WO2020062233A1 - Method and apparatus for processing and deploying application program, and computer-readable medium - Google Patents

Abstract

Provided in the present invention are a method and apparatus for processing and deploying an application program, and a machine-readable medium. The method for processing an application program comprises: acquiring a first installation package of the compressed compiled application program; decompressing the first installation package to acquire at least one application program file; performing a checksum operation on the at least one application program file; storing the checksum obtained by the checksum operation in a check file; compressing and packaging the check file and the at least one application program to acquire a second installation package; and adding a first digital signature to the second installation package. The present solution can improve the security of deploying an application program on a terminal device.

Description

Application program processing and deployment method, device and computer-readable medium Technical field

The present invention relates to the technical field of computer application programs, and in particular, to a method, an apparatus, and a computer-readable medium for processing and deploying application programs.

Background technique

With the continuous development and progress of the Internet of Things technology, the performance of terminal devices used in the field of Internet of Things technology is constantly upgraded. By deploying applications on terminal devices, the terminal devices can interact with the cloud platform for information, thereby enabling ultra-large-scale Internet of Things. Application becomes possible. In order to facilitate the unified management of application programs on the terminal device, the installation package of the developed application program is stored in the application library. When the application program needs to be deployed on a terminal device, the corresponding application is downloaded from the application library A program installation package, and then use the downloaded application installation package to deploy an application on a terminal device.

After the application installation package is downloaded from the application library, the application installation package may be maliciously tampered with. If the application installation package that has been maliciously tampered with is used to deploy the application on the terminal device, the deployed application may cause The terminal device performs malicious actions, which causes very serious consequences such as personal injury and property damage. Therefore, the existing applications deployed on terminal devices have lower security.

Summary of the Invention

In view of this, the method, device, and computer-readable medium for processing and deploying applications provided by the present invention can improve the security of deploying applications on terminal devices.

In a first aspect, an embodiment of the present invention provides an application program processing method, including:

Get the first compressed installation package of the compiled application;

Decompressing the first installation package to obtain at least one application file;

Performing a checksum operation on the at least one application file;

Store the checksum obtained by the checksum operation in a check file;

Compressing and packaging the verification file and the at least one application program file to obtain a second installation package;

Adding a first digital signature to the second installation package.

After compiling and compressing the first installation package that is compiled and compressed, checksum calculation is performed on each decompressed application file, and after the checksum operation is obtained and the checksum is stored in the checkfile, the The verification file and each application file are compressed and packaged to obtain a second installation package, and then a first digital signature is added to the second installation package. When an application needs to be deployed on a terminal device, a second installation package with a first digital signature added is obtained, and the second installation package can be double-validated according to the checksum stored in the first digital signature and the verification file to Determine whether the second installation package has been tampered with, and then use the second installation package to deploy the application on the terminal device after determining that the second installation package has not been tampered with, and ensure that the application deployed on the terminal device does not perform malicious actions, so that Improve the security of deploying applications on end devices.

Optionally, the decompressing the first installation package to obtain at least one application file includes:

Decompressing the first installation package;

Determine a noise file from a file obtained by decompressing the first installation package, and determine a file decompressed from the first installation package other than the noise file as the at least one application file Wherein, the noise file is a file unrelated to the function implementation of the application program, and the at least one application file is a file related to the function implementation of the application program.

After the first installation package is decompressed, noise files are removed from each of the decompressed files, and other files remaining after the noise files are removed are determined as application files. Since the noise files are not related to the function implementation of the application, The second installation package includes only check files and application files and does not include noise files. On the one hand, the number of files that need to be checked and calculated can be reduced, which can improve the efficiency of generating the second installation package. On the other hand, When deploying an application, you can also reduce the number of files that need to be checked and calculated, which can improve the efficiency of deploying the application.

Optionally, before the compressing and packaging the verification file and the at least one application file, the method further includes: adding a second digital signature to the verification file; and correspondingly, verifying the calibration file. Compressing and packaging the verification file and the at least one application file include: compressing and packaging the verification file and the at least one application file to which the second digital signature is added to obtain the second installation package .

By adding a second digital signature to the verification file, when deploying the application using the second installation package, it is also necessary to verify whether the second digital signature is correct, thereby ensuring that the checksum stored in the verification file has not been tampered with, which can further Improved security for deploying applications on end devices.

Optionally, the adding a first digital signature to the second installation package includes:

Performing a hash operation on the second installation package by using a hash algorithm to obtain a first identity corresponding to the second installation package;

Encrypting the first identity by using a private key to obtain an encrypted identity;

Generating a public key infrastructure PKI object corresponding to the private key and including the encrypted identity;

The PKI object is embedded in the second installation package.

The first identity is obtained by hashing the second installation package, and the encrypted identity is obtained by encrypting the first identity through the private key, and then the PKI object including the encrypted identity is embedded in the second installation package. The private key cannot be obtained, so the first identity cannot be forged, and it is guaranteed that when the application is deployed, the second installation package can be accurately judged based on the first identity, so that the application deployed by the second installation package can be guaranteed Security.

In a second aspect, an embodiment of the present invention further provides an application program deployment method, including:

S1: Obtain a second installation package added with a first digital signature;

S2: verify whether the first digital signature is correct, if yes, execute S3, otherwise execute S7;

S3: Decompress the second installation package to obtain a verification file and at least one application program file;

S4: performing a checksum operation on the at least one application file;

S5: Determine whether the checksum obtained by the checksum operation is the same as the corresponding checksum stored in the check file, if yes, execute S6, otherwise execute S7;

S6: deploy the application on a terminal device by using the second installation package, and end the current process;

S7: Determine that the second installation package has been tampered with.

After obtaining the second installation package added with the first digital signature, first verify whether the first digital signature is correct, and on the premise that the first signature is correct, the second installation package is further compressed to obtain a verification file and each The application file, and then checksum operation is performed on the application file to obtain the corresponding checksum, and then the obtained checksum is compared with the checksum stored in the check file to determine all the obtained checksums Whether it is the same as the corresponding checksum in the check file. If so, use the second installation package to deploy the application on the terminal device; otherwise, determine that the second installation package has been tampered with. Double verification is performed on the second installation package through the checksum stored in the first digital signature and the verification file. After determining that the second installation package has not been tampered with, the second installation package is used to deploy the application on the terminal device to ensure that the deployed Applications do not perform malicious actions, which can improve the security of deploying applications on end devices.

Optionally, when a second digital signature is added to the verification file, further including between the S3 and the S4:

Verify whether the second digital signature is correct, if yes, execute S4, otherwise execute S7.

When the second digital signature is added to the verification file decompressed from the second installation package, after verifying that the first digital signature is correct, then verify that the second digital signature is correct. If the second digital signature is correct, use the verification Files verify that individual application files have not been tampered with. By verifying whether the second digital signature is correct, it can be determined whether the verification file is tampered, and the accuracy of verifying whether each application file is tampered is verified by using the checksum stored in the verification file. Performing triple verification on the second installation package before using the second installation package to deploy the application can further improve the security of deploying the application on the terminal device.

Optionally, the verifying whether the first digital signature is correct includes:

Obtaining a PKI object embedded in the second installation package;

Decrypting the encrypted identity included in the PKI object by using a public key corresponding to the PKI object to obtain a first identity;

Performing a hash operation on the second installation package by using a hash algorithm to obtain a second identity corresponding to the second installation package;

Determine whether the first identity is the same as the second identity, and if so, determine that the first digital signature is correct; otherwise, determine that the first digital signature is incorrect.

After obtaining the encrypted identity from the PKI object embedded in the second installation package, the encrypted identity is decrypted by using the corresponding public key to obtain the first identity, where the first identity is obtained by un-tampered The second installation package is obtained by performing a hash operation. Then perform a hash operation on the obtained second installation package to obtain a second identity. If the second identity is the same as the first identity, it means that the second installation package has not been tampered with, and it is determined that the first digital label is correct. The second identity user has a different first identity, indicating that the second installation package has been tampered with, and it is determined that the first digital label is incorrect. By verifying the correctness of the first digital label, the integrity and consistency of the second installation package can be ensured.

According to a third aspect, an embodiment of the present invention further provides an application program processing apparatus, including:

A first installation package obtaining module, configured to obtain a compressed first installation package of a compiled application program;

A first installation package decompression module, configured to decompress the first installation package obtained by the first installation package acquisition module to obtain at least one application program file;

A first checksum operation module, configured to perform a checksum operation on the at least one application file obtained by the first installation package decompression module;

A check file generating module, configured to store the checksum obtained by performing the checksum operation by the first checksum calculation module into a check file;

An application compression module is configured to compress and package the verification file in which the verification file generation module stores a checksum and the at least one application file obtained by the first installation package decompression module. To obtain the second installation package;

An installation package signature module is configured to add a first digital signature to the second installation package obtained by the application compression module.

Optionally, the first installation package decompression module includes:

A decompression unit, configured to decompress the first installation package;

A screening unit, configured to determine a noise file from a file obtained by decompressing the first installation package by the decompression unit, and decompress other than the noise file from the first installation package Is determined to be the at least one application program file, wherein the noise file is a file that is not related to the function implementation of the application program, and the at least one application file is a file that is related to the function implementation of the application program .

Optionally, the application processing apparatus further includes: a verification file signature module;

The verification file signature module is configured to add a second digital signature to the verification file obtained by the verification file generation module;

The application compression module is configured to add the second digital signature to the verification file and the at least one application obtained by the first installation package decompression module after the verification file signature module. The program file is compressed and packed to obtain the second installation package.

Optionally, the installation package signature module includes:

A first hash operation unit, configured to perform a hash operation on the second installation package by using a hash algorithm to obtain a first identity corresponding to the second installation package;

An identity encryption unit, configured to encrypt the first identity obtained by the first hash operation unit by using a private key to obtain an encrypted identity;

A PKI object generating unit, configured to generate a public key infrastructure PKI object corresponding to the private key and including the encrypted identity obtained by the identity encryption unit;

A PKI object embedding unit is configured to embed the PKI object generated by the PKI object generating unit into the second installation package.

In a fourth aspect, an embodiment of the present invention further provides an application program deployment apparatus, including:

A second installation package obtaining module, configured to obtain a second installation package added with a first digital signature;

An installation package signature verification module, configured to verify whether the first digital signature added to the second installation package obtained by the second installation package acquisition module is correct,

A second installation package decompression module, configured to decompress the second installation package to obtain a verification file and at least one application program when the installation package signature verification module verifies that the first digital signature is correct. file;

A second checksum operation module, configured to perform a checksum operation on the at least one application program obtained by the second installation package decompression module;

A checksum verification module, configured to determine a checksum obtained by the second checksum operation module performing a checksum operation and a checksum stored in the check file obtained by the second installation package decompression module. Whether the corresponding checksums are all the same;

An application deployment module, configured to use the second installation package to install an application on a terminal device when the judgment result of the checksum verification module is yes;

An installation package status confirmation module, configured to determine that the second installation package has been completed when the installation package signature verification module verifies that the first digital signature is incorrect, or when the judgment result of the checksum verification module is no. Tampered.

Optionally, the application deployment device further includes: a check file signature verification module;

The verification file signature verification module is configured to verify whether the second digital signature is correct when the verification file decompressed by the second installation package decompression module is added with a second digital signature;

The installation package status confirmation module is further configured to determine that the second installation package has been tampered with when the verification file signature verification module verifies that the second digital signature is incorrect.

Optionally, the installation package signature verification module includes:

A PKI object obtaining unit, configured to obtain a PKI object embedded in the second installation package;

An identity decryption unit, configured to decrypt the encrypted identity included in the PKI object by using a public key corresponding to the PKI object obtained by the PKI object obtaining unit to obtain a first identity;

A second hash operation unit, configured to perform a hash operation on the second installation package by using a hash algorithm to obtain a second identity corresponding to the second installation package;

An identity comparison unit, configured to determine whether the first identity obtained by the identity decryption unit and the second identity obtained by the second hash operation unit are the same, and if yes, determining the The first digital signature is correct, otherwise it is determined that the first digital signature is incorrect.

In a fifth aspect, an embodiment of the present invention further provides an application program processing apparatus, including: at least one memory and at least one processor;

The at least one memory is configured to store a machine-readable program;

The at least one processor is configured to call the machine-readable program and execute the method provided by the first aspect or any implementation manner of the first aspect.

A machine-readable program is stored in the memory. The processor can execute the method provided in the first aspect or any one of the implementable methods of the first aspect by calling the machine-readable program stored in the memory. File and the second installation package of the application file, and add a first digital signature to the second installation package. When the application needs to be deployed on the terminal device, the second installation package with the first digital signature added can be obtained according to the first A digital signature and a checksum stored in a verification file double-check the second installation package to determine whether the second installation package has been tampered with, and then determine that the second installation package has not been tampered with, and then use the second installation package on the terminal. The application is deployed on the device to ensure that the application deployed on the terminal device does not perform malicious actions, thereby improving the security of the application deployed on the terminal device.

According to a sixth aspect, an embodiment of the present invention further provides an application program deployment apparatus, including: at least one memory and at least one processor;

The at least one memory is configured to store a machine-readable program;

The at least one processor is configured to call the machine-readable program and execute the method provided in the second aspect or any implementation manner of the second aspect.

A machine-readable program is stored in the memory, and the processor can execute the method provided in the second aspect or any one of the implementable manners of the second aspect by calling the machine-readable program stored in the memory. The second installation package is double-checked by checking the checksum stored in the file. After determining that the second installation package has not been tampered with, the second installation package is used to deploy the application on the terminal device to ensure that the deployed application does not perform malicious actions. , Which can improve the security of deploying applications on terminal devices.

According to a seventh aspect, an embodiment of the present invention further provides a computer-readable medium. The computer-readable medium stores computer instructions. When the computer instructions are executed by the processor, the processor causes the processor to execute the foregoing first aspect, second aspect, The method provided by any one possible implementation manner of the first aspect or any one possible implementation manner of the second aspect.

Computer instructions are stored on the machine-readable medium. When the computer instructions are processed and executed, the processor executes the application processing method provided by the first aspect or any possible implementation manner of the first aspect, or executes the first The application deployment method provided by the second aspect or any one of the possible implementation manners of the second aspect, before the application is deployed on the terminal device according to the second installation package, the first digital signature and the verification of the stored file are verified. Check and double-check the second installation package. After determining that the second installation package has not been tampered with, use the second installation package to deploy the application on the terminal device to ensure that the deployed application does not perform malicious actions, which can improve the Security of applications deployed on end devices.

The application processing and deployment method, device, and computer-readable medium provided by the embodiments of the present invention include adding a digital signature to the installation package and adding a verification file storing a checksum to the installation package. Before the application is deployed, multiple verifications can be performed on the installation package to ensure the integrity and consistency of the installation package, thereby ensuring the security of the application deployed by the installation package. This solution is not limited by the application programming language and platform , Has strong applicability.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart of an application program processing method according to an embodiment of the present invention; FIG.

2 is a flowchart of a method for decompressing an installation package according to an embodiment of the present invention;

3 is a flowchart of a method for adding a digital signature according to an embodiment of the present invention;

4 is a flowchart of a method for deploying an application program according to an embodiment of the present invention;

FIG. 5 is a flowchart of another application deployment method according to an embodiment of the present invention; FIG.

6 is a flowchart of a digital signature verification method according to an embodiment of the present invention;

7 is a schematic diagram of an application program processing apparatus according to an embodiment of the present invention;

8 is a schematic diagram of an installation package decompression module provided by an embodiment of the present invention;

FIG. 9 is a schematic diagram of another application processing apparatus according to an embodiment of the present invention; FIG.

10 is a schematic diagram of an installation package signature module provided by an embodiment of the present invention;

11 is a schematic diagram of an application deployment device provided by an embodiment of the present invention;

FIG. 12 is a schematic diagram of another application deployment device according to an embodiment of the present invention; FIG.

13 is a schematic diagram of an installation package signature verification module provided by an embodiment of the present invention;

FIG. 14 is a schematic diagram of another application processing apparatus according to an embodiment of the present invention; FIG.

FIG. 15 is a schematic diagram of another application deployment device according to an embodiment of the present invention.

List of reference signs:

101: Obtain the first installation package

102: Decompress the first installation package to obtain at least one application file.

103: Checksum operation on application file

104: Store the checksum obtained by the checksum operation in a check file

105: Compress and package the verification file and each application file to obtain a second installation package

106: Add the first digital signature to the second installation package

1021: Extract the first installation package

1022: Determine other files that are decompressed from the first installation package in addition to the noise files as application files

1061: Perform a hash operation on the second installation package to obtain a corresponding first identity

1062: Encrypt the first identity by using the private key to obtain an encrypted identity

1063: Generate a public key infrastructure PKI object corresponding to the private key and including an encrypted identity

1064: Embed the PKI object into the second installation package

201: Obtain a second installation package added with a first digital signature

202: Verify that the first digital signature is correct

203: Decompress the second installation package to obtain a verification file and at least one application file.

204: Perform a checksum operation on the obtained application file

205: Determine whether the checksum obtained by the checksum operation is the same as the corresponding checksum in the check file.

206: Use the second installation package to deploy the application on a terminal device

207: Determine that the second installation package has been tampered with

208: Determine whether the second digital signature is correct

2021: Get the PKI object embedded in the second installation package

2022: Decrypt the encrypted identity included in the PKI object by using the public key to obtain the first identity

2023: Perform a hash operation on the second installation package to obtain a corresponding second identity.

2024: Determine whether the first identity is the same as the second identity

301: first installation package acquisition module 302: first installation package decompression module 303: first checksum calculation module

304: verification file generation module 305: application compression module 306: installation package signature module

307: Check file signature module 3021: Decompression unit 3022: Screening unit

3061: the first hash operation unit 3062: the identity encryption unit 3063: the PKI object generation unit

3064: PKI object embedding unit 401: second installation package acquisition module 402: installation package signature verification module

403: Second installation package decompression module 404: Second checksum calculation module

405: checksum verification module 406: application deployment module 407: installation package status confirmation module

408: Verification file signature verification module 4021: PKI object acquisition unit

4022: Identification decryption unit 4023: Second hash operation unit 4024: Identification comparison unit

501: memory 502: processor 601: memory

602: Processor

detailed description

As mentioned before, after downloading the application installation package from the application library, before using the downloaded application installation package to deploy the application on the terminal device, the application installation package may be maliciously tampered with. If the use has been maliciously tampered with, The application installation package for the deployment of the application on the terminal device, the deployed application may perform malicious actions, resulting in serious consequences. Therefore, the existing applications deployed on terminal devices have lower security.

In the embodiment of the present invention, during the application publishing process, a checksum operation is performed on the application file included in the installation package of the application, and the obtained checksum is stored in the verification file. Compress and package each application file to obtain a new installation package, and add a digital signature to the new installation package. During the application deployment process, obtain the installation package with a digital signature. First verify that the digital signature of the installation package is correct. After verifying that the digital signature of the installation package is correct, decompress the installation package to obtain a verification file and each application. File, and then perform checksum calculation on each application file, and compare the obtained checksum with each checksum stored in the check file. If the obtained checksum is compared with the checksum stored in the check file, All the checksums are the same, then use the obtained installation package to deploy the application on the terminal device. It can be seen that before using the installation package to deploy the application, the integrity and consistency of the installation package is verified through digital signatures and checksums to ensure that the obtained installation package has not been maliciously tampered with, which can improve the terminal device. Deploy application security.

The method and device for application processing and deployment provided by the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

As shown in FIG. 1, an embodiment of the present invention provides an application program processing method, and the method may include the following steps:

Step 101: Obtain a compressed first installation package of the compiled application program;

Step 102: Decompress the first installation package to obtain at least one application file.

Step 103: Perform a checksum operation on at least one application file;

Step 104: storing the checksum obtained by the checksum operation into a check file;

Step 105: compress and package the verification file and at least one application file to obtain a second installation package;

Step 106: Add a first digital signature to the second installation package.

In the application program processing method provided by the embodiment of the present invention, after obtaining a first installation package of a compiled application program, decompressing the first installation package to obtain at least one application program file, and then performing processing on the obtained application program file. Checksum operation, and store the checksum obtained by the checksum operation into a check file, and then compress and pack the obtained check file and each decompressed application file to obtain a second installation package, and then Add a first digital signature to the obtained second installation package. First, add a first digital signature to the second installation package. Before deploying the application using the second installation package, you can determine whether the second installation package has been tampered by verifying that the first digital signature is correct. Second, the verification file is compressed and packaged. In the second installation package, before the application is deployed by using the second installation package, a checksum operation may be performed on the application file in the second installation package, and the obtained checksum and the check stored in the verification file may be used. And compare to determine whether each application file has been tampered with. In this way, before using the second installation package to deploy the application, the integrity and consistency of the second installation package can be verified by the first digital signature added on the second installation package and the checksum stored in the verification file in the second installation package. Perform double verification of the security, and use the second installation package to deploy applications on the terminal device after verifying that the second installation package has not been tampered with, to ensure that the applications deployed on the terminal device will not perform malicious actions, thereby improving the Deploy application security on.

In the embodiment of the present invention, at least one application program file obtained by decompressing the first installation package is a target application program file obtained by compiling application source code.

In the embodiment of the present invention, when performing a checksum operation on an application file, a checksum algorithm such as MD5, SHA-1, or SHA-2 may be specifically used to perform a checksum operation on the application file to obtain the phase The corresponding checksum.

The application program processing method provided by the embodiment of the present invention may be applied to an application program publishing process. Specifically, after adding a first digital signature to a second installation package, the second installation package with the first digital signature added may be stored. Go to an application library, and then use the automatic deployment tool to publish the application corresponding to the second installation package. The automatic deployment tool can be Jenkins.

It should be noted that when performing checksum calculation on the application file in step 103, specifically, any one of the following four methods may be selected to perform checksum calculation on the application file:

Method 1: Perform an overall checksum operation on all the obtained application files to obtain a checksum;

Method 2: Perform a checksum operation on each of the obtained application programs and obtain a checksum corresponding to each application file;

Method 3: Perform an overall checksum operation on all application files with predefined file characteristics in all application files to obtain a checksum;

Manner 4: Perform a checksum operation on each of the application files having a predefined file characteristic in the application file to obtain a checksum corresponding to each of the application files having a predefined file characteristic.

According to the above manner 1, a checksum is obtained by performing an overall checksum operation on all application files. After the application files are compressed and packaged into the second installation package, any one or more applications in the second installation package are compressed. The tampering of the program file will cause the result of the overall checksum operation on all application files to be changed, so that it can be determined whether the tampered application file exists in the second installation package according to the checksum.

For the above second method, a checksum operation is performed on each application file separately to obtain a corresponding checksum. After compressing and packaging each application file into the second installation package, any application in the second installation package is used. The tampering of the program file will cause the result of the checksum operation of the application file to change, so that the tampered application file can be located according to the checksum.

In response to the third method, the characteristics of the application files that are easily tampered with and the application files important to the application deployment are defined in advance, and then the overall checksum operation is performed on all application files with the predefined file characteristics to obtain a calibration. It is verified that, after all application files are compressed and packaged into the second installation package, any one or more application files with predefined file characteristics in the second installation package are tampered with, which will result in the The result of the overall checksum operation of the application file with the file characteristics changes, so that it can be determined according to the checksum whether there is a tampered application file with a predefined file characteristic in the second installation package to determine an important application Whether the program file has been tampered with.

In response to the fourth method, the file characteristics that are easily tampered with and the application files important to application deployment are defined in advance, and then the checksum operation is performed on each application file with the predefined file characteristics to obtain the phase characteristics. A corresponding checksum. After all application files are compressed and packaged into the second installation package, any application file with predefined file characteristics in the second installation package is tampered with, which will result in the memory of the application file. The result of the checksum operation changes, so that the checksum can locate the tampered application file with predefined file characteristics. Optionally, on the basis of the application processing method shown in FIG. 1, as shown in FIG. 2, step 102 obtains at least one application file by decompressing the first installation package, which may be specifically implemented by the following sub-steps:

Step 1021: decompress the first installation package;

Step 1022: Determine a noise file from the files obtained by decompressing the first installation package, and determine the files decompressed from the first installation package other than the noise file as application files, where the noise file is the same as The function of the application is not related to the file, and the application file is a file related to the function of the application.

The compressed first installation package of the compiled application includes two types of files. The first type of files are files that are not related to the application's function implementation, that is, noise files, and the second type of files are related to the application's function implementation. The file is the application file. Noise files are usually files related to the application installation and deployment process. Such files vary according to the deployment environment. In order to avoid the noise file being mistaken for being tampered and causing the second installation package to fail verification, the first installation package is not passed. The noise files included in the filtering are filtered out, and only the application files are compressed and packaged into the second installation package to ensure the accuracy of the verification of the second installation package.

In addition, noise files are filtered from the files obtained by decompressing the first installation package, and only checksum calculation is performed on the application files remaining after the noise files are filtered, so that the number of files requiring checksum calculation can be reduced. Number, thereby improving the efficiency of obtaining the second installation package. At the same time, when the application is subsequently deployed, it is only necessary to perform a checksum operation on the application file included in the second installation package, thereby improving the efficiency of verifying the second installation package.

It should be noted that, because the second installation package has no noise files required for application installation and deployment, when the application is deployed using the second installation package, the application deployment tool can automatically obtain the corresponding noise file according to the deployment environment. , And then use the obtained noise file and the second installation package for application deployment.

In addition, it should be noted that, in step 104, when compressing and packaging the verification file and each application file, there are two different compression and packaging methods:

First compression and packaging method: Compress and package only the verification file and all application files to generate a second installation package.

At this time, the second installation package includes only one verification file and all application files. When deploying an application using the second installation package, you need to obtain additional noise files for application deployment and installation. The specific tools can be deployed by the deployment tool. Obtained automatically based on the deployment environment.

The second compression and packing method: Compress and pack the verification file, all application files, and noise files.

At this time, the second installation package includes a verification file, all application files, and all noise files. When the application is deployed using the second installation package, additional noise files need to be obtained.

Optionally, on the basis of the application program processing method shown in FIG. 1, before the verification file and at least one application program are compressed and packaged in step 105, a second digital signature may be added to the verification file storing the checksum. In step 105, the verification file added with the second digital signature and at least one application file may be compressed and packaged to obtain a second installation including the verification file added with the second digital signature and at least one application file. package.

After the obtained checksum of each application file is stored in the verification file, a second digital signature is added to the verification file, and then the verification file to which the second digital signature is added and each application file are compressed. Package to obtain a second installation package, and then add a first digital signature to the second installation package. In this way, before using the second installation package to deploy the application, first verify that the first digital signature is correct, decompress the second installation package after determining that the first digital signature is correct, and then verify that the second digital signature is correct. After determining that the second digital signature is correct, a checksum operation is performed on each application file, and the obtained checksum is compared with the checksum stored in the check file to determine whether each application file is tampered. It can be seen that by adding a second digital signature to the verification file on the basis of the application processing method shown in FIG. 1, a triple verification is required before using the second installation package to deploy the application, which can further ensure that the terminal device Deploy application security.

Optionally, based on the application processing method described in FIG. 1 or FIG. 2, when adding a first digital signature to the second installation package in step 106, as shown in FIG. 3, this step may be specifically implemented by the following sub-steps:

Step 1061: Perform a hash operation on the second installation package by using a hash algorithm to obtain a first identity corresponding to the second installation package;

Step 1062: encrypt the first identity by using a private key to obtain an encrypted identity;

Step 1063: Generate a public key infrastructure PKI object corresponding to the private key and including an encrypted identity;

Step 1064: Embed the PKI object into the second installation package.

After obtaining the second installation package, first perform an overall hash operation on the second installation package to obtain a first identity corresponding to the second installation package, and then encrypt the first identity through the private key of the application developer To obtain the corresponding encrypted identity, and then generate a public key infrastructure (PKI) object corresponding to the private key and including the encrypted identity, and then embed the generated PKI object into the second installation package So that the PKI object is downloaded when the second installation package is downloaded.

A first identity corresponding to the second installation package is obtained by hashing the second installation package. The first identity corresponds strictly to the content of the second installation package. If the content of the second installation package changes, the first The identity of the second installation package will also change, so it can be verified by the first identity that the second installation package has been tampered with.

In order to prevent illegal persons from tampering with the second installation package and forging a matching identity, the first identity is encrypted by the private key to obtain the encrypted identity. The encrypted identity can be obtained from the public key corresponding to the private key. Perform decryption to ensure that the first identity can be obtained by decrypting when verifying the first digital signature, and the criminal can't forge the first identity because the private key cannot be obtained, so that the first digital signature can be used to verify the integrity of the second installation package. Reliability and consistency.

When generating a PKI object, the information of the evidence authority, the encrypted identity, the public key corresponding to the private key, and the PKI certificate can be integrated to obtain the PKI object.

It should be noted that when the second digital signature needs to be added to the verification file, the method for adding the second digital signature is similar to the method for adding the first digital signature. For the specific process, see FIG. 3 for the second installation package. A method of digital signature, the method of adding a second digital signature to the verification file will not be repeated here.

As shown in FIG. 4, an embodiment of the present invention provides an application deployment method. The method may include the following steps:

Step 201: Obtain a second installation package added with a first digital signature.

Step 202: verify whether the first digital signature is correct, if yes, go to step 203, otherwise go to step 207;

Step 203: Decompress the second installation package to obtain a verification file and at least one application file;

Step 204: Perform a checksum operation on the at least one application file.

Step 205: Determine whether the checksum obtained by the checksum operation is the same as the corresponding checksum stored in the check file, and if yes, go to step 206; otherwise, go to step 207;

Step 206: deploy the application on a terminal device by using the second installation package, and end the current process;

Step 207: Determine that the second installation package has been tampered with.

The method for deploying an application provided by the embodiment of the present invention, after obtaining a second installation package added with a first digital signature, first verify whether the first digital signature is correct, and if the first digital signature is incorrect, directly determine that the second installation package has been installed. Tampered with, if the first digital signature is correct, decompress the second installation package to obtain a check file and at least one application file, and then perform a checksum operation on the application file to correct the checksum operation. The checksum is compared with the checksum stored in the check file. If all the obtained check files correspond to the checksum stored in the check file, the second installation package is used for deployment on a terminal device. Application, otherwise determine that the second installation package has been tampered with. It can be seen that before the application is deployed using the second installation package, the second installation package is double-checked through the first digital signature and the checksum stored in the verification file to determine whether the second installation package has been tampered with. Two-factor authentication determines that the second installation package has not been tampered with, and then uses the second installation package to deploy the application program on the terminal device, thereby improving the security of the application program deployment on the terminal device.

In the embodiment of the present invention, when the application program is deployed on the terminal device by using the second installation package, the application program may be deployed by using a deployment tool. Specifically, because there is no noise file for storing and installing the program in the second installation package, the deployment tool can use the deployment environment of the terminal device to obtain the corresponding noise file, and then use the obtained noise file and the second installation package. Deploy applications on end devices.

Optionally, based on the application deployment method shown in FIG. 4, if the verification file decompressed from the second installation package is added with a second digital signature, as shown in FIG. 5, in steps 203 and 204 Among the further include:

Step 208: Determine whether the second digital signature is correct. If yes, go to step 204, otherwise go to step 207.

When the verification file decompressed from the second installation package is added with the second digital signature, it is judged whether the second digital signature is correct. If the second digital signature is correct, it means that the verification file has not been tampered with, and step 204 and subsequent steps are performed accordingly. Steps to verify whether each application file has been tampered with. If the second digital signature error indicates that the check file has been tampered with, and the checksum stored in the check file has no reference value, go directly to step 207 to determine the second installation package. Has been tampered with. In this way, in addition to verifying the second installation package as a whole through the first digital signature and verifying each application through the checksum, the verification file is also verified using the second digital signature, so using the second installation package in Before the verification file is deployed on the terminal device, the second installation package is triple-verified to ensure that the second installation package has not been tampered with, thereby further improving the security of deploying the application program on the terminal device.

Optionally, on the basis of the application deployment method shown in FIG. 4 or FIG. 5, as shown in FIG. 6, the step 202 of verifying whether the first digital signature is correct may be specifically implemented by the following sub-steps:

Step 2021: Obtain a PKI object embedded in the second installation package.

Step 2022: Decrypt the encrypted identity included in the PKI object by using the public key corresponding to the PKI object to obtain the first identity;

Step 2023: Perform a hash operation on the second installation package by using a hash algorithm to obtain a second identity corresponding to the second installation package.

Step 2024: Determine whether the first identity is the same as the second identity, and if yes, determine that the first digital signature is correct; otherwise, determine that the first digital signature is incorrect.

After obtaining the second installation package added with the first digital signature, obtain the PKI object embedded in the second installation package, and then decrypt the encrypted identity included in the PKI object by using the public key corresponding to the PKI object to obtain The first identity, and then hashing the second installation package by a hash algorithm to obtain the second identity corresponding to the second installation package, and then determine whether the first identity is the same as the second identity. If the identity is the same as the second identity, it is determined that the first digital signature is correct, and if the first identity is different from the second identity, it is determined that the first digital signature is incorrect.

In the embodiment of the present invention, according to the description in the foregoing embodiment of the application processing method, the encrypted identity included in the PKI object embedded in the second installation package is obtained by encrypting the first identity through the private key, and the first An identity is obtained by hashing a second installation package that has not been tampered with. After obtaining the encrypted identity included in the PKI object, the first identity can be obtained by decrypting the encrypted identity through the public key corresponding to the aforementioned private key, and obtaining the first identity by hashing the obtained second installation package. The second identity, because the result of the hash operation strictly corresponds to the content of the operation object. If the first identity is the same as the second identity, it can be determined that the second installation package has not been tampered with, that is, the first digital signature is correct. If the first identity is different from the second identity, it can be determined that the second installation package has been tampered with and the first digital signature is wrong.

It should be noted that, when the verification file obtained by decompressing the second installation package is added with a second digital signature, the method for verifying the second digital signature is similar to the method for verifying the first digital signature. The description of the first digital signature verification method shown in FIG. 6 will not be repeated here.

As shown in FIG. 7, an embodiment of the present invention provides an application program processing apparatus, and the apparatus may include:

A first installation package obtaining module 301, configured to obtain a compressed first installation package of a compiled application program;

A first installation package decompression module 302, configured to decompress the first installation package obtained by the first installation package acquisition module 301 to obtain at least one application file;

A first checksum operation module 303, configured to perform a checksum operation on at least one application program file obtained by the first installation package decompression module 302;

A check file generating module 304, configured to store the checksum obtained by the first checksum operation module 303 in a checksum operation into a check file;

An application compression module 305 is configured to compress and package a verification file in which the verification file generation module 304 stores a checksum and at least one application file obtained by the first installation package decompression module 302 to obtain a second installation. package;

An installation package signature module 306 is configured to add a first digital signature to the second installation package obtained by the application compression module 305.

In the embodiment of the present invention, the first installation package obtaining module 301 may be used to perform step 101 in the foregoing method embodiment, and the first installation package decompression module 302 may be used to perform step 102 in the foregoing method embodiment, and the first verification The sum operation module 303 may be used to perform step 103 in the foregoing method embodiment, the verification file generation module 304 may be used to perform step 104 in the foregoing method embodiment, and the application compression module 305 may be used to perform step 105 in the foregoing method embodiment. The installation package signature module 306 may be configured to perform step 106 in the foregoing method embodiment.

Optionally, based on the application program processing apparatus shown in FIG. 7, as described in FIG. 8, the first installation package decompression module 302 includes:

A decompression unit 3021, configured to decompress the first installation package;

A screening unit 3022 is configured to determine a noise file from the files obtained by decompressing the first installation package by the decompression unit 3021, and determine the files decompressed from the first installation package other than the noise files as at least one An application file, where the noise file is a file that is not related to the implementation of the function of the application, and at least one application file is a file that is related to the implementation of the function of the application.

In the embodiment of the present invention, the decompression unit 3021 may be configured to perform step 1021 in the foregoing method embodiment, and the screening unit 3022 may be configured to perform step 1022 in the foregoing method embodiment.

Optionally, on the basis of the application processing apparatus shown in FIG. 7, as shown in FIG. 9, the application processing apparatus may further include: a verification file signature module 307;

A verification file signature module 307, configured to add a second digital signature to the verification file obtained by the verification file generation module 304;

The application compression module 305 is configured to compress and package at least one application file obtained by the verification file signature module 307 with the second digital signature and the first installation package decompression module 302, to obtain a second Installation package.

Optionally, on the basis of the application processing apparatus shown in FIG. 7 or FIG. 9, as shown in FIG. 10, the installation package signature module 306 may include:

A first hash operation unit 3061, configured to perform a hash operation on the second installation package by using a hash algorithm to obtain a first identity corresponding to the second installation package;

An identity encryption unit 3062, configured to encrypt the first identity obtained by the first hash operation unit 3061 by using a private key to obtain an encrypted identity;

A PKI object generating unit 3063, configured to generate a public key infrastructure PKI object corresponding to the private key and including the encrypted identity obtained by the identity encryption unit 3062;

A PKI object embedding unit 3064 is configured to embed the PKI object generated by the PKI object generating unit 3063 into the second installation package.

In the embodiment of the present invention, the first hash operation unit 3061 may be used to execute step 1061 in the foregoing method embodiment, the identification encryption unit 3062 may be used to execute step 1062 in the foregoing method embodiment, and the PKI object generation unit 3063 may be used to execute In step 1063 in the foregoing method embodiment, the PKI object embedding unit 3064 may be configured to execute step 1064 in the foregoing method embodiment.

It should be noted that the application processing apparatus provided in each of the foregoing embodiments may be used to publish an application, and each module included in the application processing apparatus may perform steps in the foregoing embodiment of an application processing method, and may further The second installation package with the first digital signature added is stored in an application library, and then the application corresponding to the second installation package is released through an automatic deployment tool, where the automatic deployment tool may be Jenkins.

As shown in FIG. 11, an embodiment of the present invention provides an application deployment device, and the device may include:

A second installation package obtaining module 401, configured to obtain a second installation package added with a first digital signature;

An installation package signature verification module 402, configured to verify whether the first digital signature added to the second installation package obtained by the second installation package acquisition module 401 is correct,

A second installation package decompression module 403, configured to decompress the second installation package when the installation package signature verification module 402 verifies that the first digital signature is correct, to obtain a verification file and at least one application file;

A second checksum operation module 404, configured to perform a checksum operation on at least one application program obtained by the second installation package decompression module 403;

A checksum verification module 405 is used to determine that the checksum obtained by the second checksum calculation module 404 performs a checksum operation corresponding to the checksum stored in the check file obtained by the second installation package decompression module 403. Checksums are all the same;

An application deployment module 406 is configured to install an application on a terminal device by using a second installation package when the judgment result of the checksum verification module 405 is yes;

An installation package status confirmation module 407 is configured to determine that the second installation package has been tampered with when the installation package signature verification module 402 verifies that the first digital signature is incorrect, or when the judgment result of the checksum verification module 405 is no.

In the embodiment of the present invention, the second installation package obtaining module 401 may be used to perform step 201 in the foregoing method embodiment, and the installation package signature verification module 402 may be used to perform step 202 in the foregoing method embodiment, and the second installation package is decompressed. The module 403 may be used to perform step 203 in the foregoing method embodiment, the second checksum calculation module 404 may be used to perform step 204 in the foregoing method embodiment, and the checksum verification module 405 may be used to perform step in the foregoing method embodiment. 205. The application deployment module 406 may be configured to perform step 206 in the foregoing method embodiment, and the installation package status confirmation module 407 may be configured to perform step 207 in the foregoing method embodiment.

Optionally, on the basis of the application deployment device shown in FIG. 11, as shown in FIG. 12, the application deployment device may further include: a verification file signature verification module 408;

The verification file signature verification module 408 is configured to verify whether the second digital signature is correct when the verification file decompressed by the second installation package decompression module 403 is added with a second digital signature;

The installation package status confirmation module 407 is further configured to determine that the second installation package has been tampered with when the verification file signature verification module 408 verifies that the second digital signature is incorrect.

In the embodiment of the present invention, the verification file signature verification module 408 may be configured to perform step 208 in the foregoing method embodiment.

It should be noted that when the application deployment device includes an installation package status confirmation module 407, after the verification file signature verification module 408 determines that the second digital signature is correct, the second checksum calculation module 404 starts to perform the second installation package. Each of the at least one application acquired by the decompression module 403 performs a checksum operation separately to obtain a checksum corresponding to each application file.

Optionally, based on the application deployment device shown in FIG. 11 or FIG. 12, as shown in FIG. 13, the installation package signature verification module 402 may include:

A PKI object obtaining unit 4021, configured to obtain a PKI object embedded in the second installation package;

An identity decryption unit 4022, configured to decrypt the encrypted identity included in the PKI object by using the public key corresponding to the PKI object obtained by the PKI object obtaining unit 4021 to obtain a first identity;

A second hash operation unit 4023, configured to perform a hash operation on the second installation package by using a hash algorithm to obtain a second identity corresponding to the second installation package;

An identity comparison unit 4024 is configured to determine whether the first identity obtained by the identity decryption unit 4022 and the second identity obtained by the second hash operation unit 4023 are the same. If yes, determine that the first digital signature is correct, otherwise Determine the first digital signature is wrong.

In the embodiment of the present invention, the PKI object obtaining unit 4021 may be used to execute step 2021 in the foregoing method embodiment, the identity decryption unit 4022 may be used to execute step 2022 in the foregoing method embodiment, and the second hash operation unit 4023 may be used to execute In step 2023 in the foregoing method embodiment, the identification comparison unit 4024 may be used to execute step 2024 in the foregoing method embodiment.

As shown in FIG. 14, an embodiment of the present invention provides an application program processing apparatus, including: at least one memory 501 and at least one processor 502;

At least one memory 501 for storing a machine-readable program;

The at least one processor 502 is configured to call a machine-readable program stored in the at least one memory 501 and execute each step in the foregoing application program processing method embodiment.

As shown in FIG. 15, an embodiment of the present invention provides an application program deployment apparatus, including: at least one memory 601 and at least one processor 602;

At least one memory 601, configured to store a machine-readable program;

At least one processor 602 is configured to call a machine-readable program stored in at least one memory 601 and execute each step in the foregoing application program deployment method embodiment.

The present invention also provides a computer-readable medium storing instructions for causing a machine to execute an application program processing method or an application program deployment method as described herein. Specifically, a system or device equipped with a storage medium may be provided, on which software program code that implements the functions of any of the above embodiments is stored, and a computer (or CPU or MPU) of the system or device is stored ) Read out and execute the program code stored in the storage medium.

In this case, the program code itself read from the storage medium can implement the functions of any one of the above-mentioned embodiments, so the program code and the storage medium storing the program code constitute a part of the present invention.

Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD + RW), Magnetic tape, non-volatile memory card and ROM. Alternatively, the program code may be downloaded from a server computer by a communication network.

In addition, it should be clear that some or all of the actual operations can be completed not only by executing the program code read by the computer, but also by operating the computer operating system based on instructions based on the program code, thereby realizing the above embodiments. The function of any one embodiment.

In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion unit connected to the computer, and then based on the program code The instructions cause the CPU and the like installed on the expansion board or the expansion unit to perform part and all of the actual operations, thereby realizing the functions of any one of the above embodiments.

It should be noted that not all steps and modules in the above processes and system structure diagrams are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above embodiments may be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by multiple Some components in separate devices are implemented together.

In the above embodiments, the hardware unit may be implemented mechanically or electrically. For example, a hardware unit may include permanently dedicated circuits or logic (such as a dedicated processor, FPGA or ASIC) to perform the corresponding operations. The hardware unit may also include programmable logic or circuits (such as general-purpose processors or other programmable processors), which may be temporarily set by software to complete the corresponding operations. The specific implementation manner (mechanical manner, or a dedicated permanent circuit, or a temporarily set circuit) can be determined based on cost and time considerations.

The present invention has been shown and described in detail above with reference to the drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments, and those skilled in the art can know based on the above-mentioned multiple embodiments, and can combine the different embodiments described above. The code review method in the present invention obtains more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims (17)

1. The application program processing method is characterized by including:

   Get the first compressed installation package of the compiled application;

   Decompressing the first installation package to obtain at least one application file;

   Performing a checksum operation on the at least one application file;

   Store the checksum obtained by the checksum operation in a check file;

   Compressing and packaging the verification file and the at least one application program file to obtain a second installation package;

   Adding a first digital signature to the second installation package.
2. The method according to claim 1, wherein the decompressing the first installation package to obtain at least one application program file comprises:

   Decompressing the first installation package;

   Determine a noise file from a file obtained by decompressing the first installation package, and determine a file decompressed from the first installation package other than the noise file as the at least one application file Wherein, the noise file is a file unrelated to the function implementation of the application program, and the at least one application file is a file related to the function implementation of the application program.
3. The method according to claim 1 or 2, wherein:

   Before the compressing and packaging the verification file and the at least one application file, the method further includes:

   Adding a second digital signature to the verification file;

   The compressing and packaging the verification file and the at least one application file includes:

   Compress and package the verification file and the at least one application file to which the second digital signature is added, to obtain the second installation package.
4. The method according to any one of claims 1 to 3, wherein the adding a first digital signature to the second installation package comprises:

   Performing a hash operation on the second installation package by using a hash algorithm to obtain a first identity corresponding to the second installation package;

   Encrypting the first identity by using a private key to obtain an encrypted identity;

   Generating a public key infrastructure PKI object corresponding to the private key and including the encrypted identity;

   The PKI object is embedded in the second installation package.
5. The application deployment method is characterized by:

   S1: Obtain a second installation package added with a first digital signature;

   S2: verify whether the first digital signature is correct, if yes, execute S3, otherwise execute S7;

   S3: Decompress the second installation package to obtain a verification file and at least one application program file;

   S4: performing a checksum operation on the at least one application file;

   S5: Determine whether the checksum obtained by the checksum operation is the same as the corresponding checksum stored in the check file, if yes, execute S6, otherwise execute S7;

   S6: deploy the application on a terminal device by using the second installation package, and end the current process;

   S7: Determine that the second installation package has been tampered with.
6. The method according to claim 5, characterized in that when the verification file is added with a second digital signature, further comprising between the S3 and the S4:

   Verify whether the second digital signature is correct, if yes, execute S4, otherwise execute S7.
7. The method according to claim 5 or 6, wherein the verifying whether the first digital signature is correct comprises:

   Obtaining a PKI object embedded in the second installation package;

   Decrypting the encrypted identity included in the PKI object by using a public key corresponding to the PKI object to obtain a first identity;

   Performing a hash operation on the second installation package by using a hash algorithm to obtain a second identity corresponding to the second installation package;

   Determine whether the first identity is the same as the second identity, and if so, determine that the first digital signature is correct; otherwise, determine that the first digital signature is incorrect.
8. An application program processing device, comprising:

   A first installation package obtaining module (301), configured to obtain a first installation package compressed by a compiled application program;

   A first installation package decompression module (302), configured to decompress the first installation package obtained by the first installation package acquisition module (301) to obtain at least one application program file;

   A first checksum operation module (303), configured to perform a checksum operation on the at least one application file obtained by the first installation package decompression module (302);

   A check file generating module (304), configured to store a checksum obtained by a checksum operation of the first checksum computing module (303) into a check file;

   An application compression module (305), configured to store the checksum of the checksum generated by the checkfile generation module (304) and all the data obtained by the first installation package decompression module (302) Compressing and packaging at least one application file to obtain a second installation package;

   An installation package signature module (306) is configured to add a first digital signature to the second installation package obtained by the application compression module (305).
9. The apparatus according to claim 8, wherein the first installation package decompression module (302) comprises:

   A decompression unit (3021), configured to decompress the first installation package;

   A screening unit (3022), configured to determine a noise file from a file obtained by decompressing the first installation package by the decompression unit (3021), and A file decompressed by an installation package is determined to be the at least one application program file, wherein the noise file is a file unrelated to the function implementation of the application program, and the at least one application program file is related to the application program. The functions are implemented in related files.
10. The device according to claim 8 or 9, further comprising: a verification file signature module (307);

    The verification file signature module (307) is configured to add a second digital signature to the verification file obtained by the verification file generation module (304);

    The application compression module (305) is configured to add the second digital signature to the verification file and the first installation package decompression module (302) after the verification file signature module (307). ) The obtained at least one application file is compressed and packed to obtain the second installation package.
11. The device according to any one of claims 8 to 10, wherein the installation package signature module (306) comprises:

    A first hash operation unit (3061), configured to perform a hash operation on the second installation package by using a hash algorithm to obtain a first identity corresponding to the second installation package;

    An identity encryption unit (3062), configured to encrypt the first identity obtained by the first hash operation unit (3061) with a private key to obtain an encrypted identity;

    A PKI object generating unit (3063) for generating a public key infrastructure PKI object corresponding to the private key and including the encrypted identity obtained by the identity encryption unit (3062);

    A PKI object embedding unit (3064) is configured to embed the PKI object generated by the PKI object generating unit (3063) into the second installation package.
12. The application deployment device is characterized by including:

    A second installation package obtaining module (401), configured to obtain a second installation package added with a first digital signature;

    An installation package signature verification module (402), configured to verify whether the first digital signature added to the second installation package obtained by the second installation package acquisition module (401) is correct,

    A second installation package decompression module (403), configured to decompress the second installation package to obtain a check when the installation package signature verification module (402) verifies that the first digital signature is correct. Files and at least one application file;

    A second checksum operation module (404), configured to perform a checksum operation on the at least one application program obtained by the second installation package decompression module (403);

    A checksum verification module (405), configured to determine the checksum obtained by the checksum operation of the second checksum operation module (404) and the checksum obtained by the second installation package decompression module (403). Whether the corresponding checksums stored in the verification file are all the same;

    An application deployment module (406), configured to use the second installation package to install an application on a terminal device when the judgment result of the checksum verification module (405) is yes;

    An installation package status confirmation module (407) is used when the installation package signature verification module (402) verifies that the first digital signature is incorrect, or when the judgment result of the checksum verification module (405) is no To determine that the second installation package has been tampered with.
13. The device according to claim 12, further comprising: a verification file signature verification module (408);

    The verification file signature verification module (408) is configured to verify the second digital signature when a second digital signature is added to the verification file decompressed by the second installation package decompression module (403). Whether the signature is correct;

    The installation package status confirmation module (407) is further configured to determine that the second installation package has been tampered with when the check file signature verification module (408) verifies that the second digital signature is incorrect.
14. The device according to claim 12 or 13, wherein the installation package signature verification module (402) comprises:

    A PKI object obtaining unit (4021), configured to obtain a PKI object embedded in the second installation package;

    An identity decryption unit (4022), configured to decrypt the encrypted identity included in the PKI object by using a public key corresponding to the PKI object obtained by the PKI object obtaining unit (4021) to obtain a first identity Identification

    A second hash operation unit (4023), configured to perform a hash operation on the second installation package by using a hash algorithm to obtain a second identity corresponding to the second installation package;

    An identity comparison unit (4024), configured to determine the first identity obtained by the identity decryption unit (4022) and the second identity obtained by the second hash operation unit (4023) Whether they are the same, if yes, determine that the first digital signature is correct; otherwise, determine that the first digital signature is incorrect.
15. An application program processing device, comprising: at least one memory (501) and at least one processor (502);

    The at least one memory (501) is configured to store a machine-readable program;

    The at least one processor (502) is configured to call the machine-readable program to execute the method according to any one of claims 1 to 4.
16. An application program deployment device, comprising: at least one memory (601) and at least one processor (602);

    The at least one memory (601) is configured to store a machine-readable program;

    The at least one processor (602) is configured to call the machine-readable program to execute the method according to any one of claims 5 to 7.
17. A computer-readable medium, characterized in that computer instructions are stored on the computer-readable medium, and when the computer instructions are executed by a processor, the processor causes the processor to execute the method according to any one of claims 1 to 7. .

Images