Signature verification method and device for application

Abstract

An embodiment of the present application provides a method for verifying the signature of an application program, including: calling a target function in a preset dynamic link library; obtaining the dynamic signature information of the application program through the target function; and verifying the dynamic signature information Whether it is consistent with the first signature information pre-embedded in the dynamic link library; if not, close the application program; if consistent, run the application program. In the embodiment of the present application, the dynamic signature information of the application program is acquired by calling a function in the dynamic link library, and the dynamic signature information is compared with the pre-embedded first signature information. If they are inconsistent, the application program is closed. Since it is difficult to crack the dynamic link library, the method of obtaining the signature information by calling the function of the JAVA layer in the dynamic link library is also difficult to crack. This makes it difficult for counterfeiters to obtain the signature information of the application, thereby preventing the program from being repackaged.

Description

technical field [0001] The present application relates to the technical field of information security, in particular to a method for verifying a signature of an application program and a device for verifying a signature of an application program. Background technique [0002] With the development of technology, smart terminals such as smartphones and smart TVs have increasingly become an indispensable part of people's lives. Various applications on smart terminals present a rich and colorful world to people. Through applications, people can easily realize activities such as obtaining information, watching entertainment programs, purchasing commodities, and completing payment. Just because the functions of the application programs are becoming more and more powerful, people pay more and more attention to the data security of the application programs. [0003] Due to the openness of the Android system, some criminals implant malicious codes into the APP and repackage it after...

AI Technical Summary

Problems solved by technology

The APP generated by the second packaging is exactly the same as the regular APP in terms of performance, user experience, and appearance, but behind it, it is secretly running a terrible program, which will waste mobile phone power and data without knowing it, maliciously charge fees, Peeping privacy, etc.

In the face of secondary packaging, many companies have their own preventive measures. Many APPs only deal with it at the code level to prevent secondary packaging. The method is to dynamically obtain the application signature and the plaintext signature preset in the program through the program. Compare the information, and then judge whether it has been packaged twice, but the current Android terminal code is extremely easy to decipher, especially the plaintext signature information written directly in the code is more likely to leak

Images