Secondary packaging signature verification method for APK files on Android platform

Abstract

The invention provides a secondary packaging signature verification method for APK files on an Android platform. The method comprises the following steps: step 1, a signing tool signs the packaged original APK files by using a private key to generate the APK files embedded with digital signature files; step 2, a public key certificate is preset on a terminal device, and the APK files embedded with the digital signature files are downloaded to the terminal device; and step 3, the terminal device verifies the legality of the APK files embedded with the digital signature files by using the public key certificate. The secondary packaging signature verification method provided by the invention has the following advantages: the phenomenon that the applications are illegally cracked and malicious codes are embedded to the applications to cause repackaging can be effectively prevented; and the method is beneficial to ensure the security of various data such as the accounts, passwords and traffic of users.

Description

technical field [0001] The invention relates to a secondary packaging signature verification method of an APK file on an Android platform. Background technique [0002] Android is a free and open-source operating system based on Linux, which is mainly used on mobile devices, such as smart phones and tablet computers. On the Android platform, the installation files of the application (APP) are all saved in the APK (Android Package) format. The APK file is essentially a zip compressed file, mainly including res / class / jar and permission configuration files. At the same time, there is a META-INFO directory in the APK file, which is mainly used to save the data information generated when the APK file is signed natively. [0003] In general, developers will sign the APK through Eclipse / Android Studio or Ant tools, etc., generate a native signature file, and save it in the META-INFO directory. When installing the APK file, the bottom layer of the android platform will first perfo...

AI Technical Summary

Problems solved by technology

However, the existing native signature technology is a self-signed method, which is theoretically legal (that is, it is allowed to be installed), so the existing native signature technology cannot control the installation of APK.

And some APP programs are easy to be pirated. Once they are cracked and repackaged with malicious codes, they will be exactly the same as the original APP in terms of performance, user experience and appearance, but behind it may be running quietly. programs, and these programs may lead to unknowingly wasting mobile phone power, traffic, malicious deduction, voyeuristic privacy and other behaviors

Images