to call authority information to be packaged in the APK of application specific API, complete to be directed to The statement of the application of special access right includes:
The special access right is stated in the statement file of the application, and is generated in signature file, the signature file At least define the check value of the APK, may have access to API list and valid certificate date;Stored in the addressable API list There is addressable API authority recalls information;
Increase the signature file in the APK for the application of packing.
The technical scheme provided by this disclosed embodiment can include the following benefits:How introduction completes statement, will Need the content of checking to be packaged in APK, be further ensured that the accurate fixed of checking.
In one embodiment, it is described when monitoring that the application is directed to specific API call request, from the application APK in inquire about authority information called to the specific API, authority information is called to the specific API if inquiring, Allow to call the specific API, otherwise forbid calling the specific API, including:
The signature file and the first current date are extracted from the APK of the application;
Verify the specific API whether the API in the addressable API list defined in the signature file, and Whether first current date is described in the signature file within valid certificate date;
API in the addressable API lists of the checking specific API defined in the signature file, and institute State current date described in the signature file within valid certificate date when, it is allowed to call the specific API, otherwise forbid Call the specific API.
The technical scheme provided by this disclosed embodiment can include the following benefits:According at least to date, check value Verify whether that specific API can be called with addressable API list, it is ensured that the accuracy of verification.
In one embodiment, methods described also includes:
When installation is claimed as the application of special access right, signature file, the signature file are extracted from the APK of the application Legitimacy is applied to verify, at least including the check value, the valid certificate date and the list of devices;
According to the signature file, it is determined whether install the application.
The technical scheme provided by this disclosed embodiment can include the following benefits:When installation is applied, pacified Dress verification, it is ensured that the application of installation is not tampered with.
In one embodiment, it is described according to the signature file, it is determined whether installing the application includes:
Obtain the second current date, the default check value of storage and the machine mark;
Verify whether the default check value is identical with the check value;
Verify second current date whether within the valid certificate date;
It is the mark in the list of devices to verify that described the machine is identified whether;
Wherein, when the default check value is identical with the check value, second current date is effective in the certificate Within date, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
The technical scheme provided by this disclosed embodiment can include the following benefits:It is specific to introduce how to carry out school Test, ensure the accurate fixed of verification from multi-angle.
According to the second aspect of the embodiment of the present disclosure there is provided a kind of calibration equipment, including:
Declaration module, for calling authority information to be packaged in the APK of application specific API, completes to be directed to special power The statement of the application of limit;
Monitoring modular, the call request of the specific API is directed to for monitoring the application in system operation;
Enquiry module, for when monitoring that the application is directed to specific API call request, from the APK of the application Middle inquiry calls authority information to the specific API, calls authority information to the specific API if inquiring, allows The specific API is called, otherwise forbids calling the specific API.
In one embodiment, the declaration module includes:
Submodule is generated, for stating the special access right in the statement file of the application, and signature file is generated, The check value of the APK is at least defined in the signature file, API list and valid certificate date is may have access to;It is described to visit Ask the authority recalls information for the addressable API that is stored with API list;
Increase submodule, the signature file is increased during for APK in the application of packing.
In one embodiment, the enquiry module includes:
Extracting sub-module, for extracting the signature file and the first current date from the APK of the application;
First checking submodule, for that can visit described in verifying the specific API whether defined in the signature file Ask the API in API list, and whether first current date is described in the signature file within valid certificate date;
Submodule is handled, for the addressable API row as the checking specific API defined in the signature file API in table, and the current date described in the signature file within valid certificate date when, it is allowed to call the spy Determine API, otherwise forbid calling the specific API.
In one embodiment, described device also includes:
Extraction module, when being claimed as the application of special access right for installing, extracts signature text from the APK of the application Part, the signature file applies legitimacy to verify, at least including the check value, the valid certificate date and described sets Standby list;
Determining module, for according to the signature file, it is determined whether install the application.
In one embodiment, the determining module includes:
Acquisition submodule, for obtaining the second current date, the default check value of storage and the machine mark;
Second checking submodule, for verifying whether the default check value and the check value are identical;Verify described Whether two current dates are within the valid certificate date;It is the mark in the list of devices to verify that described the machine is identified whether Know;
Wherein, when the default check value is identical with the check value, second current date is effective in the certificate Within date, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
According to the third aspect of the embodiment of the present disclosure there is provided a kind of calibration equipment, including:
Processor;
Memory for storing processor-executable instruction;
Wherein, the processor is configured as:
Call authority information to be packaged in the installation kit APK of application application-specific DLL API, complete pin Statement to the application of special access right;
The call request that the application is directed to the specific API is monitored in system operation;
When monitoring that the application is directed to specific API call request, inquired about from the APK of the application to the spy That determines API calls authority information, and authority information is called to the specific API if inquiring, and allows to call described specific API, otherwise forbids calling the specific API.
According to the fourth aspect of the embodiment of the present disclosure there is provided a kind of computer-readable recording medium, calculating is stored thereon with Machine program, the step of program realizes the above method when being executed by processor.
It should be appreciated that the general description of the above and detailed description hereinafter are only exemplary and explanatory, not The disclosure can be limited.
Brief description of the drawings
Accompanying drawing herein is merged in specification and constitutes the part of this specification, shows the implementation for meeting the disclosure Example, and be used to together with specification to explain the principle of the disclosure.
Fig. 1 is the flow chart of the verification method according to an exemplary embodiment.
Fig. 2 is the flow chart of the verification method according to an exemplary embodiment.
Fig. 3 is the flow chart of the verification method according to an exemplary embodiment.
Fig. 4 is the flow chart of the verification method according to an exemplary embodiment.
Fig. 5 is the flow chart of the verification method according to an exemplary embodiment.
Fig. 6 is the block diagram of the checking device according to an exemplary embodiment.
Fig. 7 is the block diagram of the checking device according to an exemplary embodiment.
Fig. 8 is the block diagram of the checking device according to an exemplary embodiment.
Fig. 9 is the block diagram of the checking device according to an exemplary embodiment.
Figure 10 is the block diagram of the checking device according to an exemplary embodiment.
Figure 11 is the block diagram of the checking device according to an exemplary embodiment.
Embodiment
Here exemplary embodiment will be illustrated in detail, its example is illustrated in the accompanying drawings.Following description is related to During accompanying drawing, unless otherwise indicated, the same numbers in different accompanying drawings represent same or analogous key element.Following exemplary embodiment Described in embodiment do not represent all embodiments consistent with the disclosure.On the contrary, they be only with it is such as appended The example of the consistent apparatus and method of some aspects be described in detail in claims, the disclosure.
In correlation technique, the original signature check mechanism of Android system is divided into APK signatures and two parts of signature check. Signature is carried out to APK and is divided into three steps:A) digest algorithm is done to each file in bag, be stored in In MANIFEST.MF;B) digest algorithm is done to the whole files of MANIFEST.MF, is stored in the head attribute of .SF files, A digest algorithm is done to each attribute block in MANIFEST.MF files again, is stored in correspondence attribute block;C) finally using opening The private key of originator is signed to .SF files, and content is stored in .RSA.
When carrying out APK installations, Android system is first reverse to carry out the first two steps, and exploitation is then extracted from .RSA files Person's public key, using public key .SF files are done digital signature and with the .SF signature comparisons in .RSA files.Verification passes through above, can To confirm that APK contents are not tampered with.In addition in Android system, using the power that oneself can state that protection level is " signature " Limit, only allows the data and code that the protection of usage right is accessed by the application of identical digital certificate signature.
But signature check mechanism primary Android, it can guarantee that the APK of installation is not tampered with, and be common between applying Enjoy data and code provides the support of control of authority, but the original signature check mechanism granularity of Android system is excessive, it is impossible to do To accurate control concrete application Program Interfaces (Application Programming Interface, API) API Calls.
Fig. 1 is a kind of flow chart of method of calibration according to an exemplary embodiment, as shown in figure 1, method of calibration For in calibration equipment, the device to be applied in terminal, and this method comprises the following steps 101-103:
In a step 101, call authority information to be packaged in the APK of application specific API, complete to be directed to special access right Application statement.
In a step 102, call request of the monitoring application for specific API in system operation.
In step 103, when monitoring to apply the call request for specific API, inquired about from the APK of application to spy That determines API calls authority information.
At step 104, authority information is called to specific API if inquiring, allows to call specific API.
In step 105, authority information is called to specific API if not inquiring, forbids calling specific API.
In the present embodiment, the specific API called will be allowed to be packaged among the APK of application, and operationally for specific Corresponding API is inquired about in API Calls, the APK for removing caller, so as to reach the purpose accurately controlled.
In one embodiment, step 101 includes:
Special access right is stated in the statement file of application, and generates signature file, here, is at least defined in signature file APK check value, it may have access to API list and valid certificate date;It may have access to the power for the addressable API that is stored with API list Limit recalls information;Increase signature file in the APK of packing application.Signature file can also include extension permissions list.
Here, check value can be APKhash, i.e. APK cryptographic Hash, and the cryptographic Hash is the logical of each file in installation kit Cross the result that hash algorithm is obtained.What deserves to be explained is, the verification check value and check value of the present embodiment can be by Hash What algorithm was obtained, it can also be obtained by other algorithms, the present embodiment is without limitation.In the present embodiment, if certificate, APKHash is sky, can skip this step, while list of devices can not be sky.
In the present embodiment, special access right is stated among application Manifest.xml, and increase by one when packing installation kit APKHash is defined among individual extra .CER files (.CER files are the signature file in the present embodiment), the .CER files (check value), list of devices, API list, the period of validity of certificate, expansible API etc..In application process is entirely installed, Complete after the primary signature steps of Android, additionally .CER files are signed using developer's private key, and after signature Content be stored in SIGNEDCER files.In order to when mounted, be entered according to the content after the signature to the .CER files Row checking, judges whether the .CER files are tampered.
In addition in Android system, using can oneself statement protection level be set to the power of " signature (signature) " Limit, only allows the data and code that the protection of usage right is accessed by the application of identical digital certificate signature.
In one embodiment, step 103 can include:Signature file and the first current date are extracted from the APK of application; Verify specific API whether the API in the addressable API list defined in the signature file, and the first current date whether In signature file within valid certificate date;
Accordingly, step 104 can include:When in addressable API lists of the specific API of checking defined in signature file API, and current date in signature file within valid certificate date when, it is allowed to call specific API;
Accordingly, step 105 can include:When addressable API lists of the specific API of checking not defined in signature file In API, or current date not in signature file within valid certificate date when, forbid calling specific API.
Further, methods described also includes:
When installation is claimed as the application of special access right, signature file is extracted from the APK of application, here, signature file is used Legitimacy is applied to verify, at least including check value, valid certificate date and list of devices;According to signature file, it is determined whether Application is installed.
Here, application is installed to refer to application is installed by the APK.Here refer to that the application is not tampered with using legitimacy, The APK of the application is not tampered with.
In the present embodiment, the APK of application can be the APK for using public key encryption in advance, and device can be decrypted by private key, protected Card APK will not be tampered.Likewise, developer's public key can also be used to sign signature file, the signature of storage is (above Stored in described SIGNEDCER files) contrasted, it is ensured that signature file is not tampered with.Here, the signature of storage is to pass through The signature that the original signature check mechanism of Android system is obtained.
In one embodiment, it is described according to signature file, it is determined whether installing application includes:
Obtain the second current date, the default check value of storage and the machine mark;Check value is preset in checking It is no identical;Verify the second current date whether within valid certificate date;Checking the machine is identified whether in being list of devices Mark;
Wherein, when default check value is identical with check value, the second current date is within valid certificate date, and the machine mark Know when whether being the mark in list of devices, it is determined that installing application.
What deserves to be explained is, if there is no list of devices in signature file, then it is considered that list of devices is sky, only need When default check value is identical with the check value, and the second current date within valid certificate date when, it is determined that installing application. Default check value can be that the result or done to each file in APK that an algorithm obtains integrally have been done to APK The result that algorithm is obtained, the algorithm can be digest algorithm.Accordingly, check value needs also exist for obtaining by identical algorithm The result arrived.
The machine mark in the present embodiment can be the unique mark for representing the machine.For example, International Mobile Equipment Identity code (International Mobile Equipment Identity, IMEI).
What deserves to be explained is, the API list in the present embodiment can be not stored in the memory space in device, but store In Cloud Server, when needing checking, or, after application is installed, it can be sent to Cloud Server for asking this should The request of API list can be called, Cloud Server is sent according to the request to device can call API list.
Embodiment two
Fig. 2 is a kind of flow chart of method of calibration according to an exemplary embodiment, as shown in Fig. 2 method of calibration For in calibration equipment, the calibration equipment is applied to terminal device, and this method comprises the following steps 201-210,
In step 201, special access right is stated in the statement file of application, and generates signature file.
Here, APK check value is at least defined in signature file, API list and valid certificate date is may have access to;It can visit Ask the authority recalls information for the addressable API that is stored with API list.
In step 202., signature file is increased in the APK of packing application.
In step 203, when installation is claimed as the application of special access right, signature file is extracted from the APK of application.
Here, signature file applies legitimacy to verify, is at least arranged including check value, valid certificate date and equipment Table.
In step 204, the second current date, the default check value of storage and the machine mark are obtained.
Default check value is stored in MANIFEST.SF files.
In step 205, verify whether default check value is identical with check value;Verify the second current date whether in certificate Within validity date;Checking the machine identifies whether it is the mark in list of devices.If so, then performing step 206;If any no, Then terminate this flow.
In step 206, installed and applied by APK.
In step 207, call request of the monitoring application for specific API in system operation.
In a step 208, when monitoring to apply the call request for specific API, signature text is extracted from the APK of application Part and the first current date.
In step 209, verify specific API whether the API in the addressable API list defined in signature file, and Whether the first current date is in the signature file within valid certificate date.If so, then performing step 210;If any no, Then perform step 211.
In step 210, it is allowed to call specific API.
In step 211, forbid calling specific API.
The present embodiment realizes the accurate control of authority of specific API Calls, so as to ensure among enterprise customization ROM externally The senior API provided can only be by believable application call.
Embodiment three
Fig. 3 is a kind of flow chart of method of calibration according to an exemplary embodiment, as shown in figure 3, method of calibration For in calibration equipment, the calibration equipment to be applied to terminal device.In the demand that enterprise customizes ROM, in order to reach that management and control is set Standby purpose, it is desirable to some high level API of exposure, at this moment in order to ensure security, it is necessary to install the application do not distorted, and Authorization check is carried out using these special API are called in operation.
Before this, exploitation side needs to sign to the APK of application, and the present embodiment provides the signature process of exploitation side, This method comprises the following steps 301-306,
In step 301, special access right is stated in the statement file of application, and generates .CER files.
Here, APKhash is at least defined in .CER files, API list and valid certificate date is may have access to;Here, may be used Access the authority recalls information for the addressable API that is stored with API list.Each API mark and the authority species phase that can be called Correspondence.
In step 302 .CER files are increased in the APK of packing application.
In step 303, a digest algorithm is done to each file in the APK of application, by the first obtained result It is stored in MANIFEST.MF files.
In step 304, a digest algorithm is done to MANIFEST.MF files, the second obtained result is stored in In the head attribute of MANIFEST.SF files.
In step 305, a digest algorithm is done to each attribute block in MANIFEST.MF files, by the obtain the 3rd As a result it is stored in correspondence attribute block.
Within step 306, MANIFEST.SF files are signed using the private key of developer, by the 4th obtained result It is stored in .RSA.
What is needed when the present embodiment is installation application, application call API is verified information package into APK, it is ensured that afterwards Checking has checking foundation.
Fig. 4 is a kind of flow chart of method of calibration according to an exemplary embodiment, as shown in figure 4, method of calibration For in calibration equipment, the calibration equipment to be applied to terminal device.When enterprise need install this apply when, this method can include Following steps 307-317,
In step 307, an inverse algorithm is done to the 3rd result in attribute block in MANIFEST.MF files, obtained 3rd parsing content of each attribute block in MANIFEST.MF files.
Inverse algorithm is the algorithm of the reverse calculating of digest algorithm.
In step 308, an inverse algorithm is done to the 3rd parsing content for parsing attribute to the end, obtained Second parsing content of MANIFEST.MF files.
In a step 309, an inverse algorithm is done to the second parsing content, obtains APK each resolution file.
In the step 310, judge whether corresponding file is identical in each resolution file and APK.If so, then performing step 311;If it is not, then performing step 317.
In step 311, developer's public key is extracted from .RSA files, MANIFEST.SF is signed using public key To the 5th result.
In step 312, judge whether the 5th result and the 4th result are identical.If so, then performing step 313;If it is not, then Perform step 317.
In step 313 .CER files are extracted from the APK of application.
Here .CER files apply legitimacy to verify, are at least arranged including APKhash, valid certificate date and equipment Table.
In a step 314, the second current date, default cryptographic Hash and the machine IMEI are obtained.
Here, default cryptographic Hash is default check value.
In step 315, verify whether default cryptographic Hash is identical with APKhash;Verify the second current date whether in card Within book validity date;Whether checking the machine IMEI is mark in list of devices.If so, then performing step 316;If any It is no, then perform step 317.
In step 316, it is allowed to installed and applied by APK.
In step 317, no thoroughfare, and APK installs application.
This implementation is verified twice, has first carried out the invers verification of digest algorithm, and according to additional .CER files Verified, applied when verifying all to successfully pass to install by APK twice, so, double verification is further ensured that again APK is not distorted.
Fig. 5 is a kind of flow chart of method of calibration according to an exemplary embodiment, as shown in figure 4, method of calibration For in calibration equipment, the calibration equipment to be applied to terminal device.In the demand that enterprise customizes ROM, in order to reach that management and control is set Standby purpose, it is desirable to some high level API of exposure, at this moment in order to ensure security, it is necessary to be carried out to these special API Calls Authorization check.This method can include 318-322,
In step 318, call request of the monitoring application for specific API in system operation.
In step 319, when monitoring to apply the call request for specific API .CER texts are extracted from the APK of application Part and the first current date.
In step 320, verify specific API whether the API in the addressable API list defined in signature file, and Whether the first current date is in signature file within valid certificate date.If so, then performing step 321;If it is not, then performing step Rapid 322.
In step 321, it is allowed to call specific API.
In step 322, forbid calling specific API.
The present embodiment realizes the accurate control of authority of specific API Calls, so as to ensure among enterprise customization ROM externally The senior API provided can only be by believable application call.
Following is disclosure device embodiment, can be used for performing method of disclosure embodiment.
Example IV
Fig. 6 is a kind of block diagram of calibration equipment according to an exemplary embodiment, and the device can be by software, hard Being implemented in combination with for part or both is some or all of as electronic equipment.As shown in fig. 6, the calibration equipment includes:
Declaration module 401, for calling authority information to be packaged in the APK of application specific API, is completed for special The statement of the application of authority;
Monitoring modular 402, please for calling for the specific API for monitoring the application in system operation Ask;
Enquiry module 403, for when monitoring that the application is directed to specific API call request, from the application Inquired about in APK and authority information is called to the specific API, authority information is called to the specific API if inquiring, permitted Permitted to call the specific API, otherwise forbid calling the specific API.
In the present embodiment, the specific API called will be allowed to be packaged among the APK of application, and operationally for specific Corresponding API is inquired about in API Calls, the APK for removing caller, so as to reach the purpose accurately controlled.
In one embodiment, as shown in fig. 7, the declaration module 401 includes:
Submodule 4011 is generated, for stating the special access right in the statement file of the application, and signature is generated The check value of the APK is at least defined in file, the signature file, API list and valid certificate date is may have access to;It is described It may have access to the authority recalls information for the addressable API that is stored with API list;
Increase submodule 4012, the signature file is increased during for APK in the application of packing.
In one embodiment, as shown in figure 8, the enquiry module 403 includes:
Extracting sub-module 4031, for extracting the signature file and the first current date from the APK of the application;
First checking submodule 4032, described in verifying the specific API whether defined in the signature file May have access to API list in API, and first current date whether the valid certificate date described in the signature file it It is interior;
Submodule 4033 is handled, verifies that the specific API is described addressable defined in the signature file for working as API in API list, and the current date described in the signature file within valid certificate date when, it is allowed to call The specific API, otherwise forbids calling the specific API.
In one embodiment, as shown in figure 9, described device also includes:
Extraction module 404, when being claimed as the application of special access right for installing, extracts signature from the APK of the application File, the signature file applies legitimacy to verify, at least including the check value, the valid certificate date and described List of devices;
Determining module 405, for according to the signature file, it is determined whether install the application.
In one embodiment, as shown in Figure 10, the determining module 405 includes:
Acquisition submodule 4051, for obtaining the second current date, the default check value of storage and the machine mark;
Second checking submodule 4052, for verifying whether the default check value and the check value are identical;Checking institute The second current date is stated whether within the valid certificate date;Verify that described the machine is identified whether in being the list of devices Mark;
Wherein, when the default check value is identical with the check value, second current date is effective in the certificate Within date, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
According to the third aspect of the embodiment of the present disclosure there is provided a kind of calibration equipment, including:
Processor;
Memory for storing processor-executable instruction;
Wherein, processor is configured as:
Call authority information to be packaged in the installation kit APK of application application-specific DLL API, complete pin Statement to the application of special access right;
The call request that the application is directed to the specific API is monitored in system operation;
When monitoring that the application is directed to specific API call request, inquired about from the APK of the application to the spy That determines API calls authority information, and authority information is called to the specific API if inquiring, and allows to call described specific API, otherwise forbids calling the specific API.
Above-mentioned processor is also configured to:
It is described to call authority information to be packaged in the APK of application specific API, complete to be directed to the application of special access right Statement includes:
The special access right is stated in the statement file of the application, and is generated in signature file, the signature file At least define the check value of the APK, may have access to API list and valid certificate date;Stored in the addressable API list There is addressable API authority recalls information;
Increase the signature file in the APK for the application of packing.
It is described when monitor the application be directed to specific API call request when, inquired about from the APK of the application to institute That states specific API calls authority information, and authority information is called to the specific API if inquiring, and allows to call the spy Determine API, otherwise forbid calling the specific API, including:
The signature file and the first current date are extracted from the APK of the application;
Verify the specific API whether the API in the addressable API list defined in the signature file, and Whether first current date is described in the signature file within valid certificate date;
API in the addressable API lists of the checking specific API defined in the signature file, and institute State current date described in the signature file within valid certificate date when, it is allowed to call the specific API, otherwise forbid Call the specific API.
Methods described also includes:
When installation is claimed as the application of special access right, signature file, the signature file are extracted from the APK of the application Legitimacy is applied to verify, at least including the check value, the valid certificate date and the list of devices;
According to the signature file, it is determined whether install the application.
It is described according to the signature file, it is determined whether installing the application includes:
Obtain the second current date, the default check value of storage and the machine mark;
Verify whether the default check value is identical with the check value;
Verify second current date whether within the valid certificate date;
It is the mark in the list of devices to verify that described the machine is identified whether;
Wherein, when the default check value is identical with the check value, second current date is effective in the certificate Within date, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
On the device in above-described embodiment, wherein modules perform the concrete mode of operation in relevant this method Embodiment in be described in detail, explanation will be not set forth in detail herein.
Figure 11 is a kind of block diagram for calibration equipment according to an exemplary embodiment, and the device is applied to terminal Equipment.For example, device 1700 can be mobile phone, and computer, digital broadcast terminal, messaging devices, game console, Tablet device, Medical Devices, body-building equipment, personal digital assistant etc..
Device 1700 can include following one or more assemblies:Processing assembly 1702, memory 1704, power supply module 1706, multimedia groupware 1708, audio-frequency assembly 1710, input/output (I/O) interface 1712, sensor cluster 1714, Yi Jitong Believe component 1716.
The integrated operation of the usual control device 1700 of processing assembly 1702, such as with display, call, data communication, The camera operation operation associated with record operation.Processing assembly 1702 can include one or more processors 1720 to perform Instruction, to complete all or part of step of above-mentioned method.In addition, processing assembly 1702 can include one or more moulds Block, is easy to the interaction between processing assembly 1702 and other assemblies.For example, processing assembly 1702 can include multi-media module, To facilitate the interaction between multimedia groupware 1708 and processing assembly 1702.
Memory 1704 is configured as storing various types of data supporting the operation in device 1700.These data Example includes the instruction of any application program or method for being used to operate on device 1700, contact data, telephone book data, Message, picture, video etc..Memory 1704 can by any kind of volatibility or non-volatile memory device or they Combination realize, such as static RAM (SRAM), Electrically Erasable Read Only Memory (EEPROM), it is erasable can Program read-only memory (EPROM), programmable read only memory (PROM), read-only storage (ROM), magnetic memory, flash memory Reservoir, disk or CD.
Power supply module 1706 provides electric power for the various assemblies of device 1700.Power supply module 1706 can include power management System, one or more power supplys, and other components associated with generating, managing and distributing electric power for device 1700.
Multimedia groupware 1708 is included in the screen of one output interface of offer between described device 1700 and user. In some embodiments, screen can include liquid crystal display (LCD) and touch panel (TP).If screen includes touch panel, Screen may be implemented as touch-screen, to receive the input signal from user.Touch panel includes one or more touch and passed Sensor is with the gesture on sensing touch, slip and touch panel.The touch sensor can not only sensing touch or slip be dynamic The border of work, but also the detection duration related to the touch or slide and pressure.In certain embodiments, it is many Media component 1708 includes a front camera and/or rear camera.When device 1700 is in operator scheme, mould is such as shot When formula or video mode, front camera and/or rear camera can receive the multi-medium data of outside.Each preposition shooting Head and rear camera can be a fixed optical lens systems or with focusing and optical zoom capabilities.
Audio-frequency assembly 1710 is configured as output and/or input audio signal.For example, audio-frequency assembly 1710 includes a wheat Gram wind (MIC), when device 1700 is in operator scheme, when such as call model, logging mode and speech recognition mode, microphone quilt It is configured to receive external audio signal.The audio signal received can be further stored in memory 1704 or via communication Component 1716 is sent.In certain embodiments, audio-frequency assembly 1710 also includes a loudspeaker, for exports audio signal.
I/O interfaces 1712 are that interface, above-mentioned peripheral interface module are provided between processing assembly 1702 and peripheral interface module Can be keyboard, click wheel, button etc..These buttons may include but be not limited to:Home button, volume button, start button and Locking press button.
Sensor cluster 1714 includes one or more sensors, and the state for providing various aspects for device 1700 is commented Estimate.For example, sensor cluster 1714 can detect opening/closed mode of device 1700, the relative positioning of component, such as institute Display and keypad that component is device 1700 are stated, sensor cluster 1714 can be with detection means 1700 or device 1,700 1 The position of individual component changes, the existence or non-existence that user contacts with device 1700, the orientation of device 1700 or acceleration/deceleration and dress Put 1700 temperature change.Sensor cluster 1714 can include proximity transducer, be configured in not any physics The presence of object nearby is detected during contact.Sensor cluster 1714 can also include optical sensor, such as CMOS or ccd image sensing Device, for being used in imaging applications.In certain embodiments, the sensor cluster 1714 can also include acceleration sensing Device, gyro sensor, Magnetic Sensor, pressure sensor or temperature sensor.
Communication component 1716 is configured to facilitate the communication of wired or wireless way between device 1700 and other equipment.Dress The wireless network based on communication standard, such as WiFi, 2G or 3G, or combinations thereof can be accessed by putting 1700.It is exemplary at one In embodiment, communication component 1716 receives broadcast singal or broadcast correlation from external broadcasting management system via broadcast channel Information.In one exemplary embodiment, the communication component 1716 also includes near-field communication (NFC) module, to promote short distance Communication.For example, radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra wide band can be based in NFC module (UWB) technology, bluetooth (BT) technology and other technologies are realized.
In the exemplary embodiment, device 1700 can be by one or more application specific integrated circuits (ASIC), numeral Signal processor (DSP), digital signal processing appts (DSPD), PLD (PLD), field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic building bricks are realized, for performing the above method.
In the exemplary embodiment, a kind of non-transitorycomputer readable storage medium including instructing, example are additionally provided Such as include the memory 1704 of instruction, above-mentioned instruction can be performed to complete the above method by the processor 1720 of device 1700.Example Such as, the non-transitorycomputer readable storage medium can be ROM, it is random access memory (RAM), CD-ROM, tape, soft Disk and optical data storage devices etc..
A kind of non-transitorycomputer readable storage medium, when the instruction in the storage medium is by the processing of device 1700 When device is performed so that device 1700 is able to carry out above-mentioned method of calibration, and methods described includes:
Call authority information to be packaged in the installation kit APK of application application-specific DLL API, complete pin Statement to the application of special access right;
The call request that the application is directed to the specific API is monitored in system operation;
When monitoring that the application is directed to specific API call request, inquired about from the APK of the application to the spy That determines API calls authority information, and authority information is called to the specific API if inquiring, and allows to call described specific API, otherwise forbids calling the specific API.
It is described to call authority information to be packaged in the APK of application specific API, complete to be directed to the application of special access right Statement includes:
The special access right is stated in the statement file of the application, and is generated in signature file, the signature file At least define the check value of the APK, may have access to API list and valid certificate date;Stored in the addressable API list There is addressable API authority recalls information;
Increase the signature file in the APK for the application of packing.
It is described when monitor the application be directed to specific API call request when, inquired about from the APK of the application to institute That states specific API calls authority information, and authority information is called to the specific API if inquiring, and allows to call the spy Determine API, otherwise forbid calling the specific API, including:
The signature file and the first current date are extracted from the APK of the application;
Verify the specific API whether the API in the addressable API list defined in the signature file, and Whether first current date is described in the signature file within valid certificate date;
API in the addressable API lists of the checking specific API defined in the signature file, and institute State current date described in the signature file within valid certificate date when, it is allowed to call the specific API, otherwise forbid Call the specific API.
Methods described also includes:
When installation is claimed as the application of special access right, signature file, the signature file are extracted from the APK of the application Legitimacy is applied to verify, at least including the check value, the valid certificate date and the list of devices;
According to the signature file, it is determined whether install the application.
It is described according to the signature file, it is determined whether installing the application includes:
Obtain the second current date, the default check value of storage and the machine mark;
Verify whether the default check value is identical with the check value;
Verify second current date whether within the valid certificate date;
It is the mark in the list of devices to verify that described the machine is identified whether;
Wherein, when the default check value is identical with the check value, second current date is effective in the certificate Within date, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
Those skilled in the art will readily occur to its of the disclosure after considering specification and putting into practice disclosure disclosed herein Its embodiment.The application is intended to any modification, purposes or the adaptations of the disclosure, these modifications, purposes or Person's adaptations follow the general principle of the disclosure and including the undocumented common knowledge in the art of the disclosure Or conventional techniques.Description and embodiments are considered only as exemplary, and the true scope of the disclosure and spirit are by following Claim is pointed out.
It should be appreciated that the precision architecture that the disclosure is not limited to be described above and is shown in the drawings, and And various modifications and changes can be being carried out without departing from the scope.The scope of the present disclosure is only limited by appended claim.

Claims (12)

1. a kind of method of calibration, it is characterised in that methods described includes:
Call authority information to be packaged in the installation kit APK of application application-specific DLL API, complete for spy The statement of the application of different authority;
The call request that the application is directed to the specific API is monitored in system operation;
When monitoring that the application is directed to specific API call request, inquired about from the APK of the application to described specific API's calls authority information, and authority information is called to the specific API if inquiring, and allows to call the specific API, Otherwise forbid calling the specific API.
2. according to the method described in claim 1, it is characterised in that it is described by specific API call authority information to be packaged in should In APK, complete to include for the statement of the application of special access right:
The special access right is stated in the statement file of the application, and is generated in signature file, the signature file at least Define the check value of the APK, may have access to API list and valid certificate date;Being stored with the addressable API list can Access API authority recalls information;
Increase the signature file in the APK for the application of packing.
3. according to the method described in claim 1, it is characterised in that described to work as the tune for monitoring that the application is directed to specific API During with request, inquired about from the APK of the application and authority information is called to the specific API, if inquiring to described specific API's calls authority information, then allows to call the specific API, otherwise forbids calling the specific API, including:
The signature file and the first current date are extracted from the APK of the application;
Verify the specific API whether the API in the addressable API list defined in the signature file, it is and described Whether the first current date is described in the signature file within valid certificate date;
When verifying the API in the addressable API list of the specific API defined in the signature file, and described work as The preceding date described in the signature file within valid certificate date when, it is allowed to call the specific API, otherwise forbid calling The specific API.
4. according to the method described in claim 1, it is characterised in that methods described also includes:
When installation is claimed as the application of special access right, signature file is extracted from the APK of the application, the signature file is used to Legitimacy is applied in checking, at least including the check value, the valid certificate date and the list of devices;
According to the signature file, it is determined whether install the application.
5. method according to claim 4, it is characterised in that described according to the signature file, it is determined whether install institute Stating to apply includes:
Obtain the second current date, the default check value of storage and the machine mark;
Verify whether the default check value is identical with the check value;
Verify second current date whether within the valid certificate date;
It is the mark in the list of devices to verify that described the machine is identified whether;
Wherein, when the default check value is identical with the check value, second current date is in the valid certificate date Within, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
6. a kind of calibration equipment, it is characterised in that described device includes:
Declaration module, for calling authority information to be packaged in the APK of application specific API, is completed for special access right The statement of application;
Monitoring modular, the call request of the specific API is directed to for monitoring the application in system operation;
Enquiry module, for when monitoring that the application is directed to specific API call request, being looked into from the APK of the application Inquiry calls authority information to the specific API, calls authority information to the specific API if inquiring, allows to call The specific API, otherwise forbids calling the specific API.
7. device according to claim 6, it is characterised in that the declaration module includes:
Submodule is generated, for stating the special access right in the statement file of the application, and signature file is generated, it is described The check value of the APK is at least defined in signature file, API list and valid certificate date is may have access to;The addressable API Be stored with addressable API authority recalls information in list;
Increase submodule, the signature file is increased during for APK in the application of packing.
8. device according to claim 6, it is characterised in that the enquiry module includes:
Extracting sub-module, for extracting the signature file and the first current date from the APK of the application;
First checking submodule, for verify the specific API whether the addressable API defined in the signature file API in list, and whether first current date is described in the signature file within valid certificate date;
Submodule is handled, is verified for working as in the addressable API lists of the specific API defined in the signature file API, and the current date described in the signature file within valid certificate date when, it is allowed to call described specific API, otherwise forbids calling the specific API.
9. device according to claim 6, it is characterised in that described device also includes:
Extraction module, when being claimed as the application of special access right for installing, extracts signature file, institute from the APK of the application State signature file and apply legitimacy to verify, at least arranged including the check value, the valid certificate date and the equipment Table;
Determining module, for according to the signature file, it is determined whether install the application.
10. device according to claim 9, it is characterised in that the determining module includes:
Acquisition submodule, for obtaining the second current date, the default check value of storage and the machine mark;
Second checking submodule, for verifying whether the default check value and the check value are identical;Verify that described second works as Whether the preceding date is within the valid certificate date;It is the mark in the list of devices to verify that described the machine is identified whether;
Wherein, when the default check value is identical with the check value, second current date is in the valid certificate date Within, and described the machine is identified whether when being the mark in the list of devices, it is determined that installing the application.
11. a kind of calibration equipment, it is characterised in that including:
Processor;
Memory for storing processor-executable instruction;
Wherein, the processor is configured as:
Call authority information to be packaged in the installation kit APK of application application-specific DLL API, complete for spy The statement of the application of different authority;
The call request that the application is directed to the specific API is monitored in system operation;
When monitoring that the application is directed to specific API call request, inquired about from the APK of the application to described specific API's calls authority information, and authority information is called to the specific API if inquiring, and allows to call the specific API, Otherwise forbid calling the specific API.
12. a kind of computer-readable recording medium, is stored thereon with computer program, it is characterised in that the program is by processor The step of any one of claim 1-5 methods described is realized during execution.
CN201710262176.8A 2017-04-20 2017-04-20 Method of calibration and device Pending CN107169320A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710262176.8A CN107169320A (en) 2017-04-20 2017-04-20 Method of calibration and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710262176.8A CN107169320A (en) 2017-04-20 2017-04-20 Method of calibration and device

Publications (1)

Publication Number Publication Date
CN107169320A true CN107169320A (en) 2017-09-15

Family

ID=59813313

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710262176.8A Pending CN107169320A (en) 2017-04-20 2017-04-20 Method of calibration and device

Country Status (1)

Country Link
CN (1) CN107169320A (en)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108064383A (en) * 2017-10-25 2018-05-22 福建联迪商用设备有限公司 A kind of management-control method, terminal and the POS terminal of application program permission
CN109460249A (en) * 2018-11-07 2019-03-12 绿驰汽车科技(上海)有限公司 A kind of control module method for refreshing
CN109829292A (en) * 2018-12-18 2019-05-31 福建新大陆支付技术有限公司 A kind of sign test method and system in application program installation process
CN110188518A (en) * 2019-05-29 2019-08-30 Oppo广东移动通信有限公司 Method for parameter configuration, device, terminal and storage medium
CN110321228A (en) * 2018-03-28 2019-10-11 腾讯科技(深圳)有限公司 Call method, device, equipment and the computer readable storage medium of Native method
CN110837360A (en) * 2019-10-12 2020-02-25 福建天泉教育科技有限公司 Method for detecting excessive claim right and computer readable storage medium
CN112560022A (en) * 2020-12-03 2021-03-26 支付宝(杭州)信息技术有限公司 System interface call detection method and device
CN112597452A (en) * 2021-01-05 2021-04-02 Oppo广东移动通信有限公司 Application program interface calling method and device, storage medium and electronic equipment
WO2022022422A1 (en) * 2020-07-31 2022-02-03 华为技术有限公司 Permission management method and terminal device

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101854624A (en) * 2009-04-02 2010-10-06 联芯科技有限公司 Dynamic loading software authentication method, monitoring method and device for mobile terminal
CN103414563A (en) * 2013-08-05 2013-11-27 南京瑞组信息技术有限公司 Validity time management method of CPK identification, secret key pair and certificate
CN103761472A (en) * 2014-02-21 2014-04-30 北京奇虎科技有限公司 Application program accessing method and device based on intelligent terminal
US9009856B2 (en) * 2011-12-16 2015-04-14 Dell Products L.P. Protected application programming interfaces
CN106529218A (en) * 2016-10-28 2017-03-22 杭州华三通信技术有限公司 Application check method and device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101854624A (en) * 2009-04-02 2010-10-06 联芯科技有限公司 Dynamic loading software authentication method, monitoring method and device for mobile terminal
US9009856B2 (en) * 2011-12-16 2015-04-14 Dell Products L.P. Protected application programming interfaces
CN103414563A (en) * 2013-08-05 2013-11-27 南京瑞组信息技术有限公司 Validity time management method of CPK identification, secret key pair and certificate
CN103761472A (en) * 2014-02-21 2014-04-30 北京奇虎科技有限公司 Application program accessing method and device based on intelligent terminal
CN106529218A (en) * 2016-10-28 2017-03-22 杭州华三通信技术有限公司 Application check method and device

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108064383A (en) * 2017-10-25 2018-05-22 福建联迪商用设备有限公司 A kind of management-control method, terminal and the POS terminal of application program permission
CN110321228A (en) * 2018-03-28 2019-10-11 腾讯科技(深圳)有限公司 Call method, device, equipment and the computer readable storage medium of Native method
CN110321228B (en) * 2018-03-28 2023-09-22 腾讯科技(深圳)有限公司 Calling method, device and equipment of native method and computer readable storage medium
CN109460249A (en) * 2018-11-07 2019-03-12 绿驰汽车科技(上海)有限公司 A kind of control module method for refreshing
CN109829292A (en) * 2018-12-18 2019-05-31 福建新大陆支付技术有限公司 A kind of sign test method and system in application program installation process
CN110188518A (en) * 2019-05-29 2019-08-30 Oppo广东移动通信有限公司 Method for parameter configuration, device, terminal and storage medium
CN110837360A (en) * 2019-10-12 2020-02-25 福建天泉教育科技有限公司 Method for detecting excessive claim right and computer readable storage medium
CN110837360B (en) * 2019-10-12 2023-04-07 福建天泉教育科技有限公司 Method for detecting excessive claim right and computer readable storage medium
CN114741720A (en) * 2020-07-31 2022-07-12 华为技术有限公司 Authority management method and terminal equipment
WO2022022422A1 (en) * 2020-07-31 2022-02-03 华为技术有限公司 Permission management method and terminal device
CN112560022A (en) * 2020-12-03 2021-03-26 支付宝(杭州)信息技术有限公司 System interface call detection method and device
CN112560022B (en) * 2020-12-03 2024-03-12 支付宝(杭州)信息技术有限公司 Method and device for detecting system interface call
CN112597452A (en) * 2021-01-05 2021-04-02 Oppo广东移动通信有限公司 Application program interface calling method and device, storage medium and electronic equipment

Similar Documents

Publication Publication Date Title
CN107169320A (en) Method of calibration and device
US20180367315A1 (en) Method and apparatus for signing and verifying application installation package, and storage medium
CN104980580B (en) Short message inspection method and device
CN111199039B (en) Application security verification method and device and terminal equipment
CN102016865A (en) System and method of authorizing execution of software code based on accessible entitlements
EP3016349B1 (en) Method and apparatus for verifying terminal and computer program product
EP2940977B1 (en) Method and device for sending information in voice service
CN102016866A (en) System and method of authorizing execution of software code in a device based on entitlements granted to a carrier
CN104331668A (en) Wrong password prompting method and device
CN106203125A (en) Operating system and safety detection method, safety detection device and terminal
CN111339508A (en) Shared password analysis method and device, electronic equipment and storage medium
CN107766701A (en) Electronic equipment, dynamic library file guard method and device
CN105282162A (en) Processing method and device for account management business
CN106709284A (en) Root package validation method and device
CN110677551B (en) Image encryption method, device, equipment and storage medium
CN104113588A (en) Updating method and apparatus of internet yellow page
CN106599676A (en) Trusted process identification method and device
US10402562B2 (en) Method and device for encrypting application
CN112784243A (en) Authorization management method and device, electronic equipment and storage medium
CN107506636A (en) The guard method of pre-installed applications program and device
CN107480076A (en) Protection processing method, device and the terminal of system partitioning
CN107103231A (en) To application install the method and device of management
CN112733092A (en) Information processing method and device
CN106709285B (en) Display method and device of application lock interface
CN107294985A (en) Information Authentication method, apparatus and system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20170915

RJ01 Rejection of invention patent application after publication