CN115509556A - Application management method, device, equipment and medium - Google Patents
Application management method, device, equipment and medium Download PDFInfo
- Publication number
- CN115509556A CN115509556A CN202211184494.4A CN202211184494A CN115509556A CN 115509556 A CN115509556 A CN 115509556A CN 202211184494 A CN202211184494 A CN 202211184494A CN 115509556 A CN115509556 A CN 115509556A
- Authority
- CN
- China
- Prior art keywords
- application
- signature information
- installation package
- hash value
- signature
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/61—Installation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/61—Installation
- G06F8/62—Uninstallation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/70—Software maintenance or management
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Stored Programmes (AREA)
Abstract
The invention discloses an application management method, which comprises the following steps: receiving an application installation package which is sent by a server and carries signature information generated in advance, wherein the application installation package is an installation package of a target installation application; analyzing the application installation package to obtain the signature information; verifying the signature information; and when the verification is successful, finishing the installation of the target application based on the registration information and the signature information of the application installation package. The invention adopts APK with preset signature information to carry out application installation tamper-proofing and unloading authority control, thereby realizing the safety protection of the application, and distinguishing trusted authorization application and malicious illegal application from the source in the aspect of installation authentication of the vehicle application.
Description
Technical Field
The invention belongs to the technical field of information security of a vehicle-mounted system of an automobile, and particularly relates to an application management method, device, equipment and medium.
Background
Along with the automobile to the networking, intelligent orientation rapid development, the tall and erect APP of ann of car machine system is applied and is added massively, the classification that tall and erect APP was applied is also gradually abundantly, on-vehicle application has become the indispensable element in people's life gradually, thereby the security risk that rich and varied application program brought also gradually increases, if installed malicious application or carried out illegal uninstallation to legal application on the operating system of car machine, no matter then to the security of car machine own system or the security of user information privacy even the safety of vehicle driving, all there is very big security risk, for stopping the illegal installation and the uninstallation of using from the root, based on the consideration of the aspect factors such as protection user information security privacy and car machine system safety, on-vehicle application's tall and erect operating system need increase the installation of application, prevent falsifying and uninstallation safeguard function.
Disclosure of Invention
In view of the above-mentioned shortcomings of the prior art, the present invention provides an application management method, apparatus, device and medium to solve the above-mentioned technical problems.
The invention provides an application management method, which comprises the following steps:
receiving an application installation package which is issued by a server and carries signature information generated in advance, wherein the application installation package is an installation package of target installation application
Analyzing the application installation package to obtain the signature information;
verifying the signature information;
and when the verification is successful, finishing the installation of the target application based on the registration information and the signature information of the application installation package.
In an embodiment of the present invention, the generating of the signature information includes:
calculating a first hash value of the application installation package, wherein the application installation package carries signature information data;
encrypting the application installation package to obtain encrypted data;
generating signature information based on a second hash value and the public key certificate, wherein the second hash value comprises the first hash value and the encrypted data.
In an embodiment of the present invention, the step of verifying the signature information includes:
comparing the signature information obtained by analysis with preset signature information, and if the signature information obtained by analysis is consistent with the preset signature information, passing the verification; and if the signature information obtained by analysis is inconsistent with the preset signature information, the verification is failed.
In an embodiment of the present invention, the step of verifying the signature information includes:
calculating a third hash value of the application installation package, and performing first comparison on the third hash value and a first hash value in the second hash values;
when a first hash value in the second hash values is consistent with the third hash value, the first comparison is passed;
decrypting the signature information to obtain decrypted data and a fourth hash value;
comparing the fourth hash value to the second hash value a second time; when the second hash value is consistent with the fourth hash value, the second comparison is passed;
and when the first comparison and the second comparison both pass, the verification passes.
In an embodiment of the present invention, the encrypting the first hash value includes:
digitally signing the application installation package by using a signing tool;
and encrypting the application installation package by using the public key certificate.
In an embodiment of the present invention, the decrypting the signature information includes:
and decrypting the application installation package by using a public key certificate and a signing tool.
In an embodiment of the present invention, the method further includes:
receiving an application uninstalling request, wherein the application uninstalling request carries an application installation package comprising signature information, and the application installation package is an installation package of a target application;
analyzing the application uninstalling request to obtain signature information;
verifying the signature information;
after the verification of the signature information is passed, judging whether the signature information has an unloading identifier or not;
and if the verification of the signature information is passed and the signature information has the uninstalling identifier, uninstalling the target application.
In an embodiment of the present invention, when the application installation package is encrypted, the application configuration file in the application installation package is encrypted.
The invention provides an application management device, comprising:
a receiving module, configured to receive an application installation package sent by a server and carrying signature information generated in advance, where the application installation package is an installation package of a target installation application
The analysis module is used for analyzing the application installation package to obtain the signature information;
the verification module is used for verifying the signature information;
and the installation module is used for finishing the installation of the target application based on the registration information and the signature information of the application installation package when the verification is successful.
The invention provides an application management device, comprising:
the key management module is used for generating a signature certificate and sending the signature certificate to the application server;
the application server is used for presetting the management information in an application installation package, and encrypting the application installation package by using the signature certificate and a signature tool to obtain an encryption result;
the application server is further used for adding the signature certificate and the encryption result into the application installation package, and sending the application installation package added with the signature certificate and the encryption result to the vehicle-mounted device system.
The invention provides an electronic device, comprising:
one or more processors;
a storage device for storing one or more programs which, when executed by the one or more processors, cause the electronic device to implement the steps of the application management method described above.
The present invention provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor of a computer, causes the computer to perform the steps of the above-described application management method.
The invention has the beneficial effects that: the application management method in the invention comprises the following steps: receiving an application installation package which is sent by a server and carries signature information generated in advance, wherein the application installation package is an installation package of a target installation application; analyzing the application installation package to obtain the signature information; verifying the signature information; and when the verification is successful, finishing the installation of the target application based on the registration information and the signature information of the application installation package. The invention adopts the APK with preset signature information to carry out application installation tamper-proofing and unloading authority control, thereby realizing the safety protection of the application, and distinguishing trusted authorized application and malicious illegal application from the source in the aspect of installation authentication of the vehicle application.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application. It is obvious that the drawings in the following description are only some embodiments of the application, and that for a person skilled in the art, other drawings can be derived from them without inventive effort. In the drawings:
FIG. 1 is a schematic diagram of an implementation environment of an application management method according to an exemplary embodiment of the present application;
FIG. 2 is a flow diagram illustrating an application management method in accordance with an exemplary embodiment of the present application;
FIG. 3 is a block diagram of an application management system shown in an exemplary embodiment of the present application;
FIG. 4 is a flow diagram illustrating generation of signature information in accordance with an exemplary embodiment of the present application;
FIG. 5 is a flow diagram illustrating verification of the signature information in accordance with an exemplary embodiment of the present application;
fig. 6 is a block diagram of an application management apparatus shown in an exemplary embodiment of the present application;
FIG. 7 illustrates a schematic structural diagram of a computer system suitable for use in implementing the electronic device of an embodiment of the present application.
Detailed Description
Other advantages and effects of the present invention will become apparent to those skilled in the art from the disclosure herein, wherein the embodiments of the present invention are described in detail with reference to the accompanying drawings and preferred embodiments. The invention is capable of other and different embodiments and of being practiced or of being carried out in various ways, and its several details are capable of modification in various respects, all without departing from the spirit and scope of the present invention. It should be understood that the preferred embodiments are illustrative of the invention only and are not limiting upon the scope of the invention.
It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present invention, and the components related to the present invention are only shown in the drawings rather than drawn according to the number, shape and size of the components in actual implementation, and the type, quantity and proportion of the components in actual implementation may be changed freely, and the layout of the components may be more complicated.
In the following description, numerous details are set forth to provide a more thorough explanation of embodiments of the present invention, however, it will be apparent to one skilled in the art that embodiments of the present invention may be practiced without these specific details, and in other embodiments, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring embodiments of the present invention.
FIG. 1 is a schematic diagram of an exemplary application management method implementation environment of the present application. Referring to fig. 1, the implementation environment includes a terminal device 101 and a server 102, and the terminal device 101 and the server 102 communicate with each other through a wired or wireless network. The method comprises the steps that terminal equipment receives an application installation package, wherein the application installation package carries an application installation package comprising pre-generated signature information, and the application installation package is an installation package of target installation application; analyzing the application installation package to obtain the signature information; verifying the signature information; and when the verification is successful, finishing the installation of the target application based on the registration information and the signature information of the application installation package. The invention adopts the APK with preset signature information to carry out application installation tamper-proofing and unloading authority control, thereby realizing the safety protection of the application, and distinguishing trusted authorized application and malicious illegal application from the source in the aspect of installation authentication of the vehicle application.
It should be understood that the number of terminal devices 101 and servers 102 in fig. 1 is merely illustrative. There may be any number of terminal devices 101 and servers 102, as desired.
The terminal device 101 corresponds to a client, which may be any electronic device having a user input interface, including but not limited to a smart phone, a tablet, a notebook computer, a vehicle-mounted computer, and the like, wherein the user input interface includes but not limited to a touch screen, a keyboard, a physical key, an audio pickup device, and the like.
The server 102 corresponds to a server, may be a server providing various services, may be an independent physical server, may also be a server cluster or a distributed system formed by a plurality of physical servers, and may also be a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a CDN (Content Delivery Network), a big data and an artificial intelligence platform, which is not limited herein.
The terminal device 101 may communicate with the server 102 through a wireless network such as 3G (third generation mobile information technology), 4G (fourth generation mobile information technology), 5G (fifth generation mobile information technology), and the like, which is not limited herein.
Embodiments of the present application respectively provide an application management method, an application management apparatus, an electronic device, and a computer-readable storage medium, and will be described in detail below.
Referring to fig. 2, fig. 2 is a flowchart illustrating an application management method according to an exemplary embodiment of the present application. The method may be applied to the implementation environment shown in fig. 1 and specifically executed by the terminal device 101 in the implementation environment. It should be understood that the method may be applied to other exemplary implementation environments and is specifically executed by devices in other implementation environments, and the embodiment does not limit the implementation environment to which the method is applied.
Referring to fig. 2, fig. 2 is a flowchart illustrating an application management method according to an exemplary embodiment of the present application, where the application management method at least includes steps S210 to S240, and the following steps are described in detail:
step S210, receiving an application installation package which is sent by a server and carries pre-generated signature information, wherein the application installation package is an installation package of a target installation application;
step S220, analyzing the application installation package to obtain the signature information;
step S230, verifying the signature information;
and step S240, when the verification is successful, the target application is installed based on the registration information and the signature information of the application installation package.
It should be understood that, the sequence numbers of the steps in the foregoing embodiments do not imply an execution sequence, and the execution sequence of each process should be determined by functions and internal logic of the process, and should not limit the implementation process of the embodiments of the present invention in any way.
Before the above steps are explained in detail, a system to which the method is applied will be explained.
Fig. 3 is a block diagram of an application management system in an exemplary embodiment of the present application. As shown in fig. 3, the system includes: the system comprises a key management system T0, an APP application server T1, a car machine system T2, an attacker T3, a user T4 and an application installation package APKT5;
the key management system T0 generates a signature certificate for the APP application server T1, the APP application server T1 presets management information (whether installation can be carried out or not and whether unloading can be carried out) of an application installation package APKT5 in an application program configuration file in advance, the application server T1 uses the signature certificate issued by the key management system T0 and a signature tool of an android system to calculate a signature (encryption) for the application installation package APKT5, the part for calculating the signature comprises the application program configuration file in the application installation package APKT5, and the APP application server T1 uses the signature tool to add the public key certificate and the calculated signature into the application installation package APKT 5. The APP application server T1 issues signature authorization application to the vehicle-mounted machine operating system T2, and the android operating system starts application installation.
The respective steps are explained in detail below.
In step S210, receiving an application installation package that is sent by a server and carries signature information that is generated in advance, where the application installation package is an installation package of a target installation application;
an Application installation Package, i.e., APK (Android Package). In this embodiment, the application installation package is installed in the car machine operating system T2, where the car machine operating system is an android-based operating system.
In an embodiment, the application installation package with the pre-generated signature information is pre-generated in the server and then sent to the car machine operating system for installation. The target installation application is an application package that the user wants to install.
In step S220, the application installation package is analyzed to obtain the signature information;
since the signature information is verified and included in the application installation package in this embodiment, the application installation package needs to be parsed to obtain the signature information in the application installation package.
Of course, to obtain the signature information, first of all, signature information needs to be generated, and in an embodiment, as shown in fig. 4, the generation of the signature information includes:
step S410, calculating a first hash value of the application installation package, wherein the application installation package carries signature information data;
hash values, also known as Hash functions (or Hash algorithms, also known as Hash functions, in english) are a way to create small digital "fingerprints" from any kind of data. The hash function compresses a message or data into a digest so that the amount of data becomes small, fixing the format of the data. This function mixes the data in a hash, recreating a fingerprint called a hash value (hash sums, or hashes). The hash value is typically represented by a short string of random letters and numbers. Good hash functions rarely have hash collisions in the input domain. In hash tables and data processing, data is distinguished without suppressing conflicts, making database records more difficult to find.
Step S420, encrypting the application installation package to obtain encrypted data;
specifically, encrypting the application installation package includes digitally signing the application installation package with a signing tool and encrypting the application installation package with a public key certificate. Wherein, the signing tool is owned by the vehicle machine operating system. A public key certificate, often referred to simply as a certificate, is a digitally signed statement that binds the value of a public key to the identity of the person, device or service that holds the corresponding private key. The public key certificate is generated by a key management system, and may also be referred to as a signature certificate.
Step S430, generating signature information based on a second hash value and the public key certificate, where the second hash value includes the first hash value and the encrypted data.
And after the second hash value and the public key certificate are obtained, combining the second hash value and the public key certificate together to serve as signature information.
In step S230, the signature information is verified;
and checking the signature information, namely judging whether the signature information is consistent with the signature information prestored in the vehicle machine operating system. Specifically, the step of verifying the signature information includes:
comparing the signature information obtained by analysis with preset signature information, and if the signature information obtained by analysis is consistent with the preset signature information, verifying to pass; and if the signature information obtained by analysis is inconsistent with the preset signature information, the verification is failed.
It should be noted that the signature information may be pre-stored in the in-vehicle operating system. Therefore, when the target application is installed, the signature information of the target application is compared with the signature information in the car machine operating system, and whether the target application can be installed or not is determined.
More specifically, as shown in fig. 5, the step of verifying the signature information includes:
step S510, calculating a third hash value of the application installation package, and performing a first comparison between the third hash value and a first hash value in the second hash values;
step S520, when the first hash value in the second hash value is consistent with the third hash value, the first comparison is passed;
step S530, decrypting the signature information to obtain decrypted data and a fourth hash value; decrypting can be carried out on the application installation package by adopting a public key certificate and a signing tool;
step S540, comparing the fourth hash value with the second hash value for the second time; when the second hash value is consistent with the fourth hash value, the second comparison is passed;
and step S550, when the first comparison and the second comparison both pass, the verification passes.
In an embodiment, when an installed application needs to be uninstalled, a car machine operating system first receives an application uninstalling request, where the application uninstalling request carries an application installation package including signature information, and the application installation package is an installation package of a target application; analyzing the application uninstalling request to obtain signature information; verifying the signature information; after the signature information passes verification, judging whether an unloading identifier exists in the signature information; and if the signature information passes the verification and the signature information has the uninstalling identifier, uninstalling the target application. In this embodiment, when the parsed signature information matches the signature information stored in the system, the signature information is verified. In this embodiment, an application with an uninstall flag may be uninstalled, and an application without an uninstall flag may not be uninstalled.
The method adopts the APK with preset signature information to carry out application installation control, thereby realizing the safety protection of the application, distinguishing trusted authorization application and malicious illegal application from the source in the aspect of installation authentication of the vehicle-mounted machine application, protecting the safety of the vehicle-mounted machine android system and the safety of user privacy information, and in the aspect of tamper resistance of the vehicle-mounted machine application, the tampered application cannot be installed, thereby preventing a malicious attacker from illegally installing the application, further acquiring the privacy information of a user, and illegally utilizing the privacy information of the user, so that the security of the vehicle-mounted machine android system and the privacy information of the user cannot be threatened. In the aspect of unloading of the car machine application, compared with a traditional native mechanism adopting android, the mechanism that the application installed under an operating system partition cannot be unloaded (because the system partition only has read-only permission, the application of the system cannot be unloaded under the condition of not being root) is reduced, the occupancy rate of the system partition is reduced, more application programs do not need to be checked during safe starting, the time for safe starting is shortened, the time for safe starting of the operating system is reduced, the application can be ensured to be safe with the system even if the application is installed in other partitions, compared with the native mechanism of the android operating system, the permission for controlling the installation and unloading of the application is more flexible and convenient, and the overall safety of the car machine android operating system is improved. For example, a system application which is very important for an operating system and is not allowed to be operated and modified by a user may need to be installed on a system partition to be realized in a traditional manner, and as the applications of the system partition increase, the space of the system becomes smaller and smaller, which may affect the efficiency of system operation.
Compared with the traditional access control mode by adopting a black and white list, the method adopted by the invention is simpler and more convenient, increases the flexibility, reduces the burden of maintaining the black and white list, and avoids the risk of leakage loss or tampering of the black and white list. For example, when a user wants to uninstall an application, if a black and white list access control mode is adopted, whether the application can be uninstalled or not needs to be maintained in a black and white list, and then an operating system needs to verify the content of the black and white list when the application is uninstalled, but for the maintenance of the black and white list, for example, the security of the black and white list itself, the anti-tampering of the content of the black and white list can also be an extra burden, and the method adopts the method that the uninstallable information of the application is directly calculated and integrated in an application signature, and then the application is integrated in a vehicle-mounted application through an encryption tool, and the maintenance of an extra black and white list is not needed, so that the method is more preferable.
When the application installation is executed for the application management system shown in FIG. 3, the following steps are executed:
and S11, the T1 application server issues a signature authorization application to the T2 car machine operating system.
And S12, the T2 car machine operating system starts to install the authorized application.
The T2 car machine operating system first starts some services, such as surfafinger (display service of platform), sensorService (android sensor service), audioFinger (audio service), mediaPlayerService (multimedia service), cameraService (camera service), and AudioPolicyService (audio policy service), by a Zygote process, which is an init initialization process, and then instantiates variables by an android runtime which is globally unique to the system, and calls an initialization action function of systemServer by callstance of runtime. After the system initialization is completed, calling a run function run of the system Server and removing add to load the T5 application installation package APK. After the installation of the application is finished, the package management service scans the application apps and analyzes the application APKs, each APK installation package is a filing file, the APK installation package contains a configuration file of an Android application program, the configuration file is mainly analyzed, a parsepack function is called to analyze the application after the configuration file is obtained from the APK filing file, and then other installation services are called to finish the installation of the application.
The final application installation can be summarized as:
(1) Copying an application installation package APKT5 file to a specified directory;
(2) Decompressing the APK, copying files, creating a data directory of the application, analyzing the APK, checking package names and the like, and storing information such as declared components and the like;
(3) Invoking other installation services
Therefore, according to the flow of application installation and calling, corresponding application signature information is added in the installation method to judge whether the application to be installed is an authorized APP application;
and S13, the vehicle operating system T2 uses the certificate to check the signature, the signature checking process is to calculate the hash value of the APK application installation package, the hash value of the APK application installation package is compared with the hash value of the signature information in the APK application package, and the public key certificate is used to decrypt the signature part of the signature information and compare the calculated hash value of the APK application installation package. And comparing every two to obtain a consistent result, indicating that the label passes the verification, and comparing the two results to obtain a inconsistent result, indicating that the label fails the verification.
S14, installing the application APP when the T2 vehicle machine operating system checks the label;
s15, the installation of the application APP is interrupted when the T2 vehicle machine operating system fails to pass the signature verification;
tamper protection for authorized applications relies mainly on the verification function of the system on the integrity of the APK and the system installation protection function.
The principle of APK tampering is that a tamperer takes an APK which uses a system signature and generates the APK by packaging again, or a part of codes in an APK installation package or the files in the APK installation package are tampered by directly modifying an APK file binary data package.
For tampering in a repackaging manner, because the APK needs to be repackaged, but the APK after each repackaging needs a system certificate signature to be installed by the system, if a tamperer cannot obtain the signature certificate of the system, a new installation package is identified by the unauthorized application installation protection logic and prevented from being installed, thereby achieving tamper protection (but if a tamper attacker obtains the signature certificate of the system, the tamper attacker can use the signature certificate to sign, at this time, the tamper protection is meaningless, at this time, the system certificate is proposed to be changed), the system can verify the integrity of the APK when the existing application installation package binary file modification manner is installed, at this time, the integrity verification is not passed, and the installation fails, so the tamper protection method mainly considers that the tamper attacker repackages the APK to generate the scenario, and the applied tamper protection flow is as follows:
s21, an attacker T3 issues a tampered APP to carry out installation operation on the car machine operating system;
s22, the vehicle machine operation system T2 system starts to install the tampered APP;
s23, the car machine operating system T2 fails to pass the tag verification;
and S24, refusing to install the APP by the car machine operating system T2.
The uninstalling process of the application is opposite to the installing process, and the uninstalling essentially deletes the file information created and stored during installation, and the method mainly comprises the following steps:
1) Deleting information such as availability, service, provider and the like from the internal structure
2) Deleting code, library, resource and other information
3) Deleting files under data/data/packagName and data/dalvik-cache
4) Updating the package information in setting
The application offload flow is as follows
S31, a user point T4 clicks an uninstalling application APP;
s32, the car machine operating system T2 starts to prepare for unloading the application APP;
step S33, the vehicle machine operating system T2 verifies whether the preset information application can be unloaded, starts to verify the signature, compares the signature information in the system with the signature information in the APK application, and indicates that the verification is passed after the verification of the signature information in the system and the signature information in the APK application is passed;
step S34, the vehicle machine operating system T2 passes the verification and can unload the application;
and S35, the vehicle machine operating system T2 fails to pass the verification, and unloading is refused.
Specifically, after a user clicks an uninstalling operation on a system interface, an operating system will go through a series of calls, and finally call a deletePackage uninstalling method in a packageManageService to execute an uninstalling task, and then delete information related to an application to complete uninstalling, so that the method checks the APP of the application to be uninstalled during uninstalling, judges whether a signature of the APP is an authorized application, and judges whether the signature can be uninstalled, thereby judging whether to intercept the uninstalling of the application, and realizing the safety protection of the uninstalling of the application.
Fig. 6 is a block diagram of an application management apparatus according to an exemplary embodiment of the present application. The device can be applied to the implementation environment shown in fig. 1 and is specifically configured in the terminal equipment. The apparatus may also be applied to other exemplary implementation environments, and is specifically configured in other devices, and the embodiment does not limit the implementation environment to which the apparatus is applied.
As shown in fig. 6, the present application provides an application management apparatus, including:
a receiving module 610, configured to receive an application installation package that carries pre-generated signature information and is issued by a server, where the application installation package is an installation package of a target installation application
The analysis module 620 is configured to analyze the application installation package to obtain the signature information;
a verification module 630, configured to verify the signature information;
and the installation module 640 is configured to complete installation of the target application based on the registration information and the signature information of the application installation package when the verification is successful.
It should be noted that the application management apparatus provided in the foregoing embodiment and the application management method provided in the foregoing embodiment belong to the same concept, and specific ways for each module and unit to perform operations have been described in detail in the method embodiment, and are not described herein again. In practical applications, the application management apparatus provided in the foregoing embodiment may allocate the above functions to different functional modules according to needs, that is, divide the internal structure of the apparatus into different functional modules to complete all or part of the above described functions, which is not limited herein.
An embodiment of the present application further provides an electronic device, including: one or more processors; a storage device, configured to store one or more programs, which when executed by the one or more processors, cause the electronic device to implement the application management method provided in the foregoing embodiments.
FIG. 7 illustrates a schematic structural diagram of a computer system suitable for use to implement the electronic device of the embodiments of the subject application. It should be noted that the computer system 700 of the electronic device shown in fig. 7 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.
As shown in fig. 7, the computer system 700 includes a Central Processing Unit (CPU) 701, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, according to a program stored in a Read-Only Memory (ROM) 702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. In the RAM703, various programs and data necessary for system operation are also stored. The CPU701, ROM702, and RAM703 are connected to each other via a bus 704. An Input/Output (I/O) interface 705 is also connected to the bus 704.
The following components are connected to the I/O interface 705: an input portion 706 including a keyboard, a mouse, and the like; an output section 707 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 708 including a hard disk and the like; and a communication section 707 including a Network interface card such as a LAN (Local Area Network) card, a modem, or the like. The communication section 707 performs communication processing via a network such as the internet. A drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that the computer program read out therefrom is mounted into the storage section 708 as necessary.
In particular, according to embodiments of the present application, the processes described above with reference to the flow diagrams may be implemented as computer software programs. For example, embodiments of the present application include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising a computer program for performing the method illustrated in flowchart 2. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 709, and/or installed from the removable medium 711. The computer program executes various functions defined in the system of the present application when executed by a Central Processing Unit (CPU) 701.
It should be noted that the computer readable medium shown in the embodiments of the present application may be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a Read-Only Memory (ROM), an Erasable Programmable Read-Only Memory (EPROM), a flash Memory, an optical fiber, a portable Compact Disc Read-Only Memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer-readable signal medium may comprise a propagated data signal with a computer-readable computer program embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. Each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units described in the embodiments of the present application may be implemented by software, or may be implemented by hardware, and the described units may also be disposed in a processor. Wherein the names of the elements do not in some way constitute a limitation on the elements themselves.
Another aspect of the present application also provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor of a computer, causes the computer to execute the application management method as described above. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist separately without being incorporated in the electronic device.
Another aspect of the application also provides a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the application management method provided in the above embodiments.
The foregoing embodiments are merely illustrative of the principles and utilities of the present invention and are not intended to limit the invention. Those skilled in the art can modify or change the above-described embodiments without departing from the spirit and scope of the present invention. Accordingly, it is intended that all equivalent modifications or changes which can be made by those skilled in the art without departing from the spirit and technical spirit of the present invention be covered by the claims of the present invention.
Claims (12)
1. A method for application management, the method comprising:
receiving an application installation package which is sent by a server and carries signature information generated in advance, wherein the application installation package is an installation package of a target installation application;
analyzing the application installation package to obtain the signature information;
verifying the signature information;
and when the verification is successful, finishing the installation of the target application based on the registration information and the signature information of the application installation package.
2. The application management method according to claim 1, wherein the generation of the signature information includes:
calculating a first hash value of the application installation package, wherein the application installation package carries signature information data;
encrypting the application installation package to obtain encrypted data;
generating signature information based on a second hash value and the public key certificate, wherein the second hash value comprises the first hash value and the encrypted data.
3. The application management method according to claim 2, wherein the step of verifying the signature information includes:
comparing the signature information obtained by analysis with preset signature information, and if the signature information obtained by analysis is consistent with the preset signature information, passing the verification; and if the signature information obtained by analysis is inconsistent with the preset signature information, the verification is failed.
4. The application management method according to claim 3, wherein the step of verifying the signature information includes:
calculating a third hash value of the application installation package, and performing first comparison on the third hash value and a first hash value in the second hash values;
when a first hash value in the second hash values is consistent with the third hash value, the first comparison is passed;
decrypting the signature information to obtain decrypted data and a fourth hash value;
comparing the fourth hash value to the second hash value a second time; when the second hash value is consistent with the fourth hash value, the second comparison is passed;
and when the first comparison and the second comparison both pass, the verification passes.
5. The application management method according to claim 2, wherein the encrypting the first hash value includes:
digitally signing the application installation package by using a signing tool;
and encrypting the application installation package by using the public key certificate.
6. The application management method according to claim 4, wherein the decrypting the signature information comprises:
and decrypting the application installation package by using a public key certificate and a signing tool.
7. The application management method of claim 1, wherein the method further comprises:
receiving an application uninstalling request, wherein the application uninstalling request carries an application installation package comprising signature information, and the application installation package is an installation package of a target application;
analyzing the application uninstalling request to obtain signature information;
verifying the signature information;
after the signature information passes verification, judging whether an unloading identifier exists in the signature information;
and if the signature information passes the verification and the signature information has the uninstalling identifier, uninstalling the target application.
8. The application management method according to any one of claims 2 to 5, wherein when encrypting the application installation package, an application configuration file in the application installation package is encrypted.
9. An application management apparatus, characterized in that the apparatus comprises:
the system comprises a receiving module, a sending module and a receiving module, wherein the receiving module is used for receiving an application installation package which is sent by a server and carries signature information generated in advance, and the application installation package is an installation package of target installation application;
the analysis module is used for analyzing the application installation package to obtain the signature information;
the verification module is used for verifying the signature information;
and the installation module is used for finishing the installation of the target application based on the registration information and the signature information of the application installation package when the verification is successful.
10. An application management apparatus, characterized in that the apparatus comprises:
the key management module is used for generating a signature certificate and sending the signature certificate to the application server;
the application server is used for presetting the management information in an application installation package, and encrypting the application installation package by using the signature certificate and the signature tool to obtain an encryption result;
the application server is further used for adding the signature certificate and the encryption result into the application installation package, and sending the application installation package added with the signature certificate and the encryption result to the vehicle-mounted device system.
11. An electronic device, characterized in that the electronic device comprises:
one or more processors;
storage means for storing one or more programs which, when executed by the one or more processors, cause the electronic device to carry out the steps of the application management method according to any one of claims 1 to 8.
12. A computer-readable storage medium, having stored thereon a computer program which, when executed by a processor of a computer, causes the computer to carry out the steps of the application management method of any of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211184494.4A CN115509556A (en) | 2022-09-27 | 2022-09-27 | Application management method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211184494.4A CN115509556A (en) | 2022-09-27 | 2022-09-27 | Application management method, device, equipment and medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115509556A true CN115509556A (en) | 2022-12-23 |
Family
ID=84505581
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211184494.4A Pending CN115509556A (en) | 2022-09-27 | 2022-09-27 | Application management method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115509556A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116455584A (en) * | 2023-05-05 | 2023-07-18 | 北京奥蓝德信息科技有限公司 | Downloading method and system based on software integrity |
-
2022
- 2022-09-27 CN CN202211184494.4A patent/CN115509556A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116455584A (en) * | 2023-05-05 | 2023-07-18 | 北京奥蓝德信息科技有限公司 | Downloading method and system based on software integrity |
| CN116455584B (en) * | 2023-05-05 | 2023-09-29 | 北京奥蓝德信息科技有限公司 | Downloading method and system based on software integrity |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10437967B2 (en) | Code signing system and method | |
| US7103779B2 (en) | Method and apparatus for incremental code signing | |
| US8201240B2 (en) | Simple scalable and configurable secure boot for trusted mobile phones | |
| EP1776799B1 (en) | Enhanced security using service provider authentication | |
| CN112507328B (en) | File signature method, computing device and storage medium | |
| EP3583536B1 (en) | Securely defining operating system composition without multiple authoring | |
| CN103677892A (en) | Authorization scheme to enable special privilege mode in secure electronic control unit | |
| CN108259479B (en) | Business data processing method, client and computer readable storage medium | |
| CN113282946A (en) | Information security method and system based on data access process in high-reliability environment | |
| CN111966422A (en) | Localized plug-in service method and device, electronic equipment and storage medium | |
| CN115509556A (en) | Application management method, device, equipment and medium | |
| JP4526383B2 (en) | Tamper evident removable media for storing executable code | |
| CN107689934B (en) | Method, server and client for guaranteeing information security | |
| US10367644B2 (en) | Methods for managing content, computer program products and secure element | |
| CN111562916B (en) | Method and device for sharing algorithm | |
| CN115221534A (en) | Information processing method, information processing apparatus, and computer readable medium | |
| CN116305084A (en) | Software security verification method and device, electronic equipment and storage medium | |
| CN117411653A (en) | Information storage method, information storage device, information storage medium and information storage apparatus | |
| CN114301601A (en) | Interface management method and terminal based on Android platform | |
| CN116980158A (en) | Data processing method and related equipment | |
| CN114879980A (en) | Vehicle-mounted application installation method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |