WO2015101149A1 - 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器 - Google Patents

基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器 Download PDF

Info

Publication number
WO2015101149A1
WO2015101149A1 PCT/CN2014/093443 CN2014093443W WO2015101149A1 WO 2015101149 A1 WO2015101149 A1 WO 2015101149A1 CN 2014093443 W CN2014093443 W CN 2014093443W WO 2015101149 A1 WO2015101149 A1 WO 2015101149A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
certificate
installation package
terminal
update
Prior art date
Application number
PCT/CN2014/093443
Other languages
English (en)
French (fr)
Inventor
陈继
Original Assignee
北京网秦天下科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京网秦天下科技有限公司 filed Critical 北京网秦天下科技有限公司
Publication of WO2015101149A1 publication Critical patent/WO2015101149A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability

Definitions

  • the present invention relates to the field of application security, and more particularly to a method, a terminal, and a secondary server for detecting security of an application installation package based on an application certificate on a mobile terminal.
  • a method, a terminal, and a corresponding auxiliary server for detecting security of an application installation package based on an application certificate according to the present invention are provided.
  • a method of detecting security of an application installation package based on an application certificate executed in a terminal includes: (a) finding and checking in an application certificate library (b) comparing the application certificate found in the application certificate library with the application certificate included in the application installation package; and (c) Based on the results of the alignment, corresponding detection results are provided in accordance with one or more predetermined detection criteria.
  • the application certificate store is located in the terminal and is downloaded by the terminal from a remote server.
  • the method further comprises: (d) transmitting an update request to the remote server, the update request for requesting to update the application certificate store; (e) receiving an update request result from the remote server And possible update data for updating the application certificate store.
  • the method further comprises, after step (e), if the update request result indicates that there is an update for the application certificate store, the terminal updates the location using the received update data Describe the application certificate library.
  • the update data is either full update data or incremental update data.
  • each of the application certificate records in the application certificate library includes at least: application feature data for identifying an application; and an application certificate corresponding to the application.
  • the application certificate includes at least one of the following: version information, serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and certificate issuer pair certificate Signature information.
  • the predetermined detection criterion includes: whether the mismatch obtained by the comparison between the application certificate found in the application certificate library and the application certificate included in the application installation package includes the following item Or multiple: version information, serial number, signature algorithm, issuer, certificate owner, certificate owner public key, and certificate issuer's signature information for the certificate.
  • step (c) comprises: if it is determined that the mismatch includes version information, a serial number, a signature algorithm, an issuer, a certificate owner, a certificate owner public key, and a certificate issuer's signature information for the certificate And one or more of the following, providing a detection result indicating that the application certificate of the application installation package is illegal, otherwise providing a detection result indicating that the application certificate of the application installation package is legal.
  • step (a) and its subsequent steps are performed after the application installation package is self-decrypted.
  • step (a) if the application installation package is not encrypted, then the application security is obtained. After the package is loaded, step (a) and its subsequent steps are performed.
  • the method further comprises, prior to step (a), saving the application installation package in a temporary isolation area of the memory.
  • the method further comprises: if the detection result indicates that the application certificate of the application installation package is legal, moving the application installation package to the original target download location and continuing normal And the step of installing the application installation package and/or alerting the user of the terminal if the detection result indicates that the application certificate of the application installation package is illegal.
  • the method includes between step (a) and step (b): (a1) submitting the application installation package to a remote server and requesting the remote server to update an application certificate store; (a2) receiving update data for the application certificate store from the remote server; and (a3) using the received The update data updates the application certificate store.
  • a terminal for detecting security of an application installation package based on an application certificate includes: a searching unit, configured to search, in an application certificate library, an application certificate corresponding to an application included in an application installation package to be detected; and a comparison unit configured to search for the application certificate library The application certificate and the application certificate included in the application installation package are compared; and a providing unit is configured to provide a corresponding detection result according to one or more predetermined detection standards based on the result of the comparison.
  • the application certificate store is located in the terminal and is downloaded by the terminal from a remote server.
  • the terminal further includes: an update requesting unit, configured to send an update request to the remote server, the update request is for requesting to update the application certificate store; and an update receiving unit, configured to The remote server receives the update request result and possibly updated data for updating the application certificate store.
  • the terminal further includes: an updating unit, configured to update, by using the received update data, the update information if the update request result indicates that there is an update for the application certificate store Apply the certificate store.
  • the update data is either full update data or incremental update data.
  • each of the application certificate records in the application certificate library includes at least: application feature data for identifying an application; and an application certificate corresponding to the application.
  • the application certificate includes at least one of the following: version information, serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and certificate issuer pair certificate Signature information.
  • the predetermined detection criterion includes: whether the mismatch obtained by the comparison between the application certificate found in the application certificate library and the application certificate included in the application installation package includes the following item Or multiple: version information, serial number, signature algorithm, issuer, certificate owner, certificate owner public key, and certificate issuer's signature information for the certificate.
  • the providing unit is further configured to: if it is determined that the mismatch includes version information, a serial number, a signature algorithm, an issuer, a certificate owner, a certificate owner public key, and a certificate issuer to the certificate
  • One or more of the signature information provides a detection result indicating that the application certificate of the application installation package is illegal, and otherwise provides a detection result indicating that the application certificate of the application installation package is legal.
  • the terminal further includes: a decryption unit, configured to decrypt the application installation package if the application installation package is encrypted.
  • the terminal further includes: a temporary saving unit, configured to save the application installation package in a temporary isolation area of the memory.
  • the temporary saving unit is further configured to: if the detection result indicates that the application certificate of the application installation package is legal, move the application installation package to the original target download location and continue the normal installation step; And if the detection result indicates that the application certificate of the application installation package is illegal, terminating the installation process of the application installation package and/or alerting the user of the terminal.
  • the terminal further includes: a specific application update request unit, configured to submit the application installation package to the remote server and request the remote server to update the application certificate library; and the specific application update receiving unit is configured to The remote server receives update data for the application certificate store; and a specific application update unit for updating the application certificate store using the received update data.
  • a specific application update request unit configured to submit the application installation package to the remote server and request the remote server to update the application certificate library
  • the specific application update receiving unit is configured to The remote server receives update data for the application certificate store
  • a specific application update unit for updating the application certificate store using the received update data.
  • an auxiliary detection application installation performed in a server
  • the method of security of the package includes: (a) obtaining the application from an official distribution channel of the application; (b) performing one or more security analyses for the application; (c) based on the one or more security analyses As a result, the security of the application is judged; and (d) the application certificate of the application determined to be secure is stored in the application certificate store.
  • the security analysis includes one or more of the following: certificate information analysis, rights requirement analysis, network behavior analysis, and key API call analysis.
  • the application certificate includes at least one of the following: version information, serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and certificate issuer pair certificate Signature information.
  • each of the application certificate records in the application certificate library includes at least: application feature data for identifying an application; and an application certificate corresponding to the application.
  • the method further comprises: (e) receiving an update request from the terminal, the update request for requesting to update a terminal application certificate store on the terminal; (f) according to the update request included Version information, determining whether the terminal should update its terminal application certificate store; and (g) transmitting an update request result and possible update data of the terminal application certificate store for updating the terminal based on the determination .
  • the update data is either full update data or incremental update data.
  • the method further comprises: receiving, from the terminal, a request for updating an application certificate store for a specific application installation package and data of the specific application installation package; installing an application included in the package for the specific application Performing one or more security analyses; determining, based on the results of the one or more security analyses, security of an application included in the particular application installation package; and updating the server based on the determining The certificate store is applied, and the update data of the terminal application certificate store for the terminal related to the specific application installation package is sent to the terminal.
  • a server for assisting in detecting security of an application installation package includes: an obtaining unit, configured to acquire the application from an official publishing channel of the application; an analyzing unit, configured to perform one or more security analysis on the application; and a determining unit, configured to be based on the one or As a result of the plurality of security analysis, the security of the application is determined; and the storage unit is configured to store the application certificate of the application determined to be secure into the application certificate store.
  • the security analysis includes one or more of the following: certificate information analysis, rights requirement analysis, network behavior analysis, and key API call analysis.
  • the application certificate includes at least one of the following: version information, serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and certificate issuer pair certificate Signature information.
  • each of the application certificate records in the application certificate library includes at least: application feature data for identifying an application; and an application certificate corresponding to the application.
  • the server further includes: an update request receiving unit, configured to receive an update request from the terminal, the update request is used to request to update a terminal application certificate library on the terminal; and a version determining unit is configured to a version information included in the update request, determining whether the terminal should update its terminal application certificate library; and an update result sending unit, configured to send an update request result to the terminal and possibly for updating based on the determining The terminal of the terminal applies update data of the certificate store.
  • the update data is either full update data or incremental update data.
  • the server further includes: a specific application update receiving unit, configured to receive, from the terminal, a request for updating an application certificate library for a specific application installation package and data of the specific application installation package; a unit for performing one or more security analysis for an application included in the specific application installation package; a specific application update determining unit, configured to determine the result based on the result of the one or more security analysis Security of an application included in a specific application installation package; and a specific application update unit for updating an application certificate library of the server based on the judgment, and transmitting, to the terminal, a target related to the specific application installation package
  • the terminal of the terminal applies update data of the certificate store.
  • a legal certificate base establishment and application verification mechanism based on the mobile terminal can be provided.
  • the present invention uses the officially released application as a verification basis to implement a legality verification mechanism for the mobile application signature certificate.
  • the present invention ensures the legitimacy of the application in the process of being released to the installation and use, prevents the user from installing a malicious application that has been illegally repackaged, reduces various losses caused by the use of the malicious application, and improves the security of the mobile terminal application.
  • FIG. 1 is a schematic diagram showing an example application scenario of a system for detecting security of an application installation package based on an application certificate in accordance with the present invention.
  • FIG. 2 is a flow chart showing an example of creating, managing, and delivering legal certificate information at a server and detecting security of an application installation package at a terminal in accordance with the present invention.
  • FIG. 3 is a flow diagram showing an example method of detecting security of an application installation package based on an application credential performed at a terminal, in accordance with an embodiment of the present invention.
  • FIG. 4 is a block diagram showing an example terminal for performing the method of FIG. 3, in accordance with an embodiment of the present invention.
  • FIG. 5 is a flow diagram showing an example method performed at a server for assisting in detecting security of an application installation package, in accordance with an embodiment of the present invention.
  • FIG. 6 is a block diagram showing an example server for performing the method shown in FIG. 5, in accordance with an embodiment of the present invention.
  • the present invention will be described in detail by taking the scenario in which the present invention is applied to a wireless mobile communication system as an example.
  • the present invention is not limited thereto, and the present invention is also applicable to a fixed communication system, a wired communication system, or an arbitrary hybrid structure applied to a wireless mobile communication system, a fixed communication system, a wired communication system, or the like.
  • the present invention is not limited to the specific communication protocols of the various mobile communication terminals involved, and may include, but is not limited to, 2G, 3G, 4G, 5G networks, WCDMA, CDMA2000, TD-SCDMA systems, etc. Different mobile terminals may use the same communication protocol or different communication protocols.
  • the present invention is not limited to a specific operating system of the mobile terminal, and may include, but is not limited to, iOS, Windows Phone, Symbian, Android, etc., and different mobile terminals may use the same operating system. Different operating systems are also possible.
  • FIG. 1 is a schematic diagram showing an application scenario of an application security detection system 1000 in accordance with the present invention.
  • system 1000 can include terminal 100 and server 200.
  • terminal 100 and server 200 For the sake of clarity, only one terminal 100 and one server 200 are shown in the figure, but the present invention is not limited thereto and may include two or more numbers of terminals and/or servers and the like.
  • the terminal 100 may belong to a user or may be operated by a user.
  • the terminal 100 and the server 200 can communicate via the communication network 300.
  • Examples of communication network 300 may include, but are not limited to, the Internet, mobile communication networks, fixed lines (e.g., xDSL, fiber optics, etc.), and the like.
  • the inventive concept of the present invention will be described in detail by taking the Android platform as an example.
  • the present invention is not limited thereto, and it can also be applied to other platforms such as iOS, Windows Phone, Symbian, and the like.
  • it is mainly realized by a program written in a computer language such as Python or Java.
  • the invention is not limited thereto, and it is also applicable to other computer languages and/or combinations thereof.
  • the "sample acquisition” module (hereinafter referred to as SFM, the Sample Fetch Module) can be implemented in the Python language.
  • the module can be used to form a sample application database (hereinafter referred to as BASD) through an official release channel published by an application developer or development organization, and/or supplemented by an authoritative third-party application distribution channel such as the Google Play Store. That is, Basic App Sample Database).
  • BASD sample application database
  • BASD Basic App Sample Database
  • the present invention is not limited thereto, and it is also possible to obtain an application as a sample by other means, such as copying from a trusted third party by an SD card, and the like.
  • the sample validation and building block (hereinafter referred to as SVBM, Sample Verification and Build Module) can be implemented in the Python language.
  • the module can parse application samples from BASD and perform various security analyses.
  • the security analysis can include one or more of the following: certificate information analysis, permission requirement analysis, network behavior analysis, key API call analysis, and the like.
  • the security analysis may also include other analysis for security, such as feature code analysis for the application.
  • the basic information of the application sample eg, sample name, sample version, and/or issue time
  • the certificate authority, certificate validity period, and/or certificate file are stored in a legal sample database (hereinafter referred to as LDL, ie, the Legal Sample Database) to form LSD information;
  • LDL legal sample database
  • LSDF LSD Filelize
  • the module parses the latest legal application sample and corresponding certificate information from the LSD information, and organizes the information in XML form to form a certificate library file (hereinafter referred to as CLF, ie, Certificate Library File) (completely updated) and Update the certificate store file (hereinafter referred to as UCLF, Updated Certificate Library File) (incremental update).
  • CLF certificate library file
  • UCLF Updated Certificate Library File
  • CLFM certificate store file management database
  • various update files may not be generated in advance, but when the terminal 100 requests, the update data for the terminal 100 is generated in real time according to the version information and the like carried in the update request of the terminal 100.
  • the storage space can be saved by sacrificing a certain response speed by changing the space by time.
  • the terminal 100 may be notified of the existence of the certificate store update file by means of a message push manner (for example, a SIP message or the like); or the terminal 100 may be notified by other means that the certificate store update file exists, such as a short message or an electronic message. Mail, etc.
  • Terminal 100 may download and/or be pushed from server 200 for a full update (eg, CLF), or may download and/or be pushed for incremental updates (eg, UCLF).
  • the download process can be done in encrypted form (for example, using the HTTPS protocol).
  • the CLF itself can be encrypted by, for example, a 3DES encryption algorithm (or any other encryption algorithm) to prevent the middleman from attacking the hijacking and causing file loss and the like.
  • the certificate legality verification of the terminal 100 (hereinafter referred to as LCV, Legal Certificate Verification) can be implemented by combining the NDK and the SDK in Java, and the main functions of the LCV.
  • the module includes management and update of CLF (hereinafter referred to as CLFC, ie CLF Check), download application certificate verification (hereinafter referred to as DACV, ie Downloaded Application Certificate Verification), and install application certificate verification (hereinafter referred to as IACV, ie Installed App Certificate Verification). ), the server legally applies the certificate to obtain communication (hereinafter referred to as CFS, that is, Certificate From Server).
  • CLFC CLFC
  • DACV download application certificate verification
  • IACV ie Downloaded Application Certificate Verification
  • IACV ie Installed App Certificate Verification
  • DACV and IACV work in a similar manner, except that the DACV is responsible for security detection of the downloaded unencrypted application installation package, and IACV is responsible for performing security detection on the downloaded encrypted application installation package after decryption of the package. (Because it is encrypted, it is not possible for the DAVC to certificate the application installation package in the case of encryption), which will be described in more detail below.
  • the system can load the LCV at startup and the LCFC is enabled by the LCV to detect the presence of the local CLF. If not, the CLFC may request the CLF from the server 200. After verifying that the identity of the terminal 100 is valid, the server 200 may pass the encrypted full CLF to the CLFC through the HTTPS channel.
  • the present invention is not limited thereto, and in fact, in other embodiments, the server 200 may not verify the identity of the terminal 100.
  • the CLFC may request a CLF update check from the server 200, and if there is an update, the server 200 may (or may not verify) after verifying that the terminal information is valid, based on the local CLF of the terminal 100 included in the update request.
  • the corresponding UCLF determined by the version information is encrypted and passed to the CLFC through the HTTPS channel.
  • the UCLF determined based on the version information of the local CLF can ensure that the UCLF can be used for the terminal 100, thereby preventing the update mismatch.
  • the complete CLF can be encrypted and passed to the CLFC over the HTTPS channel to replace the original CLF as a whole.
  • the CLF and/or UCLF may be unencrypted.
  • the CLFC may use the 3DES algorithm (or other corresponding decryption algorithm) to decrypt using the corresponding key to obtain the plaintext CLF or UCLF.
  • the CLFC may use the 3DES algorithm (or other corresponding decryption algorithm) to decrypt using the corresponding key to obtain the plaintext CLF or UCLF.
  • the CLF or UCLF is not encrypted, the next steps are taken directly.
  • the contents of the file can be updated to the local CLF to form the latest CLF. Otherwise, the original CLF can be replaced with the CLF as a whole.
  • the CLFC can parse the CLF file and form file information and certificates in the memory.
  • the information MAP correspondence relationship list (hereinafter referred to as ACM, that is, Application and Certificate Mapping).
  • the certificate information may include one or more of the following: version information, serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and The certificate issuer's signature information for the certificate.
  • the format of each record in the ACM can be as follows:
  • the present invention is not limited thereto, and other formats capable of implementing similar functions may also be used.
  • the MD5 value can be used to replace the SHA1 value, or the order of the data items can be exchanged, and the like.
  • the LCV can then enable DACV and IACV to monitor download behavior and installation behavior.
  • the download is a generalized download, that is, at least: download via the Internet, download via LAN, download via Bluetooth, download via WiFi, download (copy) through a removable memory card (for example, SD card), pass USB port download, download via infrared port and more.
  • the DACV can analyze the DC. If the DC is not an application installation file, the DACV can release its takeover of the download behavior and move the DC from the TIL to the original target download address and perform a normal download operation.
  • the DACV can first parse the DC file information.
  • the DACV can then query the ACM based on the file information (eg, the name of the application, the digital digest MD5 or the SHAl value) to obtain corresponding full file information and certificate information (hereinafter referred to as MCI, ie, the Match Certificate Info).
  • MCI full file information and certificate information
  • the DACV can compare the certificate content in the DC with the MCI. If a non-match is found and the hazard level in the set detection criteria is met, a system warning message will be given to inform the user that downloading the application installation file certificate information is illegal and there is a high risk. DC related information will be deleted after it is recorded locally.
  • the detection criterion may be: whether the mismatch obtained by the comparison between the application certificates in the MCI and the DC includes one or more of the following: version information, serial number, signature calculation Law, issuer, certificate owner, certificate owner public key, and certificate issuer's signature information for the certificate. That is, the detection criterion may be to determine whether the data items other than the validity period in the certificate are consistent.
  • the IACV will be enabled and take over the subsequent behavioral detection of the DC. IACV will take over the installation behavior of the DDC when the DC completes the self-decryption process (eg, decrypts it by the host processor of the terminal 100) and generates a decrypted file (hereinafter referred to as DDC, Decrypted Download Content) and begins to take installation actions. . It analyzes the DDC, obtains file information, and then queries the ACM based on the file information to obtain the MCI.
  • DDC Decrypted Download Content
  • the IACV can compare the certificate content and the MCI in the DDC, and if a non-match is found and meets the dangerous level in the set detection standard, a system warning message will be given. Inform the user that downloading the application installation file certificate information is illegal and there is a high risk. After the DDC related information is recorded locally, its installation behavior will be terminated and the operation process will be recorded in the specified log file.
  • the DAVC and/or IACV issues a CLF update request to the server 200 and simultaneously uploads the corresponding DC and/or DDC information. Then, after the server 200 generates the updated CLF for the corresponding application and delivers it to the terminal 100, the ACM information is re-discovered by the DACV and/or IACV, and then all the verification processes in (g) are performed again.
  • All logs generated by the LCV, DACV, and IACV work processes can be recorded in a specified location on the SD card in clear text, such as "/sdcard/lcv/alllog".
  • Files can be stored in XML format.
  • the logs of the respective modules may be separately and/or combined stored in any storage location of the terminal 100 and/or the server 200 in other encrypted/unencrypted formats. After the log files are archived and packaged regularly, they can be uploaded to the server 200 for unified management.
  • a legal certificate base establishment and application verification mechanism based on the terminal 100 can be provided. It is installed from the application to the installation of the application on the terminal 100, and the official release application is used as the verification basis to implement the legality verification mechanism for the mobile application signature certificate. In addition, it ensures the legitimacy of the application during the release to the installation process, prevents the user from installing malicious applications that are illegally repackaged, reduces various losses caused by the use of malicious applications, and improves the security of the mobile terminal application.
  • method 400 can include steps S410, S420, and S430.
  • steps S410, S420, and S430 may be performed separately or in combination, and may be performed in parallel or sequentially, and is not limited to the specific order of operations illustrated in FIG.
  • method 400 can be performed by terminal 100 shown in FIG.
  • FIG. 5 is a flow diagram showing a method 450 of assisting in detecting security of an application installation package performed in server 200, in accordance with an embodiment of the present invention.
  • method 450 can include steps S460, S470, S480, and S490.
  • some of the steps of method 450 may be performed separately or in combination, and may be performed in parallel or sequentially, and are not limited to the specific order of operations illustrated in FIG.
  • method 450 can be performed by server 200 shown in FIG.
  • the terminal 100 may include: a searching unit 110, a comparing unit 120, and a providing unit 130.
  • the searching unit 110 may be configured to search, in the application certificate library, an application certificate corresponding to an application included in the application installation package to be detected.
  • the lookup unit 110 may be a central processing unit (CPU) of the terminal 100, a digital signal processor (DSP), a microprocessor, a microcontroller, etc., which may be in communication with the terminal 100 (eg, a wireless transceiver, an ethernet) Network card, xDSL modem, etc.) and / or storage part (for example, RAM, SD card, etc.), in the local application certificate library and / or remote application certificate library, find and include in the application installation package to be detected Apply the corresponding application certificate.
  • CPU central processing unit
  • DSP digital signal processor
  • microprocessor e.g., a microcontroller, etc.
  • the terminal 100 eg, a wireless transceiver, an ethernet) Network card, xDSL modem, etc.
  • storage part for example, RAM, SD card, etc.
  • the comparison unit 120 can be used to compare the application certificate found in the application certificate library and the application certificate included in the application installation package.
  • the comparison unit 110 may be a central processing unit (CPU) of the terminal 100, a digital signal processor (DSP), a microprocessor, a microcontroller, etc., which may be associated with a storage portion of the terminal 100 (eg, RAM, SD card, etc.) Matching, the application certificate found in the application certificate library and the application certificate contained in the application installation package are compared.
  • the providing unit 130 can be configured to provide a corresponding detection result according to one or more predetermined detection criteria based on the result of the comparison.
  • the providing unit 130 may be a central processing unit (CPU) of the terminal 100, A digital signal processor (DSP), a microprocessor, a microcontroller, etc., which can cooperate with an output portion of the terminal 100 (eg, a display, a printer, etc.), based on the result of the comparison, based on one or more predetermined tests Standards to provide the corresponding test results.
  • the terminal 100 may further include other units not shown in FIG. 4, such as an update request unit, an update receiving unit, an update unit, a decryption unit, a temporary save unit, a specific application update request unit, a specific application update receiving unit, and a specific Apply update units, etc.
  • the update request unit can be used to send an update request to the remote server 200 for requesting an update of the application certificate store.
  • the update receiving unit can be configured to receive an update request result from the remote server 200 and possibly update data for updating the application certificate store.
  • the update unit can be configured to update the application certificate store using the received update data if the update request result indicates that there is an update for the application certificate store.
  • the decryption unit can be used to decrypt the application installation package if the application installation package is encrypted.
  • the temporary save unit can be used to save the application installation package in a temporary quarantine of the memory.
  • the specific application update request unit can be used to submit an application installation package to the remote server 200 and request the remote server 200 to update the application certificate store.
  • the specific application update receiving unit can be used to receive update data for the application certificate store from the remote server 200.
  • the specific application update unit can be used to update the application certificate store using the received update data.
  • FIG. 6 is a block diagram showing an example server 200 for assisting in detecting security of an application installation package in accordance with an embodiment of the present invention.
  • the server 200 may include: an obtaining unit 210, an analyzing unit 220, a determining unit 230, and a storing unit 240.
  • the obtaining unit 210 can be used to obtain an application from an official distribution channel of the application.
  • the acquisition unit 210 may be a central processing unit (CPU) of the server 200, a digital signal processor (DSP), a microprocessor, a microcontroller, etc., which may be in communication with the server 200 (eg, a wireless transceiver, an ethernet) A network card, xDSL modem, etc.) and/or a storage portion (eg, RAM, SD card, etc.) cooperate to obtain an application from an official distribution channel of the application.
  • CPU central processing unit
  • DSP digital signal processor
  • microprocessor e.g., a microcontroller
  • a storage portion eg, RAM, SD card, etc.
  • the Analysis unit 220 can be used to perform one or more security analyses for the application.
  • the ratio analysis unit 220 can be a central processing unit (CPU), digital signal processor (DSP), microprocessor, microcontroller, etc. of the server 200, which can perform one or more security analyses, such as Book information analysis, permission requirements analysis, network behavior analysis, key API call analysis, etc.
  • the determining unit 230 can be configured to determine the security of the application based on the result of one or more security analyses.
  • the determining unit 230 may be a central processing unit (CPU) of the server 200, a digital signal processor (DSP), a microprocessor, a microcontroller, etc., which may determine the application based on the result of one or more security analyses.
  • CPU central processing unit
  • DSP digital signal processor
  • microprocessor a microcontroller, etc.
  • the storage unit 240 can be configured to store the application certificate of the application determined to be secure into the application certificate library.
  • the storage unit 240 may be a central processing unit (CPU) of the server 200, a digital signal processor (DSP), a microprocessor, a microcontroller, etc., which may be associated with a storage portion of the server 200 (eg, RAM, SD card, etc.)
  • DSP digital signal processor
  • the application certificate of the application that is determined to be secure is stored in the application certificate store.
  • the server 200 may further include other units not shown in FIG. 6, such as an update request receiving unit, a version determining unit, an update result transmitting unit, a specific application update receiving unit, a specific application analyzing unit, a specific application update determining unit, and Specific application update unit.
  • the update request receiving unit may be configured to receive an update request from the terminal 100 for requesting to update the terminal application certificate store on the terminal 100.
  • the version determining unit may be configured to determine whether the terminal 100 should update its terminal application certificate store according to the version information included in the update request.
  • the update result transmitting unit may be configured to transmit, to the terminal 100, an update request result and possibly update data for updating the terminal application certificate store of the terminal 100 based on the determination.
  • the specific application update receiving unit may be configured to receive, from the terminal 100, a request to update an application certificate store for a specific application installation package and data of the specific application installation package.
  • the application specific analysis unit can be used to perform one or more security analyses for the applications included in the particular application installation package.
  • the specific application update determination unit can be configured to determine the security of the applications included in the particular application installation package based on the results of the one or more security analyses.
  • the specific application update unit may update the application certificate library of the server 200 based on the determination, and transmit the update data of the terminal application certificate store for the terminal 100 related to the specific application installation package to the terminal 100.
  • a method 400 and a terminal 100 for detecting security of an application installation package based on an application certificate executed on the terminal 100 according to an embodiment of the present invention will be described in detail below with reference to FIGS. 3 and 4.
  • step S410 the application certificate corresponding to the application included in the application installation package to be detected may be searched by the search unit 110 of the terminal 100 in the application certificate library.
  • step S420 the application certificate found in the application certificate library and the application certificate included in the application installation package may be compared by the comparison unit 120 of the terminal 100.
  • the corresponding detection result may be provided by the providing unit 130 of the terminal 100 based on one or more predetermined detection criteria based on the result of the comparison.
  • the application certificate store may be located in the terminal 100 and may be downloaded by the terminal 100 from the remote server 200.
  • method 400 can also include: (402) transmitting an update request to remote server 200 for requesting an update of an application certificate store; (404) receiving an update request result from remote server 200 and possibly for updating Apply the update data of the certificate store.
  • the method 400 may further include, after the step (404), if the update request result indicates that there is an update for the application certificate store, the terminal 100 updates the application certificate store using the received update data.
  • the update data can be either full update data or incremental update data.
  • each application certificate record in the application certificate store may include at least: application feature data for identifying the application; and an application certificate corresponding to the application.
  • the application certificate can include at least one of the following: version information, serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and certificate issuer's certificate Signature information.
  • the predetermined detection criteria may include whether the mismatch obtained between the application certificate found in the application certificate library and the application certificate included in the application installation package includes one or more of the following: version Information, serial number, signature algorithm, issuer, certificate owner, certificate owner public key, and certificate issuer's signature information for the certificate.
  • step S430 may include: if it is determined that the mismatch includes version information, a serial number, a signature algorithm, an issuer, a certificate owner, a certificate owner public key, and a certificate issuer's signature information on the certificate.
  • step S410 and its subsequent steps may be performed after the application installation package is self-decrypted.
  • step S410 and subsequent steps may be performed after the application installation package is obtained.
  • the method 400 may further include, before the step S410, saving the application installation package in a temporary isolation area of the memory.
  • the method 400 may further include, after the step S430, if the detection result indicates that the application certificate of the application installation package is legal, moving the application installation package to the original target download location and continuing the normal installation step; and if the detection result indicates If the application certificate of the application installation package is illegal, the installation process of the application installation package is terminated and/or the user of the terminal 100 is alerted.
  • the method 400 may include: (S412) to the remote server between step S410 and step S420 200 submits an application installation package and requests the remote server 200 to update the application certificate store; (S414) receives update data for the application certificate store from the remote server 200; and (S416) updates the application certificate store using the received update data.
  • a method 450 and a server 200 for assisting in detecting the security of an application installation package executed at the server 200 according to an embodiment of the present invention will be described in detail below with reference to FIGS. 5 and 6.
  • the method 450 begins in step S460, in which the application can be obtained from the official distribution channel of the application by the acquisition unit 210 of the server 200.
  • step S470 one or more security analyses may be performed by the analysis unit 220 of the server 200 for the application.
  • step S480 the security of the application may be determined by the determination unit 230 of the server 200 based on the result of one or more security analyses.
  • step S490 the application certificate of the application determined to be secure may be stored in the application certificate store by the storage unit 240 of the server 200.
  • the security analysis can include one or more of the following: certificate information analysis, permission requirement analysis, network behavior analysis, and key API call analysis.
  • the application certificate can include at least one of the following data: version information, Serial number, signature algorithm, issuer, expiration date, certificate owner, certificate owner public key, and certificate issuer's signature information for the certificate.
  • each application certificate record in the application certificate store may include at least: application feature data for identifying the application; and an application certificate corresponding to the application.
  • the method 450 can further include: (452) receiving, from the terminal 100, an update request for requesting to update the terminal application certificate store on the terminal 100; (454) according to the version information included in the update request, Determining whether the terminal 100 should update its terminal application certificate store; and (456) transmitting an update request result and possible update data for updating the terminal application certificate store of the terminal 100 to the terminal 100 based on the determination.
  • the update data can be either full update data or incremental update data.
  • the method 450 may further include: receiving, from the terminal 100, a request for updating an application certificate library for a specific application installation package and data of the specific application installation package; performing an application for the application included in the specific application installation package Item or multiple security analysis; determining the security of the application included in the specific application installation package based on the result of one or more security analysis; and updating the application certificate library of the server 200 based on the determination, and to the terminal 100
  • the update data of the terminal application certificate store for the terminal 100 related to the specific application installation package is transmitted.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Stored Programmes (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明提供了基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器。该方法包括：(a)在应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书；(b)对在所述应用证书库中查找到的应用证书以及所述应用安装包中包含的应用证书进行比对；以及(c)基于所述比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。

Description

基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器 技术领域
本发明涉及应用安全领域，更具体地涉及移动终端上基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器。
背景技术
随着移动终端的广泛流行，其已经成为了人们在生产生活中不可或缺的一部分，而终端上的应用(app)更是其中的重要组成部分。目前，对于基于例如安卓平台的应用市场和应用发布来说，应用的制作和发布通常比较随意和自由。具体地，任何用户只要使用合规的证书签发机制，则在对需要发布的应用证书签名之后，通过简单的认证流程，就能够在应用市场上顺利发布和允许应用下载和后续安装。
由于缺乏类似于由苹果商店提供的完善的验证机制，所以在各种安卓应用市场中的各类合法的官方应用经常会被恶意第三方进行二次或多次打包，并在向其中加入恶意代码或过度权限要求等之后被作为官方应用重新发布(例如，通过一些第三方下载站等)。由于在安卓系统下安装应用时，缺乏完备的应用验证机制，所以在安装过程中在终端的简单权限提示后，这种经过非法再次打包的恶意应用就可在终端上顺利安装，并最终导致用户的损失(例如，产生未经许可的流量、扣费、甚至敏感信息泄漏等等)，甚至使用户终端沦为傀儡设备(指利用漏洞，而成为恶意攻击的源头或跳板的设备)。
发明内容
为了解决上述问题，提供了根据本发明的基于应用证书来检测应用安装包的安全性的方法、终端及相应的辅助服务器。
根据本发明的第一方面，提供了一种在终端中执行的基于应用证书来检测应用安装包的安全性的方法。该方法包括：(a)在应用证书库中，查找与待检 测的应用安装包中包含的应用相对应的应用证书；(b)对在所述应用证书库中查找到的应用证书以及所述应用安装包中包含的应用证书进行比对；以及(c)基于所述比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。
在一些实施例中，所述应用证书库位于所述终端中，且是由所述终端从远程服务器下载的。
在一些实施例中，所述方法还包括：(d)向所述远程服务器发送更新请求，所述更新请求用于请求更新所述应用证书库；(e)从所述远程服务器接收更新请求结果以及可能的用于更新应用证书库的更新数据。
在一些实施例中，所述方法在步骤(e)之后还包括：如果所述更新请求结果指示存在针对所述应用证书库的更新，则所述终端使用接收到的所述更新数据来更新所述应用证书库。
在一些实施例中，所述更新数据是完全更新数据或增量更新数据。
在一些实施例中，所述应用证书库中的每一条应用证书记录至少包括：用于识别应用的应用特征数据；以及与该应用相对应的应用证书。
在一些实施例中，所述应用证书包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，所述预定检测标准包括：在所述应用证书库中查找到的应用证书和所述应用安装包中包含的应用证书之间比对得到的不匹配项是否包括以下一项或多项：版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，步骤(c)包括：如果确定不匹配项包括版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息中的一项或多项，则提供指示所述应用安装包的应用证书非法的检测结果，否则提供指示所述应用安装包的应用证书合法的检测结果。
在一些实施例中，如果所述应用安装包被加密，则在所述应用安装包自解密之后，才执行步骤(a)及其后续步骤。
在一些实施例中，如果所述应用安装包未被加密，则在获取到所述应用安 装包之后，就执行步骤(a)及其后续步骤。
在一些实施例中，所述方法在步骤(a)之前还包括：将所述应用安装包保存在存储器的临时隔离区中。
在一些实施例中，所述方法在步骤(c)之后还包括：如果所述检测结果指示所述应用安装包的应用证书合法，则将所述应用安装包移动至原目标下载位置并继续正常安装步骤；以及如果所述检测结果指示所述应用安装包的应用证书非法，则终止所述应用安装包的安装过程和/或向所述终端的用户告警。
在一些实施例中，如果在步骤(a)中未找到与待检测的应用安装包中包含的应用相对应的应用证书，则所述方法在步骤(a)和步骤(b)之间包括：(a1)向远程服务器提交所述应用安装包并请求所述远程服务器更新应用证书库；(a2)从所述远程服务器接收针对所述应用证书库的更新数据；以及(a3)使用接收到的所述更新数据来更新所述应用证书库。
根据本发明的第二方面，提供了一种基于应用证书来检测应用安装包的安全性的终端。该终端包括：查找单元，用于在应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书；比对单元，用于对在所述应用证书库中查找到的应用证书以及所述应用安装包中包含的应用证书进行比对；以及提供单元，用于基于所述比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。
在一些实施例中，所述应用证书库位于所述终端中，且是由所述终端从远程服务器下载的。
在一些实施例中，所述终端还包括：更新请求单元，用于向所述远程服务器发送更新请求，所述更新请求用于请求更新所述应用证书库；更新接收单元，用于从所述远程服务器接收更新请求结果以及可能的用于更新应用证书库的更新数据。
在一些实施例中，所述终端还包括：更新单元，用于如果所述更新请求结果指示存在针对所述应用证书库的更新，则所述终端使用接收到的所述更新数据来更新所述应用证书库。
在一些实施例中，所述更新数据是完全更新数据或增量更新数据。
在一些实施例中，所述应用证书库中的每一条应用证书记录至少包括：用于识别应用的应用特征数据；以及与该应用相对应的应用证书。
在一些实施例中，所述应用证书包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，所述预定检测标准包括：在所述应用证书库中查找到的应用证书和所述应用安装包中包含的应用证书之间比对得到的不匹配项是否包括以下一项或多项：版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，所述提供单元还用于：如果确定不匹配项包括版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息中的一项或多项，则提供指示所述应用安装包的应用证书非法的检测结果，否则提供指示所述应用安装包的应用证书合法的检测结果。
在一些实施例中，所述终端还包括：解密单元，用于在所述应用安装包被加密的情况下，对所述应用安装包解密。
在一些实施例中，所述终端还包括：临时保存单元，用于将所述应用安装包保存在存储器的临时隔离区中。
在一些实施例中，所述临时保存单元还用于：如果所述检测结果指示所述应用安装包的应用证书合法，则将所述应用安装包移动至原目标下载位置并继续正常安装步骤；以及如果所述检测结果指示所述应用安装包的应用证书非法，则终止所述应用安装包的安装过程和/或向所述终端的用户告警。
在一些实施例中，所述终端还包括：特定应用更新请求单元，用于向远程服务器提交所述应用安装包并请求所述远程服务器更新应用证书库；特定应用更新接收单元，用于从所述远程服务器接收针对所述应用证书库的更新数据；以及特定应用更新单元，用于使用接收到的所述更新数据来更新所述应用证书库。
根据本发明的第三方面，提供了一种在服务器中执行的辅助检测应用安装 包的安全性的方法。该方法包括：(a)从应用的官方发布渠道获取所述应用；(b)针对所述应用执行一项或多项安全性分析；(c)基于所述一项或多项安全性分析的结果，判断所述应用的安全性；以及(d)将被判断为安全的应用的应用证书存放到应用证书库中。
在一些实施例中，所述安全性分析包括以下各项中的一项或多项：证书信息分析、权限要求分析、网络行为分析、以及关键API调用分析。
在一些实施例中，所述应用证书包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，所述应用证书库中的每一条应用证书记录至少包括：用于识别应用的应用特征数据；以及与该应用相对应的应用证书。
在一些实施例中，所述方法还包括：(e)从终端接收更新请求，所述更新请求用于请求更新所述终端上的终端应用证书库；(f)根据所述更新请求中包括的版本信息，判断所述终端是否应当更新其终端应用证书库；以及(g)基于所述判断，向所述终端发送更新请求结果以及可能的用于更新所述终端的终端应用证书库的更新数据。
在一些实施例中，所述更新数据是完全更新数据或增量更新数据。
在一些实施例中，所述方法还包括：从终端接收用于针对特定应用安装包来更新应用证书库的请求和所述特定应用安装包的数据；针对所述特定应用安装包中包含的应用执行一项或多项安全性分析；基于所述一项或多项安全性分析的结果，判断所述特定应用安装包中包含的应用的安全性；以及基于所述判断，更新所述服务器的应用证书库，并向所述终端发送与所述特定应用安装包相关的针对所述终端的终端应用证书库的更新数据。
根据本发明的第四方面，提供了一种辅助检测应用安装包的安全性的服务器。该服务器包括：获取单元，用于从应用的官方发布渠道获取所述应用；分析单元，用于针对所述应用执行一项或多项安全性分析；判断单元，用于基于所述一项或多项安全性分析的结果，判断所述应用的安全性；以及存放单元，用于将被判断为安全的应用的应用证书存放到应用证书库中。
在一些实施例中，所述安全性分析包括以下各项中的一项或多项：证书信息分析、权限要求分析、网络行为分析、以及关键API调用分析。
在一些实施例中，所述应用证书包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，所述应用证书库中的每一条应用证书记录至少包括：用于识别应用的应用特征数据；以及与该应用相对应的应用证书。
在一些实施例中，所述服务器还包括：更新请求接收单元，用于从终端接收更新请求，所述更新请求用于请求更新所述终端上的终端应用证书库；版本判断单元，用于根据所述更新请求中包括的版本信息，判断所述终端是否应当更新其终端应用证书库；以及更新结果发送单元，用于基于所述判断，向所述终端发送更新请求结果以及可能的用于更新所述终端的终端应用证书库的更新数据。
在一些实施例中，所述更新数据是完全更新数据或增量更新数据。
在一些实施例中，所述服务器还包括：特定应用更新接收单元，用于从终端接收用于针对特定应用安装包来更新应用证书库的请求和所述特定应用安装包的数据；特定应用分析单元，用于针对所述特定应用安装包中包含的应用执行一项或多项安全性分析；特定应用更新判断单元，用于基于所述一项或多项安全性分析的结果，判断所述特定应用安装包中包含的应用的安全性；以及特定应用更新单元，用于基于所述判断，更新所述服务器的应用证书库，并向所述终端发送与所述特定应用安装包相关的针对所述终端的终端应用证书库的更新数据。
通过使用本发明的方法、终端及相应的辅助服务器，可以提供基于移动终端的合法证书库建立和应用验证机制。从应用的发布到应用在终端上的安装，本发明以官方发布的应用作为验证基础，实现对移动应用签名证书的合法性验证机制。此外，本发明确保了应用在发布到安装使用过程中的合法性，避免用户安装经过非法再次打包的恶意应用，减少用户因使用恶意应用造成的各种损失，提高移动终端应用的安全性。
附图说明
通过下面结合附图说明本发明的优选实施例，将使本发明的上述及其它目的、特征和优点更加清楚，其中：
图1是示出了根据本发明的基于应用证书来检测应用安装包的安全性的系统的示例应用场景的示意图。
图2是示出了根据本发明的在服务器处创建、管理和下发合法证书信息以及在终端处检测应用安装包的安全性的示例流程图。
图3是示出了根据本发明实施例的在终端处执行的基于应用证书来检测应用安装包的安全性的示例方法的流程图。
图4是示出了根据本发明实施例的用于执行图3所示方法的示例终端的框图。
图5是示出了根据本发明实施例的在服务器处执行的用于辅助检测应用安装包的安全性的示例方法的流程图。
图6是示出了根据本发明实施例的用于执行图5所示的方法的示例服务器的框图。
具体实施方式
下面参照附图对本发明的优选实施例进行详细说明，在描述过程中省略了对于本发明来说是不必要的细节和功能，以防止对本发明的理解造成混淆。以下，以本发明应用于无线移动通信系统的场景为例，对本发明进行了详细描述。但本发明并不局限于此，本发明也可以应用于固定通信系统、有线通信系统，或者应用于无线移动通信系统、固定通信系统、有线通信系统等的任意混合结构。就移动通信系统而言，本发明并不局限于所涉及的各个移动通信终端的具体通信协议，可以包括(但不限于)2G、3G、4G、5G网络，WCDMA、CDMA2000、TD-SCDMA系统等，不同的移动终端可以采用相同的通信协议，也可以采用不同的通信协议。此外，本发明并不局限于移动终端的具体操作系统，可以包括(但不限于)iOS、Windows Phone、Symbian(塞班)、Android(安卓)等，不同的移动终端可以采用相同的操作系统，也可以采用不同的操作系统。
图1是示出了根据本发明的应用安全检测系统1000的应用场景的示意图。如图1所示，系统1000可以包括终端100和服务器200。为了清楚起见，图中仅示出了一个终端100、一个服务器200，但本发明并不局限于此，可以包括两个或更多数目的终端和/或服务器等等。终端100可以属于用户或者可以由用户操作。终端100和服务器200可以通过通信网络300进行通信。通信网络300的示例可以包括(但不限于)：互联网、移动通信网络、固定线路(如xDSL、光纤等)等。
在本发明的下述实施例中，以安卓平台为例来详细说明本发明的创造性理念。然而本发明不限于此，其也可以适用于其他平台，例如iOS、Windows Phone、Symbian等等。此外，在本发明的下述实施例中，主要通过以Python、Java等计算机语言编写的程序来实现。然而本发明不限于此，其也可以适用于其他计算机语言和/或其组合。
下面将参照图1和2来详细描述在服务器200处执行的应用证书库的建立、管理(维护)、下发等流程以及在终端100处执行的基于应用证书的应用安装包安全性检测流程。
服务器200处的应用证书库的建立、管理和下发的流程
(a)首先，可以通过Python语言实现“样本获取”模块(以下简称为SFM，即Sample Fetch Module)。该模块可以通过应用开发人员或开发机构公布的官方发布渠道，和/或辅以Google Play商店等权威第三方应用分发渠道，来获取应用的样本，以形成基本应用样本数据库(以下简称为BASD，即Basic App Sample Database)。当然，本发明不限于此，其也可以通过其他方式获得作为样本的应用，例如通过SD卡从受信的第三方复制等等。
(b)然后，可以通过Python语言实现样本验证和构建模块(以下简称为SVBM，即Sample Verification and Build Module)。该模块可以解析来自BASD的应用样本，并对其进行各种安全性分析。安全性分析可以包括以下各项中的一项或多项：证书信息分析、权限要求分析、网络行为分析、关键API调用分析等等。当然，安全性分析还可以包括针对安全性的其他分析，例如针对应用的特征代码分析等。
如果根据上述一个或多个分析的结果，确定应用的样本符合合法性要求，则可以将该应用样本的基本信息(例如，样本名称、样本版本、和/或签发时间)和对应的证书信息(例如，证书颁发机构、证书有效期、和/或证书文件)存放到合法样本数据库(以下简称为LSD，即Legal Sample Database)中，以形成LSD信息；
(c)接下来，可以通过Python语言来实现LSD信息的文件化处理(以下简称为LSDF，即LSD Filelize)。该模块从LSD信息中解析出最新的合法应用样本和对应的证书信息，并将这些信息以XML方式进行组织，以形成证书库文件(以下简称为CLF，即Certificate Library File)(完全更新)和更新证书库文件(以下简称为UCLF，即Updated Certificate Library File)(增量更新)。然后，可以将CLF和UCLF文件属性信息和保存位置信息写入证书库文件管理数据库中(以下简称为CLFM，即CLF Management)，用于证书库文件的归档管理和历史回溯等。换言之，这些更新文件是预先生成的，并被存储在CLFM中的。
在另一实施例中，可以不提前生成各种更新文件，而是在终端100请求时，根据终端100的更新请求中携带的版本信息等，实时生成针对终端100的更新数据。在该情况下，可以通过用时间换空间的方式，牺牲一定的响应速度来实现存储空间的节约。
(d)在LSDF的工作完成后，可以通过消息推送方式(例如，SIP消息等)，通知终端100存在证书库更新文件；或者通过其他方式来通知终端100存在证书库更新文件，例如短信、电子邮件等。终端100可以从服务器200下载和/或被推送完全更新(例如，CLF)，或者可以下载和/或被推送增量更新(例如，UCLF)。下载过程可以采用加密方式进行(例如，使用HTTPS协议)。同时，可以通过例如3DES加密算法(或其他任何加密算法)对CLF本身进行加密处理，以防止中间人攻击劫持造成文件丢失等。
接下来，将详细描述终端100处的基于应用证书来验证应用安装包的安全性的流程以及服务器200的对应流程。
(a)首先，可以通过Java结合NDK和SDK来实现终端100的证书合法性验证(以下简称为LCV，即Legal Certificate Verification)，LCV的主要功能 模块包括CLF的管理和更新(以下简称为CLFC，即CLF Check)、下载应用证书验证(以下简称为DACV，即Downloaded Application Certificate Verification)、安装应用证书验证(以下简称为IACV，即Installed App Certificate Verification)、服务器合法应用证书获取通讯(以下简称为CFS，即Certificate From Server)等。这些模块都可以采用后端service方式运行，并工作在应用层。
大体上，DACV和IACV的工作方式类似，只是DACV负责对下载到的未加密的应用安装包进行安全性检测，而IACV负责对下载到的加密的应用安装包在该包解密之后进行安全性检测(由于其被加密，因此DACV不可能在加密情况下对该应用安装包进行证书)，下文中将对此进行更详细的描述。
(b)系统可以在启动时加载LCV，并由LCV来启用CLFC，以检测本地CLF是否存在。如果不存在，则CLFC可以向服务器200请求CLF，服务器200验证终端100身份有效后，可以将加密后的完全CLF通过HTTPS通道传递给CLFC。本发明不限于此，实际上在其他实施例中，服务器200可以不对终端100的身份进行验证。
如果本地CLF已经存在，则CLFC可以向服务器200请求CLF更新检查，如果存在更新，则服务器200可以在验证终端信息有效后(或可以不验证)，将基于更新请求中包含的终端100的本地CLF的版本信息所确定的相应UCLF加密后通过HTTPS通道传递给CLFC。基于本地CLF的版本信息所确定的UCLF可以确保该UCLF可以用于终端100，从而防止了更新失配。
在另一实施例中，可以将完整的CLF加密后通过HTTPS通道传递给CLFC，以整体替换原有的CLF。在另一些实施例中，CLF和/或UCLF可以是不加密的。
(c)接下来，CLFC可以在接收到加密的CLF或UCLF后，通过3DES算法(或其他对应解密算法)使用对应密钥进行解密，以获取明文CLF或UCLF。当然，如果CLF或UCLF并未被加密，则直接进行后续步骤。
如果是UCLF，则可以将文件内容更新到本地CLF，以形成最新CLF。否则，可以用CLF整体替换原有的CLF。
(d)之后，CLFC可以解析CLF文件，并在内存中形成文件信息和证书 信息MAP对应关系链表(以下简称为ACM，即Application and Certificate Mapping)。在本发明的一个实施例中，证书信息可以包括以下各项中的一项或多项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。在一个实施例中，ACM中的每条记录的格式可以如下所述：
<SHA1[证书信息(版本信息、序列号、签名算法...)]>
当然，本发明不限于此，也可以使用能够实现类似功能的其他格式。例如可以使用MD5值来替换SHA1值，或者可以交换数据项的顺序等等。
(e)然后，LCV可以启用DACV和IACV，以监测下载行为和安装行为。
(f)在DACV发现下载行为时，其可以接管下载动作，并将下载内容(以下简称为DC，即Downloaded Content)首先保存在临时隔离区(以下简称为TIL，即Temporary Isolation Location)。当然，此处的下载为广义的下载，即至少可以包含：通过互联网下载，通过局域网下载，通过蓝牙下载，通过WiFi下载，通过可拆卸式存储器卡(例如，SD卡)下载(拷贝)，通过USB端口下载，通过红外端口下载等等。
(g)之后，DACV可以分析DC，如果该DC不是应用安装文件，则DACV可以释放其对下载行为的接管，并将DC从TIL移动到原目标下载地址，并执行正常的下载操作。
如果DC是安装文件而且DACV可以对DC进行信息解析时(例如，由于DC未被加密)，DACV可以首先解析DC的文件信息。然后DACV可以根据文件信息(例如，该应用的名称、数字摘要MD5或SHAl值)来查询ACM，以获取对应完整文件信息和证书信息(以下简称为MCI，即Matched Certificate Info)。
如果查询到匹配信息，则DACV可以对DC中的证书内容和MCI进行比较。如果发现存在不匹配项且符合设定的检测标准中的危险级别时，将给出系统警告消息，以通知用户下载应用安装文件证书信息非法，存在高风险。DC相关信息在本地进行记录后，将被删除。
在一个实施例中，检测标准可以是：通过在MCI和DC中的应用证书之间比对得到的不匹配项是否包括以下一项或多项：版本信息、序列号、签名算 法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。即，检测标准可以是判断证书中除了有效期之外的其它数据项是否一致。
如果DACV发现DC内容被加密而无法解析时，IACV将被启用，并接管对DC的后续行为检测。在DC完成自解密过程(例如由终端100的主处理器对其进行解密)并产生解密后文件(以下简称为DDC，即Decrypted Download Content)并开始采取安装行为时，IACV将接管DDC的安装行为。其对DDC进行分析，获取文件信息，然后根据文件信息查询ACM，以获取MCI。
类似于DACV的操作，如果查询到匹配信息，则IACV可以对DDC中证书内容和MCI进行比较，如果发现存在不匹配项且符合设定的检测标准中的危险级别时，将给出系统警告消息，通知用户下载应用安装文件证书信息非法，存在高风险。DDC相关信息在本地进行记录后，将被终止其安装行为，并将操作过程记录到指定日志文件中。
如果DACV和IACV对DC或DDC的检查均为正常，则该DC或DDC将被允许后续的所有操作。
(h)当在ACM中无法查找到匹配选项时，DACV和/或IACV向服务器200发出CLF更新请求并同时上传相应的DC和/或DDC信息。然后等待服务器200针对相应应用生成了更新CLF、并下发到终端100后，由DACV和/或IACV重新查找ACM信息，然后再次进行(g)中的所有验证过程。
(i)LCV、DACV、IACV工作过程产生的所有日志可以通过明文方式记录在SD卡中的指定位置，例如“/sdcard/lcv/alllog”。文件可以通过XML格式进行存放。当然那，本发明不限于此，也可以用其他加密/不加密格式在终端100和/或服务器200的任意存储位置单独和/或合并存储各个模块的日志。日志文件定期进行归档打包后，可以上传到服务器200进行统一管理。
这样，通过上述流程，可以提供基于终端100的合法证书库建立和应用验证机制。其从应用发布到应用在终端100上的安装，以官方发布应用作为验证基础，实现对移动应用签名证书的合法性验证机制。此外，其确保应用在发布到安装使用过程中的合法性，避免用户安装经过非法再次打包的恶意应用，减少用户因使用恶意应用造成的各种损失，提高移动终端应用的安全性。
图3是示出了根据本发明实施例的在终端100中执行的基于应用证书来检测应用安装包的安全性的方法400的流程图。如图3所示，方法400可以包括步骤S410、S420和S430。根据本发明，方法400的一些步骤可以单独执行或组合执行，以及可以并行执行或顺序执行，并不局限于图3所示的具体操作顺序。在一些实施例中，方法400可以由图1所示的终端100执行。
图5是示出了根据本发明实施例的在服务器200中执行的辅助检测应用安装包的安全性的方法450的流程图。如图5所示，方法450可以包括步骤S460、S470、S480和S490。根据本发明，方法450的一些步骤可以单独执行或组合执行，以及可以并行执行或顺序执行，并不局限于图5所示的具体操作顺序。在一些实施例中，方法450可以由图1所示的服务器200执行。
图4是示出了根据本发明实施例的基于应用证书来检测应用安装包的安全性的示例终端100的框图。如图4所示，终端100可以包括：查找单元110、比对单元120和提供单元130。
查找单元110可以用于在应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书。查找单元110可以是终端100的中央处理单元(CPU)、数字信号处理器(DSP)、微处理器、微控制器等等，其可以与终端100的通信部分(例如，无线收发信机、以太网卡、xDSL调制解调器等)和/或存储部分(例如，RAM、SD卡等)相配合，在本地的应用证书库和/或远程的应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书。
比对单元120可以用于对在应用证书库中查找到的应用证书以及应用安装包中包含的应用证书进行比对。比对单元110可以是终端100的中央处理单元(CPU)、数字信号处理器(DSP)、微处理器、微控制器等等，其可以与终端100的存储部分(例如，RAM、SD卡等)相配合，对在应用证书库中查找到的应用证书以及应用安装包中包含的应用证书进行比对。
提供单元130可以用于基于比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。提供单元130可以是终端100的中央处理单元(CPU)、 数字信号处理器(DSP)、微处理器、微控制器等等，其可以与终端100的输出部分(例如，显示器、打印机等)相配合，基于比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。
此外，终端100还可以包括图4中未示出的其他单元，例如更新请求单元、更新接收单元、更新单元、解密单元、临时保存单元、特定应用更新请求单元、特定应用更新接收单元、以及特定应用更新单元等。在一些实施例中，更新请求单元可以用于向远程服务器200发送更新请求，该更新请求用于请求更新应用证书库。在一些实施例中，更新接收单元可以用于从远程服务器200接收更新请求结果以及可能的用于更新应用证书库的更新数据。在一些实施例中，更新单元可以用于如果更新请求结果指示存在针对应用证书库的更新，则终端100使用接收到的更新数据来更新应用证书库。在一些实施例中，解密单元可以用于在应用安装包被加密的情况下，对该应用安装包解密。在一些实施例中，临时保存单元可以用于将应用安装包保存在存储器的临时隔离区中。在一些实施例中，特定应用更新请求单元可以用于向远程服务器200提交应用安装包并请求远程服务器200更新应用证书库。在一些实施例中，特定应用更新接收单元可以用于从远程服务器200接收针对应用证书库的更新数据。在一些实施例中，特定应用更新单元可以用于使用接收到的更新数据来更新应用证书库。
图6是示出了根据本发明实施例的用于辅助检测应用安装包的安全性的示例服务器200的框图。如图6所示，服务器200可以包括：获取单元210、分析单元220、判断单元230和存放单元240。
获取单元210可以用于从应用的官方发布渠道获取应用。获取单元210可以是服务器200的中央处理单元(CPU)、数字信号处理器(DSP)、微处理器、微控制器等等，其可以与服务器200的通信部分(例如，无线收发信机、以太网卡、xDSL调制解调器等)和/或存储部分(例如，RAM、SD卡等)相配合，从应用的官方发布渠道获取应用。
分析单元220可以用于针对应用执行一项或多项安全性分析。比分析元220可以是服务器200的中央处理单元(CPU)、数字信号处理器(DSP)、微处理器、微控制器等等，其可以针对应用执行一项或多项安全性分析，例如证 书信息分析、权限要求分析、网络行为分析、关键API调用分析等。
判断单元230可以用于基于一项或多项安全性分析的结果，判断该应用的安全性。判断单元230可以是服务器200的中央处理单元(CPU)、数字信号处理器(DSP)、微处理器、微控制器等等，其可以基于一项或多项安全性分析的结果，判断该应用的安全性。
存放单元240可以用于将被判断为安全的应用的应用证书存放到应用证书库中。存放单元240可以是服务器200的中央处理单元(CPU)、数字信号处理器(DSP)、微处理器、微控制器等等，其可以与服务器200的存储部分(例如，RAM、SD卡等)相配合，将被判断为安全的应用的应用证书存放到应用证书库中。
此外，服务器200还可以包括图6中未示出的其他单元，例如更新请求接收单元、版本判断单元、更新结果发送单元、特定应用更新接收单元、特定应用分析单元、特定应用更新判断单元、以及特定应用更新单元。在一些实施例中，更新请求接收单元可以用于从终端100接收更新请求，该更新请求用于请求更新终端100上的终端应用证书库。在一些实施例中，版本判断单元可以用于根据更新请求中包括的版本信息，判断终端100是否应当更新其终端应用证书库。在一些实施例中，更新结果发送单元可以用于基于判断，向终端100发送更新请求结果以及可能的用于更新终端100的终端应用证书库的更新数据。在一些实施例中，特定应用更新接收单元可以用于从终端100接收用于针对特定应用安装包来更新应用证书库的请求和该特定应用安装包的数据。在一些实施例中，特定应用分析单元可以用于针对特定应用安装包中包含的应用执行一项或多项安全性分析。在一些实施例中，特定应用更新判断单元可以用于基于一项或多项安全性分析的结果，判断特定应用安装包中包含的应用的安全性。在一些实施例中，特定应用更新单元可以基于该判断，更新服务器200的应用证书库，并向终端100发送与特定应用安装包相关的针对终端100的终端应用证书库的更新数据。
以下将结合图3和图4，对根据本发明实施例的在终端100上执行的基于应用证书来检测应用安装包的安全性的方法400和终端100进行详细的描述。
方法400开始于步骤S410，在步骤S410中，可以由终端100的查找单元110在应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书。
在步骤S420中，可以由终端100的比对单元120对在应用证书库中查找到的应用证书以及应用安装包中包含的应用证书进行比对。
在步骤S430中，可以由终端100的提供单元130基于比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。
在一些实施例中，应用证书库可以位于终端100中，且可以是由终端100从远程服务器200下载的。
在一些实施例中，方法400还可以包括：(402)向远程服务器200发送更新请求，更新请求用于请求更新应用证书库；(404)从远程服务器200接收更新请求结果以及可能的用于更新应用证书库的更新数据。
在一些实施例中，方法400在步骤(404)之后还可以包括：如果更新请求结果指示存在针对应用证书库的更新，则终端100使用接收到的更新数据来更新应用证书库。
在一些实施例中，更新数据可以是完全更新数据或增量更新数据。
在一些实施例中，应用证书库中的每一条应用证书记录可以至少包括：用于识别应用的应用特征数据；以及与该应用相对应的应用证书。
在一些实施例中，应用证书可以包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，预定检测标准可以包括：在应用证书库中查找到的应用证书和应用安装包中包含的应用证书之间比对得到的不匹配项是否包括以下一项或多项：版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，步骤S430可以包括：如果确定不匹配项包括版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息中的一项或多项，则提供指示应用安装包的应用证书非法的检测结果，否则提供指示应用安装包的应用证书合法的检测结果。
在一些实施例中，如果应用安装包被加密，则可以在应用安装包自解密之后，才执行步骤S410及其后续步骤。
在一些实施例中，如果应用安装包未被加密，则可以在获取到应用安装包之后，就执行步骤S410及其后续步骤。
在一些实施例中，方法400在步骤S410之前还可以包括：将应用安装包保存在存储器的临时隔离区中。
在一些实施例中，方法400在步骤S430之后还可以包括：如果检测结果指示应用安装包的应用证书合法，则将应用安装包移动至原目标下载位置并继续正常安装步骤；以及如果检测结果指示应用安装包的应用证书非法，则终止应用安装包的安装过程和/或向终端100的用户告警。
在一些实施例中，如果在步骤S410中未找到与待检测的应用安装包中包含的应用相对应的应用证书，则方法400在步骤S410和步骤S420之间可以包括：(S412)向远程服务器200提交应用安装包并请求远程服务器200更新应用证书库；(S414)从远程服务器200接收针对应用证书库的更新数据；以及(S416)使用接收到的更新数据来更新应用证书库。
以下将结合图5和图6，对根据本发明实施例的用于在服务器200处执行的辅助检测应用安装包的安全性的方法450和服务器200进行详细的描述。
方法450开始于步骤S460，在步骤S460中，可以由服务器200的获取单元210从应用的官方发布渠道获取应用。
在步骤S470中，可以由服务器200的分析单元220针对应用执行一项或多项安全性分析。
在步骤S480中，可以由服务器200的判断单元230基于一项或多项安全性分析的结果，判断应用的安全性。
在步骤S490中，可以由服务器200的存放单元240将被判断为安全的应用的应用证书存放到应用证书库中。
在一些实施例中，安全性分析可以包括以下各项中的一项或多项：证书信息分析、权限要求分析、网络行为分析、以及关键API调用分析。
在一些实施例中，应用证书可以包括以下数据中的至少一项：版本信息、 序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
在一些实施例中，应用证书库中的每一条应用证书记录可以至少包括：用于识别应用的应用特征数据；以及与该应用相对应的应用证书。
在一些实施例中，方法450还可以包括：(452)从终端100接收更新请求，该更新请求用于请求更新终端100上的终端应用证书库；(454)根据更新请求中包括的版本信息，判断终端100是否应当更新其终端应用证书库；以及(456)基于该判断，向终端100发送更新请求结果以及可能的用于更新终端100的终端应用证书库的更新数据。
在一些实施例中，更新数据可以是完全更新数据或增量更新数据。
在一些实施例中，方法450还可以包括：从终端100接收用于针对特定应用安装包来更新应用证书库的请求和该特定应用安装包的数据；针对特定应用安装包中包含的应用执行一项或多项安全性分析；基于一项或多项安全性分析的结果，判断特定应用安装包中包含的应用的安全性；以及基于该判断，更新服务器200的应用证书库，并向终端100发送与特定应用安装包相关的针对终端100的终端应用证书库的更新数据。
至此已经结合优选实施例对本发明进行了描述。应该理解，本领域技术人员在不脱离本发明的精神和范围的情况下，可以进行各种其它的改变、替换和添加。因此，本发明的范围不局限于上述特定实施例，而应由所附权利要求所限定。

Claims (23)

  1. 一种在终端中执行的基于应用证书来检测应用安装包的安全性的方法，包括：
    (a)在应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书；
    (b)对在所述应用证书库中查找到的应用证书以及所述应用安装包中包含的应用证书进行比对；以及
    (c)基于所述比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。
  2. 根据权利要求1所述的方法，其中，所述应用证书库位于所述终端中，且是由所述终端从远程服务器下载的。
  3. 根据权利要求2所述的方法，还包括：
    (d)向所述远程服务器发送更新请求，所述更新请求用于请求更新所述应用证书库；
    (e)从所述远程服务器接收更新请求结果以及可能的用于更新应用证书库的更新数据。
  4. 根据权利要求3所述的方法，在步骤(e)之后还包括：
    如果所述更新请求结果指示存在针对所述应用证书库的更新，则所述终端使用接收到的所述更新数据来更新所述应用证书库。
  5. 根据权利要求3所述的方法，其中，所述更新数据是完全更新数据或增量更新数据。
  6. 根据权利要求1所述的方法，其中，所述应用证书库中的每一条应用证书记录至少包括：
    用于识别应用的应用特征数据；以及
    与该应用相对应的应用证书。
  7. 根据权利要求1所述的方法，其中，所述应用证书包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
  8. 根据权利要求7所述的方法，其中，所述预定检测标准包括：在所述应用证书库中查找到的应用证书和所述应用安装包中包含的应用证书之间比对得到的不匹配项是否包括以下一项或多项：版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
  9. 根据权利要求8所述的方法，其中，步骤(c)包括：
    如果确定不匹配项包括版本信息、序列号、签名算法、发行机构、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息中的一项或多项，则提供指示所述应用安装包的应用证书非法的检测结果，否则提供指示所述应用安装包的应用证书合法的检测结果。
  10. 根据权利要求1所述的方法，其中，如果所述应用安装包被加密，则在所述应用安装包自解密之后，才执行步骤(a)及其后续步骤。
  11. 根据权利要求1所述的方法，其中，如果所述应用安装包未被加密，则在获取到所述应用安装包之后，就执行步骤(a)及其后续步骤。
  12. 根据权利要求1所述的方法，在步骤(a)之前还包括：
    将所述应用安装包保存在存储器的临时隔离区中。
  13. 根据权利要求12所述的方法，在步骤(c)之后还包括：
    如果所述检测结果指示所述应用安装包的应用证书合法，则将所述应用安装包移动至原目标下载位置并继续正常安装步骤；以及
    如果所述检测结果指示所述应用安装包的应用证书非法，则终止所述应用安装包的安装过程和/或向所述终端的用户告警。
  14. 根据权利要求1所述的方法，其中，如果在步骤(a)中未找到与待检测的应用安装包中包含的应用相对应的应用证书，则所述方法在步骤(a)和步骤(b)之间包括：
    (a1)向远程服务器提交所述应用安装包并请求所述远程服务器更新应用证书库；
    (a2)从所述远程服务器接收针对所述应用证书库的更新数据；以及
    (a3)使用接收到的所述更新数据来更新所述应用证书库。
  15. 一种基于应用证书来检测应用安装包的安全性的终端，包括：
    查找单元，用于在应用证书库中，查找与待检测的应用安装包中包含的应用相对应的应用证书；
    比对单元，用于对在所述应用证书库中查找到的应用证书以及所述应用安装包中包含的应用证书进行比对；以及
    提供单元，用于基于所述比对的结果，根据一条或多条预定检测标准来提供相应的检测结果。
  16. 一种在服务器中执行的辅助检测应用安装包的安全性的方法，包括：
    (a)从应用的官方发布渠道获取所述应用；
    (b)针对所述应用执行一项或多项安全性分析；
    (c)基于所述一项或多项安全性分析的结果，判断所述应用的安全性；以及
    (d)将被判断为安全的应用的应用证书存放到应用证书库中。
  17. 根据权利要求16所述的方法，其中，所述安全性分析包括以下各项中的一项或多项：证书信息分析、权限要求分析、网络行为分析、以及关键API调用分析。
  18. 根据权利要求16所述的方法，其中，所述应用证书包括以下数据中的至少一项：版本信息、序列号、签名算法、发行机构、有效期、证书所有人、证书所有人公开密钥、以及证书发行者对证书的签名信息。
  19. 根据权利要求16所述的方法，其中，所述应用证书库中的每一条应用证书记录至少包括：
    用于识别应用的应用特征数据；以及
    与该应用相对应的应用证书。
  20. 根据权利要求16所述的方法，还包括：
    (e)从终端接收更新请求，所述更新请求用于请求更新所述终端上的终端应用证书库；
    (f)根据所述更新请求中包括的版本信息，判断所述终端是否应当更新其终端应用证书库；以及
    (g)基于所述判断，向所述终端发送更新请求结果以及可能的用于更新所述终端的终端应用证书库的更新数据。
  21. 根据权利要求20所述的方法，其中，所述更新数据是完全更新数据或增量更新数据。
  22. 根据权利要求16所述的方法，还包括：
    从终端接收用于针对特定应用安装包来更新应用证书库的请求和所述特定应用安装包的数据；
    针对所述特定应用安装包中包含的应用执行一项或多项安全性分析；
    基于所述一项或多项安全性分析的结果，判断所述特定应用安装包中包含的应用的安全性；以及
    基于所述判断，更新所述服务器的应用证书库，并向所述终端发送与所述特定应用安装包相关的针对所述终端的终端应用证书库的更新数据。
  23. 一种辅助检测应用安装包的安全性的服务器，包括：
    获取单元，用于从应用的官方发布渠道获取所述应用；
    分析单元，用于针对所述应用执行一项或多项安全性分析；
    判断单元，用于基于所述一项或多项安全性分析的结果，判断所述应用的安全性；以及
    存放单元，用于将被判断为安全的应用的应用证书存放到应用证书库中。
PCT/CN2014/093443 2013-12-30 2014-12-10 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器 WO2015101149A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310744120.8 2013-12-30
CN201310744120.8A CN103778367A (zh) 2013-12-30 2013-12-30 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器

Publications (1)

Publication Number Publication Date
WO2015101149A1 true WO2015101149A1 (zh) 2015-07-09

Family

ID=50570593

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/093443 WO2015101149A1 (zh) 2013-12-30 2014-12-10 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器

Country Status (2)

Country Link
CN (1) CN103778367A (zh)
WO (1) WO2015101149A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112152961A (zh) * 2019-06-26 2020-12-29 北京观成科技有限公司 一种恶意加密流量的识别方法及装置

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103778367A (zh) * 2013-12-30 2014-05-07 网秦（北京）科技有限公司 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器
CN103995774B (zh) * 2014-05-16 2017-04-26 北京猎豹网络科技有限公司 软件安装包检测方法及装置
CN104035874B (zh) * 2014-06-30 2017-11-07 深圳数字电视国家工程实验室股份有限公司 一种软件程序检测方法、装置及系统
CN104123491A (zh) * 2014-07-18 2014-10-29 广州金山网络科技有限公司 一种检测应用程序安装包是否被篡改的方法及装置
CN104123493B (zh) * 2014-07-31 2017-09-26 百度在线网络技术（北京）有限公司 应用程序的安全性检测方法和装置
CN104267988A (zh) * 2014-09-26 2015-01-07 北京飞流九天科技有限公司 用于对移动应用进行打包的系统和方法
CN104657634B (zh) * 2015-02-28 2017-11-14 百度在线网络技术（北京）有限公司 盗版应用的识别方法和装置
CN104933355A (zh) * 2015-06-18 2015-09-23 上海斐讯数据通信技术有限公司 移动终端可信应用的安装校验系统及其校验方法
CN105069646A (zh) * 2015-07-27 2015-11-18 立德高科（昆山）数码科技有限责任公司 基于服务器发送的信息使商家app续用的方法及系统
KR102365532B1 (ko) * 2015-09-22 2022-02-21 삼성전자주식회사 보안 기능 수행 방법 및 이를 지원하는 전자 장치
SG10201509221YA (en) 2015-11-06 2017-06-29 Huawei Int Pte Ltd System and method for managing installation of an application package requiring high-risk permission access
CN106778261A (zh) * 2015-11-20 2017-05-31 中兴通讯股份有限公司 伪装应用的处理方法和装置
CN107341393A (zh) * 2016-04-29 2017-11-10 腾讯科技（深圳）有限公司 应用程序安装包的检测方法和装置
CN107689934B (zh) * 2016-08-03 2020-12-04 腾讯科技（深圳）有限公司 一种保障信息安全的方法、服务器及客户端
CN107766716B (zh) * 2016-08-16 2021-08-31 阿里巴巴集团控股有限公司 证书检测方法及装置、电子设备
CN106789897B (zh) * 2016-11-15 2019-08-06 沃通电子认证服务有限公司 用于移动终端应用程序的数字证书验证方法及系统
CN106778190A (zh) * 2016-11-29 2017-05-31 艾体威尔电子技术(北京)有限公司 一种增强安卓系统应用安装运行安全的系统和方法
CN106599676A (zh) * 2016-12-22 2017-04-26 北京元心科技有限公司 可信进程识别方法及装置
CN107992742A (zh) * 2017-10-27 2018-05-04 维沃移动通信有限公司 一种安装包识别的方法和装置
CN110059475A (zh) * 2018-01-18 2019-07-26 伊姆西Ip控股有限责任公司 用于数据保护的方法、设备和计算机程序产品
CN109379371B (zh) * 2018-11-20 2021-11-23 多点生活(成都)科技有限公司 证书验证方法、装置及系统
CN109829292B (zh) * 2018-12-18 2021-06-22 福建新大陆支付技术有限公司 一种应用程序安装过程中的验签方法及系统
CN113591079B (zh) * 2020-04-30 2023-08-15 中移互联网有限公司 获取异常应用安装包的方法、装置及电子设备
CN114938466B (zh) * 2022-04-28 2023-11-07 国家广播电视总局广播电视科学研究院 一种互联网电视应用监测系统及方法
CN118260748A (zh) * 2022-12-28 2024-06-28 华为技术有限公司 一种拦截方法、系统及相关装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1866870A (zh) * 2006-02-23 2006-11-22 华为技术有限公司 基于设备管理协议的软件合法性验证系统及验证方法
CN102891843A (zh) * 2012-09-18 2013-01-23 北京深思洛克软件技术股份有限公司 本地服务单元认证安卓客户端应用程序的方法
CN102955700A (zh) * 2011-08-18 2013-03-06 腾讯科技（深圳）有限公司 软件升级系统及方法
CN103778367A (zh) * 2013-12-30 2014-05-07 网秦（北京）科技有限公司 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100461197C (zh) * 2006-05-16 2009-02-11 北京启明星辰信息技术有限公司 一种恶意代码自动分析系统及方法
CN101916344B (zh) * 2010-08-31 2013-09-25 北京深思洛克软件技术股份有限公司 一种验证软件保护装置合法性的方法及系统
CN102222183B (zh) * 2011-04-28 2013-11-13 奇智软件（北京）有限公司 移动终端软件包安全检测方法及系统
CN102883324A (zh) * 2012-10-19 2013-01-16 广州市动景计算机科技有限公司 移动终端中的插件调用安全验证方法及装置、移动终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1866870A (zh) * 2006-02-23 2006-11-22 华为技术有限公司 基于设备管理协议的软件合法性验证系统及验证方法
CN102955700A (zh) * 2011-08-18 2013-03-06 腾讯科技（深圳）有限公司 软件升级系统及方法
CN102891843A (zh) * 2012-09-18 2013-01-23 北京深思洛克软件技术股份有限公司 本地服务单元认证安卓客户端应用程序的方法
CN103778367A (zh) * 2013-12-30 2014-05-07 网秦（北京）科技有限公司 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112152961A (zh) * 2019-06-26 2020-12-29 北京观成科技有限公司 一种恶意加密流量的识别方法及装置
CN112152961B (zh) * 2019-06-26 2023-01-31 北京观成科技有限公司 一种恶意加密流量的识别方法及装置

Also Published As

Publication number Publication date
CN103778367A (zh) 2014-05-07

Similar Documents

Publication Publication Date Title
WO2015101149A1 (zh) 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器
US11475137B2 (en) Distributed data storage by means of authorisation token
US11870758B2 (en) Systems and methods for application identification
CN106878264B (zh) 一种数据管理方法及服务器
US20140150096A1 (en) Method for assuring integrity of mobile applications and apparatus using the method
US9900161B2 (en) Method for certifying android client application by local service unit
US10348756B2 (en) System and method for assessing vulnerability of a mobile device
WO2015090153A1 (zh) 应用安装包的安全检测方法、装置和系统
US8874922B2 (en) Systems and methods for multi-layered authentication/verification of trusted platform updates
KR101238511B1 (ko) 펌웨어 컴포넌트의 상태 공고 및 펌웨어 컴포넌트의 갱신
US20110029555A1 (en) Method, system and apparatus for content identification
US11388012B2 (en) Application certificate
US9608966B2 (en) Information handling device, information output device, and recording medium
JP2008146479A (ja) ソフトウェア部品、ソフトウェア部品管理方法、及びソフトウェア部品管理システム
CN113297560A (zh) 基于区块链的身份认证方法、装置、设备及可读存储介质
GB2520056A (en) Digital data retention management
CN112307515B (zh) 基于数据库的数据处理方法、装置、电子设备和介质
WO2016165215A1 (zh) 应用程序加载代码签名的方法和装置
US20110154436A1 (en) Provider Management Methods and Systems for a Portable Device Running Android Platform
US11232190B2 (en) Device attestation techniques
US9548969B2 (en) Encryption/decryption method, system and device
US20140230068A1 (en) System and method for packaging and authenticating a software product
US8667601B2 (en) Method and device for upgrading rights object that was stored in memory card
JP2019008738A (ja) 検証装置
WO2022248938A1 (en) Authenticating data and communication sources

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14876393

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14876393

Country of ref document: EP

Kind code of ref document: A1