Disclosure of Invention
The embodiment of the application provides a fake APP identification method and device, wherein after an APP is downloaded by a user on terminal equipment, when the APP is interacted with a service server, the service server carries out fake identification on the APP, so that the service server is prevented from providing service for the fake APP, and the safety of the service server is ensured.
In a first aspect, an embodiment of the present application provides a method for identifying a counterfeit APP, where the method may be applied to a server, or may be applied to a chip of the server. The method is described below by taking an example of application to a server, and includes: the server sends a first random number to the terminal equipment; the method comprises the steps that a server receives a certificate chain and signature data sent by terminal equipment, wherein a certificate in the certificate chain comprises a service certificate of an application program APP to be identified, the service certificate carries a package name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified, and the signature data is obtained by encrypting a first random number by the terminal equipment by using a private key corresponding to the service certificate; the server judges whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data; if the service certificate is the service certificate of the APP to be identified, the server judges whether the APP to be identified is a counterfeit APP or not according to the package name and the fingerprint of the first signature certificate. After the APP to be identified on the terminal equipment is started, before service interaction is carried out with the service server, the certificate chain and signature data are sent to the service server, the service server verifies that each certificate in the certificate chain is legal, after the service certificate is the own service certificate of the APP to be identified, whether signature certificate fingerprints corresponding to package names in the service certificate are identical with signature certificate fingerprints corresponding to the package names stored in advance is compared, so that whether the APP to be identified is a counterfeit APP is identified, service provided by the service server for the counterfeit APP is avoided, and service safety is improved. In addition, if the service server can only provide services for a certain number of users at the same time, the application can prevent illegal users from accessing the service server through the counterfeit APP and can ensure the services of legal users.
In a feasible design, the server determines whether the service certificate is a service certificate of the APP to be identified according to the certificate chain and the signature data, including: the server decrypts the signature data by using the public key of the service certificate to obtain a random number, which is called as a second random number hereinafter, and then compares whether the first random number is identical to the second random number or not, if the first random number is identical to the second random number, the server determines that the service certificate is the service certificate of the APP to be identified; if the first random number is different from the second random number, the server determines that the service certificate is not the service certificate of the APP to be identified. By adopting the method, the purpose that the server determines whether the service certificate is the service certificate of the APP is realized.
In a feasible design, the certificates in the certificate chain further comprise a root certificate of the terminal equipment and a device authentication authorization (CA) certificate, the trusted certificate level on the server is the root certificate, and the server judges whether the certificates in the certificate chain are legal or not, and the method comprises the following steps: judging whether the root certificate is legal or not, judging whether the equipment certificate is legal or not, and finally judging whether the service certificate is legal or not. In the verification process of the validity of the certificate chain, the server judges whether a root certificate in the certificate chain exists in a locally stored trusted root certificate set, if the root certificate in the certificate chain is contained in the trusted root certificate set, the server considers that the root certificate is trusted, otherwise, the server considers that the root certificate in the certificate chain is not trusted; then, the server decrypts the equipment CA certificate by using the public key of the root certificate to obtain a hash value, and performs hash operation on the content of the equipment CA certificate by using a hash algorithm carried by the equipment CA certificate to obtain another hash value, if the two hash values are the same, the server considers that the equipment CA certificate is legal, otherwise, the server considers that the equipment CA certificate is illegal; then, the server decrypts the service certificate by using the public key of the equipment CA certificate to obtain a hash value, and performs hash operation on the content of the service certificate by using a hash algorithm carried by the service certificate to obtain another hash value, and if the two hash values are the same, the server considers that the service certificate is legal; conversely, the server considers the service certificate as illegal. By adopting the scheme, the aim of verifying the validity of the certificate in the certificate chain is fulfilled when the trusted certificate level on the service server is the root certificate.
In a possible design, the certificate in the certificate chain further includes a device authorization CA certificate of the terminal device, the trusted certificate level on the server is the device CA certificate, and the server determines whether the certificate in the certificate chain is legal, including: the server determines whether a device CA certificate in a certificate chain exists in a pre-deployed trusted CA certificate set; if the equipment CA certificate in the certificate chain exists in the CA certificate set, the server decrypts the service certificate by using the public key of the equipment CA certificate to obtain a hash value, and carries out hash operation on the content of the service certificate by using a hash algorithm carried by the service certificate to obtain another hash value, and if the two hash values are the same, the server considers that the service certificate is legal; conversely, the server considers the service certificate as illegal. By adopting the scheme, the aim of verifying the validity of the certificate in the certificate chain is fulfilled when the trusted certificate level on the service server is the equipment CA certificate.
In a feasible design, if the service certificate is the service certificate of the APP to be identified, the server determines whether the APP to be identified is a counterfeit APP according to the package name and the first signature certificate fingerprint, including: if the service certificate is the service certificate of the APP to be identified, the server compares the first signature certificate fingerprint corresponding to the package name in the certificate chain with the second signature certificate fingerprint stored when the original APP corresponding to the package name is registered on the server; if the first signature certificate fingerprint and the second signature certificate fingerprint are different, the server determines that the APP to be identified is a counterfeit APP. By adopting the scheme, the purpose that the server performs counterfeit identification on the APP to be identified according to the package name and the signature certificate fingerprint is achieved.
In a second aspect, an embodiment of the present application provides a method for identifying a counterfeit application APP, where the method may be applied to a terminal device, or may be applied to a chip in the terminal device. The method is described below by taking an example of application to a terminal device, and includes: the terminal equipment sends a request message for establishing a link between an application program APP to be identified and the server to the server; the terminal receives an authentication message which is sent by a server and used for authenticating the APP to be identified, wherein the authentication message comprises a first random number; the terminal equipment sends a certificate chain and signature data to a server, wherein the signature data is obtained by encrypting a first random number through a private key corresponding to the APP to be identified; and the terminal receiving server verifies whether the APP to be identified is the result of the counterfeit APP according to the certificate chain and the signature data. After the APP to be identified on the terminal equipment is started, before service interaction is carried out with the service server, the certificate chain and signature data are sent to the service server, the service server verifies that each certificate in the certificate chain is legal, after the service certificate is the own service certificate of the APP to be identified, whether signature certificate fingerprints corresponding to package names in the service certificate are identical with signature certificate fingerprints corresponding to the package names stored in advance is compared, so that whether the APP to be identified is a counterfeit APP is identified, service provided by the service server for the counterfeit APP is avoided, and service safety is improved. In addition, if the service server can only provide services for a certain number of users at the same time, the application can prevent illegal users from accessing the service server through the counterfeit APP and can ensure the services of legal users.
In a feasible design, the certificate chain comprises a service certificate of the APP to be identified, wherein the service certificate carries a package name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified; the terminal receiving server verifies whether the APP to be identified is the result of the counterfeit APP according to the certificate chain and the signature data, and the terminal receiving server comprises: the terminal equipment receiving server matches the corresponding second visa certificate fingerprint with the first signature certificate fingerprint when registering the package name of the APP to obtain a counterfeit identification result; if the matching is successful, the counterfeit result indicates that the APP is not a counterfeit APP, or if the matching is failed, the counterfeit recognition result indicates that the APP is a counterfeit APP. By adopting the scheme, whether the APP to be identified is the counterfeit APP is identified, so that the service server is prevented from providing service for the counterfeit APP, and the service safety is improved. In addition, if the service server can only provide services for a certain number of users at the same time, the application can prevent illegal users from accessing the service server by the counterfeit APP and can ensure the services of legal users
In one possible design, before the terminal device sends the certificate chain and the signature data to the server, the method further includes: the terminal equipment utilizes the equipment CA certificate to issue a service certificate for the APP to be identified, and the content of the service certificate comprises the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified. By adopting the scheme, the purpose that the terminal equipment issues the service certificate for the APP to be identified by using the equipment CA certificate is realized.
In one possible design, the service certificate is generated and managed for a certificate management service of the terminal device, where the certificate management service is located in a Framework layer of a system of the terminal device. By adopting the scheme, the purpose of setting certificate management service on the terminal equipment is realized.
In a possible design, the service certificate further comprises a public key of the APP to be identified, the public key corresponding to a private key that encrypts the first random number. By adopting the scheme, the aim of checking whether the service certificate is the service certificate of the APP to be identified is fulfilled.
In a possible design, an operating system of a terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the terminal device issues a service certificate for an APP to be identified by using a device CA certificate, including: the terminal equipment sends a service certificate application request message to a trusted application TA running on the TEE operating system through a client application CA running on the REE operating system; the terminal equipment controls the TA to issue a service certificate for the APP to be identified by using the equipment CA certificate. By adopting the scheme, the purpose that the terminal equipment controls the TA to issue the service certificate for the APP to be identified by using the equipment CA certificate is achieved.
In a third aspect, an embodiment of the present application provides a server, including:
a transmitter for transmitting the first random number to the terminal device;
The terminal equipment comprises a receiver and a terminal equipment, wherein the receiver is used for receiving a certificate chain and signature data sent by the terminal equipment, a certificate in the certificate chain comprises a service certificate of an application program APP to be identified, the service certificate carries a packet name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified, and the signature data is obtained by encrypting the first random number by the terminal equipment by utilizing a private key corresponding to the service certificate;
The processor is used for judging whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data; if the service certificate is the service certificate of the APP to be identified, judging whether the APP to be identified is a counterfeit APP or not according to the package name and the first signature certificate fingerprint.
In a feasible implementation manner, the processor is configured to determine whether a certificate in the certificate chain is legal, and if the certificate in the certificate chain is legal, decrypt the signature data according to a public key carried by a service certificate in the certificate chain to obtain a second random number; judging whether the first random number is the same as the second random number, if so, determining that the service certificate is the service certificate of the APP to be identified; and if the first random number is different from the second random number, determining that the service certificate is not the service certificate of the APP to be identified.
In a feasible implementation manner, the certificate in the certificate chain further includes a root certificate of the terminal device and a device authentication authorization CA certificate, the processor is configured to determine whether the root certificate in the certificate chain exists in a pre-deployed trusted root certificate set, if the root certificate in the certificate chain exists in the root certificate set, decrypt the device CA certificate included in the certificate chain by using a public key carried by the root certificate to obtain a first hash value, perform hash operation on the device CA certificate according to a hash algorithm carried by the device CA certificate to obtain a second hash value, determine that the device CA certificate is a legal certificate if the first hash value is the same as the second hash value, decrypt the service certificate according to a public key carried by the device CA certificate to obtain a third hash value, and perform an operation on the service certificate according to a hash algorithm carried by the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determine that the service certificate is the legal certificate.
In a possible implementation manner, the certificate in the certificate chain further includes a device authorization CA certificate of the terminal device, the processor is configured to determine whether a device CA certificate in the certificate chain exists in a pre-deployed trusted CA certificate set, if the device CA certificate in the certificate chain exists in the CA certificate set, decrypt a service certificate by using a public key carried by the trusted device CA certificate to obtain a third hash value, perform hash operation on the service certificate according to a hash algorithm carried by the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determine that the service certificate is a legal certificate.
In a possible implementation manner, the processor is configured to determine, if the service certificate is a service certificate of the APP to be identified, whether the APP to be identified is a counterfeit APP according to the package name and the first signature certificate fingerprint, including: if the service certificate is the service certificate of the APP to be identified, determining a second signature certificate fingerprint according to the package name, storing the corresponding relation between the package name and the second signature certificate fingerprint, judging whether the first signature certificate fingerprint and the second signature certificate fingerprint are identical, and if the first signature certificate fingerprint and the second signature certificate fingerprint are not identical, determining that the APP to be identified is a counterfeit APP.
In a possible implementation, the server is a service server or an authentication authorization server.
In a fourth aspect, an embodiment of the present application provides a terminal device, including:
The system comprises a transmitter, a server and a server, wherein the transmitter is used for transmitting a request message for establishing a link between an application program APP to be identified and the server;
the receiver is used for receiving a verification message which is sent by the server and used for verifying the APP to be identified, wherein the verification message comprises a first random number;
The sender is further configured to send a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number through a private key corresponding to the first APP;
the receiver is further configured to receive a result of verifying whether the APP to be identified is a counterfeit APP by the server according to the certificate chain and the signature data.
In a feasible implementation manner, the certificate chain comprises a service certificate of the APP to be identified, the service certificate carries a package name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified, and the receiver is used for receiving a counterfeit identification result obtained by matching a second visa certificate fingerprint corresponding to the package name of the APP with the first signature certificate fingerprint by the server; if the matching is successful, the counterfeit result indicates that the APP is not a counterfeit APP, or if the matching is failed, the counterfeit recognition result indicates that the APP is a counterfeit APP.
In a possible implementation manner, the terminal device further includes: and the processor is used for utilizing a device CA certificate to issue the service certificate for the APP to be identified before the sender sends the certificate chain and the signature data to the server, wherein the content of the service certificate comprises the package name of the APP to be identified and the first signature certificate fingerprint of the APP to be identified.
In a possible implementation manner, the service certificate is generated and managed for a certificate management service of the terminal device, where the certificate management service is located in a Framework layer of a system of the terminal device.
In a possible implementation manner, the service certificate further includes a public key of the APP to be identified, where the public key corresponds to a private key that encrypts the first random number.
In a possible implementation manner, the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the terminal device further includes: a processor;
the sender is configured to send a service certificate application request message to a trusted application TA running on the TEE operating system through a client application CA running on the TEE operating system;
The processor is configured to control the TA to issue the service certificate for the APP to be identified by using the equipment CA certificate.
In a fifth aspect, embodiments of the present application provide a computer program product comprising instructions which, when run on a processor, cause the processor computer to perform the method of the first aspect or various possible implementations of the first aspect.
In a sixth aspect, embodiments of the application provide a computer program product comprising instructions which, when run on a processor, cause the processor to perform the method of the second aspect or various possible implementations of the second aspect described above.
In a seventh aspect, embodiments of the present application provide a computer readable storage medium having instructions stored therein, which when run on a processor, cause the processor to perform the method of the first aspect or various possible implementations of the first aspect.
In an eighth aspect, embodiments of the present application provide a computer readable storage medium having instructions stored therein which, when run on a processor, cause the processor to perform the method of the second aspect or various possible implementations of the second aspect described above.
In a ninth aspect, an embodiment of the present application provides a chip, where the chip system includes a processor and may further include a memory, to implement the method in the first aspect or the various possible implementations of the first aspect.
In a tenth aspect, embodiments of the present application provide a chip, where the chip system includes a processor and may further include a memory, for implementing the method in the second aspect or the various possible implementations of the second aspect.
In an eleventh aspect, an embodiment of the present application further provides a counterfeit APP identifying system, including a server implemented in any one of the third aspect or any one of the possible manners of the third aspect, and a terminal device implemented in any one of the fourth aspect or any one of the possible manners of the fourth aspect.
According to the fake APP identification method, the server and the terminal equipment provided by the embodiment of the application, after the APP to be identified on the terminal equipment is started, before service interaction is carried out with the service server, the certificate chain and signature data are sent to the service server, the service server verifies that each certificate in the certificate chain is legal, after the service certificate is the own service certificate of the APP to be identified, whether the signature certificate fingerprint corresponding to the package name in the service certificate is identical with the prestored signature certificate fingerprint corresponding to the package name is compared, so that whether the APP to be identified is the fake APP is identified, service provided by the service server for the fake APP is avoided, and service safety is improved. In addition, if the service server can only provide services for a certain number of users at the same time, the application can prevent illegal users from accessing the service server through the counterfeit APP and can ensure the services of legal users.
Detailed Description
In the current process of identifying the counterfeit APP, the APP is identified by extracting the feature vector of the APK file of the APP or adding monitoring features and the like into the APK file, and the identification method is suitable for detecting the counterfeit APP in an application market. However, some service servers only serve specific APPs. Taking APP as APP, for example, bloom as share, one function of bloom as share is to share photos, and when traveling out, a user shares photos to friends through bloom as share. When sharing photos, the terminal equipment of the user needs to be connected with a service server for sharing photos to relatives and friends through the service server, wherein the service server is used for providing services for the share. In the sharing process, the service server cannot judge whether the share on the terminal equipment is counterfeit, so that the counterfeit APP illegally uses the service server, namely the service server is easy to attack by the counterfeit APP.
In view of this, an embodiment of the present application provides a method for identifying a counterfeit APP, where after a user downloads an APP (hereinafter referred to as an APP to be identified) on a terminal device, when the user interacts with a service server using the APP, the service server performs counterfeit identification on the APP, so as to avoid the service server from providing services for the counterfeit APP, and improve security.
In the embodiment of the application, the terminal device is a device capable of providing voice and/or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. The terminal devices may communicate with one or more core networks via a radio access network (radio access network, RAN), and may be mobile terminal devices such as mobile phones (or "cellular" phones) and computers with mobile terminal devices, e.g., portable, pocket, hand-held, computer-built-in or vehicle-mounted mobile devices that exchange voice and/or data with the radio access network. For example, personal communication services (personal communication service, PCS) phones, cordless phones, session initiation protocol (session initiation protocol, SIP) phones, wireless local loop (wireless local loop, WLL) stations, personal digital assistants (personal DIGITAL ASSISTANT, PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminals in future 5G networks or terminal devices in future evolved public land mobile networks (public land mobile network, PLMNs), etc., as embodiments of the application are not limited in this respect. The terminal device may also be referred to as a system, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile), remote station (remote station), access point (access point), remote terminal device (remote terminal), access terminal device (ACCESS TERMINAL), user terminal device (user terminal), user agent (user agent), user device (user device), or user equipment (user equipment).
The server refers to a service server or an authentication and authorization server, the service server refers to an APP for providing services for a certain or some genuine APP, and the authentication and authorization server is a server deploying a trusted certificate list. When only a service server is deployed in the network architecture, a trusted certificate list is deployed on the service server, an original APP is registered on the service server, and the service server is responsible for certificate chain validity checking, judging whether the service certificate is the service certificate of the APP and imitation APP identification. When a service server and an authentication authorization server are deployed in a network architecture at the same time, a genuine APP can be registered on the service server, a trusted certificate list is deployed on the service server, a latest trusted certificate list is obtained on the authentication authorization server periodically, and the service server is responsible for certificate chain validity verification, judgment of whether the service certificate is the service certificate of the APP and counterfeit APP identification; or the legal APP can be registered on the service server, but a trusted certificate list is not deployed on the service server, the authentication authorization server is responsible for verifying the validity of the certificate chain and judging whether the service certificate is the service certificate of the APP, and the service server is responsible for counterfeit identification; or registering the original APP on the authentication and authorization server, wherein the authentication and authorization server is responsible for checking the validity of the certificate chain, judging whether the service certificate is the service certificate of the APP or not and recognizing the counterfeit APP, and the service server only plays a role in transparent transmission and forwarding. For example, please refer to fig. 1A and 1B.
Fig. 1A is a schematic diagram of a network architecture to which a counterfeit APP identification method according to an embodiment of the present application is applicable. Referring to fig. 1A, the scenario includes a terminal device and a service server, where a network connection is established between the terminal device and the service server, the service server is a server for one or more genuine APPs, when a genuine APP is issued, a developer needs to register the genuine APP on the service server, and a correspondence between a signature certificate fingerprint and a package name of the genuine APP is stored; at the same time, a set of trusted certificates, such as a set of root certificates that are trusted or a set of trusted device authentication authority (CERTIFICATE AUTHORITY, CA) certificates, required for verifying the validity of the certificate chain is stored on the service server. If the terminal equipment downloads and installs the original APP, the terminal equipment can use the functions provided by the service server by using the APP. For the user, it does not know whether the APP downloaded and installed on the terminal device is a counterfeit APP, so in this embodiment, the terminal device downloads and installs the APP, starts the APP, hereinafter referred to as APP to be identified, and the service server performs counterfeit identification on the APP to be identified according to the certificate chain, the service certificate of the APP to be identified, and the like, where the service certificate of the APP to be identified carries the package name and the signature certificate fingerprint of the APP to be identified. For example, the APP to be identified is share, and the user does not know that the share is the genuine share or the counterfeit share, so after the user starts the share, the service server identifies the APP to be identified, if the user identifies that the APP to be identified is the genuine share, the APP to be identified uses functions provided by the service server, such as remotely sharing data such as photos and files to other users, and if the service server identifies that the APP to be identified is the counterfeit APP, the APP to be identified is refused to use functions provided by the service server.
Typically, in the scenario shown in fig. 1A, the terminal device, the service server and the master APP are from the same vendor. However, embodiments of the present application are not limited, e.g., the terminal device and the service server are from the same vendor, and the master APP is developed by a third party, and the service server provides an interface for access by the master APP developed by the third party.
Fig. 1B is a schematic diagram of a network architecture to which another method for identifying a counterfeit APP according to an embodiment of the present application is applicable. Referring to fig. 1B, the scenario includes a terminal device, a service server, and an authentication authorization server, where a network connection is established between the terminal device and the service server, and a network connection is established between the service server and the authentication authorization server. The service server is a server aiming at one or more legal APP, and when the legal APP is issued, a developer stores the corresponding relationship between the signature certificate fingerprint and the package name of the legal APP on the authentication and authorization server. In addition, a set of trusted certificates, such as a set of root certificates that are trusted or a set of trusted device authentication authority (CERTIFICATE AUTHORITY, CA) certificates, required for verifying the validity of the certificate chain is stored on the authentication authorization server. When the terminal equipment downloads and installs the APP to be identified, the APP to be identified is started, and certificate chains and the like are sent to the service server, the service server sends the received certificate chains and the like to the authentication and authorization server, and the authentication and authorization server performs counterfeit identification on the APP. Or the authentication authorization server can only store a trusted certificate set, a research and development personnel store signature certificate fingerprints, package names and corresponding relations between the signature certificate fingerprints and the package names of the original APP on the service server, after the service server receives the certificate chain and the signature data, the service server sends the certificate chain and the signature data to the authentication authorization server, the authentication authorization server checks whether the legal certificate of the certificate chain and the service certificate in the certificate chain are the APP certificate, and only if the certificates in the certificate chain are legal and the service certificate is the APP service certificate, the service server performs counterfeit identification on the APP according to the package names and the first signature certificate fingerprints in the service certificate.
In the embodiment of the application, the counterfeit APP is not limited to the APP implanted with the malicious code or the advertisement information and the illegal APP developed by the lawbreaker. The counterfeit APP in the embodiment of the application is relative, for example, the service server only provides service for the APP1, the legal APP downloaded and installed by the terminal equipment comprises the APP1, the APP2 and the APP3, and the APP2 and the APP3 are the counterfeit APP for the service server as the APP2 and the APP3 are not the APP corresponding to the service server.
In the scenario shown in fig. 1B, the terminal device, the service server and the master APP may be from the same vendor or different vendors.
In the embodiment of the application, the terminal equipment injects a trusted root, such as a root certificate and/or a device CA certificate, when generating, wherein the device CA certificate is issued by the root certificate. After the terminal equipment leaves the factory, the terminal equipment can utilize the equipment CA certificate to issue a service certificate for the APP to be identified. The certificates in the embodiments of the present application, such as a root certificate, a device CA certificate, a service certificate, etc., each have a key pair, where the key pair includes a public key and a private key, the public key is carried in the certificate, and the private key is stored in a secure storage partition of the terminal device.
The following describes the method for identifying the counterfeit APP according to the embodiment of the present application in detail, taking the architecture shown in fig. 1A as an example. Exemplary, referring to fig. 2, fig. 2 is a flowchart of a method for identifying a counterfeit APP according to an embodiment of the present application, where the method for identifying a counterfeit APP according to the present application is described from the perspective of interaction between a service server and a terminal device. The embodiment comprises the following steps:
101. And the terminal sends a request message for establishing a link between the application program APP to be identified and the server to the server.
The terminal device downloads and installs the APP, starts the APP, hereinafter referred to as APP to be identified, and sends a link establishment request to the service server for the APP.
102. The server sends a first random number to the terminal device.
Illustratively, in FIG. 1A, a business server is a server for a particular master APP that a user expects to only serve that master APP, and not to be served by other APPs. When the original APP is released, a research and development personnel registers the original APP on the service server and stores the corresponding relation between the signature certificate fingerprint and the package name of the original APP; at the same time, a set of trusted certificates, such as a set of root certificates that are trusted or a set of trusted device authentication authority (CERTIFICATE AUTHORITY, CA) certificates, required for verifying the validity of the certificate chain is stored on the service server. After receiving the request message, the service server initiates an identity challenge to the terminal equipment and issues a first random number, which may also be called challenge (challenge); correspondingly, the terminal device receives the first random number.
If the authentication and authorization server is deployed, in step 101 and step 102, the terminal device sends a link establishment request to the service server, and the service server sends the link establishment request to the authentication and authorization server, and triggers the authentication and authorization server to send the first random number.
103. And the terminal equipment encrypts the first random number by utilizing a private key corresponding to the service certificate of the APP to be identified to obtain signature data.
In this step, the terminal device encrypts the first random number by using a private key corresponding to the service certificate of the APP to be identified, for example, the terminal device encrypts the first random number by using a secure hash algorithm 256 (secure hash algorithm, sha 256), a secure hash algorithm 384 (secure hash algorithm 384, sha 384), or a secure hash algorithm 512 (secure hash algorithm, sha 512) to obtain signature data.
104. The terminal device sends the signature data and the certificate chain to a server.
The method comprises the steps that a certificate chain carries a service certificate of an APP to be identified, and the service certificate carries a packet name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified.
In the step, a terminal device sends signature data and a certificate chain to a server; accordingly, the server receives the signature data and the certificate chain.
105. And the server judges whether the service certificate is the service certificate of the APP to be identified according to the certificate chain and the signature data.
Taking the server as the service server in fig. 1A as an example, this step includes two stages: the first stage, the business server checks the certificates in the certificate chain according to the prestored trusted certificates, and judges whether each certificate in the certificate chain is legal or not; if the service server determines that each certificate in the certificate chain is legal, entering a second stage: the service server decrypts the signature data by using the public key carried by the service certificate in the certificate chain to judge whether the service certificate is the service certificate of the APP to be identified, and if the service certificate is the service certificate of the APP to be identified, step 106 is executed; if the service certificate is not the service certificate of the APP to be identified, step 108 is performed.
Illustratively, in a first phase, taking the trusted certificate level as a root certificate, the certificate chain includes a root certificate, a device CA certificate, and a service certificate. Because the certificate is issued in a first stage, for example, the device CA certificate of the terminal device is issued by using the root certificate of the terminal device, and the service certificate of the APP to be identified is issued by using the device CA certificate, when the service server judges whether each certificate in the certificate chain is legal, the service server judges whether the root certificate is legal first, then judges whether the device certificate is legal, and finally judges whether the service certificate is legal. In the verification process of the validity of the certificate chain, the service server judges whether a root certificate in the certificate chain exists in a locally stored trusted root certificate set, if the root certificate in the certificate chain is contained in the trusted root certificate set, the service server considers that the root certificate is trusted, otherwise, the service server considers that the root certificate in the certificate chain is not trusted; then, the service server decrypts the equipment CA certificate by using the public key of the root certificate to obtain a hash value, and performs hash operation on the content of the equipment CA certificate by using a hash algorithm carried by the equipment CA certificate to obtain another hash value, if the two hash values are the same, the service server considers that the equipment CA certificate is legal, otherwise, the service server considers that the equipment CA certificate is illegal; then, the service server decrypts the service certificate by using the public key of the equipment CA certificate to obtain a hash value, and performs hash operation on the content of the service certificate by using a hash algorithm carried by the service certificate to obtain another hash value, and if the two hash values are the same, the service server considers that the service certificate is legal; conversely, the service server considers the service certificate as illegal.
In the second stage, when judging whether the service certificate is the service certificate of the APP to be identified, the service server decrypts the signature data by utilizing the public key of the service certificate to obtain a random number, which is called a second random number hereinafter, and then compares whether the first random number is identical to the second random number or not, and if the first random number is identical to the second random number, the service server determines that the service certificate is the service certificate of the APP to be identified; if the first random number is different from the second random number, the service server determines that the service certificate is not the service certificate of the APP to be identified.
106. And the service server judges whether the APP to be identified is a counterfeit APP to be identified according to the package name and the first signature certificate fingerprint.
From the above step 102, it can be seen that: before issuing, a master APP needs to register with a service server, so that the corresponding relation between the package name of the master APP and the signature certificate fingerprint is stored on the service server. Therefore, in this step, the service server compares the first signature certificate fingerprint corresponding to the packet name in the certificate chain with the second signature certificate fingerprint stored when the original APP corresponding to the packet name is registered on the server, so as to determine whether the APP to be identified is a counterfeit APP, and if the APP to be identified is not a counterfeit APP, execute step 107; if the APP to be identified is a counterfeit APP, then step 108 is performed.
107. The service server sends an identification result to the terminal equipment, wherein the identification result is used for indicating that the APP to be identified is a legal APP and carrying out service interaction with the terminal equipment.
108. And the service server identifies the result to the terminal equipment, and the identification result is used for indicating that the APP to be identified is a counterfeit APP and refusing to carry out service interaction with the terminal equipment aiming at the APP.
It should be noted that, in the embodiment of the present application, the counterfeit APP is relative to the service server, and the counterfeit APP includes a conventional counterfeit APP and some genuine APPs. For example, there are three APPs: APP1, APP2 and APP3, wherein APP1 and APP2 belong to a counterfeit APP in a conventional sense, and the counterfeit APP in the conventional sense refers to all the APPs except the counterfeit APP, and the counterfeit APP and the APP of the counterfeit APP which can be detected by a server of a third party application store and can not be detected by a server of a third party application commodity are actually the APP of the counterfeit APP; APP3 is a genuine APP, but it is not registered on the service server, and thus APP3 is also a counterfeit APP for the service server.
According to the fake APP identification method provided by the embodiment of the application, after the APP to be identified on the terminal equipment is started, before service interaction is carried out with the service server, the certificate chain and signature data are sent to the service server, the service server verifies that each certificate in the certificate chain is legal, after the service certificate is the own service certificate of the APP to be identified, whether the signature certificate fingerprint corresponding to the package name in the service certificate is identical with the prestored signature certificate fingerprint corresponding to the package name is compared, so that whether the APP to be identified is the fake APP is identified, service provided by the service server for the fake APP is avoided, and service safety is improved. In addition, if the service server can only provide services for a certain number of users at the same time, the application can prevent illegal users from accessing the service server through the counterfeit APP and can ensure the services of legal users.
In the embodiment of the application, the terminal equipment can be any terminal equipment of an operating system, such as terminal equipment of an apple operating system, terminal equipment of an android operating system and the like, and after the APP to be identified is installed on the terminal equipment of any operating system, the terminal equipment utilizes the equipment CA certificate stored on the terminal equipment to issue a service certificate for the APP to be identified. The above-mentioned counterfeit APP identification method is described in detail below by taking terminal equipment as terminal equipment of an android operating system as an example.
Fig. 3 is a schematic diagram of an architecture to which a counterfeit APP identification method according to an embodiment of the present application is applicable. Referring to fig. 3, in this embodiment, the terminal device is called an end side, the service server and the authentication authorization server are deployed on the cloud side, an operating system of the terminal device includes a trusted execution environment and a (trusted execution environment, TEE) rich execution environment (rich execution environment, re), the TEE is responsible for processing transactions requiring higher security protection, such as key storage, encryption and decryption, fingerprint identification, etc., the re is a common operating system, such as an Android system, an iOS apple system, etc., a client application (client application, CA) providing a certificate service for an APP is present in the re, and a trusted application (trusted application, TA) corresponding to the CA is present in the TEE. Wherein the APP includes, but is not limited to, the APP to be identified. In the embodiment of the application, the REE and the TEE respectively comprise an application layer, a framework layer, a kernel layer and a hardware layer from top to bottom. The REEs of the terminal devices are capable of providing certificate management services, which are located in the framework (Android framework) layer of the REEs, for providing key and certificate management related functions for the APP to be identified. In order to meet the service requirement of the TEE-based hardware protection key, the key trusted authentication (key attestation) is realized, and the certificate management service can realize at least three functions: 1) Before the terminal equipment leaves the factory, the certificate management service is utilized to inject the production line certificate, namely the root certificate and the equipment CA certificate into the terminal equipment; 2) Supporting to generate a service certificate, namely, the terminal equipment utilizes the equipment CA certificate to issue the service certificate for the APP to be identified; 3) And supporting the trusted authentication based on the service key, namely when the service server initiates identity challenge, the terminal equipment encrypts the first random number sent by the service server by using a private key corresponding to the service certificate by using a certificate management service to obtain signature data.
For the function 1), in the process of manufacturing the terminal device by a manufacturer, the root certificate and the device CA certificate are preset and stored in a safe storage partition of the terminal device, such as a loop protection partition (replay protect memory block) and an RPMB), the data in the RPMB cannot be modified, and even if a user restores the factory setting to the terminal device, the data in PRMB cannot be deleted.
Aiming at the function 2), after the APP to be identified is downloaded and installed on the terminal equipment, when a user clicks to start the APP to be identified, the APP to be identified applies for a service certificate to a CA, the CA obtains the package name of the APP to be identified and the fingerprint of the first signature certificate of the APP to be identified through an Android system, and then sends a certificate application request to a TA to apply for the service certificate for the APP to be identified. After receiving the application request, the TA issues a service certificate for the APP to be identified by using the equipment CA certificate, and records the package name of the APP to be identified and the fingerprint of the first signature certificate into the service certificate. The service certificate is maintained in a secure storage partition of the terminal device after being generated, such as a Secure FILE SYSTEM (SFS), and data in the SFS may be deleted when the APP to be identified is uninstalled or the terminal device is restored to a factory value.
Aiming at the function 3), after the APP to be identified is started, the terminal equipment initiates an establishment request to the service server aiming at the APP to be identified, and the service server initiates an identity authentication challenge, so that the service server performs counterfeit identification on the APP to be identified. For example, referring to fig. 4, fig. 4 is a flowchart of another method for identifying a counterfeit APP according to an embodiment of the present application. Referring to fig. 4, in this embodiment, an APP to be identified and a certificate management service are both loaded on a terminal device, a trusted root certificate set is deployed on a service server, and the service server periodically obtains a certificate revocation list from an authentication authorization server to update a locally deployed trusted certificate, where the embodiment includes:
201. the service server obtains a root certificate of the terminal equipment.
In this step, the service server obtains the root certificate of the terminal device offline, or the service server interacts with the authentication authorization server to obtain the root certificate of the terminal device.
202. The service server sends a certificate revocation list request to the authentication authorization server.
203. The authentication authorization server sends a response message to the service server, the response message carrying a certificate revocation list.
In steps 202 and 203 described above, the service server periodically sends a certificate revocation list request to the authentication authorization server to request an up-to-date certificate revocation list (CERTIFICATE REVOCATION LIST, CRL) to update the locally deployed trusted certificate.
204. And the terminal equipment sends a link establishment request to the service server aiming at the APP to be identified.
In the step, when the APP to be identified is started, a terminal device initiates a link establishment request to a service server aiming at the APP to be identified.
205. The service server initiates identity authentication to the terminal equipment, wherein the identity authentication carries a first random number.
In the step, a service server sends identity authentication to terminal equipment aiming at APP to be identified.
206. And the terminal equipment sends a certificate application request to the TA through the CA so as to apply for a service certificate for the APP to be identified.
207. And the terminal equipment utilizes the equipment CA certificate to issue a service certificate for the APP to be identified.
In the embodiment of the application, the device CA certificate is issued by using the root certificate, and the service certificate is issued by the device CA certificate. For example, referring to fig. 5, fig. 5 is a flowchart of issuing a certificate used in the method for identifying a counterfeit APP according to an embodiment of the present application.
Referring to fig. 5, in this embodiment, the root certificate and the device CA certificate are also referred to as a preset certificate of the terminal device production line, and the two certificates are injected into the terminal device before the terminal device leaves the factory, and cannot be deleted because the terminal device restores the factory value or uninstalls the APP to be identified. After the terminal equipment leaves the factory, a user loads the APP to be identified on the terminal equipment, and when the APP to be identified is started, the terminal equipment utilizes the equipment CA certificate to issue a service certificate for the APP to be identified. The following table lists details of the service credentials.
It should be noted that the above table is merely an example, and the content of the service certificate in the embodiment of the present application is not limited thereto.
208. And the terminal equipment encrypts the first random number by using a private key corresponding to the service certificate to obtain signature data.
209. The terminal device sends the signature data and the certificate chain to the CA through the TA.
210. The terminal device sends the signature data and the certificate chain to the service server.
The certificate chain comprises a root certificate, a device CA certificate and a service certificate.
211. The service server determines whether the certificates in the certificate chain are legal, if each certificate in the certificate chain is legal, step 212 is executed, and if a certain stage of certificate in the certificate chain is not legal, step 215 is executed.
Because the certificate is issued in a first-level and first-level manner, in the certificate chain checking process, the service server sequentially judges whether the root certificate, the equipment CA certificate and the service certificate are legal or not.
Firstly, a service server determines whether a root certificate in a certificate chain exists in a pre-deployed trusted root certificate set, and if the root certificate in the certificate chain exists in the pre-deployed trusted root certificate set, the root certificate in the certificate chain is a trusted root certificate of the service server and is a legal certificate. If the root certificate in the certificate chain does not exist in the pre-deployed trusted root certificate set, the root certificate in the certificate chain is not the trusted root certificate of the service server and is an illegal certificate.
Secondly, if the root certificate in the certificate chain exists in the root certificate set, the service server decrypts the equipment CA certificate contained in the certificate chain by utilizing the public key of the root certificate to obtain a first hash value, and carries out hash operation on the equipment CA certificate according to a hash algorithm carried by the equipment CA certificate to obtain a second hash value. The service server judges whether the first hash value and the second hash value are the same, if the first hash value and the second hash value are the same, the equipment CA certificate is a legal equipment CA certificate, and if the first hash value and the second hash value are different, the equipment CA certificate is an illegal equipment CA certificate.
And finally, if the equipment CA certificate is a legal equipment CA certificate, the service server decrypts the service certificate according to the public key carried by the equipment CA certificate to obtain a third hash value, and carries out hash operation on the service certificate according to the hash algorithm carried by the service certificate to obtain a fourth hash value. The service server judges whether the third hash value and the fourth hash value are the same, if the third hash value and the fourth hash value are the same, the service certificate is legal, and if the third hash value and the fourth hash value are different, the service certificate is illegal.
The above-mentioned hash operation on the certificate refers to hash operation on one or more pieces of attribute information in the certificate.
212. The service server judges whether the service certificate is the service certificate of the APP to be identified, and if so, step 213 is executed; if the service certificate is not the service certificate of the APP to be identified, step 215 is performed.
If the certificate is legal, in this step, the service server decrypts the signature data according to the public key carried by the service certificate in the certificate chain to obtain a second random number, then the service server judges whether the second random number is identical to the first random number sent in step 205, if the first random number is identical to the second random number, the service server determines that the service certificate is the service certificate of the APP itself to be identified; if the first random number is different from the second random number, the service server determines that the service certificate is not the service certificate of the APP to be identified.
213. The service server judges whether the APP to be identified is a counterfeit APP or not according to the package name and the first signature certificate fingerprint, and if the APP to be identified is not the counterfeit APP, step 214 is executed; if the APP to be identified is a counterfeit APP, then step 215 is performed.
In the embodiment of the application, each APP has a package name and a signature certificate fingerprint. Taking android APP as an example, after developing APP, after packing and generating an Android Package (APK), a developer signs an APK file, and the validity of the APK file and the uniqueness of the APP are ensured through the signature mechanism, so that later APP upgrading and the like are facilitated. When the APP is issued, research and development personnel register in the service server, and the corresponding relation between the package name and the signature certificate fingerprint is stored in the service server.
If in step 209, the service server determines that the service certificate is a service certificate issued by the terminal device for the APP to be identified, in this step, the service server determines a second signature certificate fingerprint according to the packet name of the APP to be identified, and determines whether the first signature certificate fingerprint and the second signature certificate fingerprint are the same; if the first signature certificate fingerprint is different from the second signature certificate fingerprint, the service server determines that the APP to be identified is a counterfeit APP; and if the first signature certificate fingerprint is the same as the second signature certificate fingerprint, the service server determines that the APP to be identified is the legal APP.
214. The service server sends an identification result to the terminal equipment, wherein the identification result is used for indicating that the APP to be identified is a legal APP and carrying out service interaction with the terminal equipment aiming at the APP to be identified.
215. The service server sends an identification result to the terminal equipment, wherein the identification result is used for indicating that the APP to be identified is a counterfeit APP and refusing to carry out service interaction with the terminal equipment aiming at the APP to be identified.
In the embodiment of fig. 4, the above-mentioned counterfeit APP identification method is described in detail by taking the example that the trusted root certificate set is deployed on the service server, the certificates in the certificate chain include the root certificate, the device CA certificate and the service certificate, however, the embodiment of the present application is not limited, and in other possible implementations, the device CA certificate may be deployed on the service server, where the certificates in the certificate chain only include the device CA certificate and the service certificate.
In the following, the above-mentioned counterfeit APP identification method is described in detail by taking a service server as an example of providing a data forwarding service for a user and sharing data by a genuine APP corresponding to the service server to other users through the service server. For example, see fig. 6.
Fig. 6 is a schematic diagram of a counterfeit detection passing scene in a counterfeit APP identification method provided by an embodiment of the present application. The embodiment comprises the following steps:
301. registering the legal APP on the service server.
In this step, when the original APP is released, a developer registers the original APP on a service server, and the service server stores a package name of the original APP, a signature certificate fingerprint, and a correspondence between the package name and the signature certificate fingerprint. For example, the package name of the original APP is com.xxx.app1, and the signature certificate fingerprint is 111111. Wherein the package name is located in a file of the installation package, such as an android management file; the signature certificate fingerprint is stored in the signature certificate of the installation package. While most APPs are installed on the terminal device, the installation package is deleted, the terminal device may obtain the package name and signature certificate from the REE operating system before the APP is uninstalled.
302. And installing the APP to be identified on the terminal equipment.
The package name of the APP to be identified is the same as that of the original APP, but the terminal device does not know whether the APP to be identified is the original APP or the counterfeit APP. When the APP to be identified is a legal APP, the terminal equipment determines that the signature certificate fingerprint of the APP to be identified is 111111; when the APP to be identified is a counterfeit APP, the developer cannot acquire the signature certificate fingerprint of the original APP, and therefore, the signature certificate fingerprint of the APP to be identified is different from the signature certificate fingerprint of the original APP, for example, 222222.
303. And the terminal equipment utilizes the equipment CA certificate to issue a service certificate for the APP to be identified.
The service certificate comprises a package name of the APP to be identified and a first signature certificate fingerprint.
304. The terminal equipment sends a link establishment request to the service server aiming at the APP to be identified.
305. The service server sends a first random number to the terminal device.
306. The terminal device sends the signature data and the certificate chain to the service server.
In this step, the terminal device encrypts the first random number by using the private key of the service certificate, and sends the certificate chain and the signature data to the service server after obtaining the signature data.
307. The service server verifies whether the certificate in the certificate chain is legal, if the certificate chain is legal, the service server determines whether the service certificate is the service certificate of the APP, and if the service certificate is the service certificate of the APP to be identified, the service server determines whether the APP is a counterfeit APP.
In the step, the service server firstly verifies whether each certificate in the certificate chain is legal or not and whether the service certificate is the service certificate of the APP itself or not through the certificate chain. If each service certificate in the certificate chain is legal and the service certificate is a service certificate of the APP itself, the service server acquires a package name and a first signature certificate fingerprint of the APP to be identified from the service certificate, determines a second signature certificate fingerprint according to the package name, and finally checks whether the first signature certificate fingerprint is identical to a prestored second signature certificate fingerprint on the service server, if so, the APP to be identified is determined to be a genuine APP, and if not, the APP to be identified is considered to be a counterfeit APP. For example, if in this step, the second signature certificate fingerprint is 111111, and the first signature certificate fingerprint is the same as the first signature certificate fingerprint obtained by the terminal device from the installation package of the APP to be identified, then the service server considers the APP to be identified as the master APP. For another example, if in the step, the second signature certificate fingerprint is 222222, and the first signature certificate fingerprint is different from the first signature certificate fingerprint obtained by the terminal device from the installation package of the APP to be identified, the service server considers the APP to be identified as a counterfeit APP.
Fig. 7 is a schematic structural diagram of a server according to an embodiment of the present application. The server 100 may include:
a transmitter 11 for transmitting the first random number to the terminal device;
A receiver 12, configured to receive a certificate chain and signature data sent by a terminal device, where a certificate in the certificate chain includes a service certificate of an application program APP to be identified, where the service certificate carries a packet name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified, and the signature data is obtained by encrypting, by the terminal device, the first random number by using a private key corresponding to the service certificate;
The processor 13 is configured to determine whether the service certificate is a service certificate of the APP to be identified according to the certificate chain and the signature data; if the service certificate is the service certificate of the APP to be identified, judging whether the APP to be identified is a counterfeit APP or not according to the package name and the first signature certificate fingerprint.
In a possible implementation manner, the processor 13 is configured to determine whether the certificate in the certificate chain is legal, and if the certificate in the certificate chain is legal, decrypt the signature data according to a public key carried by the service certificate in the certificate chain to obtain a second random number; judging whether the first random number is the same as the second random number, if so, determining that the service certificate is the service certificate of the APP to be identified; and if the first random number is different from the second random number, determining that the service certificate is not the service certificate of the APP to be identified.
In a feasible implementation manner, the certificate in the certificate chain further includes a root certificate of the terminal device and a device authentication authorization CA certificate, the processor 13 is configured to determine whether the root certificate in the certificate chain exists in a pre-deployed trusted root certificate set, if the root certificate in the certificate chain exists in the root certificate set, decrypt the device CA certificate included in the certificate chain by using a public key carried by the root certificate to obtain a first hash value, perform hash operation on the device CA certificate according to a hash algorithm carried by the device CA certificate to obtain a second hash value, if the first hash value is the same as the second hash value, determine that the device CA certificate is a legal certificate, decrypt the service certificate according to a public key carried by the device CA certificate to obtain a third hash value, and perform hash operation on the service certificate according to a hash algorithm carried by the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determine that the service certificate is the legal certificate.
In a possible implementation manner, the certificate in the certificate chain further includes a device authorized CA certificate of the terminal device, the processor 13 is configured to determine whether there is a device CA certificate in the certificate chain in a pre-deployed trusted CA certificate set, if there is a device CA certificate in the certificate chain in the CA certificate set, decrypt a service certificate by using a public key carried by the trusted device CA certificate to obtain a third hash value, perform hash operation on the service certificate according to a hash algorithm carried by the service certificate to obtain a fourth hash value, and if the third hash value is the same as the fourth hash value, determine that the service certificate is a legal certificate.
In a possible implementation manner, the processor 13 is configured to determine, if the service certificate is a service certificate of the APP to be identified, whether the APP to be identified is a counterfeit APP according to the package name and the first signature certificate fingerprint, including: if the service certificate is the service certificate of the APP to be identified, determining a second signature certificate fingerprint according to the package name, storing the corresponding relation between the package name and the second signature certificate fingerprint, judging whether the first signature certificate fingerprint and the second signature certificate fingerprint are identical, and if the first signature certificate fingerprint and the second signature certificate fingerprint are not identical, determining that the APP to be identified is a counterfeit APP.
In a possible implementation, the server is a service server or an authentication authorization server.
The implementation principle and technical effects of the server provided by the embodiment of the present application can be seen in the above method embodiments, and are not described herein.
Fig. 8 is a schematic structural diagram of a terminal device according to an embodiment of the present application. The terminal device 200 may include:
A transmitter 21, configured to transmit a request message for establishing a link between an APP to be identified and a server to the server;
A receiver 22, configured to receive an authentication message sent by the server for authenticating the APP to be identified, where the authentication message includes a first random number;
the sender 21 is further configured to send a certificate chain and signature data to the server, where the signature data is obtained by encrypting the first random number through a private key corresponding to the APP to be identified;
The receiver 22 is further configured to receive a result of verifying, by the server, whether the APP to be identified is a counterfeit APP according to the certificate chain and the signature data.
In a possible implementation manner, the certificate chain includes a service certificate of the APP to be identified, where the service certificate carries a package name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified, and the receiver 22 is configured to receive a counterfeit identification result obtained by matching a second visa certificate fingerprint corresponding to the package name of the APP registered by the server with the first signature certificate fingerprint; if the matching is successful, the counterfeit result indicates that the APP is not a counterfeit APP, or if the matching is failed, the counterfeit recognition result indicates that the APP is a counterfeit APP.
Referring to fig. 8 again, in a possible implementation manner, the terminal device 200 further includes: the processor 23 is configured to issue the service certificate for the APP to be identified by using a device CA certificate before the sender 21 sends a certificate chain and signature data to the server, where the content of the service certificate includes a package name of the APP to be identified and a first signature certificate fingerprint of the APP to be identified.
In a possible implementation manner, the service certificate is generated and managed for a certificate management service of the terminal device, where the certificate management service is located in a Framework layer of a system of the terminal device.
In a possible implementation manner, the service certificate further includes a public key of the APP to be identified, where the public key corresponds to a private key that encrypts the first random number.
In a possible implementation manner, the operating system of the terminal device includes a rich execution environment REE operating system and a trusted execution environment TEE operating system, and the transmitter 21 is configured to send, through a client application CA running on the REE operating system, a service certificate application request message to a trusted application TA running on the TEE operating system;
the processor 23 is configured to control the TA to issue the service certificate for the APP to be identified using the device CA certificate.
Fig. 9 is a schematic structural diagram of another server according to an embodiment of the present application. The server 300 may include: a processor 31, a transceiver 32, and a memory 33; the transceiver 32 is used for transmitting and receiving data; the memory 33 is used for storing instructions; the processor 31 is configured to instruct the instructions in the memory 33 to cause the server to perform the counterfeit APP identification method applied to the server as described above.
Fig. 10 is a schematic structural diagram of another terminal device according to an embodiment of the present application. The terminal device 400 may include: a processor 41, a transceiver 42 and a memory 43; the transceiver 42 is used for transmitting and receiving data; the memory 43 is used for storing instructions; the processor 41 is configured to instruct the instructions in the memory 43 to cause the terminal device to perform the counterfeit APP identification method applied to the terminal device as described above.
Fig. 11 is a schematic architecture diagram of an APP identification system according to an embodiment of the present application. Referring to fig. 9, a counterfeit APP identification system 1000 provided in this embodiment includes a server 100 as described in fig. 7, and at least one terminal device 200 as described in fig. 8.
In addition, on the basis of the fake APP identification method, the embodiment of the application also provides:
A computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs a counterfeit APP identification method as applied to a server as above.
A computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs a counterfeit APP identification method as applied to a terminal device as described above.
A chip having stored thereon a computer program which, when executed by a processor, performs a counterfeit APP identification method as applied to a server as described above.
A chip having stored thereon a computer program which, when executed by a processor, performs a counterfeit APP identification method as applied to a terminal device as described above.
In the embodiment provided by the application, the method provided by the embodiment of the application is mainly introduced from the interaction point of the terminal equipment and the server. It may be understood that, in order to implement the functions in the methods provided in the embodiments of the present application, the terminal device and the server include corresponding hardware structures and/or software modules that perform the respective functions. Those of skill in the art will readily appreciate that the various illustrative algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is implemented as hardware or computer software driven hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The embodiment of the application can divide the functional modules of the terminal equipment and the server according to the method example, for example, each functional module can be divided corresponding to each function, and two or more functions can be integrated in one processing module. The integrated modules may be implemented in hardware or in software functional modules. It should be noted that, in the embodiment of the present application, the division of the modules is schematic, which is merely a logic function division, and other division manners may be implemented in actual implementation.
The term "plurality" herein refers to two or more. The term "and/or" is herein merely an association relationship describing an associated object, meaning that there may be three relationships, e.g., a and/or B, may represent: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front and rear associated objects are an "or" relationship; in the formula, the character "/" indicates that the front and rear associated objects are a "division" relationship.
It will be appreciated that the various numerical numbers referred to in the embodiments of the present application are merely for ease of description and are not intended to limit the scope of the embodiments of the present application.
It should be understood that, in the embodiment of the present application, the sequence number of each process does not mean that the execution sequence of each process should be determined by the function and the internal logic, and should not limit the implementation process of the embodiment of the present application.
It is understood that in embodiments of the present application, the memory may be a nonvolatile memory, such as a hard disk (HARD DISK DRIVE, HDD) or a Solid State Disk (SSD), and may also be a volatile memory (RAM), for example, a random-access memory (RAM). The memory is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The memory in embodiments of the present application may also be circuitry or any other device capable of performing memory functions for storing program instructions and/or data.
From the foregoing description of the embodiments, it will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-described division of functional modules is illustrated, and in practical application, the above-described functional allocation may be implemented by different functional modules according to needs, i.e. the internal structure of the apparatus is divided into different functional modules to implement all or part of the functions described above.
In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the modules or units is merely a logical functional division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another apparatus, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and the parts displayed as units may be one physical unit or a plurality of physical units, may be located in one place, or may be distributed in a plurality of different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The method provided by the embodiment of the application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, produces a flow or function in accordance with embodiments of the present application, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, a server, a terminal, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by a wired (e.g., coaxial cable, fiber optic, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains an integration of one or more available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., SSD), etc.
The foregoing is merely illustrative of specific embodiments of the present application, and the scope of the present application is not limited thereto, but any changes or substitutions within the technical scope of the present application should be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.