WO2023061320A1 - 一种设备标识符防伪造方法、装置和电子设备 - Google Patents

一种设备标识符防伪造方法、装置和电子设备 Download PDF

Info

Publication number
WO2023061320A1
WO2023061320A1 PCT/CN2022/124341 CN2022124341W WO2023061320A1 WO 2023061320 A1 WO2023061320 A1 WO 2023061320A1 CN 2022124341 W CN2022124341 W CN 2022124341W WO 2023061320 A1 WO2023061320 A1 WO 2023061320A1
Authority
WO
WIPO (PCT)
Prior art keywords
device identifier
anonymous
server
anonymous device
identifier
Prior art date
Application number
PCT/CN2022/124341
Other languages
English (en)
French (fr)
Inventor
姚平
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Priority to EP22880259.1A priority Critical patent/EP4418710A1/en
Publication of WO2023061320A1 publication Critical patent/WO2023061320A1/zh
Priority to US18/635,634 priority patent/US20240259811A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/126—Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity

Definitions

  • the present application belongs to the technical field of data encryption, and in particular relates to an anti-counterfeiting method, device and electronic equipment of a device identifier.
  • Supplementary Device Identifiers are usually used instead of International Mobile Equipment Identity to provide personalized services while protecting user privacy.
  • Supplementary device identifiers are usually generated on the mobile side using reference values + random values, including anonymous device identifiers (Open Anonymous Device Identifier, OAID), developer anonymous device identifiers (Vender Anonymous Device Identifier, VAID), and application anonymous device identifiers.
  • OAID Open Anonymous Device Identifier
  • VAID developer anonymous device identifiers
  • application anonymous device identifiers Identifier (Application Anonymous Device Identifier, AAID), etc., so that the application uses the above-mentioned supplementary device identifier to identify the user, and processes related data on the server side based on these device identifiers.
  • the relevant codes of the generation rules are relatively public (or hackers can illegally obtain them through decompilation, etc.), so after obtaining the relevant generation rules, they can generate various Supplement the device identifier, and imitate the application logic, report it to the server, and then obtain economic benefits.
  • the server cannot detect whether the device identifier is forged based on the device identifier itself.
  • the purpose of the embodiments of the present application is to provide a device identifier anti-counterfeiting method, device and electronic device, which can solve the problem that the generation rules of device identifiers in the related art are easily obtained illegally, and then various device identifiers are generated in batches to obtain Illegal economic benefits, and the server cannot detect whether the device identifier is forged based on the device identifier itself.
  • an embodiment of the present application provides an anti-counterfeiting method for a device identifier, which is applied to an electronic device, and the method includes:
  • the trusted application running a trusted application in a trusted execution environment, the trusted application encrypting the initial anonymous device identifier with a private key to obtain a first signature;
  • the server can use a public key to verify the authenticity of the first anonymous device identifier, and the public key matches the private key.
  • the embodiment of the present application provides an anti-counterfeiting method for a device identifier, which is applied to a server, and the method includes:
  • the electronic device receiving a first anonymous device identifier reported by the electronic device, wherein the first anonymous device identifier includes a first signature, and the first signature is obtained by encrypting the initial anonymous device identifier by the electronic device using a private key; owned;
  • the embodiment of the present application provides an anti-counterfeiting device for device identifiers, which is applied to electronic devices, and the device includes:
  • An acquisition module configured to acquire an initial anonymous device identifier when a request from a target application for querying an anonymous device identifier is received;
  • An encryption module configured to run a trusted application in a trusted execution environment, where the trusted application encrypts the initial anonymous device identifier with a private key to obtain a first signature
  • a first generating module configured to generate a first anonymous device identifier according to the initial anonymous device identifier and the first signature
  • a reporting module configured to report the first anonymous device identifier to a server, wherein the server can use a public key to verify the authenticity of the first anonymous device identifier, and use the private key to encrypt data Decryption is only possible with the public key corresponding to said private key.
  • the embodiment of the present application provides a device identifier anti-counterfeiting device, which is applied to a server, and the device includes:
  • the receiving module is configured to receive the first anonymous device identifier reported by the electronic device, wherein the first anonymous device identifier includes a first signature, and the first signature is that the electronic device uses a private key to identify the initial anonymous device identifier. obtained by encrypting the identifier;
  • An authentication module configured to authenticate the authenticity of the first anonymous device identifier by using a public key, and generate an authenticity authentication result, wherein the public key matches the private key;
  • a returning module configured to return the authenticity identification result to the electronic device.
  • the embodiment of the present application provides an electronic device, the electronic device includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, and the program or instruction is executed by The processor implements the steps of the method described in the first aspect when executed.
  • the embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the implementation as described in the first aspect or the second aspect is realized. steps of the method.
  • the embodiment of the present application provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run programs or instructions, so as to implement the first aspect Or the method described in the second aspect.
  • a computer program/program product is provided, the computer program/program product is stored in a non-transitory storage medium, and the program/program product is executed by at least one processor to implement the first aspect Or the steps of the method described in the second aspect.
  • a communication device configured to execute the steps of the method described in the first aspect or the second aspect.
  • the server-side The public key paired with the private key can be used to verify the authenticity of the generated first anonymous device identifier, which further enhances the management of the device identifier and ensures data security.
  • FIG. 1 is one of the schematic flowcharts of an anti-counterfeiting method for a device identifier provided in an embodiment of the present application;
  • FIG. 2 is the second schematic flow diagram of an anti-counterfeiting method for a device identifier provided in an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of an anti-counterfeiting system for device identifiers provided by an embodiment of the present application
  • FIG. 4 is one of the structural schematic diagrams of an anti-counterfeiting device for device identifiers provided by an embodiment of the present application
  • Fig. 5 is the second structural schematic diagram of an anti-counterfeiting device for device identifiers provided by an embodiment of the present application
  • FIG. 6 is a schematic structural diagram of an electronic device provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a hardware structure of an electronic device implementing an embodiment of the present application.
  • FIG. 1 is one of the schematic flowcharts of an anti-counterfeiting method for a device identifier provided in an embodiment of the present application.
  • the embodiment of the first aspect of the present application provides an anti-counterfeiting method for device identifiers, which is applied to electronic devices, and the method includes the following steps:
  • Step 101 Obtain an initial anonymous device identifier when a request from a target application program for querying an anonymous device identifier is received.
  • the target application in order to provide personalized services under the premise of protecting user privacy, can call the get (get) OAID interface to query the anonymous device identifier OAID, and then provide corresponding services based on the anonymous device identifier .
  • the electronic device first generates an initial anonymous device identifier according to relevant rules.
  • Step 102 Running a trusted application program in a trusted execution environment, the trusted application program encrypts the initial anonymous device identifier with a private key to obtain a first signature.
  • the Trusted Execution Environment (Trusted Execution Environment, TEE), the Trusted Execution Environment is a security area within the Central Processing Unit (CPU), which runs in an independent environment and runs in parallel with the operating system, The CPU ensures that both the confidentiality and integrity of the code and data in the TEE are protected.
  • TEE is more secure than an operating system.
  • Trusted applications running in the TEE have access to the full functionality of the device's main processor and memory, while hardware isolation protects these components from user-installed applications running in the main OS.
  • trusted application Trusted APP, TA
  • trusted application can run in TEE to handle sensitive business.
  • the security of the anonymous device identifier can be greatly improved, and the encryption rules can be reduced.
  • the possibility of illegal theft; and, even if the generation rules are illegally stolen, since the private key is also used to encrypt the generated initial anonymous device identifier, the probability of being cracked is greatly reduced.
  • Step 103 Generate a first anonymous device identifier according to the initial anonymous device identifier and the first signature;
  • the initial anonymous device identifier and the first signature may be concatenated or combined to obtain the first anonymous device identifier.
  • Step 104 Report the first anonymous device identifier to a server, wherein the server can use a public key to verify the authenticity of the first anonymous device identifier, and the public key matches the private key.
  • the server can verify the authenticity of the first anonymous device identifier reported by the electronic device, that is, the server can use the The public key authenticates the authenticity of the first anonymous device identifier, so as to obtain the authenticity result of the reported first anonymous device identifier from the server, so as to perform subsequent steps, such as whether to allow the target application to call or generate related service data .
  • the trusted application program uses an asymmetric encryption algorithm to encrypt the initial anonymous device identifier.
  • the asymmetric encryption algorithm needs to use two keys, that is, the public key (public key, referred to as the public key) key) and private key (privatekey, referred to as private key).
  • the public key and the private key are a pair. If the data is encrypted with the public key, it can only be decrypted with the corresponding private key. Because encryption and decryption use two different keys, this algorithm is called an asymmetric encryption algorithm.
  • Party A generates a pair of keys and discloses the public key, and other roles (Party B) that need to send information to Party A use the key (Party A’s public key) to pair
  • Party A uses its own private key to decrypt the encrypted information.
  • Party B uses its own private key to decrypt.
  • Party A can use its own private key to sign the confidential information before sending it to Party B; Party B then uses Party A's public key to verify the signature of the data sent back by Party A.
  • the private key is used to encrypt the initial anonymous device identifier on the electronic device side
  • the public key is used to decrypt the first anonymous device identifier on the server side. If the decryption meets expectations, it is considered that the electronic device reported True for the first anonymous device identifier, false otherwise.
  • the trusted application program in the process of generating the first anonymous device identifier on the electronic device side, is run in the trusted execution environment and encrypted with the private key, and the first anonymous device identifier is generated After reporting to the server to further check its authenticity, it greatly increases the difficulty of stealing and forging the anonymous identifier, and then cannot forge the relevant data of the target application, which has a great effect on combating hackers and purifying the network environment.
  • the reporting the first anonymous device identifier to the server includes:
  • the target application program reports the first anonymous device identifier to the server.
  • the first anonymous device identifier may be returned to the target application program, and the target application program reports the first anonymous device identifier to the server, So that the server feeds back the authenticity identification result to the target application program, and then the target application program performs corresponding operations according to the authenticity identification result.
  • the electronic device may also report the first anonymous device identifier to the server while returning the first anonymous device identifier to the target application program, That is, there is no need to go through the target application program; of course, the electronic device can also report the first anonymous device identifier to the server after generating the first anonymous device identifier, and then return the first anonymous device identifier to the The target application.
  • the method further includes:
  • a log file is generated and/or the application service is stopped, wherein the log file is used to record that the first anonymous device identifier is false.
  • corresponding processing may be performed according to the authenticity of the authenticity verification result in combination with the business logic of the target application program itself .
  • the target application program generates a corresponding log file, recording that the first anonymous device identifier of this query is false, and/or, the target application program stops providing application program services, specifically , that is, the target application no longer generates or calls for the associated data.
  • the target application normally provides corresponding application services.
  • the server-side The public key paired with the private key can be used to verify the authenticity of the generated first anonymous device identifier, which further enhances the management of the device identifier and ensures data security.
  • FIG. 2 is the second schematic flow diagram of an anti-counterfeiting method for a device identifier provided in an embodiment of the present application.
  • the embodiment of the second aspect of the present application also provides another device identifier anti-counterfeiting method, which is applied to the server, and the method includes:
  • Step 201 Receive the first anonymous device identifier reported by the electronic device, wherein the first anonymous device identifier contains a first signature, and the first signature is the electronic device using a private key to pair the initial anonymous device identifier obtained after encryption;
  • the initial anonymous device identifier can be generated by the electronic device according to relevant rules
  • the first anonymous device identifier is obtained according to the initial anonymous device identifier and the first signature
  • the process of generating the first anonymous device identifier by the electronic device is as in the above-mentioned embodiment mentioned, and will not be repeated here.
  • Step 202 Use a public key to authenticate the authenticity of the first anonymous device identifier, and generate an authenticity identification result, wherein the public key matches the private key;
  • a public key is stored on the server, and the public key matches the private key stored on the electronic device, and the data encrypted with the private key can only be encrypted with the public key corresponding to the private key.
  • the characteristics of the public key and the private key are as described in the above embodiments, and will not be repeated here.
  • the server can use the public key to successfully decrypt the first anonymous device identifier, it means that the first anonymous device identifier is true, otherwise, it is false, that is, the authentication result includes both true and false. situation.
  • Step 203 Return the authentication result to the electronic device.
  • the server After generating the authenticity verification result, the server feeds it back to the electronic device, so that the target application program on the electronic device performs corresponding processing according to the authenticity verification result and the business logic of the target application program itself.
  • the processing content please refer to the above-mentioned embodiment , which will not be repeated here.
  • the method further includes:
  • the authentication result of the first anonymous device identifier is true, save the first anonymous device identifier in the device identifier database.
  • the authenticity verification result of the first anonymous device identifier is true, it is kept in the device identifier database for subsequent query.
  • the server is used to provide the authentication service of the anonymous device identifier, so that the electronic device can report the first anonymous device identifier to the server to check its authenticity, which greatly improves the authenticity of the anonymous identifier. It is difficult to steal and forge, and then it is impossible to forge the relevant data of the target application, which has a great effect on combating hackers and purifying the network environment.
  • FIG. 3 is a schematic structural diagram of an anti-counterfeiting system for a device identifier provided in an embodiment of the present application.
  • the embodiment of the present application combines an electronic device (mobile terminal) and a server (service terminal) to further illustrate the device identifier anti-counterfeiting method of the present application.
  • the processing process of the electronic device and the server includes the following steps:
  • Step 301 the application (Application, APP) calls the getOAID interface of the supplementary device identifier module to query the OAID;
  • the supplementary device identifier module is used to generate an anonymous device identifier.
  • Step 302 The supplementary device identifier module generates an OAID according to relevant rules
  • OAID SHA256 (hardware identification+random number);
  • Step 303 the supplementary device identifier module invokes the signature (signature) interface (OAID) of the encryption capability encapsulation software development kit (Software Development Kit, SDK);
  • the signature interface signature (OAID) can call the trusted application in the trusted execution environment, and the encryption capability encapsulates the specific software package written by the SDK to assist encryption.
  • Step 304 The encryption capability encapsulation SDK sends the OAID to the TA in the TEE, requesting to sign it;
  • Step 305 The TA module signs the input OAID using the internally stored signature private key to obtain the OAID signature (signature, SIG);
  • Step 306 The TA module returns the result (original OAID, OAID signature SIG) to the encryption capability encapsulation SDK;
  • Step 307 the signature (OAID) interface returns the result (original OAID, OAID signature SIG) to the supplementary device identifier module;
  • Step 309 The supplementary device identifier module reports ⁇ original OAID, OAID signature SIG> to the identifier anti-forgery query service:
  • Step 310 The identifier anti-forgery query service verifies the reported ⁇ original OAID, OAID signature SIG> according to the saved public key, that is, verifies whether the OAID signature SIG is correct, and if the verification is successful, save it in the supplementary identifier signature database , discard if unsuccessful;
  • Step 311 APP reports information to the APP server, which includes OAID (new) and business content;
  • Step 312 The APP server queries the identifier anti-forgery query service whether the OAID is forged, and performs corresponding processing according to the query result combined with the APP's own business logic.
  • Step 313 The identifier anti-forgery query service queries the supplementary identifier signature database according to the provided OAID. If the query is successful, it returns "true”, and if the query is unsuccessful, it returns "forgery”.
  • step 308 and step 309 can be executed simultaneously or sequentially, for example, step 308 is executed first and then step 309 is executed, or step 309 is executed first and then step 309 is executed.
  • the trusted application program is run in the trusted execution environment during the process of generating the first anonymous device identifier on the electronic device side, and the private key is used for encryption, and after the first anonymous device identifier is generated, the Report to the server to further check its authenticity, which greatly increases the difficulty of stealing and forging anonymous identifiers, and then cannot forge the relevant data of the target application, which has a great effect on combating hackers and purifying the network environment.
  • the execution subject may be the device identifier anti-counterfeiting device, or the device identifier anti-counterfeiting device is used to implement the device identifier anti-counterfeiting method. module.
  • the device identifier anti-counterfeiting device is used as an example to illustrate the device identifier anti-counterfeiting device provided in the embodiment of the present application.
  • FIG. 4 is one of the schematic structural diagrams of an anti-counterfeiting device for a device identifier provided in an embodiment of the present application.
  • another embodiment of the present application also provides a device identifier anti-counterfeiting device, which is applied to electronic devices, and the device corresponds to the device identifier anti-counterfeiting method in the embodiment of the first aspect.
  • Device 40 includes:
  • An obtaining module 41 configured to obtain an initial anonymous device identifier in the case of receiving a request from the target application program to inquire about the anonymous device identifier;
  • An encryption module 42 configured to run a trusted application in a trusted execution environment, where the trusted application encrypts the initial anonymous device identifier with a private key to obtain a first signature;
  • a first generating module 43 configured to generate a first anonymous device identifier according to the initial anonymous device identifier and the first signature
  • the reporting module 44 is configured to report the first anonymous device identifier to a server, wherein the server can use a public key to verify the authenticity of the first anonymous device identifier, and the public key is the same as the private key. key match.
  • the reporting module includes:
  • a returning unit configured to return the first anonymous device identifier to the target application
  • a reporting unit configured for the target application program to report the first anonymous device identifier to the server.
  • the device also includes:
  • a receiving module configured to receive the authentication result returned by the server according to the first anonymous device identifier
  • the second generating module is configured to generate a log file and/or stop providing application program services when the authentication result is false, wherein the log file is used to record that the first anonymous device identifier is Fake.
  • the device identifier anti-counterfeiting device provided by the embodiment of the present application can realize various processes realized by the method embodiment in FIG. 1 , and details are not repeated here to avoid repetition.
  • the server-side The public key paired with the private key can be used to verify the authenticity of the generated first anonymous device identifier, which further enhances the management of the device identifier and ensures data security.
  • FIG. 5 is a second schematic structural diagram of an anti-counterfeiting device for a device identifier provided in an embodiment of the present application.
  • another embodiment of the present application also provides a device identifier anti-counterfeiting device, which is applied to a server, and the device corresponds to the device identifier anti-counterfeiting method in the embodiment of the second aspect, the device 50 includes:
  • the receiving module 51 is configured to receive a first anonymous device identifier reported by the electronic device, wherein the first anonymous device identifier includes a first signature, and the first signature is an initial anonymization of the electronic device using a private key. obtained after encrypting the device identifier;
  • An authentication module 52 configured to authenticate the authenticity of the first anonymous device identifier by using a public key, and generate an authenticity authentication result, wherein the public key matches the private key;
  • a returning module 53 configured to return the authentication result to the electronic device.
  • the device also includes:
  • the saving module is configured to save the first anonymous device identifier in the device identifier database when the authentication result of the first anonymous device identifier is true.
  • the device identifier anti-counterfeiting device provided in the embodiment of the present application can implement various processes implemented in the method embodiment in FIG. 2 , and details are not repeated here to avoid repetition.
  • the server is used to provide the authentication service of the anonymous device identifier, so that the electronic device can report the first anonymous device identifier to the server to check its authenticity, which greatly improves the theft of the anonymous identifier. It is difficult to forge, and then it is impossible to forge the relevant data of the target application, which has a great effect on combating hackers and purifying the network environment.
  • the device identifier anti-counterfeiting device in the embodiment of the present application may be a device, or a component, an integrated circuit, or a chip in a terminal.
  • the device may be a mobile electronic device or a non-mobile electronic device.
  • the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a handheld computer, a vehicle electronic device, a wearable device, an ultra-mobile personal computer (Ultra-Mobile Personal Computer, UMPC), a netbook or a personal digital assistant (Personal Digital Assistant).
  • the non-mobile electronic device may be a personal computer (Personal Computer, PC), a television (Television, TV), a teller machine or a self-service machine, etc., which are not specifically limited in this embodiment of the present application.
  • PC Personal Computer
  • TV Television
  • teller machine teller machine
  • self-service machine etc.
  • the device identifier anti-counterfeiting device in the embodiment of the present application may be a device with an operating system.
  • the operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in this embodiment of the present application.
  • the embodiment of the present application further provides an electronic device 600, including a processor 601, a memory 602, and programs or instructions stored in the memory 602 and operable on the processor 601,
  • an electronic device 600 including a processor 601, a memory 602, and programs or instructions stored in the memory 602 and operable on the processor 601
  • the program or instruction is executed by the processor 601
  • each process of the above embodiment of the device identifier anti-counterfeiting method can be realized, and the same technical effect can be achieved. To avoid repetition, details are not repeated here.
  • the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.
  • FIG. 7 is a schematic diagram of a hardware structure of an electronic device implementing an embodiment of the present application.
  • the electronic device 700 includes, but is not limited to: a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, a user input unit 707, an interface unit 708, a memory 709, and a processor 7010, etc. part.
  • the electronic device 700 can also include a power supply (such as a battery) for supplying power to various components, and the power supply can be logically connected to the processor 7010 through the power management system, so that the management of charging, discharging, and function can be realized through the power management system. Consumption management and other functions.
  • a power supply such as a battery
  • the structure of the electronic device shown in FIG. 7 does not constitute a limitation to the electronic device.
  • the electronic device may include more or fewer components than shown in the figure, or combine some components, or arrange different components, and details will not be repeated here. .
  • the processor 7010 is configured to obtain an initial anonymous device identifier when receiving a request from the target application program to query the anonymous device identifier;
  • the processor 7010 is further configured to run a trusted application program in a trusted execution environment, where the trusted application program uses a private key to encrypt the initial anonymous device identifier to obtain the first signature;
  • the processor 7010 is further configured to generate a first anonymous device identifier according to the initial anonymous device identifier and the first signature;
  • the radio frequency unit 701 is configured to report the first anonymous device identifier to a server, wherein the server can use a public key to verify the authenticity of the first anonymous device identifier, and the public key and the private key match.
  • the server-side The public key paired with the private key can be used to verify the authenticity of the generated first anonymous device identifier, which further enhances the management of the device identifier and ensures data security.
  • the reporting the first anonymous device identifier to the server includes:
  • the target application program reports the first anonymous device identifier to the server.
  • the radio frequency unit 701 is also configured to receive an authenticity identification result returned by the server according to the first anonymous device identifier;
  • the processor 7010 is further configured to generate a log file and/or stop providing the application service when the authentication result is false, wherein the log file is used to record that the first anonymous device identifier is Fake.
  • the input unit 704 may include a graphics processor (Graphics Processing Unit, GPU) 7041 and a microphone 7042, and the graphics processor 7041 is used for the image capture device (such as the image data of the still picture or video obtained by the camera) for processing.
  • the display unit 706 may include a display panel 7061, and the display panel 7061 may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like.
  • the user input unit 707 includes a touch panel 7071 and other input devices 7072 .
  • the touch panel 7071 is also called a touch screen.
  • the touch panel 7071 may include two parts, a touch detection device and a touch controller.
  • Other input devices 7072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, and joysticks, which will not be repeated here.
  • Memory 709 may be used to store software programs as well as various data, including but not limited to application programs and operating systems.
  • the processor 7010 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 7010 .
  • the embodiment of the present application also provides a readable storage medium, the storage medium may be volatile or nonvolatile, and the readable storage medium stores programs or instructions, and when the programs or instructions are executed by the processor, the
  • the various processes of the above embodiment of the device identifier anti-counterfeiting method can achieve the same technical effect, so in order to avoid repetition, details are not repeated here.
  • the processor is the processor in the electronic device described in the above embodiments.
  • the readable storage medium includes computer readable storage medium, such as computer read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc.
  • the embodiment of the present application further provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the above-mentioned device identifier anti-counterfeiting method
  • the various processes of the embodiment can achieve the same technical effect, so in order to avoid repetition, details are not repeated here.
  • chip mentioned in the embodiment of the present application may also be referred to as a system-on-chip, system-on-chip, system-on-a-chip, or system-on-a-chip.
  • the term “comprising”, “comprising” or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or device. Without further limitations, an element defined by the phrase “comprising a " does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising that element.
  • the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved. Functions are performed, for example, the described methods may be performed in an order different from that described, and various steps may also be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种设备标识符防伪造方法、装置和电子设备，属于加密技术领域。应用于电子设备的设备标识符防伪造方法包括：在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。

Description

一种设备标识符防伪造方法、装置和电子设备
相关申请的交叉引用
本申请主张在2021年10月15日在中国提交的中国专利申请No.202111201849.1的优先权，其全部内容通过引用包含于此。
技术领域
本申请属于数据加密技术领域，具体涉及一种设备标识符防伪造方法、装置和电子设备。
背景技术
随着移动互联网用户隐私数据管理日趋严格，应用程序在非必要的情况下不允许获取国际移动设备识别码。目前，通常使用补充设备标识符来代替国际移动设备识别码，以便在保护用户隐私的前提下，提供个性化的服务。补充设备标识符通常在移动端采用参考值+随机值的方式生成，包括匿名设备标识符(Open Anonymous Device Identifier，OAID)、开发者匿名设备标识符(Vender Anonymous Device Identifier，VAID)、应用匿名设备标识符(Application Anonymous Device Identifier，AAID)等，使得应用程序使用上述的补充设备标识符来标识用户，并在服务端根据这些设备标识符处理相关数据。
然而，由于设备标识符在手机端生成，生成规则的相关代码相对公开(或者说黑客能够通过反编译等手段非法获取)，因此在获取到相关生成规则后，即可以按照生成规则批量产生各种补充设备标识符，并仿造应用逻辑，上报服务端，继而获取经济利益。并且，由于补充设备标识符的特点，服务端无法根据设备标识符本身来检测设备标识符是否是伪造的。
发明内容
本申请实施例的目的是提供一种一种设备标识符防伪造方法、装置和电 子设备，能够解决相关技术中设备标识符的生成规则容易被非法获取、继而批量产生各种设备标识符以获取非法经济利益，而服务端无法根据设备标识符本身来检测设备标识符是否为假造的问题。
第一方面，本申请实施例提供了一种设备标识符防伪造方法，应用于电子设备，该方法包括：
在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；
在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；
根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。
第二方面，本申请实施例提供了一种设备标识符防伪造方法，应用于服务器，该方法包括：
接收电子设备上报的第一匿名设备标识符，其中，所述第一匿名设备标识符中包含第一签名，所述第一签名是所述电子设备采用私钥对初始匿名设备标识符进行加密后得到的；
采用公钥对所述第一匿名设备标识符的真伪进行鉴别，生成真伪鉴别结果，其中，所述公钥与所述私钥匹配；
将所述真伪鉴别结果返回给所述电子设备。
第三方面，本申请实施例提供了一种设备标识符防伪造装置，应用于电子设备，该装置包括：
获取模块，用于在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；
加密模块，用于在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；
第一生成模块，用于根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
上报模块，用于将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，采用所述私钥进行加密的数据只有用与所述私钥对应的公钥才可解密。
第四方面，本申请实施例提供了一种设备标识符防伪造装置，应用于服务器，该装置包括：
接收模块，用于接收电子设备上报的第一匿名设备标识符，其中，所述第一匿名设备标识符中包含第一签名，所述第一签名是所述电子设备采用私钥对初始匿名设备标识符进行加密后得到的；
鉴别模块，用于采用公钥对所述第一匿名设备标识符的真伪进行鉴别，生成真伪鉴别结果，其中，所述公钥与所述私钥匹配；
返回模块，用于将所述真伪鉴别结果返回给所述电子设备。
第五方面，本申请实施例提供了一种电子设备，该电子设备包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的方法的步骤。
第六方面，本申请实施例提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面或第二方面所述的方法的步骤。
第七方面，本申请实施例提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如第一方面或第二方面所述的方法。
第八方面，提供了一种计算机程序/程序产品，所述计算机程序/程序产品被存储在非瞬态的存储介质中，所述程序/程序产品被至少一个处理器执行以实现如第一方面或第二方面所述的方法的步骤。
第九方面，提供了一种通信设备，被配置为执行如第一方面或第二方面所述的方法的步骤。
在本申请实施例中，通过在电子设备的可信执行环境中采用私钥对生成的初始匿名设备标识符进行加密，有效降低了设备标识符相关生成规则被非法窃取的风险，并且，服务器端可以采用与所述私钥配对的公钥对生成的第一匿名设备标识符进行真伪验证，进一步增强了设备标识符的管理，保证了数据的安全性。
附图说明
图1为本申请实施例提供的一种设备标识符防伪造方法的流程示意图之一；
图2为本申请实施例提供的一种设备标识符防伪造方法的流程示意图之二；
图3为本申请实施例提供的一种设备标识符防伪造系统的结构示意图；
图4为本申请实施例提供的一种设备标识符防伪造装置的结构示意图之一；
图5为本申请实施例提供的一种设备标识符防伪造装置的结构示意图之二；
图6为本申请实施例提供的一种电子设备的结构示意图；
图7为实现本申请实施例的一种电子设备的硬件结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描 述的那些以外的顺序实施，且“第一”、“第二”等所区分的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”，一般表示前后关联对象是一种“或”的关系。
下面结合附图，通过具体的实施例及其应用场景对本申请实施例提供的一种设备标识符防伪造方法、装置和电子设备进行详细地说明。
请参考图1，图1为本申请实施例提供的一种设备标识符防伪造方法的流程示意图之一。如图1所示，本申请第一方面实施例提供了一种设备标识符防伪造方法，应用于电子设备，所述方法包括以下步骤：
步骤101：在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符。
本申请实施例中，目标应用程序为了在保护用户隐私的前提下提供个性化的服务，可以调用获取(get)OAID接口，以查询匿名设备标识符OAID，继而根据匿名设备标识符来提供相应服务。
可选的，电子设备根据相关规则先生成初始匿名设备标识符，例如，生成初始匿名设备标识符时，可以采用原有的规则生成，即一般可以采用参考值+随机值后再进行哈希(hash)处理的方式生成，例如，OAID＝SHA256(硬件标识+随机数)。
步骤102：在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名。
其中，可信执行环境(Trusted Execution Environment，TEE)，可信执行环境是中央处理器(Central Processing Unit，CPU)内的一个安全区域，它运行在一个独立的环境中且与操作系统并行运行，CPU确保TEE中代码和数据的机密性和完整性都得到保护。通过同时使用硬件和软件来保护数据和代码，TEE比操作系统更加安全。在TEE中运行的可信应用程序可以访问设备主处理器和内存的全部功能，而硬件隔离保护这些组件不受主操作系统中运行的用户安装应用程序的影响。
而可信应用程序(Trusted APP，TA)，可信应用程序可在TEE中运行，以处理敏感业务。
本申请实施例中，通过在可信执行环境中运行可信应用程序，并采用私钥对生成的初始匿名设备标识符进行加密，可以极大提高匿名设备标识符的安全性，降低加密规则被非法窃取的可能；并且，即使生成规则被非法窃取，由于还采用私钥对生成的初始匿名设备标识符进行了加密，因此，被破解的概率大大降低。
步骤103：根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
示例性的，可以将初始匿名设备标识符和第一签名进行拼接或组合，继而得到第一匿名设备标识符。
步骤104：将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。
在生成第一匿名设备标识符之后，可以将其上报服务器，该服务器可以对电子设备上报的第一匿名设备标识符的真伪进行鉴别，也即，服务器可以采用与所述私钥相匹配的公钥对第一匿名设备标识符的真伪进行鉴别，以从服务器获知上报的第一匿名设备标识符的真伪结果，从而执行后续的步骤，例如是否允许目标应用程序调用或生成相关服务数据。
需要说明的是，本申请实施例中，可信应用程序采用非对称加密算法对初始匿名设备标识符进行加密，非对称加密算法需要用到两个密钥，即公开密钥(publickey，简称公钥)和私有密钥(privatekey，简称私钥)。公钥与私钥是一对，如果用公钥对数据进行加密，只有用对应的私钥才能解密。因为加密和解密使用的是两个不同的密钥，所以这种算法叫作非对称加密算法。非对称加密算法实现机密信息交换的基本过程是：甲方生成一对密钥并将公钥公开，需要向甲方发送信息的其他角色(乙方)使用该密钥(甲方的公钥)对机密信息进行加密后再发送给甲方；甲方再用自己私钥对加密后的信息进行解 密。甲方想要回复乙方时正好相反，使用乙方的公钥对数据进行加密，同理，乙方使用自己的私钥来进行解密。另一方面，甲方可以使用自己的私钥对机密信息进行签名后再发送给乙方；乙方再用甲方的公钥对甲方发送回来的数据进行验签。
因此，本申请实施例在电子设备侧采用私钥对初始匿名设备标识符进行加密，而在服务器侧采用公钥对第一匿名设备标识符进行解密，若解密符合预期，即认为电子设备上报的第一匿名设备标识符为真，反之则为假。
由此，本申请实施例中，既在电子设备侧生成第一匿名设备标识符的过程中在可信执行环境中运行可信应用程序采用私钥进行加密，又在生成第一匿名设备标识符后上报服务器，以进一步查询其真伪，极大提高了匿名标识符的窃取、伪造难度，继而无法伪造目标应用程序的相关数据，对打击黑客、净化网络环境有极大作用。
在本申请的一些实施例中，所述将所述第一匿名设备标识符上报服务器，包括：
将所述第一匿名设备标识符返回给所述目标应用程序；
所述目标应用程序将所述第一匿名设备标识符上报服务器。
也就是说，本申请实施例中，在生成第一匿名设备标识符之后，可以将第一匿名设备标识符返回给目标应用程序，并由目标应用程序将该第一匿名设备标识符上报服务器，以便服务器反馈真伪鉴别结果给目标应用程序，继而目标应用程序根据真伪鉴别结果执行相应操作。
可选的，电子设备也可以在生成所述第一匿名设备标识符后，在将所述第一匿名设备标识符返回给所述目标应用程序的同时，将第一匿名设备标识符上报服务器，也即不需要经过目标应用程序；当然，电子设备还可以在生成所述第一匿名设备标识符后，先将第一匿名设备标识符上报服务器，再将所述第一匿名设备标识符返回给所述目标应用程序。
本申请的另一些实施例中，所述将所述第一匿名设备标识符上报服务器之后，所述方法还包括：
接收所述服务器根据所述第一匿名设备标识符返回的真伪鉴别结果；
在所述真伪鉴别结果为假的情况下，生成日志文件和/或停止提供应用程序服务，其中，所述日志文件用于记录所述第一匿名设备标识符为假。
示例性的，在接收到服务器根据电子设备上报的第一匿名设备标识符返回的真伪鉴别结果后，即可以根据真伪鉴别结果的真伪，结合目标应用程序自身的业务逻辑执行相应的处理。例如，若返回的鉴别结果为假，则目标应用程序生成相应的日志文件，记录本次查询的第一匿名设备标识符为假，和/或，目标应用程序停止提供应用程序服务，具体来说，即目标应用程序不再生成或调用相关数据。而若返回的鉴别结果为真，则目标应用程序正常提供相应应用程序服务。
在本申请实施例中，通过在电子设备的可信执行环境中采用私钥对生成的初始匿名设备标识符进行加密，有效降低了设备标识符相关生成规则被非法窃取的风险，并且，服务器端可以采用与所述私钥配对的公钥对生成的第一匿名设备标识符进行真伪验证，进一步增强了设备标识符的管理，保证了数据的安全性。
请参考图2，图2为本申请实施例提供的一种设备标识符防伪造方法的流程示意图之二。如图2所示，本申请第二方面实施例还提供了另一种设备标识符防伪造方法，应用于服务器，所述方法包括：
步骤201：接收电子设备上报的第一匿名设备标识符，其中，所述第一匿名设备标识符中包含第一签名，所述第一签名是所述电子设备采用私钥对初始匿名设备标识符进行加密后得到的；
其中，初始匿名设备标识符可以由电子设备根据相关规则生成，第一匿名设备标识符根据初始匿名设备标识符和第一签名得到，电子设备生成第一匿名设备标识符的过程如上述实施例中所述，在此不再赘述。
步骤202：采用公钥对所述第一匿名设备标识符的真伪进行鉴别，生成真伪鉴别结果，其中，所述公钥与所述私钥匹配；
本申请实施例中，服务器上存储有公钥，所述公钥与电子设备上存储的 私钥相匹配，采用所述私钥进行加密的数据只有用与所述私钥对应的公钥才可解密，所述公钥和所述私钥的特性如上述实施例中所述，在此不再赘述。
可以知道，当服务器可以采用公钥对所述第一匿名设备标识符成功解密，则意味着该第一匿名设备标识符为真，反之，则为假，即真伪鉴别结果包括真、假两种情况。
步骤203：将所述真伪鉴别结果返回给所述电子设备。
在生成真伪鉴别结果后，服务器将其反馈给电子设备，以便电子设备上的目标应用程序根据真伪鉴别结果以及目标应用程序自身的业务逻辑进行相应处理，这里的处理内容请参照上述实施例，在此不再赘述。
本申请的一些实施例中，所述生成真伪鉴别结果之后，所述方法还包括：
在所述第一匿名设备标识符的真伪鉴别结果为真的情况下，将所述第一匿名设备标识符保存至设备标识符数据库中。
也就是说，若所述第一匿名设备标识符的真伪鉴别结果为真，则将其保留在设备标识符数据库中，以便后续查询。
总之，本申请实施例中，利用服务器提供匿名设备标识符真伪鉴别服务，使得电子设备可以在生成第一匿名设备标识符后上报服务器，以查询其真伪，极大提高了匿名标识符的窃取、伪造难度，继而无法伪造目标应用程序的相关数据，对打击黑客、净化网络环境有极大作用。
请参考图3，图3为本申请实施例提供的一种设备标识符防伪造系统的结构示意图。如图3所示，本申请实施例结合电子设备(移动端)和服务器(服务端)以进一步阐述本申请的设备标识符防伪造方法。本申请实施例中，电子设备和服务器的处理过程包括以下步骤：
步骤301：应用端(Application，APP)调用补充设备标识符模块的getOAID接口，查询OAID；
其中，补充设备标识符模块用于生成匿名设备标识符。
步骤302：补充设备标识符模块根据相关规则，生成OAID；
例如，OAID＝SHA256(硬件标识+随机数)；
步骤303：补充设备标识符模块调用加密能力封装软件开发工具包(Software Development Kit，SDK)的签名(signature)接口(OAID)；
其中，签名接口signature(OAID)可以调用可信执行环境中的可信应用程序，加密能力封装SDK为辅助加密而编写的特定软件包。
步骤304：加密能力封装SDK将OAID发送给TEE中的TA，请求对其进行签名；
步骤305：TA模块使用内部保存的签名私钥，对输入的OAID进行签名，得到OAID签名(signature，SIG)；
步骤306：TA模块将结果(原始OAID，OAID签名SIG)返回给加密能力封装SDK；
步骤307：signature(OAID)接口返回结果(原始OAID，OAID签名SIG)给补充设备标识符模块；
步骤308：补充设备标识符模块将(原始OAID，OAID签名SIG)作为新的OAID返回给APP，即新OAID＝原始OAID+OAID签名SIG；
步骤309：补充设备标识符模块将<原始OAID，OAID签名SIG>上报给标识符防伪造查询服务：
步骤310：标识符防伪造查询服务根据保存的公钥，校验上报的<原始OAID,OAID签名SIG>，即验证OAID签名SIG是否正确，如果校验成功的话则保存到补充标识符签名数据库中，如果不成功则丢弃；
步骤311：APP上报给APP服务端信息，其中包含OAID(新的)和业务内容；
步骤312：APP服务端向标识符防伪造查询服务查询OAID是否伪造，并根据查询结果结合APP自身业务逻辑进行相应处理。
步骤313：标识符防伪造查询服务根据提供的OAID，查询补充标识符签名数据库，如果查询成功，返回“真实”，如果查询不成功，返回“伪造”。
上述步骤中，步骤308和步骤309可以同步执行，也可以分先后执行，例如步骤308先执行，步骤309后执行，或者步骤309先执行，步骤309后 执行。
总之，本申请实施例中，既在电子设备侧生成第一匿名设备标识符的过程中在可信执行环境中运行可信应用程序采用私钥进行加密，又在生成第一匿名设备标识符后上报服务器，以进一步查询其真伪，极大提高了匿名标识符的窃取、伪造难度，继而无法伪造目标应用程序的相关数据，对打击黑客、净化网络环境有极大作用。
需要说明的是，本申请实施例提供的设备标识符防伪造方法，执行主体可以为设备标识符防伪造装置，或者该设备标识符防伪造装置中的用于执行设备标识符防伪造方法的控制模块。本申请实施例中以设备标识符防伪造装置执行设备标识符防伪造方法为例，说明本申请实施例提供的设备标识符防伪造装置。
请参考图4，图4为本申请实施例提供的一种设备标识符防伪造装置的结构示意图之一。如图4所示，本申请再一实施例还提供了一种设备标识符防伪造装置，应用于电子设备，该装置与第一方面实施例中的设备表示符防伪造方法相对应，所述装置40包括：
获取模块41，用于在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；
加密模块42，用于在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；
第一生成模块43，用于根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
上报模块44，用于将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。
可选的，所述上报模块包括：
返回单元，用于将所述第一匿名设备标识符返回给所述目标应用程序；
上报单元，用于所述目标应用程序将所述第一匿名设备标识符上报服务 器。
可选的，所述装置还包括：
接收模块，用于接收所述服务器根据所述第一匿名设备标识符返回的真伪鉴别结果；
第二生成模块，用于在所述真伪鉴别结果为假的情况下，生成日志文件和/或停止提供应用程序服务，其中，所述日志文件用于记录所述第一匿名设备标识符为假。
本申请实施例提供的设备标识符防伪造装置能够实现图1的方法实施例实现的各个过程，为避免重复，这里不再赘述。
在本申请实施例中，通过在电子设备的可信执行环境中采用私钥对生成的初始匿名设备标识符进行加密，有效降低了设备标识符相关生成规则被非法窃取的风险，并且，服务器端可以采用与所述私钥配对的公钥对生成的第一匿名设备标识符进行真伪验证，进一步增强了设备标识符的管理，保证了数据的安全性。
请参考图5，图5为本申请实施例提供的一种设备标识符防伪造装置的结构示意图之二。如图5所示，本申请又一实施例还提供了一种设备标识符防伪造装置，应用于服务器，该装置与第二方面实施例中的设备表示符防伪造方法相对应，所述装置50包括：
接收模块51，用于接收电子设备上报的第一匿名设备标识符，其中，所述第一匿名设备标识符中包含第一签名，所述第一签名是所述电子设备采用私钥对初始匿名设备标识符进行加密后得到的；
鉴别模块52，用于采用公钥对所述第一匿名设备标识符的真伪进行鉴别，生成真伪鉴别结果，其中，所述公钥与所述私钥匹配；
返回模块53，用于将所述真伪鉴别结果返回给所述电子设备。
可选的，所述装置还包括：
保存模块，用于在所述第一匿名设备标识符的真伪鉴别结果为真的情况下，将所述第一匿名设备标识符保存至设备标识符数据库中。
本申请实施例提供的设备标识符防伪造装置能够实现图2的方法实施例实现的各个过程，为避免重复，这里不再赘述。
本申请实施例中，利用服务器提供匿名设备标识符真伪鉴别服务，使得电子设备可以在生成第一匿名设备标识符后上报服务器，以查询其真伪，极大提高了匿名标识符的窃取、伪造难度，继而无法伪造目标应用程序的相关数据，对打击黑客、净化网络环境有极大作用。
本申请实施例中的设备标识符防伪造装置可以是装置，也可以是终端中的部件、集成电路、或芯片。该装置可以是移动电子设备，也可以为非移动电子设备。示例性的，移动电子设备可以为手机、平板电脑、笔记本电脑、掌上电脑、车载电子设备、可穿戴设备、超级移动个人计算机(Ultra-Mobile Personal Computer，UMPC)、上网本或者个人数字助理(Personal Digital Assistant，PDA)等，非移动电子设备可以为个人计算机(Personal Computer，PC)、电视机(Television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的设备标识符防伪造装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为iOS操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
可选的，如图6所示，本申请实施例还提供一种电子设备600，包括处理器601，存储器602，存储在存储器602上并可在所述处理器601上运行的程序或指令，该程序或指令被处理器601执行时实现上述设备标识符防伪造方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，本申请实施例中的电子设备包括上述所述的移动电子设备和非移动电子设备。
图7为实现本申请实施例的一种电子设备的硬件结构示意图。
该电子设备700包括但不限于：射频单元701、网络模块702、音频输出单元703、输入单元704、传感器705、显示单元706、用户输入单元707、 接口单元708、存储器709、以及处理器7010等部件。
本领域技术人员可以理解，电子设备700还可以包括给各个部件供电的电源(比如电池)，电源可以通过电源管理系统与处理器7010逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。图7中示出的电子设备结构并不构成对电子设备的限定，电子设备可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不再赘述。
其中，处理器7010，用于在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；
处理器7010，还用于在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；
处理器7010，还用于根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
射频单元701，用于将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。
在本申请实施例中，通过在电子设备的可信执行环境中采用私钥对生成的初始匿名设备标识符进行加密，有效降低了设备标识符相关生成规则被非法窃取的风险，并且，服务器端可以采用与所述私钥配对的公钥对生成的第一匿名设备标识符进行真伪验证，进一步增强了设备标识符的管理，保证了数据的安全性。
可选的，所述将所述第一匿名设备标识符上报服务器，包括：
将所述第一匿名设备标识符返回给所述目标应用程序；
所述目标应用程序将所述第一匿名设备标识符上报服务器。
可选的，射频单元701，还用于接收所述服务器根据所述第一匿名设备标识符返回的真伪鉴别结果；
处理器7010，还用于在所述真伪鉴别结果为假的情况下，生成日志文件和/或停止提供应用程序服务，其中，所述日志文件用于记录所述第一匿名设 备标识符为假。
应理解的是，本申请实施例中，输入单元704可以包括图形处理器(Graphics Processing Unit，GPU)7041和麦克风7042，图形处理器7041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。显示单元706可包括显示面板7061，可以采用液晶显示器、有机发光二极管等形式来配置显示面板7061。用户输入单元707包括触控面板7071以及其他输入设备7072。触控面板7071，也称为触摸屏。触控面板7071可包括触摸检测装置和触摸控制器两个部分。其他输入设备7072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。存储器709可用于存储软件程序以及各种数据，包括但不限于应用程序和操作系统。处理器7010可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器7010中。
本申请实施例还提供一种可读存储介质，该存储介质可以是易失的或非易失的，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述设备标识符防伪造方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器为上述实施例中所述的电子设备中的处理器。所述可读存储介质，包括计算机可读存储介质，如计算机只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现上述设备标识符防伪造方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片、系统芯片、 芯片系统或片上系统芯片等。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对相关技术做出贡献的部分可以以计算机软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (15)

  1. 一种设备标识符防伪造方法，应用于电子设备，所述方法包括：
    在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；
    在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；
    根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
    将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。
  2. 根据权利要求1所述的方法，其中，所述将所述第一匿名设备标识符上报服务器，包括：
    将所述第一匿名设备标识符返回给所述目标应用程序；
    所述目标应用程序将所述第一匿名设备标识符上报服务器。
  3. 根据权利要求1所述的方法，其中，所述将所述第一匿名设备标识符上报服务器之后，还包括：
    接收所述服务器根据所述第一匿名设备标识符返回的真伪鉴别结果；
    在所述真伪鉴别结果为假的情况下，生成日志文件和/或停止提供应用程序服务，其中，所述日志文件用于记录所述第一匿名设备标识符为假。
  4. 一种设备标识符防伪造方法，应用于服务器，所述方法包括：
    接收电子设备上报的第一匿名设备标识符，其中，所述第一匿名设备标识符中包含第一签名，所述第一签名是所述电子设备采用私钥对初始匿名设备标识符进行加密后得到的；
    采用公钥对所述第一匿名设备标识符的真伪进行鉴别，生成真伪鉴别结果，其中，所述公钥与所述私钥匹配；
    将所述真伪鉴别结果返回给所述电子设备。
  5. 根据权利要求4所述的方法，其中，所述生成真伪鉴别结果之后，还包括：
    在所述第一匿名设备标识符的真伪鉴别结果为真的情况下，将所述第一匿名设备标识符保存至设备标识符数据库中。
  6. 一种设备标识符防伪造装置，应用于电子设备，所述装置包括：
    获取模块，用于在接收到目标应用程序查询匿名设备标识符的请求的情况下，获取初始匿名设备标识符；
    加密模块，用于在可信执行环境中运行可信应用程序，所述可信应用程序采用私钥对所述初始匿名设备标识符进行加密，以得到第一签名；
    第一生成模块，用于根据所述初始匿名设备标识符和所述第一签名，生成第一匿名设备标识符；
    上报模块，用于将所述第一匿名设备标识符上报服务器，其中，所述服务器可采用公钥对所述第一匿名设备标识符的真伪进行鉴别，所述公钥与所述私钥匹配。
  7. 根据权利要求6所述的装置，其中，所述上报模块包括：
    返回单元，用于将所述第一匿名设备标识符返回给所述目标应用程序；
    上报单元，用于所述目标应用程序将所述第一匿名设备标识符上报服务器。
  8. 根据权利要求6所述的装置，其中，所述装置还包括：
    接收模块，用于接收所述服务器根据所述第一匿名设备标识符返回的真伪鉴别结果；
    第二生成模块，用于在所述真伪鉴别结果为假的情况下，生成日志文件和/或停止提供应用程序服务，其中，所述日志文件用于记录所述第一匿名设备标识符为假。
  9. 一种设备标识符防伪造装置，应用于服务器，所述装置包括：
    接收模块，用于接收电子设备上报的第一匿名设备标识符，所述第一匿名设备标识符中包含第一签名，所述第一签名是所述电子设备采用私钥对初 始匿名设备标识符进行加密后得到的；
    鉴别模块，用于采用公钥对所述第一匿名设备标识符的真伪进行鉴别，生成真伪鉴别结果，其中，所述公钥与所述私钥匹配；
    返回模块，用于将所述真伪鉴别结果返回给所述电子设备。
  10. 根据权利要求9所述的装置，其中，所述装置还包括：
    保存模块，用于在所述第一匿名设备标识符的真伪鉴别结果为真的情况下，将所述第一匿名设备标识符保存至设备标识符数据库中。
  11. 一种电子设备，包括处理器，存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1-3中任一项所述的设备标识符防伪造方法的步骤。
  12. 一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如权利要求1-5中任一项所述的设备标识符防伪造方法的步骤。
  13. 一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如权利要求1-5中任一项所述的设备标识符防伪造方法的步骤。
  14. 一种计算机程序产品，所述计算机程序产品被存储在非易失的存储介质中，所述计算机程序产品被至少一个处理器执行以实现如权利要求1-5中任一项所述的设备标识符防伪造方法的步骤。
  15. 一种通信设备，被配置为执行如权利要求1-5中任一项所述的设备标识符防伪造方法的步骤。
PCT/CN2022/124341 2021-10-15 2022-10-10 一种设备标识符防伪造方法、装置和电子设备 WO2023061320A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22880259.1A EP4418710A1 (en) 2021-10-15 2022-10-10 Device identifier counterfeiting prevention method and apparatus, and electronic device
US18/635,634 US20240259811A1 (en) 2021-10-15 2024-04-15 Device identifier counterfeiting prevention method and apparatus, and electronic device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111201849.1 2021-10-15
CN202111201849.1A CN113938878A (zh) 2021-10-15 2021-10-15 一种设备标识符防伪造方法、装置和电子设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/635,634 Continuation US20240259811A1 (en) 2021-10-15 2024-04-15 Device identifier counterfeiting prevention method and apparatus, and electronic device

Publications (1)

Publication Number Publication Date
WO2023061320A1 true WO2023061320A1 (zh) 2023-04-20

Family

ID=79279856

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/124341 WO2023061320A1 (zh) 2021-10-15 2022-10-10 一种设备标识符防伪造方法、装置和电子设备

Country Status (4)

Country Link
US (1) US20240259811A1 (zh)
EP (1) EP4418710A1 (zh)
CN (1) CN113938878A (zh)
WO (1) WO2023061320A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113938878A (zh) * 2021-10-15 2022-01-14 维沃移动通信有限公司 一种设备标识符防伪造方法、装置和电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130290711A1 (en) * 2012-04-27 2013-10-31 Google Inc. Providing content to a user across multiple devices
CN112148724A (zh) * 2020-10-16 2020-12-29 杭州兑吧网络科技有限公司 一种设备标识处理方法、系统、计算机设备及可读存储介质
CN112507291A (zh) * 2020-11-18 2021-03-16 北京深思数盾科技股份有限公司 Android设备的唯一标识的生成方法和装置
CN113342854A (zh) * 2021-06-21 2021-09-03 杭州推啊网络科技有限公司 一种移动设备唯一id生成方法和系统
CN113938878A (zh) * 2021-10-15 2022-01-14 维沃移动通信有限公司 一种设备标识符防伪造方法、装置和电子设备

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1342944A (zh) * 2000-09-11 2002-04-03 曹义东 一种利用互联网防伪的方法
US10356204B2 (en) * 2012-12-13 2019-07-16 Microsoft Technology Licensing, Llc Application based hardware identifiers
CN104283853B (zh) * 2013-07-08 2018-04-10 华为技术有限公司 一种提高信息安全性的方法、终端设备及网络设备
CN105849739B (zh) * 2013-09-17 2020-10-30 香港物流及供应链管理应用技术研发中心 验证系统和验证方法
US9311473B2 (en) * 2014-02-28 2016-04-12 Ncr Corporation Unattended secure device authorization
CN104715386B (zh) * 2015-04-03 2017-03-22 上海焕云网络技术有限公司 一种基于微信id实现验证全条码的防伪方法
CN106156618A (zh) * 2015-04-17 2016-11-23 国民技术股份有限公司 一种安全芯片、移动终端和实现移动终端系统安全的方法
CN106899552B (zh) * 2015-12-21 2020-03-20 中国电信股份有限公司 认证方法，认证终端以及系统
CN107171784B (zh) * 2017-05-12 2020-07-31 珠海富鸿科技有限公司 突发环境事件应急指挥调度方法及系统
CN109766678B (zh) * 2018-12-12 2020-11-03 同济大学 面向移动端设备指纹识别认证方法、系统、介质及设备
CN109743160A (zh) * 2018-12-20 2019-05-10 深圳市任子行科技开发有限公司 防止Hook串改的安卓设备唯一标识获取方法和装置
CN109600392A (zh) * 2019-01-15 2019-04-09 四川虹微技术有限公司 一种防止信息篡改的方法及装置
CN111506882B (zh) * 2019-01-30 2024-02-27 京东方科技集团股份有限公司 电子设备及数字文件管理方法
GB2582169B (en) * 2019-03-13 2021-08-11 Trustonic Ltd Authentication method
CN113497778B (zh) * 2020-03-18 2023-05-12 北京同邦卓益科技有限公司 一种数据的传输方法和装置
CN111598573B (zh) * 2020-04-10 2023-10-31 维沃移动通信有限公司 一种设备指纹验证方法及装置
CN111625846B (zh) * 2020-04-24 2023-08-29 公安部第一研究所 一种移动终端设备的系统状态记录方法
CN111966993B (zh) * 2020-08-19 2024-03-01 广州虎牙科技有限公司 设备标识码识别、生成算法测试方法、装置、设备及介质
CN112926046B (zh) * 2021-03-26 2024-04-19 公安部第三研究所 保护设备标识信息的移动终端设备匿名标识信息认证方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130290711A1 (en) * 2012-04-27 2013-10-31 Google Inc. Providing content to a user across multiple devices
CN112148724A (zh) * 2020-10-16 2020-12-29 杭州兑吧网络科技有限公司 一种设备标识处理方法、系统、计算机设备及可读存储介质
CN112507291A (zh) * 2020-11-18 2021-03-16 北京深思数盾科技股份有限公司 Android设备的唯一标识的生成方法和装置
CN113342854A (zh) * 2021-06-21 2021-09-03 杭州推啊网络科技有限公司 一种移动设备唯一id生成方法和系统
CN113938878A (zh) * 2021-10-15 2022-01-14 维沃移动通信有限公司 一种设备标识符防伪造方法、装置和电子设备

Also Published As

Publication number Publication date
EP4418710A1 (en) 2024-08-21
US20240259811A1 (en) 2024-08-01
CN113938878A (zh) 2022-01-14

Similar Documents

Publication Publication Date Title
US12081545B2 (en) Out-of-band authentication to access web-service with indication of physical access to client device
US11558381B2 (en) Out-of-band authentication based on secure channel to trusted execution environment on client device
WO2020237868A1 (zh) 数据传输方法、电子设备、服务器及存储介质
CN107743133B (zh) 移动终端及其基于可信安全环境的访问控制方法和系统
JP4240297B2 (ja) 端末機器、認証端末プログラム、機器認証サーバ、機器認証プログラム
JP5344716B2 (ja) モバイルデバイスからコンピュータへのセキュアな遠隔での起動、ブート、およびログイン方法、システム及びプログラム
US8904195B1 (en) Methods and systems for secure communications between client applications and secure elements in mobile devices
US8321924B2 (en) Method for protecting software accessible over a network using a key device
CN110059499A (zh) 一种文件访问权限认证方法及电子设备
CN107864124B (zh) 一种终端信息安全保护方法、终端及蓝牙锁
CN101005361A (zh) 一种服务器端软件保护方法及系统
CN110378097A (zh) 保障传感器数据安全
US20110047378A1 (en) System and method for identifying account and peripheral device thereof
CN111178884A (zh) 信息处理方法、装置、设备及可读存储介质
US20240259811A1 (en) Device identifier counterfeiting prevention method and apparatus, and electronic device
US20180262471A1 (en) Identity verification and authentication method and system
US20110202772A1 (en) Networked computer identity encryption and verification
US20220353092A1 (en) System and Method for Secure Internet Communications
WO2023040451A1 (zh) 资源转移
CN110659474B (zh) 应用间通信方法、装置、终端及存储介质
US20180218363A1 (en) Payment instrument management with key tokenization
US11399015B2 (en) Data security tool
WO2023046104A1 (zh) 对象移动方法、装置
US10845990B2 (en) Method for executing of security keyboard, apparatus and system for executing the method
CN114219055B (zh) 一种条码生成方法、条码验证方法及支付系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22880259

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022880259

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022880259

Country of ref document: EP

Effective date: 20240515