Disclosure of Invention
The present invention is directed to a method and system for security verification of application installation, and an application server, an electronic device and a computer-readable storage medium, so as to improve the problem of operation stability of the prior art system after a third-party application is installed.
According to a first aspect of the invention, a method for security verification of an application installation comprises: initiating an application downloading request from an application webpage end, responding the downloading request by an application server end and downloading a target application from the application server end, wherein the target application is obtained by encrypting an original application according to a preset encryption algorithm; after the target application is downloaded, calling an application installation safety inspection system to decrypt the target application according to a preset decryption algorithm, and determining whether the original application can be obtained through restoration; and when the original application is determined to be obtained through reduction, installing the original application.
Further, the step of encrypting the original application according to a preset encryption algorithm includes: acquiring an MD5 value of an original application; converting the MD5 value of the original application into a first byte array; encrypting the first byte array according to a preset algorithm to obtain a second byte array; calculating the length of the second byte array, and splicing the second byte array after the original application to obtain a first encryption application; converting the length of the second byte array into short type data and converting the short type data into a third byte array; and splicing the third byte number group after the first encryption application to obtain a second encryption application, wherein the second encryption application is obtained after encryption.
Further, the step of decrypting the target application according to a preset decryption algorithm and determining whether the original application can be restored comprises the following steps; taking out the last two bytes of the second encryption application, and judging whether the last two bytes can be converted into short type data or not; if the last two bytes cannot be converted into short type data, determining that the original application cannot be obtained through reduction; if the last two bytes can be converted into short type data, deleting the last two bytes of the second encryption application to obtain the first encryption application, determining the value B of the short type data, taking B bytes from the back of the first encryption application, and decrypting the B bytes according to the preset algorithm; and if the decryption is unsuccessful, determining that the original application cannot be restored, and if the decryption is successful, deleting the last 32 bits of the first encrypted application to obtain the original application.
Further, the preset algorithm is an RSA algorithm.
Further, the application webpage end is an application shop end of the intelligent vehicle, the application server end is an application server end of the intelligent vehicle, and the application installation safety inspection system is an on-board controller of the intelligent vehicle.
According to a second aspect of the invention, an electronic device comprises:
a memory for storing a computer program;
a processor for executing the computer program stored in the memory, and when the computer program is executed, implementing any of the methods described above.
According to a third aspect of the invention, a computer-readable storage medium has stored thereon a computer program which, when executed by a processor, implements any of the methods described above.
According to a fourth aspect of the invention, a system for security verification of application installation comprises: the verification unit is used for decrypting the target application according to a preset decryption algorithm after the target application is downloaded, and determining whether the original application can be obtained through restoration; the target application is obtained by encrypting the original application according to a preset encryption algorithm; and the installation unit is used for installing the original application when the original application is restored.
Further, the preset encryption algorithm specifically includes: acquiring an MD5 value of an original application; converting the MD5 value of the original application into a first byte array; encrypting the first byte array according to a preset algorithm to obtain a second byte array; calculating the length of the second byte array, and splicing the second byte array after the original application to obtain a first encryption application; converting the length of the second byte array into short type data and converting the short type data into a third byte array; and splicing the third byte number group after the first encryption application to obtain a second encryption application, wherein the second encryption application is obtained after encryption.
Further, the verification unit is specifically configured to take out the last two bytes of the second encryption application, and determine whether the last two bytes can be converted into short-type data; if the last two bytes cannot be converted into short type data, determining that the original application cannot be obtained through reduction; if the last two bytes can be converted into short type data, deleting the last two bytes of the second encryption application to obtain the first encryption application, determining the value B of the short type data, taking B bytes from the back of the first encryption application, and decrypting the B bytes according to the preset algorithm; and if the decryption is unsuccessful, determining that the original application cannot be restored, and if the decryption is successful, deleting the last 32 bits of the first encrypted application to obtain the original application.
Further, the preset algorithm is an RSA algorithm.
According to a fifth aspect of the present invention, an application server of the present invention comprises: the storage module is used for storing the application obtained by encrypting the original application according to a preset encryption algorithm; and the download response module is used for responding the download request of the application webpage end and issuing the target application to the application webpage end.
Further, the preset encryption algorithm specifically includes: acquiring an MD5 value of an original application; converting the MD5 value of the original application into a first byte array; encrypting the first byte array according to a preset algorithm to obtain a second byte array; calculating the length of the second byte array, and splicing the second byte array after the original application to obtain a first encryption application; converting the length of the second byte array into short type data and converting the short type data into a third byte array; and splicing the third byte number group after the first encryption application to obtain a second encryption application, wherein the second encryption application is obtained after encryption.
The application installation safety inspection method, the application installation safety inspection system and the application server decrypt the target application according to a preset decryption algorithm by calling the application installation safety inspection system, and determine whether the original application can be obtained by restoration; and only when the original application is determined to be restored, the original application is installed, so that the installation of the third-party application can be limited, the system can run more stably, and the method is safe and reliable.
Other characteristic features and advantages of the invention will become apparent from the following description of exemplary embodiments, which is to be read in connection with the accompanying drawings.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention. It should be noted that the embodiments and features of the embodiments in the present application may be arbitrarily combined with each other without conflict.
As shown in fig. 1, the present invention provides a method for security verification of application installation, comprising:
step 101: and initiating an application downloading request from the application webpage end, and responding to the downloading request by the application server end and downloading the target application from the application server end. It should be understood that the target application is an application obtained by encrypting the original application according to a preset encryption algorithm.
Step 102: after the target application is downloaded, calling an application installation safety inspection system to decrypt the target application according to a preset decryption algorithm, and determining whether the original application can be obtained through restoration. The original application is, for example, an unencrypted or encrypted previous original application.
Step 103: and when the original application is determined to be obtained through reduction, installing the original application.
The embodiment of the application installation safety inspection method comprises the steps of decrypting a target application according to a preset decryption algorithm by calling an application installation safety inspection system, and determining whether an unencrypted original application can be obtained through restoration; and only installing the original application when the original application is determined to be restored. Therefore, the embodiment of the invention can realize that the intelligent system limits the installation of the third-party application, so that the system can run more stably, and is safe and reliable.
As shown in fig. 2, the present invention provides an application installation security inspection method, which is a preferred implementation manner of the embodiment of the method shown in fig. 1, and the explanation of the embodiment shown in fig. 1 can be applied to this embodiment, and the application installation security inspection method of this embodiment includes:
step 201: the application A which can be installed in manual review specifically comprises the following steps: the method comprises the following steps that a test maintainer firstly installs and tests a third-party application on an intelligent vehicle machine, so that the third-party application is prevented from influencing the stability of an intelligent system of the vehicle machine, phenomena such as obvious display blockage, flash retreat and the like do not exist in the running process, and the application meeting the requirements of the intelligent vehicle machine system is screened out.
Step 202: and the application server side builds a management background, uploads the matched application and realizes encryption operation. The specific encryption operation is as follows:
firstly, obtaining the MD5 value of each original application, and converting the MD5 value of the original application into byte [ ] (namely a first byte array);
secondly, carrying out RSA2 encryption on the first byte array, acquiring a new byte [ ] (namely, a second byte array), calculating the byte length of the byte [ ] (namely, the second byte array), and splicing the byte [ ] (namely, the second byte array) after the original application to obtain a first encryption application;
and thirdly, converting the length into short type data, converting the short into byte [ ] (namely a third byte array) because the short type data is fixed 2 bytes, and splicing the third byte array after the first encryption application to obtain a final encryption application (namely a second encryption application).
Then, uploading the second encrypted application to an application server end through a management background, adding related application information by background maintenance personnel, and uploading the application; when the user clicks on the online application at the application store end, the application store is responsible for downloading the application. And after the downloading is finished, calling an installation instruction of an application installation safety verification system (such as an on-board controller of the intelligent vehicle) for installation. A series of verification operations are performed prior to installation. The method specifically comprises the following steps:
step 203: firstly, taking out the last two bytes of the downloaded application, converting the last two bytes into short type data, and if the conversion into short type data is successful, carrying out the next installation and verification, namely executingstep 204; if the conversion of the short type data is not successful, then an installation failure is prompted (step 209).
Step 204: removing the last two bytes of the downloaded application to obtain an application a, acquiring a value B of short type data, taking out B bytes from the back of the application a, and then decrypting by using RSA;
step 205, judging whether the decryption is successful, if the decryption is failed, prompting an installation error (step 209); if the decryption is successful, thenext operation 206 is performed.
Step 206: removing the fixed 32-bit length of MD5 from the back of application b to obtain an original application, and comparing the MD5 value of the original application with the MD5 value obtained by RSA decryption instep 204;
step 207: and (4) judging whether the MD5 value of the original application is consistent with the MD5 value obtained by RSA decryption in thestep 204, if so, executing thestep 208, and otherwise, prompting that the installation is failed (step 209).
Step 208: and (4) handing the original application to a system application program for installation, and ending the flow when the installation is successful.
It should be noted that, the installation of the application in the intelligent system needs to perform corresponding security verification on the application, and only trusted applications need to be installed, including but not limited to using the encryption and decryption method (such as RSA algorithm) described above.
In the embodiment, the MD5 value is combined with the RSA algorithm, so that cracking can be effectively prevented, the intelligent system can limit the installation of third-party application, and the system can run more stably. Meanwhile, the encrypted application is spliced by adding bytes, the original application is obtained by deleting partial bytes through a decryption algorithm, safety and reliability are achieved, all encryption processes are that the encrypted bytes are added at the tail of the original application, the corresponding tail bytes are intercepted in the decryption process, the original application cannot be modified, and the running stability of the original application is guaranteed. In addition, through the automatic operation of the application verification mechanism, a user only needs to click the application to download, does not need to pay attention to background verification operation, only installs the allowed application, and can improve the experience of the user in the process of using the system.
As shown in fig. 3, the present invention provides a system for performing security check on application installation, which is a preferred implementation of the application installation security check system in the method embodiments shown in fig. 1 and fig. 2, and the explanation of the embodiments shown in fig. 1 and fig. 2 can be applied to this embodiment, and the application installation security check system of this embodiment includes:
the verification unit 301 is configured to decrypt the target application according to a preset decryption algorithm after the target application is downloaded, and determine whether the original application can be restored; the target application is obtained by encrypting the original application according to a preset encryption algorithm;
an installation unit 302, configured to install the original application when the original application is restored.
In a specific operation, the preset encryption algorithm specifically comprises:
acquiring an MD5 value of an original application;
converting the MD5 value of the original application into a first byte array;
encrypting the first byte array according to a preset algorithm to obtain a second byte array;
calculating the length of the second byte array, and splicing the second byte array after the original application to obtain a first encryption application;
converting the length of the second byte array into short type data and converting the short type data into a third byte array;
and splicing the third byte number group after the first encryption application to obtain a second encryption application, wherein the second encryption application is obtained after encryption.
Preferably, the checking unit 301 is specifically configured to take out the last two bytes of the second encryption application, and determine whether the last two bytes can be converted into short-type data; if the last two bytes cannot be converted into short type data, determining that the original application cannot be obtained through reduction; if the last two bytes can be converted into short type data, deleting the last two bytes of the second encryption application to obtain the first encryption application, determining the value B of the short type data, taking B bytes from the back of the first encryption application, and decrypting the B bytes according to the preset algorithm; and if the decryption is unsuccessful, determining that the original application cannot be restored, and if the decryption is successful, deleting the last 32 bits of the first encrypted application to obtain the original application.
In specific operation, the preset algorithm is an RSA algorithm.
According to the method and the device, the original application is obtained by deleting part of bytes through a decryption algorithm, the method and the device are safe and reliable, all decryption is to intercept corresponding tail bytes, the original application is not modified, the intelligent system can limit the installation of the third-party application, and the system can run more stably. In addition, through the automatic operation of the application verification mechanism, a user only needs to click the application to download, does not need to pay attention to background verification operation, only installs the allowed application, and can improve the experience of the user in the process of using the system.
As shown in fig. 4, the present invention provides an application server, which is a preferred implementation manner of the application server in the method embodiments shown in fig. 1 and fig. 2, and the explanation of the embodiment shown in fig. 1 and fig. 2 can be applied to this embodiment, where the application server of this embodiment includes:
the storage module 401 is configured to store an application obtained by encrypting an original application according to a preset encryption algorithm;
and adownload response module 402, configured to respond to a download request of the application web page, and issue the target application to the application web page.
Preferably, the preset encryption algorithm specifically includes:
acquiring an MD5 value of an original application;
converting the MD5 value of the original application into a first byte array;
encrypting the first byte array according to a preset algorithm to obtain a second byte array;
calculating the length of the second byte array, and splicing the second byte array after the original application to obtain a first encryption application;
converting the length of the second byte array into short type data and converting the short type data into a third byte array;
and splicing the third byte number group after the first encryption application to obtain a second encryption application, wherein the second encryption application is obtained after encryption.
The embodiment can effectively prevent the encryption application from being cracked by combining the MD5 value with the RSA algorithm, is safe and reliable, adds the encryption bytes at the tail of the original application in all encryption processes, does not modify the original application, and ensures the running stability of the original application.
An embodiment of the present invention further provides an electronic device, including:
a memory for storing a computer program;
a processor for executing the computer program stored in the memory, and when the computer program is executed, implementing any of the methods described above.
Embodiments of the present invention also provide a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements any of the methods described above.
The above-described aspects may be implemented individually or in various combinations, and such variations are within the scope of the present invention.
Finally, it should be noted that: the above examples are only for illustrating the technical solutions of the present invention, and are not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.