WO2017206185A1 - 验证应用程序合法性的方法、装置及*** - Google Patents

验证应用程序合法性的方法、装置及*** Download PDF

Info

Publication number
WO2017206185A1
WO2017206185A1 PCT/CN2016/084809 CN2016084809W WO2017206185A1 WO 2017206185 A1 WO2017206185 A1 WO 2017206185A1 CN 2016084809 W CN2016084809 W CN 2016084809W WO 2017206185 A1 WO2017206185 A1 WO 2017206185A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
digital signature
terminal device
server
random number
Prior art date
Application number
PCT/CN2016/084809
Other languages
English (en)
French (fr)
Inventor
马洁
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/084809 priority Critical patent/WO2017206185A1/zh
Publication of WO2017206185A1 publication Critical patent/WO2017206185A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method, apparatus, and system for verifying the legitimacy of an application.
  • the terminal device 10 generally includes an application layer 101, an operating system layer 102, and a hardware device layer 103.
  • the application layer refers to an aggregate of programs that implement functions such as instant messaging, watching movies, and the like. It includes various applications such as APP1 and APP2; the operating system layer refers to a function collection that implements application installation, scheduling, uninstallation, and information exchange with the hardware of the terminal device.
  • Common operating systems include Android and IOS operating systems.
  • Etc. which generally includes the TCP/IP layer and Hardware Abstraction Layer (HAL); the hardware device layer generally includes CPU, memory, and Bluetooth Low Energy (BLE), Wireless Fidelity (WIreless-Fidelity, Wi-Fi) and other communication modules.
  • HAL Hardware Abstraction Layer
  • BLE Bluetooth Low Energy
  • WIreless-Fidelity Wi-Fi
  • the APP When the APP interacts with the APP server, the APP first sends a request for accessing the wireless network to the communication module through the operating system, and the communication module establishes a data transmission channel according to the request and the operator's network, and then transmits the application message to the APP server. Similarly, the message returned from the server needs to be sent to the APP through the communication module and the operating system in turn.
  • the communication module is a passive forwarding process, and is only responsible for transmitting data from the APP to the network according to the request and transmitting the data to the APP from the network, without determining whether the APP is legal.
  • the illegal Trojan program or the data of the tampered application can directly access the Internet for illegal operations, which poses a security risk.
  • the invention provides a method, a device and a system for verifying the legitimacy of an application, so as to solve the problem of the security risk caused by not judging the legality of the application in the prior art.
  • an embodiment of the present invention provides a method for verifying validity of an application, where The method includes: the application validity verification server respectively sends a random number to the terminal device and the application server; respectively receiving a first digital signature sent by the terminal device and a second digital signature sent by the application server, where the first The digital signature is calculated by the terminal device according to the random number, a key pre-stored locally by the terminal device, and a preset algorithm; the second digital signature is the application server according to the random number, The key pre-stored by the application server and the preset algorithm are calculated; and determining, according to the first digital signature and the second digital signature, whether the application installed by the terminal device is legal.
  • the method for verifying the legitimacy of an application provided by the embodiment of the present invention the application validity verification server respectively sends a random number to the terminal device and the application server, so that the terminal device and the application server respectively calculate the digital signature according to the random number, and the application program
  • the legality verification server determines whether the application installed by the terminal device is legal by comparing whether the digital signature sent by the terminal device and the application server is consistent.
  • the method for verifying the legitimacy of the application provided by the embodiment of the present invention can verify the installation of the terminal device by the application legality verification server, compared with the prior art that the application device installed in the terminal device is not verified for the security of the device. Whether the application is legal, and the terminal device only processes the legitimate application normally, and avoids the security risk caused by the use of the illegal application by the terminal device.
  • the method further includes: if the application installed by the terminal device is a legitimate application, And the application validity verification server sends the identifier corresponding to the application and the first digital signature to the terminal device.
  • the application validity verification server sends the identifier of the legitimate application and the corresponding legal digital signature to the terminal device, so that the terminal device performs normal processing on the interaction information sent by the legitimate application according to the identifier and the digital signature.
  • the determining, according to the first digital signature and the second digital signature, the terminal Whether the device installed by the device is legal includes: the application legality verification server compares whether the first digital signature and the second digital signature are consistent; if the first digital signature and the second digital signature are consistent, determining The application installed on the terminal device is legal.
  • This implementation gives an implementation of the application legality verification server to verify that the application is legitimate.
  • the application legality verification server compares the end Whether the digital signature sent by the end device and the application server are consistent, and when the digital signatures sent by the two are consistent, the application is determined to be a legitimate application.
  • the method includes: the application legality verification server generates a third digital signature according to the locally pre-stored key, the preset algorithm, and the random number; comparing the first digital signature, Whether the second digital signature is consistent with the third digital signature; if the first digital signature and the second digital signature are consistent with the third digital signature, determining that the application installed by the terminal device is a legitimate application program.
  • This implementation gives an alternative implementation of the application legality verification server to verify that the application is legitimate.
  • the application legality verification server compares whether the digital signature sent by the terminal device and the application server is consistent with the digital signature calculated by the application legality verification server itself. When the three digital signatures are consistent, the application is determined to be Legitimate application.
  • the method further includes: the application legality verification server receives the application installed by the terminal device and sent by the terminal device Identifying an address of the application server according to the identifier of the application and a preset mapping table, where the preset mapping table includes a correspondence between an identifier of each application and an address of each application server.
  • the embodiment of the present invention further provides a method for verifying the validity of an application, the method comprising: receiving, by a terminal device, a first identifier of an application installed by a terminal device sent by an application legality verification server, and the application a first digital signature corresponding to the program; acquiring an interaction message between the application server and the application installed by the terminal device, where the interaction message carries a second identifier of the application and a second digital signature corresponding to the application Comparing whether the first identifier and the second identifier are consistent; if they are consistent, comparing whether the first digital signature and the second digital signature are consistent; if they are consistent, processing the interaction message.
  • the terminal device receives the identifier and digital signature of the legitimate application sent by the application legality verification server;
  • the end device verifies whether the identifier sent by the server is consistent by comparing the application identifier and the validity of the application carried in the interaction message, and the digital signature and the application carried in the interaction message. Whether the digital signatures sent by the validity verification server are consistent. If they are consistent, the interaction message is an interactive message of the legitimate application, and the interaction message is processed, and only the interaction message between the legitimate application and the application server can be processed. Avoid security risks caused by using illegal applications.
  • the embodiment of the present invention further provides a method for verifying the validity of an application, where the method includes: the application validity verification server sends a random number corresponding to an application installed by the terminal device to the terminal device to facilitate the terminal.
  • the device calculates a first digital signature corresponding to the application installed by the terminal device according to the locally pre-stored key, a preset algorithm, and the random number; the application legality verification server performs the pre-stored key according to the local pre-stored key And determining, by the algorithm and the random number, a second digital signature corresponding to the application, and sending the second digital signature to the terminal device.
  • the application validity verification server sends a random number to the terminal device, so that the terminal device calculates the first digital signature corresponding to the application; the application legality verification server also sends the terminal device to the terminal device. Send the calculated second digital signature.
  • the terminal device can compare whether the first digital signature calculated by itself and the second digital signature sent by the application validity verification server are consistent, and if they are consistent, determine that the application is a legitimate application.
  • the method for verifying the legitimacy of the application provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and thus the terminal is compared with the method for verifying the validity of the application installed in the terminal device.
  • the device only processes the legitimate application normally, avoiding the security risks caused by the use of illegal applications by the terminal device.
  • the embodiment of the present invention further provides a method for verifying the validity of an application, where the method includes: receiving, by the terminal device, a random number corresponding to an application installed by the terminal device sent by the application legality verification server; The first digital signature corresponding to the application installed by the terminal device is calculated by the random number, the local pre-stored key, and the preset algorithm; the terminal device further receives the first corresponding to the application sent by the application legality verification server Two digital signatures; comparing whether the first digital signature and the second digital signature are consistent; if they are consistent, determining that the application installed by the terminal device is a legitimate application.
  • the terminal device receives the random number and the second digital signature sent by the application legality verification server; calculates the first digital signature of the application, compares the first digital signature with the second Whether the digital signatures are consistent, if they are consistent, then the application is determined to be a legitimate application.
  • an embodiment of the present invention provides an application validity verification server, including: a sending module, configured to separately send a random number to a terminal device and an application server; and a receiving module, configured to separately receive the sending by the terminal device a first digital signature and a second digital signature sent by the application server, where the first digital signature is a random number sent by the terminal device according to the sending module, a key pre-stored locally by the terminal device, and a pre- The second digital signature is calculated by the application server according to the random number sent by the sending module, the pre-stored key of the application server, and a preset algorithm; and the processing module is configured to: Determining whether the application installed by the terminal device is legal according to the first digital signature and the second digital signature received by the receiving module.
  • the application legality verification server provided by the embodiment of the present invention, the sending module separately sends a random number to the terminal device and the application server, so that the terminal device and the application server respectively calculate the digital signature according to the random number, and the receiving module respectively receives the terminal device and The digital signature calculated by the application server, and the processing module determines whether the application installed by the terminal device is legal by comparing whether the digital signature sent by the terminal device and the application server is consistent.
  • the application legality verification server provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and the terminal device is compared with the prior art, which does not verify the validity of the application installed by the terminal device. Only legitimate applications are processed normally to avoid security risks caused by the use of illegal applications by terminal devices.
  • the sending module is further configured to: when the processing module determines that the application installed by the terminal device is a legitimate application, The terminal device sends an identifier corresponding to the application installed by the terminal device and the first digital signature.
  • the processing module is specifically configured to: compare the first digital signature with the second digit Whether the signatures are consistent; when the first digital signature and the second digital signature are consistent, determining that the application installed by the terminal device is a legitimate application.
  • the processing module is specifically configured to: according to a local pre-stored key, a preset algorithm And generating, by the random number, a third digital signature; comparing whether the first digital signature and the second digital signature are consistent with the third digital signature; and when the first digital signature and the second digital signature are both When the third digital signature is consistent, it is determined that the application installed by the terminal device is a legitimate application.
  • the receiving module is further configured to receive an identifier of the application that is installed by the terminal device that is sent by the terminal device, where the processing module is further configured to: according to the identifier of the application and the preset mapping table received by the receiving module Determining an address of the application server, the preset mapping table including a correspondence between an identifier of each application and an address of each application server.
  • an embodiment of the present invention provides a terminal device, including: a receiving module, configured to receive a first identifier of an application installed by the terminal device and an application corresponding to the application, a digital signature; a processing module, configured to acquire an interaction message between the application server and the application, where the interaction message carries a second identifier of the application and a second digital signature corresponding to the application; The processing module is further configured to compare whether the first identifier received by the receiving module and the second identifier obtained by the processing module from the interaction information are consistent, and when the first identifier and the second identifier are consistent, the comparison Whether the first digital signature received by the receiving module and the second digital signature obtained by the processing module from the interaction information are consistent, and when the first digital signature and the second digital signature are consistent, the interaction message is processed.
  • the receiving module receives the identifier and the digital signature of the legitimate application sent by the application legality verification server; when the processing module receives the interaction message between the application and the application server, the processing module compares the interaction message.
  • the carried identifier, the digital signature, and the application validity verification server are consistent with the identifier and the digital signature sent by the server. If they are consistent, the interaction message is an interactive message of the legitimate application, and the interaction message is processed, and only the processing can be implemented. Interactive messages between legitimate applications and application servers to avoid the security risks associated with using illegal applications.
  • the embodiment of the present invention further provides an application legality verification server, and a package
  • the sending module is configured to send a random number to the terminal device, where the random number is used by the terminal device to calculate, according to the random number, a locally pre-stored key, and a preset algorithm, an application installed by the terminal device.
  • Corresponding first digital signature a processing module, configured to calculate, according to the locally pre-stored key, the preset algorithm, and the random number, a second digital signature corresponding to the application; the sending module is further used Sending, to the terminal device, the second digital signature corresponding to the application.
  • the application legality verification server provided by the embodiment of the present invention, the sending module sends a random number to the terminal device to facilitate the terminal device to calculate the first digital signature; the processing module calculates the second digital signature and sends the second digit to the terminal device by using the sending module. signature. In this way, the terminal device compares whether the first digital signature calculated by itself and the second digital signature sent by the sending module are consistent. If they are consistent, the application is determined to be a legitimate application.
  • the application legality verification server provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and the terminal device is compared with the prior art, which does not verify the validity of the application installed by the terminal device. Only legitimate applications are processed normally to avoid security risks caused by the use of illegal applications by terminal devices.
  • the embodiment of the present invention further provides a terminal device, including: a receiving module, configured to receive a random number corresponding to an application installed by a terminal device sent by an application legality verification server; and a processing module, configured to And receiving, by the receiving module, a random number, a local pre-stored key, and a preset algorithm, to calculate a first digital signature corresponding to the application; the receiving module is further configured to receive, by the application legality verification server, the a second digital signature corresponding to the application; the processing module is further configured to compare whether the first digital signature calculated by the processing module and the second digital signature received by the receiving module are consistent, when the first When the digital signature and the second digital signature are identical, the application is determined to be a legitimate application.
  • a terminal device including: a receiving module, configured to receive a random number corresponding to an application installed by a terminal device sent by an application legality verification server; and a processing module, configured to And receiving, by the receiving module, a random number, a local pre-stored key, and
  • the receiving module receives the random number sent by the application legality verification server, and the processing module calculates the first digital signature according to the random number; the receiving module is further configured to receive the application legality verification server and send the And a second digital signature, the processing module compares whether the first digital signature and the second digital signature are consistent, and when they are consistent, determining that the application is a legitimate application.
  • the terminal device provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and the terminal device only applies to the legal application. Program is being positive It is often handled to avoid the security risks caused by the use of illegal applications by terminal devices.
  • the ninth aspect, the embodiment of the present invention further provides a system for verifying the validity of an application, comprising: the application legality verification server according to any one of the fifth aspect and the fifth aspect, and the sixth aspect
  • the application server is a server corresponding to an application installed on the terminal device.
  • the system for verifying the legitimacy of the application provided by the embodiment of the present invention
  • the application legality verification server respectively sends a random number to the terminal device and the application server
  • the terminal device and the application server respectively calculate the digital signature according to the random number
  • the application legality determines whether the application installed by the terminal device is legal by comparing whether the digital signature sent by the terminal device and the application server is consistent.
  • the system for verifying the validity of the application provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and thus the terminal is legally verified.
  • the device only processes the legitimate application normally, avoiding the security risks caused by the use of illegal applications by the terminal device.
  • the embodiment of the present invention further provides a system for verifying the validity of an application, comprising: the application legality verification server according to the seventh aspect, and the terminal device according to the eighth aspect.
  • the application validity verification server sends a random number to the terminal device; the terminal device calculates a first digital signature according to the random number; and the application legality verification server further sends the identifier to the terminal device. And a second digital signature, the terminal device compares whether the calculated first digital signature and the second digital signature sent by the application validity verification server are consistent, and if they are consistent, determining that the application is a legitimate application.
  • the system for verifying the validity of the application provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and thus the terminal is legally verified. The device only processes the legitimate application normally, avoiding the security risks caused by the use of illegal applications by the terminal device.
  • FIG. 1 is a schematic structural diagram of a terminal device provided by the prior art
  • FIG. 2 is a schematic structural diagram of a first system for verifying the validity of an application according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a first method for verifying the validity of an application according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a second method for verifying the validity of an application according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a third method for verifying the validity of an application according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a second system for verifying the validity of an application according to an embodiment of the present invention.
  • FIG. 7 is a flowchart of a fourth method for verifying the validity of an application according to an embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of the legality of a periodic verification application according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a first application legality verification server according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a first terminal device according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a second application validity verification server according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of a second terminal device according to an embodiment of the present invention.
  • the method, device and system for verifying the legitimacy of an application provided by the embodiments of the present invention are mainly applied in the 3rd Generation Partnership Project (3GPP) Out of the Evolved Packet System (EPS).
  • 3GPP 3rd Generation Partnership Project
  • EPS Evolved Packet System
  • an embodiment of the present invention provides a system for verifying the validity of an application, where the system includes an application legality verification server 201, a terminal device 202, and an application server 203.
  • the application legality verification server 201 is located on the EPS core network side, and the application legality verification server may be integrated into an existing core network server, for example, a Proximity Service Function (Prose function) server; a Prose function A logical network element added to the EPS for device-to-device communication (3GPP Release-12D2D) in the 3GPP standard 12 system for implementing management of the through terminal.
  • Proximity Service Function Prose function
  • Prose function Proximity Service Function
  • the application validity verification server may also independently become a logical network element, for example, by adding a new server implementation on the EPS core network side, which may include the apparatus shown in FIG.
  • the terminal device 202 may be an electronic device capable of installing an application (Application), such as a personal computer, a PAD, a mobile phone, etc., and may include the device as shown in FIG.
  • the application server 203 is a server corresponding to an application installed on the terminal device, and different applications correspond to different application servers, and the application server is configured to verify the random number and locality sent by the server according to the application legality.
  • the pre-stored key and the preset algorithm calculate the digital signature and send the digital signature to the application legality verification server.
  • an embodiment of the present invention provides a method for verifying the validity of an application, which can be applied to the system shown in FIG. 2, where the method includes:
  • the application legality verification server sends a random number to the terminal device and the application server respectively.
  • the random number is 256 bits long, and can be used for truncation when used in particular, for example, only 128 of them are used.
  • the terminal device calculates the first digital signature according to the received random number, the locally pre-stored key, and a preset algorithm.
  • the application server calculates a second digital signature based on the received random number, the locally pre-stored key, and a locally pre-stored algorithm.
  • the terminal device and the application server both locally store a key (Key) value pre-assigned by the operator, and an algorithm for calculating the digital signature.
  • the terminal device and the application server corresponding to the application store the key values and algorithms. with.
  • step 3021 the terminal device generates a digest according to the locally stored algorithm and the received random number, and encrypts the digest with the locally stored key value to obtain an encrypted digest; the encrypted digest is calculated by the terminal device.
  • the first digital signature is a digital signature according to the locally stored algorithm and the received random number.
  • step 3022 the application server generates a digest according to the locally stored algorithm and the received random number, and encrypts the digest with the locally stored key value to obtain an encrypted digest; the encrypted digest is The second digital signature calculated by the application server.
  • the terminal device sends a first digital signature to the application legality verification server.
  • the application server sends a second digital signature to the application legality verification server.
  • the application legality verification server determines, according to the first digital signature and the second digital signature, whether the application installed by the terminal device is legal.
  • the application legality verification server compares the first digital signature with the second digital signature; if the first digital signature and the second digital signature are the same, determining the The application installed by the terminal device is a legitimate application.
  • the application validity verification server In a second implementation manner of the step, the application validity verification server generates a third digital signature according to the locally pre-stored key, the algorithm, and the random number, and the third digital signature and the first digit respectively The signature, the second digital signature is compared; if the first digital signature and the second digital signature are both the same as the third digital signature, the application is determined to be a legitimate application.
  • Digital signatures are generally used to ensure the integrity of information transmission, identity authentication of senders, and the like. It is typically implemented using asymmetric key cryptography. Specifically, the publisher of the information uses the first key for encryption. After receiving the digital signature, the receiver uses the second key for verification. In general, the first key is a public key and the second key is a private key. In some cases, the first key is a private key and the second key is a public key. Therefore, in the third implementation manner of this step, the key value pre-assigned by the operator to the terminal device and the application server is the public key; the key stored by the application legality verification server is the private key.
  • the application legality verification server uses the locally stored private key to decrypt the first digital signature and the second number, respectively.
  • the word signature is obtained, and the decrypted digest is obtained, and the random number is calculated according to the decrypted digest and the locally stored algorithm, and the calculated random number is compared with the locally stored random number. If they are consistent, the application is determined. For legitimate applications.
  • the method for verifying the legitimacy of an application provided by the embodiment of the present invention the application validity verification server respectively sends a random number to the terminal device and the application server, so that the terminal device and the application server respectively calculate the digital signature according to the random number, and the application program
  • the legality verification server determines whether the application installed by the terminal device is legal by comparing whether the digital signature sent by the terminal device and the application server is consistent.
  • the method for verifying the legitimacy of the application provided by the embodiment of the present invention can verify the installation of the terminal device by the application legality verification server, compared with the prior art that the application device installed in the terminal device is not verified for the security of the device. Whether the application is legal, and the terminal device only processes the legitimate application normally, and avoids the security risk caused by the use of the illegal application by the terminal device.
  • the interaction information between the application and other devices may be processed according to the determination result.
  • an embodiment of the present invention further provides a method for verifying the validity of an application, including:
  • the application legality verification server sends a random number to the terminal device and the application server, respectively.
  • step 301 For the specific implementation process of the step, refer to step 301, and details are not described herein again.
  • the terminal device calculates the first digital signature according to the received random number, the locally pre-stored key, and the local pre-stored algorithm.
  • step 3021 For the specific implementation process of this step, refer to step 3021, and details are not described herein again.
  • the application server calculates the second digital signature according to the received random number, the local pre-stored key, and the local pre-stored algorithm.
  • step 3022 For the specific implementation process of this step, refer to step 3022, and details are not described herein again.
  • the terminal device sends a first digital signature to the application legality verification server.
  • step 3031 For the specific implementation process of this step, refer to step 3031, and details are not described herein again.
  • the application server sends a second digital signature to the application legality verification server.
  • step 3032 For the specific implementation process of this step, refer to step 3032, and details are not described herein again.
  • the application legality verification server determines, according to the first digital signature and the second digital signature, whether the application installed by the terminal device is legal.
  • step 304 For the specific implementation process of this step, refer to step 304, and details are not described herein again.
  • the application legality verification server sends the identifier of the application and the first digital signature to the terminal device.
  • the identifier of the application is the name of the application and/or the IP address corresponding to the application. It can also include the IP address of the terminal device where the application is located.
  • the application legality verification server may periodically send the identifier list of the legality application to the terminal device, as shown in Table 1 below, the list stores multiple legalities in one cycle.
  • the application legality verification server can also inform the terminal device of the verification result of the application every time after verifying an application.
  • the terminal device receives an interaction message between the application server and the application, and obtains an identifier and a digital signature of the application carried in the interaction message.
  • the application needs to add its identifier and signature information to the header information when interacting with its corresponding server.
  • the terminal device compares whether the application identifier carried in the interaction message and the application identifier sent by the application validity verification server are consistent.
  • step 408 is performed.
  • step 510 may be performed first, then step 509 may be performed, or may be performed at the same time.
  • step 409 If it is consistent, it indicates that the interactive message is from the legitimate application, and step 409 is performed. Otherwise, it indicates that the interactive message is from the illegal application, and step 410 is performed.
  • the terminal device discards the interaction message.
  • the application also sends the identifier of each installed application to the application legality verification server; the application legality verification server is based on the identifier of each application and each application.
  • the address of the application server corresponding to the program builds a preset mapping table and saves it locally.
  • the terminal device sends the identifier of the application to the application legality verification server, and the application legality verification server can determine the identifier according to the identifier and the preset mapping table.
  • the address of the application server which in turn sends a random number to the application server.
  • the identifier of each application and the address of the corresponding application server are stored in the preset mapping table.
  • the application legality verification server can periodically verify the validity of the application installed by the terminal device.
  • the application legality verification server may allocate multiple random numbers to the terminal device and the application server at one time, for example: RAND_0, RAND_1, RAND_2 to RAND_N, and the terminal device and the application.
  • the program server is saved locally.
  • the terminal device and the application server can periodically calculate the digital signature using the locally stored random number and initiate a periodic verification process.
  • the timer is set in the terminal device, and when the timer is not expired, the application is allowed to send data carrying the digital signature. When the timer expires, the application is notified to perform the next legality verification, if the next legality has not been completed yet.
  • Sexual verification disables or discards data sent by the application.
  • the verification process in addition to periodically initiating the above verification process by the terminal device, the verification process may be periodically initiated by the application validity verification server.
  • the application legality verification server sets the timer timing. When the timing ends, the application legality verification server resends the random number to the terminal device to start a new round of application legality verification process.
  • the application validity verification server determines whether the application installed by the terminal device is legal by comparing whether the digital signature sent by the terminal device and the application server are consistent, and the judgment result is obtained.
  • the terminal device is informed to enable the terminal device to forward only the interactive message of the legitimate application when forwarding the interaction message between the application and its corresponding application server.
  • the embodiment of the present invention further provides a method for verifying the validity of an application, including:
  • the terminal device sends a registration request message of the application installed by the terminal device to the application legality verification server.
  • the registration request message carries an application identifier.
  • the registration request message may further carry an identifier of the terminal device, for example, an IP address of the terminal device.
  • the application legality verification server finds the IP address of the application server according to the application identifier in the registration request message and the locally stored preset mapping table.
  • the application legality verification server returns a registration response message to the terminal device, where the registration response message carries a random number.
  • the application legality verification server sends an application signature request message to the application server, where the application signature request message carries a random number.
  • the terminal device calculates the first digital signature according to the received random number, the locally pre-stored key, and the local pre-stored algorithm.
  • the application server calculates the second digital signature based on the received random number, the locally pre-stored key, and the local pre-stored algorithm.
  • the terminal device sends a first digital signature to the application legality verification server.
  • the application server returns an application signature to the application legality verification server A name response message carrying a second digital signature.
  • the application legality verification server determines, according to the first digital signature and the second digital signature, whether the application is legal.
  • the application legality verification server sends the identifier of the application and the first digital signature to the terminal device.
  • the terminal device receives an interaction message between the application server and the application, and obtains an identifier and a digital signature of the application carried in the interaction message.
  • the terminal device compares whether the application identifier carried in the interaction message and the application identifier sent by the application validity verification server are consistent.
  • step 510 is performed.
  • the terminal device compares whether the digital signature carried in the interaction message and the digital signature sent by the application validity verification server are consistent.
  • step 510 may be performed first, then step 509 may be performed, or may be performed at the same time.
  • step 511 is performed, otherwise step 512 is performed.
  • the terminal device forwards the interaction message.
  • the terminal device discards the interaction message.
  • the embodiment of the present invention further provides a system for verifying the validity of an application, where the system includes an application legality verification server 601 and a terminal device 602.
  • the application legality verification server 601 is located on the EPS core network side, and the application legality verification server can be integrated into an existing core network server, for example, a Proximity Service Function (Prose function) server; a Prose function A logical network element added to the EPS for device-to-device communication (3GPP Release-12D2D) in the 3GPP standard 12 system for implementing management of the through terminal.
  • Proximity Service Function Prose function
  • Prose function Proximity Service Function
  • Prose function Prose function A logical network element added to the EPS for device-to-device communication (3GPP Release-12D2D) in the 3GPP standard 12 system for implementing management of the through terminal.
  • the application validity verification server may also be a logical network element independently, for example, by adding a new server implementation on the EPS core network side, which may include the apparatus shown in FIG.
  • the terminal device 602 may be an electronic device capable of installing an application (Application), such as a personal computer, a PAD, a mobile phone, etc., and may include the device as shown in FIG.
  • an embodiment of the present invention further provides a method for verifying the legitimacy of an application.
  • the method is applied to the system shown in Figure 6, the method comprising:
  • the application legality verification server sends, to the terminal device, a random number corresponding to the application installed by the terminal device and a second digital signature corresponding to the application.
  • the second digital signature is a digital signature calculated by the application legality verification server according to the random number, a locally pre-stored key, and a preset algorithm.
  • the terminal device calculates the first digital signature according to the random number, a locally pre-stored key, and a preset algorithm.
  • the following steps 703 and 704 describe a specific implementation process in which the terminal device is used as an execution body for verifying the legitimacy of the application, which is also different from the method shown in FIG. 3 to FIG. 5 in that the application legality verification server is used as the execution subject. To reduce the number of interactions between the terminal device and the application validity verification server.
  • the terminal device compares whether the first digital signature calculated by itself and the second digital signature sent by the application validity verification server are consistent.
  • the terminal device determines that the application is a legitimate application.
  • the application legality verification server sends the identifier of the legitimate application to the terminal device, and the terminal device saves the identifier of the legitimate application and the corresponding corresponding to the legitimate application.
  • a digital signature In this way, when the terminal device processes the interactive message of the application, the interaction information carries the identifier of the application and the digital signature corresponding to the application, and compares the identifier of the application carried in the interaction information with the identifier of the application saved locally, Whether the digital signature carried in the interaction information is consistent with the digital signature saved locally. If the two signatures are consistent, the interaction message is forwarded. Otherwise, the interaction message is discarded.
  • the application validity verification server sends a random number to the terminal device, so that the terminal device calculates the first digital signature corresponding to the application; the application legality verification server also sends the terminal device to the terminal device. Send the calculated second digital signature.
  • the terminal device can compare whether the first digital signature calculated by itself and the second digital signature sent by the application validity verification server are consistent, and if they are consistent, determine that the application is a legitimate application.
  • the method for verifying the legitimacy of the application provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and thus the terminal is compared with the method for verifying the validity of the application installed in the terminal device.
  • the device only processes the legitimate application normally, avoiding the use of illegal applications by the terminal device. The security risks brought by the order.
  • the periodic verification of the validity of the application may be implemented in the following manner: a timer is set in the terminal device, and when the timeout ends, the terminal device may use the locally saved random number calculation digital signature to initiate the verification request again. If the application's legality verification has not been completed, the terminal device discards the data sent by the application.
  • an embodiment of the present invention provides a process for verifying the validity of an application periodically.
  • the verification process is performed by using the verification cycle 1 and the verification cycle 2 as an example.
  • the application legality verification server sends, to the terminal device, a plurality of random numbers corresponding to the application and a digital signature corresponding to each random number.
  • the terminal device locally saves the multiple random numbers and a digital signature corresponding to each random number.
  • the terminal device calculates the digital signature 1 according to the random number 1 in the plurality of random numbers, the locally pre-stored key, and a preset algorithm.
  • the terminal device compares whether the digital signature 1 calculated by itself is consistent with the digital signature corresponding to the random number 1 sent by the application validity verification server.
  • the terminal device calculates the digital signature 2 according to the random number 2 in the plurality of random numbers, the locally pre-stored key, and a preset algorithm.
  • the terminal device compares whether the digital signature 2 calculated by itself is consistent with the digital signature corresponding to the random number 2 sent by the application validity verification server.
  • an embodiment of the present invention provides an application legality verification server, which is used to perform the method shown in any of the embodiments of FIG. 3 to FIG.
  • the sending module 901 is configured to send a random number to the terminal device and the application server, respectively.
  • the receiving module 902 is configured to receive a first digital signature sent by the terminal device and a second digital signature sent by the application server, where the first digital signature is sent by the terminal device according to the sending module 901. a random number, a key pre-stored by the terminal device, and a preset algorithm are calculated; the second digital signature is a random number sent by the application server according to the sending module 901, and the application server is locally pre-prescribed The stored key is And the default algorithm is calculated.
  • the processing module 903 is configured to determine, according to the first digital signature and the second digital signature received by the receiving module 902, whether the application installed by the terminal device is legal.
  • the sending module 901 is further configured to: when the processing module 903 determines that the application installed by the terminal device is a legitimate application, send, to the terminal device, an application corresponding to the terminal device installed Identification and the first digital signature.
  • the processing module 903 is specifically configured to: compare whether the first digital signature and the second digital signature are consistent; and when the first digital signature and the second digital signature are consistent, determine that the terminal device is installed.
  • the application is a legitimate application.
  • the processing module 903 is specifically configured to: generate a third digital signature according to the locally pre-stored key, a preset algorithm, and the random number; and compare whether the first digital signature and the second digital signature are equal And the third digital signature is consistent; when the first digital signature and the second digital signature are consistent with the third digital signature, determining that the application installed by the terminal device is a legitimate application.
  • the receiving module 902 is further configured to receive an identifier of an application that is installed by the terminal device and sent by the terminal device.
  • the processing module 903 is further configured to determine an address of the application server according to the identifier of the application received by the receiving module 902 and a preset mapping table, where the preset mapping table includes each application. The identity of the identity and the address of each application server.
  • the physical device corresponding to the sending module in the embodiment of the present invention may be a transmitter, and the physical device corresponding to the receiving module may be a receiver, and the physical device corresponding to the processing module is a processor.
  • the sending module sends a random number to the terminal device and the application server, respectively, so that the terminal device and the application server respectively calculate the digital signature according to the random number
  • the receiving module respectively receives the terminal device and the application server to calculate
  • the digital signature of the processing module determines whether the application installed by the terminal device is legal by comparing whether the digital signature sent by the terminal device and the application server is consistent.
  • the application legality verification server provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and the terminal device is compared with the prior art, which does not verify the validity of the application installed by the terminal device. Only legitimate applications are processed normally to avoid terminal devices The security risks associated with using an illegal application.
  • an embodiment of the present invention provides a terminal device, which is used to perform the method shown in any of the embodiments of FIG. 3 to FIG.
  • the receiving module 1001 is configured to receive a first identifier of the application installed by the terminal device sent by the application validity verification server, and a first digital signature corresponding to the application.
  • the processing module 1002 is configured to obtain an interaction message between the application server and the application, where the interaction message carries a second identifier of the application and a second digital signature corresponding to the application.
  • the processing module 1002 is further configured to compare whether the first identifier received by the receiving module 1001 and the second identifier obtained by the processing module 1002 from the interaction information are consistent, when the first identifier and the second identifier are When the first digital signature received by the receiving module 1001 and the second digital signature obtained by the processing module 1002 are consistent, when the first digital signature and the second digital signature are consistent, the processing is performed.
  • the interactive message is further configured to compare whether the first identifier received by the receiving module 1001 and the second identifier obtained by the processing module 1002 from the interaction information are consistent, when the first identifier and the second identifier are When the first digital signature received by the receiving module 1001 and the second digital signature obtained by the processing module 1002 are consistent, when the first digital signature and the second digital signature are consistent, the processing is performed.
  • the interactive message is further configured to compare whether the first identifier received by the receiving module 1001 and the second identifier obtained by the processing module 1002 from the interaction information are consistent, when the first identifier and the second
  • the physical device corresponding to the receiving module in the embodiment of the present invention may be a receiver, and the physical device corresponding to the processing module is a processor.
  • the receiving module receives the identifier and the digital signature of the legitimate application sent by the application legality verification server; when receiving the interaction message between the application and the application server, the processing module carries the comparison message by comparing the interaction message.
  • the application identifier, the digital signature, and the application legality verification server are consistent with the identifier and the digital signature sent by the server. If they are consistent, the interaction message is an interactive message of the legitimate application, and the interaction message is processed, and only the processing is legal. Interactive messages between the application and the application server to avoid security risks caused by the use of illegal applications.
  • an embodiment of the present invention further provides an application legality verification server, which is used to execute the method shown in FIG. 7.
  • the server includes:
  • the sending module 1101 is configured to send a random number to the terminal device, where the random number is used by the terminal device to calculate, according to the random number, a locally pre-stored key, and a preset algorithm, an application corresponding to the terminal device installation The first digital signature.
  • the processing module 1102 is configured to calculate, according to the locally pre-stored key, the preset algorithm, and the random number, a second digital signature corresponding to the application.
  • the sending module 1101 is further configured to send the second digital signature corresponding to the application to the terminal device.
  • the physical device corresponding to the sending module in the embodiment of the present invention may be a transmitter, and the physical device corresponding to the processing module is a processor.
  • the sending module sends a random number to the terminal device to facilitate the terminal device to calculate the first digital signature
  • the processing module calculates the second digital signature and sends the second digital signature to the terminal device by using the sending module.
  • the terminal device compares whether the first digital signature calculated by itself and the second digital signature sent by the sending module are consistent. If they are consistent, the application is determined to be a legitimate application.
  • the device for verifying the validity of the application provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and thus the terminal is legally verified. The device only processes the legitimate application normally, avoiding the security risks caused by the use of illegal applications by the terminal device.
  • an embodiment of the present invention further provides a terminal device, configured to perform the method shown in FIG. 7, including:
  • the receiving module 1201 is configured to receive a random number sent by the application legality verification server.
  • the processing module 1202 is configured to calculate, according to the random number received by the receiving module 1201, a locally pre-stored key, and a preset algorithm, a first digital signature corresponding to the application installed by the terminal device.
  • the processing module 1202 is configured to acquire a first identifier of an application installed by the terminal device.
  • the receiving module 1201 is further configured to receive a second digital signature corresponding to the application sent by the application validity verification server.
  • the processing module 1202 is further configured to compare whether the first digital signature calculated by the processing module 1202 and the second digital signature received by the receiving module 1201 are consistent, when the first digital signature and the second digital signature are consistent. When it is determined, the application installed by the terminal device is a legitimate application.
  • the physical device corresponding to the receiving module in the embodiment of the present invention may be a receiver, and the physical device corresponding to the processing module is a processor.
  • the receiving module receives the application legality verification server Transmitting a random number and calculating, by the processing module, the first digital signature according to the random number; the receiving module is further configured to receive a second digital signature sent by the application legality verification server, and the processing module compares the first digital signature with the second digital signature Consistent, when all are consistent, make sure the application is a legitimate application.
  • the device for verifying the validity of the application provided by the embodiment of the present invention can verify whether the application installed by the terminal device is legal, and thus the terminal is legally verified. The device only processes the legitimate application normally, avoiding the security risks caused by the use of illegal applications by the terminal device.
  • the embodiment of the present invention further provides a system, including the application legality verification server shown in FIG. 9, the terminal device and the application server shown in FIG. 10, wherein the application server is corresponding to the application installed on the terminal device. Server.
  • the embodiment of the present invention further provides a system, including the application legality verification server shown in FIG. 11 and the terminal device shown in FIG.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了验证应用程序合法性的方法、装置及***，涉及通信技术领域。为了解决现有技术中存在的不进行应用程序合法性验证，进而存在安全隐患的问题而发明。该方法包括：应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数；分别接收应用程序发送的第一数字签名和服务器发送的第二数字签名，第一数字签名为终端设备根据随机数、终端设备本地预存储的密钥以及预设算法计算得到；第二数字签名为应用程序服务器根据随机数、服务器本地预存储的密钥以及预设算法计算得到；根据第一数字签名和第二数字签名，确定应用程序是否合法。本发明应用在终端设备使用应用程序的过程中。

Description

验证应用程序合法性的方法、装置及*** 技术领域
本发明涉及通信技术领域，尤其涉及一种验证应用程序合法性的方法、装置及***。
背景技术
随着通信技术的发展，越来越多的用户通过在手机等终端设备上安装的应用程序(Application，APP)实现网络访问。目前，如图1所示，终端设备10一般包括应用程序层101、操作***层102和硬件设备层103；其中，应用程序层是指实现例如即时通信、看电影等功能的程序的集合体，其包含了APP1、APP2等各种应用程序；操作***层是指实现应用程序的安装、调度、卸载以及和终端设备的硬件进行信息交互的功能集合体，常见的操作***包括安卓、IOS操作***等，其一般包括TCP/IP层和硬件抽象层(Hardware Abstraction Layer，HAL)；硬件设备层一般包括CPU、内存以及蓝牙低功耗(Bluetooth Low Energy，BLE)、无线保真(WIreless-Fidelity，Wi-Fi)等通信模块等。
APP与APP服务器交互时，APP首先通过操作***向通信模块发送接入无线网络的请求，通信模块根据该请求和运营商的网络建立数据传输通道，然后将应用程序的消息传输到APP服务器。同理，从服务器返回的消息需要依次通过通信模块、操作***最后发送至APP。
在上述交互过程中，通信模块是一个被动转发的过程，只负责根据请求将来自APP的数据发送到网络上以及从网络上接收到数据就传输给APP，而不对APP是否合法进行判断。当终端设备感染病毒后，非法的木马程序或者被篡改的应用程序的数据可以直接访问互联网进行非法的操作，存在安全隐患。
发明内容
本发明提供一种验证应用程序合法性的方法、装置及***，以解决现有技术中存在的由于不对应用程序的合法性进行判断带来的安全隐患的问题。
为达到上述目的，本发明采用如下技术方案：
第一方面，本发明实施例提供一种验证应用程序合法性的方法，所述 方法包括：应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数；分别接收所述终端设备发送的第一数字签名和所述应用程序服务器发送的第二数字签名，所述第一数字签名为所述终端设备根据所述随机数、所述终端设备本地预存储的密钥以及预设算法计算得到；所述第二数字签名为所述应用程序服务器根据所述随机数、所述应用程序服务器本地预存储的密钥以及所述预设算法计算得到；根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
本发明实施例提供的验证应用程序合法性的方法，应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数，以便于终端设备和应用程序服务器分别根据随机数计算数字签名，应用程序合法性验证服务器通过比较终端设备和应用程序服务器发送的数字签名是否一致来确定终端设备安装的应用程序是否合法。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的方法，能够通过应用程序合法性验证服务器验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
可选的，在第一方面的第一种实现方式中，在确定所述终端设备安装的应用程序是否合法后，所述方法还包括：如果所述终端设备安装的应用程序为合法应用程序，则所述应用程序合法性验证服务器向所述终端设备发送所述应用程序所对应的标识以及所述第一数字签名。
在该实现方式中，应用程序合法性验证服务器将合法应用程序的标识以及对应的合法数字签名发送给终端设备以便于终端设备根据该标识和数字签名对合法应用程序发送的交互信息等进行正常处理。
可选的，结合第一方面或者第一方面的第一种实现方式，在第一方面的第二种实现方式中，所述根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法，包括：所述应用程序合法性验证服务器比较所述第一数字签名和第二数字签名是否一致；如果所述第一数字签名和第二数字签名一致，则确定所述终端设备安装的应用程序合法。
该实现方式给出了应用程序合法性验证服务器验证应用程序是否合法的一种实现方式。通过该实现方式，应用程序合法性验证服务器比较终 端设备和应用程序服务器分别发送的数字签名是否一致，当两者发送的数字签名一致时，确定所述应用程序为合法应用程序。
可选的，结合第一方面或者第一方面的第一种实现方式，在第一方面的第三种实现方式中，所述根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法，包括：所述应用程序合法性验证服务器根据本地预存储的密钥、所述预设算法和所述随机数生成第三数字签名；比较所述第一数字签名、第二数字签名是否均和所述第三数字签名一致；如果所述第一数字签名、第二数字签名均和所述第三数字签名一致，则确定所述终端设备安装的应用程序为合法应用程序。
该实现方式给出了应用程序合法性验证服务器验证应用程序是否合法的另一种实现方式。通过该实现方式，应用程序合法性验证服务器比较终端设备、应用程序服务器发送的数字签名与应用程序合法性验证服务器自身计算的数字签名是否一致，当三个数字签名均一致时，确定应用程序为合法应用程序。
可选的，结合第一方面、第一方面的第一种实现方式、第二种实现方式或者第三种实现方式中的任意一种，在第一方面的第四种实现方式中，在所述应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数前，所述方法还包括：所述应用程序合法性验证服务器接收所述终端设备发送的所述终端设备安装的应用程序的标识；根据所述应用程序的标识以及预设映射表，确定所述应用程序服务器的地址，所述预设映射表包括每个应用程序的标识和每个应用程序服务器的地址的对应关系。
第二方面，本发明实施例还提供一种验证应用程序合法性的方法，所述方法包括：终端设备接收应用程序合法性验证服务器发送的终端设备安装的应用程序的第一标识以及所述应用程序对应的第一数字签名；获取应用程序服务器与所述终端设备安装的应用程序的交互消息，所述交互消息中携带所述应用程序的第二标识和所述应用程序对应的第二数字签名；比较所述第一标识和所述第二标识是否一致；如果一致，则比较所述第一数字签名和所述第二数字签名是否一致；如果一致，则处理所述交互消息。
本发明实施例提供的验证应用程序合法性的方法，终端设备接收应用程序合法性验证服务器发送的合法应用程序的标识和数字签名；这样，终 端设备在接收到应用程序和应用程序服务器的交互消息时，通过比较交互消息中携带的应用程序标识和应用程序合法性验证服务器发送的标识是否一致，以及交互消息中携带的数字签名和应用程序合法性验证服务器发送的数字签名是否一致，如果一致，则表明该交互消息为合法应用程序的交互消息，则处理该交互消息，能够实现仅处理合法应用程序与应用程序服务器之间的交互消息，避免因使用非法应用程序带来的安全隐患。
第三方面，本发明实施例还提供一种验证应用程序合法性的方法，所述方法包括：应用程序合法性验证服务器向终端设备发送终端设备安装的应用程序对应的随机数以便于所述终端设备根据本地预存储的密钥、预设算法以及所述随机数计算所述终端设备安装的应用程序对应的第一数字签名；应用程序合法性验证服务器根据本地预存储的密钥、所述预设算法和所述随机数计算得到所述应用程序对应的第二数字签名，并向所述终端设备发送所述第二数字签名。
本发明实施例提供的验证应用程序合法性的方法，应用程序合法性验证服务器向终端设备发送随机数以便于终端设备计算应用程序对应的第一数字签名；应用程序合法性验证服务器还向终端设备发送其计算后的得到第二数字签名。终端设备能够比较其自身计算的第一数字签名和应用程序合法性验证服务器发送的第二数字签名是否一致，如果一致，则确定所述应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的方法，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
第四方面，本发明实施例还提供一种验证应用程序合法性的方法，所述方法包括：终端设备接收应用程序合法性验证服务器发送的终端设备安装的应用程序对应的随机数；根据所述随机数、本地预存储的密钥和预设算法计算所述终端设备安装的应用程序对应的第一数字签名；终端设备还接收所述应用程序合法性验证服务器发送的所述应用程序对应的第二数字签名；比较所述第一数字签名和第二数字签名是否一致；如果一致，则确定所述终端设备安装的应用程序为合法应用程序。
本发明实施例提供的验证应用程序合法性的方法，终端设备接收应用程序合法性验证服务器发送的随机数和第二数字签名；计算应用程序的第一数字签名，比较第一数字签名和第二数字签名是否一致，如果均一致，则确定应用程序为合法应用程序。
第五方面，本发明实施例提供一种应用程序合法性验证服务器，包括：发送模块，用于分别向终端设备和应用程序服务器发送随机数；接收模块，用于分别接收所述终端设备发送的第一数字签名和所述应用程序服务器发送的第二数字签名，所述第一数字签名为所述终端设备根据所述发送模块发送的随机数、所述终端设备本地预存储的密钥以及预设算法计算得到；所述第二数字签名为所述应用程序服务器根据所述发送模块发送的随机数、所述应用程序服务器本地预存储的密钥以及预设算法计算得到；处理模块，用于根据所述接收模块接收的第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
本发明实施例提供的应用程序合法性验证服务器，发送模块分别向终端设备和应用程序服务器发送随机数，以便于终端设备和应用程序服务器分别根据随机数计算数字签名，接收模块分别接收终端设备和应用程序服务器计算得到的数字签名，处理模块通过比较终端设备和应用程序服务器发送的数字签名是否一致来判断终端设备安装的应用程序是否合法。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的应用程序合法性验证服务器，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
可选的，结合第五方面，在第五方面的第一种实现方式中，所述发送模块，还用于在所述处理模块确定所述终端设备安装的应用程序为合法应用程序时，向所述终端设备发送所述终端设备安装的应用程序所对应的标识以及所述第一数字签名。
可选的，结合第五方面或者第五方面的第一种实现方式，在第五方面的第二种实现方式中，所述处理模块具体用于：比较所述第一数字签名和第二数字签名是否一致；当所述第一数字签名和第二数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
可选的，结合第五方面或者第五方面的第一种实现方式，在第五方面的第三种实现方式中，所述处理模块具体用于：根据本地预存储的密钥、预设算法和所述随机数生成第三数字签名；比较所述第一数字签名、第二数字签名是否均和所述第三数字签名一致；当所述第一数字签名、第二数字签名均和所述第三数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
可选的，结合第五方面或者第五方面的第一种实现方式、第二种实现方式、第三种实现方式中的任意一种，在第五方面的第四种实现方式中，所述接收模块，还用于接收所述终端设备发送的所述终端设备安装的应用程序的标识；所述处理模块，还用于根据所述接收模块接收的所述应用程序的标识以及预设映射表，确定所述应用程序服务器的地址，所述预设映射表包括每个应用程序的标识和每个应用程序服务器的地址的对应关系。
第六方面，本发明实施例提供一种终端设备，包括：接收模块，用于接收应用程序合法性验证服务器发送的所述终端设备安装的应用程序的第一标识以及所述应用程序对应的第一数字签名；处理模块，用于获取应用程序服务器与所述应用程序的交互消息，所述交互消息中携带所述应用程序的第二标识和所述应用程序对应的第二数字签名；所述处理模块，还用于比较所述接收模块接收的第一标识和所述处理模块从交互信息中获取的所述第二标识是否一致，当所述第一标识和第二标识一致时，比较所述接收模块接收的第一数字签名和所述处理模块从交互信息中获取的第二数字签名是否一致，当所述第一数字签名和第二数字签名一致时，处理所述交互消息。
本发明实施例提供的终端设备，接收模块接收应用程序合法性验证服务器发送的合法应用程序的标识和数字签名；处理模块在接收到应用程序和应用程序服务器的交互消息时，通过比较交互消息中携带的应用程序标识、数字签名和应用程序合法性验证服务器发送的标识和数字签名是否一致，如果一致，则表明该交互消息为合法应用程序的交互消息，则处理该交互消息，能够实现仅处理合法应用程序与应用程序服务器之间的交互消息，避免因使用非法应用程序带来的安全隐患。
第七方面，本发明实施例还提供一种应用程序合法性验证服务器，包 括：发送模块，用于向终端设备发送随机数，所述随机数用于所述终端设备根据所述随机数、本地预存储的密钥和预设算法计算得到所述终端设备安装的应用程序对应的第一数字签名；处理模块，用于根据本地预存储的密钥、所述预设算法和所述随机数计算得到所述应用程序对应的第二数字签名；所述发送模块，还用于向所述终端设备发送所述应用程序对应的所述第二数字签名。
本发明实施例提供的应用程序合法性验证服务器，发送模块向终端设备发送随机数以便于终端设备计算第一数字签名；处理模块计算第二数字签名并通过发送模块向终端设备发送该第二数字签名。这样，终端设备比较其自身计算的第一数字签名和发送模块发送的第二数字签名是否一致，如果一致，则确定所述应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的应用程序合法性验证服务器，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
第八方面，本发明实施例还提供一种终端设备，包括：接收模块，用于接收应用程序合法性验证服务器发送的终端设备安装的应用程序对应的随机数；处理模块，用于根据所述接收模块接收的随机数、本地预存储的密钥和预设算法计算所述应用程序对应的第一数字签名；所述接收模块，还用于接收所述应用程序合法性验证服务器发送的所述应用程序对应的第二数字签名；所述处理模块，还用于比较所述处理模块计算得到的所述第一数字签名和所述接收模块接收的第二数字签名是否一致，当所述第一数字签名和第二数字签名一致时，确定所述应用程序为合法应用程序。
本发明实施例提供的终端设备，接收模块接收应用程序合法性验证服务器发送的随机数并由处理模块根据该随机数计算第一数字签名；接收模块还用于接收应用程序合法性验证服务器发送的第二数字签名，处理模块比较第一数字签名和第二数字签名是否一致，当均一致时，确定应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的终端设备，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正 常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
第九方面，本发明实施例还提供一种验证应用程序合法性的***，包括：第五方面及第五方面的任意一种实现方式中所述的应用程序合法性验证服务器、第六方面所述的终端设备和应用程序服务器，其中，所述应用程序服务器为与终端设备上安装的应用程序对应的服务器。
本发明实施例提供的验证应用程序合法性的***，应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数，终端设备和应用程序服务器分别根据随机数计算数字签名，应用程序合法性验证服务器通过比较终端设备和应用程序服务器发送的数字签名是否一致来判断终端设备安装的应用程序是否合法。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的***，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
第十方面，本发明实施例还提供一种验证应用程序合法性的***，包括：第七方面所述的应用程序合法性验证服务器和第八方面所述的终端设备。
本发明实施例提供的验证应用程序合法性的***，应用程序合法性验证服务器向终端设备发送随机数；终端设备根据该随机数计算第一数字签名；应用程序合法性验证服务器还向终端设备发送第二数字签名，终端设备比较其计算得到的第一数字签名和应用程序合法性验证服务器发送的第二数字签名是否一致，如果一致，则确定所述应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的***，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员 来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为现有技术提供的终端设备的结构示意图；
图2为本发明实施例提供的第一种验证应用程序合法性的***的结构示意图；
图3为本发明实施例提供的第一种验证应用程序合法性的方法的流程图；
图4为本发明实施例提供的第二种验证应用程序合法性的方法的流程图；
图5为本发明实施例提供的第三种验证应用程序合法性的方法的流程图；
图6为本发明实施例提供的第二种验证应用程序合法性的***的结构示意图；
图7为本发明实施例提供的第四种验证应用程序合法性的方法的流程图；
图8为本发明实施例提供的周期性验证应用程序合法性的流程示意图；
图9为本发明实施例提供的第一种应用程序合法性验证服务器的结构示意图；
图10为本发明实施例提供的第一种终端设备的结构示意图；
图11为本发明实施例提供的第二种应用程序合法性验证服务器的结构示意图；
图12为本发明实施例提供的第二种终端设备的结构示意图。
具体实施方式
下面将结合本实施例中的附图，对本实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供的验证应用程序合法性的方法、装置及***主要应用在第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)提 出的演进的分组***(Evolved Packet System，EPS)中。
如图2所示，本发明实施例提供一种验证应用程序合法性的***，该***包括：应用程序合法性验证服务器201、终端设备202以及应用程序服务器203。其中，应用程序合法性验证服务器201位于EPS核心网侧，该应用程序合法性验证服务器可以集成在现有的核心网服务器中，例如：邻近服务功能(Proximity Service Function，Prose function)服务器；Prose function为3GPP标准12***中的设备到设备通信(3GPP Release-12D2D)在EPS中增加的一个逻辑网元，用于实现对于直通终端的管理。在其他实现方式中，该应用程序合法性验证服务器还可以独立成为一个逻辑网元，例如：通过在EPS核心网侧单独增加一个新的服务器实现，其可包含如图9所示的装置。终端设备202可以为个人电脑(Personal Computer)、PAD、手机等能够安装应用程序(Application，APP)的电子设备，其可包含如图10所示的装置。应用程序服务器203为与终端设备上安装的应用程序对应的服务器，不同的应用程序对应不同的应用程序服务器，所述应用程序服务器用于根据所述应用程序合法性验证服务器发送的随机数、本地预存储的密钥以及预设算法计算数字签名，并向所述应用程序合法性验证服务器发送所述数字签名。
如图3所示，本发明实施例提供了一种验证应用程序合法性的方法，可应用于如图2所示的***中，该方法包括：
301：应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数。
其中，该随机数为256位长，在具体使用时，可以截断使用，例如：仅使用其中的128位等。
3021：终端设备根据接收的随机数、本地预存储的密钥和预设算法计算第一数字签名。
3022：应用程序服务器根据接收的随机数、本地预存储的密钥和本地预存储的算法计算第二数字签名。
其中，终端设备和应用程序服务器均本地保存有由运营商预先分配的密钥(Key)值，以及用于计算数字签名的算法。对于同一个应用程序，终端设备和该应用程序对应的应用程序服务器保存的密钥值和算法均相 同。
步骤3021中，终端设备根据本地存储的算法以及接收的随机数生成摘要，并利用本地存储的密钥值对该摘要进行加密，得到加密后的摘要；该加密后的摘要即为终端设备计算得到的第一数字签名。
同理，步骤3022中，应用程序服务器根据本地存储的算法以及接收的随机数生成摘要，并利用本地存储的密钥值对该摘要进行加密，得到加密后的摘要；该加密后的摘要即为应用程序服务器计算得到的第二数字签名。
3031：终端设备向应用程序合法性验证服务器发送第一数字签名。
3032：应用程序服务器向应用程序合法性验证服务器发送第二数字签名。
304：应用程序合法性验证服务器根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
在本步骤的第一种实现方式中，所述应用程序合法性验证服务器比较所述第一数字签名和第二数字签名；如果所述第一数字签名和第二数字签名相同，则确定所述终端设备安装的应用程序为合法应用程序。
在本步骤的第二种实现方式中，所述应用程序合法性验证服务器根据本地预存储的密钥、算法和所述随机数生成第三数字签名，通过该第三数字签名分别和第一数字签名、第二数字签名比较；如果第一数字签名、第二数字签名均和第三数字签名相同，则确定所述应用程序为合法应用程序。
数字签名(Digital Signature)一般用于保证信息传输的完整性、发送者的身份认证等。其一般通过使用非对称密钥加密技术来实现。具体为：信息的发布者使用第一密钥进行加密。接收方在接收到数字签名后，使用第二密钥进行验证。一般而言，第一密钥为公钥，第二密钥为私钥。有些情况下，第一密钥为私钥，第二密钥为公钥。因而，在本步骤的第三种实现方式中，运营商预分配给终端设备以及应用程序服务器的密钥值为公钥；应用程序合法性验证服务器保存的密钥为私钥。当终端设备和应用程序服务器返回数字签名到应用程序合法性验证服务器的时候，应用程序合法性验证服务器利用本地存储的私钥去分别解密第一数字签名和第二数 字签名，得到解密后的摘要，再根据解密后的摘要和本地存储的算法计算得到随机数，比较该计算得到的随机数和本地保存的随机数是否一致，如果一致，则确定所述应用程序为合法应用程序。
本发明实施例提供的验证应用程序合法性的方法，应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数，以便于终端设备和应用程序服务器分别根据随机数计算数字签名，应用程序合法性验证服务器通过比较终端设备和应用程序服务器发送的数字签名是否一致来确定终端设备安装的应用程序是否合法。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的方法，能够通过应用程序合法性验证服务器验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
作为上述方法的补充，在对终端设备安装的应用程序是否合法进行判断后，可根据判断结果处理应用程序与应用程序服务器等其他设备之间的交互信息。
如图4所示，本发明实施例还提供了一种验证应用程序合法性的方法，包括：
401：应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数。
其中，该步骤的具体实现过程可参考步骤301，此处不再赘述。
4021：终端设备根据接收的随机数、本地预存储的密钥和本地预存储的算法计算第一数字签名。
该步骤的具体实现过程可参考步骤3021，此处不再赘述。
4022：应用程序服务器根据接收的随机数、本地预存储的密钥和本地预存储的算法计算第二数字签名。
该步骤的具体实现过程可参考步骤3022，此处不再赘述。
4031：终端设备向应用程序合法性验证服务器发送第一数字签名。
该步骤的具体实现过程可参考步骤3031，此处不再赘述。
4032：应用程序服务器向应用程序合法性验证服务器发送第二数字签名。
该步骤的具体实现过程可参考步骤3032，此处不再赘述。
404：应用程序合法性验证服务器根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
该步骤的具体实现过程可参考步骤304，此处不再赘述。
405：如果所述终端设备安装的应用程序为合法应用程序，则应用程序合法性验证服务器向终端设备发送所述应用程序的标识以及所述第一数字签名。
其中，应用程序的标识为应用程序的名称和/或应用程序对应的IP地址。还可以包括应用程序所在的终端设备的IP地址。
在本步骤具体实现过程中，应用程序合法性验证服务器可以周期性的向终端设备发送合法性应用程序的标识列表，如下表表1所示，该列表中保存有在一个周期内的多个合法应用程序的标识及其对应的经验证的合法数字签名。应用程序合法性验证服务器也可以在每次对一个应用程序进行验证后及时告知终端设备该应用程序的验证结果。
表1
合法应用程序的标识 合法应用程序的数字签名
APP1-ID 合法数字签名1
APP2-ID 合法数字签名2
406：终端设备接收应用程序服务器与应用程序的交互消息，获取所述交互消息中携带的应用程序的标识和数字签名。
其中，应用程序在与其对应的服务器交互时，需要在包头信息中增加其标识以及签名信息。
407：终端设备比较所述交互消息中携带的应用程序标识和所述应用程序合法性验证服务器发送的应用程序标识是否一致。
如果一致，则执行步骤408。
408：比较所述交互消息中携带的数字签名和所述应用程序合法性验证服务器发送的数字签名是否一致。
可选的，本发明实施例不限定步骤509和步骤510的执行顺序，也可以先执行步骤510，再执行步骤509，或者同时执行。
如果一致，则表明该交互消息来自合法应用程序，执行步骤409，否则表明该交互消息来自非法应用程序，则执行步骤410。
409：终端设备转发所述交互消息。
410：终端设备丢弃所述交互消息。
可选的，终端设备上安装应用程序后，应用程序还会向应用程序合法性验证服务器发送安装的每个应用程序的标识；应用程序合法性验证服务器根据每个应用程序的标识以及每个应用程序对应的应用程序服务器的地址构建预设映射表并保存在本地。这样，在步骤301或401之前，在进行应用程序合法性验证时，终端设备向应用程序合法性验证服务器发送应用程序的标识，应用程序合法性验证服务器根据该标识以及预设映射表能够确定所述应用程序服务器的地址，进而向应用程序服务器发送随机数。
如下表表2所示，预设映射表中保存有各个应用程序的标识及其对应的应用程序服务器的地址。
表2
应用程序标识 应用程序服务器的地址
APP1-ID APP1-Server-IP
APP2-ID APP2-Server-IP
APP3-ID APP3-Server-IP
可选的，应用程序合法性验证服务器可以周期性的对终端设备安装的应用程序进行合法性验证。
在周期性验证的一种实现方式中，应用程序合法性验证服务器可一次性的向终端设备和应用程序服务器分配多个随机数，例如：RAND_0、RAND_1、RAND_2至RAND_N，并由终端设备和应用程序服务器本地保存。这样终端设备和应用程序服务器可周期性的利用本地保存的随机数计算数字签名并发起周期性验证的过程。或者，终端设备内设置定时器，定时器未到期时，允许应用程序发送携带数字签名的数据，定时器到期时，通知应用程序进行下一次的合法性验证，如果尚未完成下一次的合法性验证，则禁止或者丢弃应用程序发送的数据。
在周期性判断的另一种实现方式中，除了由终端设备周期性发起上述验证过程外，还可以由应用程序合法性验证服务器周期性的发起验证过程。示例性的，应用程序合法性验证服务器内设置定时器定时，当定时结束后，应用程序合法性验证服务器向终端设备重新发送随机数以开始进行新一轮的应用程序的合法性验证过程。
本发明实施例提供的上述验证应用程序合法性的方法，应用程序合法性验证服务器通过比较终端设备和应用程序服务器发送的数字签名是否一致来判断终端设备安装的应用程序是否合法，并将判断结果告知终端设备，使得终端设备在转发应用程序和其对应的应用程序服务器之间的交互消息时，仅转发合法应用程序的交互消息。
如图5所示，结合实际交互信令，本发明实施例还提供了一种验证应用程序合法性的方法，包括：
501：终端设备向应用程序合法性验证服务器发送终端设备安装的应用程序的注册请求消息。
其中，所述注册请求消息中携带应用程序标识。
可选的，注册请求消息中还可以携带终端设备的标识，例如：终端设备的IP地址。
502：应用程序合法性验证服务器根据注册请求消息中的应用程序标识以及本地存储的预设映射表查找到应用程序服务器的IP地址。
其中，预设映射表的具体实现可参考前文所述。
5031：应用程序合法性验证服务器向终端设备返回注册响应消息，所述注册响应消息中携带随机数。
5032：应用程序合法性验证服务器向应用程序服务器发送应用程序签名请求消息，所述应用程序签名请求消息中携带随机数。
5041：终端设备根据接收的随机数、本地预存储的密钥和本地预存储的算法计算第一数字签名。
5042：应用程序服务器根据接收的随机数、本地预存储的密钥和本地预存储的算法计算第二数字签名。
5051：终端设备向应用程序合法性验证服务器发送第一数字签名。
5052：应用程序服务器向应用程序合法性验证服务器返回应用程序签 名响应消息，该消息中携带第二数字签名。
506：应用程序合法性验证服务器根据所述第一数字签名和第二数字签名，确定所述应用程序是否合法。
507：如果所述应用程序为合法应用程序，则应用程序合法性验证服务器向终端设备发送所述应用程序的标识以及所述第一数字签名。
508：终端设备接收应用程序服务器与应用程序的交互消息，获取所述交互消息中携带的应用程序的标识和数字签名。
509：终端设备比较所述交互消息中携带的应用程序标识和所述应用程序合法性验证服务器发送的应用程序标识是否一致。
如果一致，则执行步骤510。
510：终端设备比较所述交互消息中携带的数字签名和所述应用程序合法性验证服务器发送的数字签名是否一致。
可选的，本发明实施例不限定步骤509和步骤510的执行顺序，也可以先执行步骤510，再执行步骤509，或者同时执行。
如果一致，则执行步骤511，否则执行步骤512。
511：终端设备转发所述交互消息。
512：终端设备丢弃所述交互消息。
如图6所示，本发明实施例还提供一种验证应用程序合法性的***，该***包括应用程序合法性验证服务器601和终端设备602。其中，应用程序合法性验证服务器601位于EPS核心网侧，该应用程序合法性验证服务器可以集成在现有的核心网服务器中，例如：邻近服务功能(Proximity Service Function，Prose function)服务器；Prose function为3GPP标准12***中的设备到设备通信(3GPP Release-12D2D)在EPS中增加的一个逻辑网元，用于实现对于直通终端的管理。在其他实现方式中，该应用程序合法性验证服务器还可以独立成为一个逻辑网元，例如：通过在EPS核心网侧单独增加一个新的服务器实现，其可包含如图11所示的装置。终端设备602可以为个人电脑(Personal Computer)、PAD、手机等能够安装应用程序(Application，APP)的电子设备，其可包含如图12所示的装置。
如图7所示，本发明实施例还提供了一种验证应用程序合法性的方 法，应用于图6所示的***中，所述方法包括：
701：应用程序合法性验证服务器向终端设备发送终端设备安装的应用程序对应的随机数以及所述应用程序对应的第二数字签名。
其中，该第二数字签名为应用程序合法性验证服务器根据所述随机数、本地预存储的密钥以及预设算法计算出来的数字签名。
702：终端设备根据所述随机数、本地预存储的密钥以及预设算法计算第一数字签名。
下述步骤703和步骤704描述了以终端设备作为验证应用程序合法性的执行主体的具体实现过程，这也与图3至图5所示的方法中以应用程序合法性验证服务器作为执行主体不同，可减少终端设备与应用程序合法性验证服务器之间的交互次数。
703：终端设备比较其自身计算的第一数字签名和应用程序合法性验证服务器发送的第二数字签名是否一致。
704：如果一致，则终端设备确定所述应用程序为合法应用程序。
可选的，在确定所述应用程序为合法应用程序后，应用程序合法性验证服务器向终端设备发送该合法应用程序的标识，终端设备保存该合法应用程序的标识和该合法应用程序对应的第一数字签名。这样，终端设备在处理应用程序的交互消息时，该交互信息中携带应用程序的标识和应用程序对应的数字签名，比较交互信息中携带的应用程序的标识和其本地保存的应用程序的标识、交互信息中携带的数字签名和其本地保存的数字签名是否一致，如果均一致，则转发该交互消息，否则，丢弃该交互消息。
本发明实施例提供的验证应用程序合法性的方法，应用程序合法性验证服务器向终端设备发送随机数以便于终端设备计算应用程序对应的第一数字签名；应用程序合法性验证服务器还向终端设备发送其计算后的得到第二数字签名。终端设备能够比较其自身计算的第一数字签名和应用程序合法性验证服务器发送的第二数字签名是否一致，如果一致，则确定所述应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的方法，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程 序带来的安全隐患。
可选的，可通过以下方式实现对应用程序合法性的周期性验证：终端设备内设置定时器，当一次定时结束后，终端设备可利用本地保存的随机数计算数字签名再次发起验证请求。如果尚未完成应用程序的合法性验证，终端设备则丢弃应用程序发送的数据。
如图8所示，本发明实施例提供了一种周期性的对应用程序进行合法性验证的实现过程，以验证周期1和验证周期2为例，该过程具体包括：
801：应用程序合法性验证服务器向终端设备发送应用程序对应的多个随机数以及与每个随机数对应的数字签名。
802：终端设备本地保存所述多个随机数以及与每个随机数对应的数字签名。
803：在验证周期1内，终端设备根据所述多个随机数中的随机数1、本地预存储的密钥和预设算法计算数字签名1。
804：终端设备比较其自身计算的数字签名1与所述应用程序合法性验证服务器发送的所述随机数1对应的数字签名是否一致。
805：如果一致，则确定所述应用程序为合法应用程序。
806：在验证周期2内，终端设备根据所述多个随机数中的随机数2、本地预存储的密钥和预设算法计算数字签名2。
807：终端设备比较其自身计算的数字签名2与所述应用程序合法性验证服务器发送的随机数2对应的数字签名是否一致。
805：如果一致，则确定所述应用程序为合法应用程序。
如图9所示，本发明实施例提供一种应用程序合法性验证服务器，用于执行图3至图5任一实施例所示的方法，包括：
发送模块901，用于分别向终端设备和应用程序服务器发送随机数。
接收模块902，用于分别接收所述终端设备发送的第一数字签名和所述应用程序服务器发送的第二数字签名，所述第一数字签名为所述终端设备根据所述发送模块901发送的随机数、所述终端设备本地预存储的密钥以及预设算法计算得到；所述第二数字签名为所述应用程序服务器根据所述发送模块901发送的随机数、所述应用程序服务器本地预存储的密钥以 及预设算法计算得到。
处理模块903，用于根据所述接收模块902接收的第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
进一步的，所述发送模块901，还用于在所述处理模块903确定所述终端设备安装的应用程序为合法应用程序时，向所述终端设备发送所述终端设备安装的应用程序所对应的标识以及所述第一数字签名。
可选的，所述处理模块903具体用于：比较所述第一数字签名和第二数字签名是否一致；当所述第一数字签名和第二数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
可选的，所述处理模块903具体用于：根据本地预存储的密钥、预设算法和所述随机数生成第三数字签名；比较所述第一数字签名、第二数字签名是否均和所述第三数字签名一致；当所述第一数字签名、第二数字签名均和所述第三数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
进一步的，所述接收模块902，还用于接收所述终端设备发送的所述终端设备安装的应用程序的标识。
所述处理模块903，还用于根据所述接收模块902接收的所述应用程序的标识以及预设映射表，确定所述应用程序服务器的地址，所述预设映射表包括每个应用程序的标识和每个应用程序服务器的地址的对应关系。
需要特别明的是，本发明实施例中的发送模块所对应的实体设备可以为发射器，接收模块对应的实体设备可以为接收器，处理模块对应的实体设备为处理器。
本发明实施例提供的装置，发送模块分别向终端设备和应用程序服务器发送随机数，以便于终端设备和应用程序服务器分别根据随机数计算数字签名，接收模块分别接收终端设备和应用程序服务器计算得到的数字签名，处理模块通过比较终端设备和应用程序服务器发送的数字签名是否一致来判断终端设备安装的应用程序是否合法。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的应用程序合法性验证服务器，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备 使用非法应用程序带来的安全隐患。
如图10所示，本发明实施例提供了一种终端设备，用于执行图3至图5任一实施例所示的方法，所述终端设备包括：
接收模块1001，用于接收应用程序合法性验证服务器发送的所述终端设备安装的应用程序的第一标识以及所述应用程序对应的第一数字签名。
处理模块1002，用于获取应用程序服务器与所述应用程序的交互消息，所述交互消息中携带所述应用程序的第二标识和所述应用程序对应的第二数字签名。
所述处理模块1002，还用于比较所述接收模块1001接收的第一标识和所述处理模块1002从交互信息中获取的所述第二标识是否一致，当所述第一标识和第二标识一致时，比较所述接收模块1001接收的第一数字签名和所述处理模块1002从交互信息中获取的第二数字签名是否一致，当所述第一数字签名和第二数字签名一致时，处理所述交互消息。
需要特别明的是，本发明实施例中的接收模块对应的实体设备可以为接收器，处理模块对应的实体设备为处理器。
本发明实施例提供的装置，接收模块接收应用程序合法性验证服务器发送的合法应用程序的标识和数字签名；处理模块在接收到应用程序和应用程序服务器的交互消息时，通过比较交互消息中携带的应用程序标识、数字签名和应用程序合法性验证服务器发送的标识和数字签名是否一致，如果一致，则表明该交互消息为合法应用程序的交互消息，则处理该交互消息，能够实现仅处理合法应用程序与应用程序服务器之间的交互消息，避免因使用非法应用程序带来的安全隐患。
如图11所示，本发明实施例还提供了一种应用程序合法性验证服务器，用于执行图7所示的方法，该服务器包括：
发送模块1101，用于向终端设备发送随机数，所述随机数用于所述终端设备根据所述随机数、本地预存储的密钥和预设算法计算得到所述终端设备安装的应用程序对应的第一数字签名。
处理模块1102，用于根据本地预存储的密钥、所述预设算法和所述随机数计算得到所述应用程序对应的第二数字签名。
所述发送模块1101，还用于向所述终端设备发送所述应用程序对应的所述第二数字签名。
需要特别明的是，本发明实施例中的发送模块所对应的实体设备可以为发射器，处理模块对应的实体设备为处理器。
本发明实施例提供的装置，发送模块向终端设备发送随机数以便于终端设备计算第一数字签名；处理模块计算第二数字签名并通过发送模块向终端设备发送该第二数字签名。这样，终端设备比较其自身计算的第一数字签名和发送模块发送的第二数字签名是否一致，如果一致，则确定所述应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的装置，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
如图12所示，本发明实施例还提供了一种终端设备，用于执行图7所示的方法，包括：
接收模块1201，用于接收应用程序合法性验证服务器发送的随机数。
处理模块1202，用于根据所述接收模块1201接收的随机数、本地预存储的密钥和预设算法计算所述终端设备安装的应用程序对应的第一数字签名。
所述处理模块1202，用于获取所述终端设备安装的应用程序的第一标识。
所述接收模块1201，还用于接收所述应用程序合法性验证服务器发送的所述应用程序对应的第二数字签名。
所述处理模块1202，还用于比较所述处理模块1202计算得到的第一数字签名和所述接收模块1201接收的第二数字签名是否一致，当所述第一数字签名和第二数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
需要特别明的是，本发明实施例中的接收模块对应的实体设备可以为接收器，处理模块对应的实体设备为处理器。
本发明实施例提供的装置，接收模块接收应用程序合法性验证服务器 发送的随机数并由处理模块根据该随机数计算第一数字签名；接收模块还用于接收应用程序合法性验证服务器发送的第二数字签名，处理模块比较第一数字签名和第二数字签名是否一致，当均一致时，确定应用程序为合法应用程序。与现有技术中不对终端设备安装的应用程序进行合法性验证进而存在安全隐患相比，本发明实施例提供的验证应用程序合法性的装置，能够验证终端设备安装的应用程序是否合法，进而终端设备仅对合法应用程序进行正常处理，避免由于终端设备使用非法应用程序带来的安全隐患。
本发明实施例还提供了一个***，包括图9所示的应用程序合法性验证服务器、图10所示的终端设备和应用程序服务器，其中，应用程序服务器为与终端设备上安装的应用程序对应的服务器。
本发明实施例还提供了一个***，包括图11所示的应用程序合法性验证服务器和图12所示的终端设备。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的***，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的***，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (15)

  1. 一种验证应用程序合法性的方法，其特征在于，所述方法包括：
    应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数；
    分别接收所述终端设备发送的第一数字签名和所述应用程序服务器发送的第二数字签名，所述第一数字签名为所述终端设备根据所述随机数、所述终端设备本地预存储的密钥以及预设算法计算得到；所述第二数字签名为所述应用程序服务器根据所述随机数、所述应用程序服务器本地预存储的密钥以及所述预设算法计算得到；
    根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
  2. 根据权利要求1所述的方法，其特征在于，在确定所述终端设备安装的应用程序是否合法后，所述方法还包括：
    如果所述终端设备安装的应用程序为合法应用程序，则所述应用程序合法性验证服务器向所述终端设备发送所述应用程序所对应的标识以及所述第一数字签名。
  3. 根据权利要求1或2所述的方法，其特征在于，所述根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法，包括：
    所述应用程序合法性验证服务器比较所述第一数字签名和第二数字签名是否一致；
    如果所述第一数字签名和第二数字签名一致，则确定所述终端设备安装的应用程序合法。
  4. 根据权利要求1或2所述的方法，其特征在于，所述根据所述第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法，包括：
    所述应用程序合法性验证服务器根据本地预存储的密钥、所述预设算法和所述随机数生成第三数字签名；
    比较所述第一数字签名、第二数字签名是否均和所述第三数字签名一致；
    如果所述第一数字签名、第二数字签名均和所述第三数字签名一致，则确定所述终端设备安装的应用程序为合法应用程序。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，在所述应用程序合法性验证服务器分别向终端设备和应用程序服务器发送随机数前，所述方法还包括：
    所述应用程序合法性验证服务器接收所述终端设备发送的所述终端设备安装的应用程序的标识；
    根据所述应用程序的标识以及预设映射表，确定所述应用程序服务器的地址，所述预设映射表包括每个应用程序的标识和每个应用程序服务器的地址的对应关系。
  6. 一种应用程序合法性验证服务器，其特征在于，包括：
    发送模块，用于分别向终端设备和应用程序服务器发送随机数；
    接收模块，用于分别接收所述终端设备发送的第一数字签名和所述应用程序服务器发送的第二数字签名，所述第一数字签名为所述终端设备根据所述发送模块发送的随机数、所述终端设备本地预存储的密钥以及预设算法计算得到；所述第二数字签名为所述应用程序服务器根据所述发送模块发送的随机数、所述应用程序服务器本地预存储的密钥以及预设算法计算得到；
    处理模块，用于根据所述接收模块接收的第一数字签名和第二数字签名，确定所述终端设备安装的应用程序是否合法。
  7. 根据权利要求6所述的服务器，其特征在于，
    所述发送模块，还用于在所述处理模块确定所述终端设备安装的应用程序为合法应用程序时，向所述终端设备发送所述终端设备安装的应用程序所对应的标识以及所述第一数字签名。
  8. 根据权利要求6或7所述的服务器，其特征在于，所述处理模块具体用于：
    比较所述第一数字签名和第二数字签名是否一致；
    当所述第一数字签名和第二数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
  9. 根据权利要求6或7所述的服务器，其特征在于，所述处理模块具 体用于：
    根据本地预存储的密钥、预设算法和所述随机数生成第三数字签名；
    比较所述第一数字签名、第二数字签名是否均和所述第三数字签名一致；
    当所述第一数字签名、第二数字签名均和所述第三数字签名一致时，确定所述终端设备安装的应用程序为合法应用程序。
  10. 根据权利要求6至9任一项所述的服务器，其特征在于，所述接收模块，还用于接收所述终端设备发送的所述终端设备安装的应用程序的标识；
    所述处理模块，还用于根据所述接收模块接收的所述应用程序的标识以及预设映射表，确定所述应用程序服务器的地址，所述预设映射表包括每个应用程序的标识和每个应用程序服务器的地址的对应关系。
  11. 一种终端设备，其特征在于，包括：
    接收模块，用于接收应用程序合法性验证服务器发送的所述终端设备安装的应用程序的第一标识以及所述应用程序对应的第一数字签名；
    处理模块，用于获取应用程序服务器与所述应用程序的交互消息，所述交互消息中携带所述应用程序的第二标识和所述应用程序对应的第二数字签名；
    所述处理模块，还用于比较所述接收模块接收的第一标识和所述处理模块从交互信息中获取的所述第二标识是否一致，当所述第一标识和第二标识一致时，比较所述接收模块接收的第一数字签名和所述处理模块从交互信息中获取的第二数字签名是否一致，当所述第一数字签名和第二数字签名一致时，处理所述交互消息。
  12. 一种应用程序合法性验证服务器，其特征在于，包括：
    发送模块，用于向终端设备发送随机数，所述随机数用于所述终端设备根据所述随机数、本地预存储的密钥和预设算法计算得到所述终端设备安装的应用程序对应的第一数字签名；
    处理模块，用于根据本地预存储的密钥、所述预设算法和所述随机数计算得到所述应用程序对应的第二数字签名；
    所述发送模块，还用于向所述终端设备发送所述应用程序对应的所述 第二数字签名。
  13. 一种终端设备，其特征在于，包括：
    接收模块，用于接收应用程序合法性验证服务器发送的终端设备安装的应用程序对应的随机数；
    处理模块，用于根据所述接收模块接收的随机数、本地预存储的密钥和预设算法计算所述应用程序对应的第一数字签名；
    所述接收模块，还用于接收所述应用程序合法性验证服务器发送的所述应用程序对应的第二数字签名；
    所述处理模块，还用于比较所述处理模块计算得到的所述第一数字签名和所述接收模块接收的第二数字签名是否一致，当所述第一数字签名和第二数字签名一致时，确定所述应用程序为合法应用程序。
  14. 一种验证应用程序合法性的***，其特征在于，包括：权利要求6至10任一项所述的应用程序合法性验证服务器、权利要求11所述的终端设备和应用程序服务器，其中，所述应用程序服务器为与终端设备上安装的应用程序对应的服务器。
  15. 一种验证应用程序合法性的***，其特征在于，包括：权利要求12所述的应用程序合法性验证服务器和权利要求13所述的终端设备。
PCT/CN2016/084809 2016-06-03 2016-06-03 验证应用程序合法性的方法、装置及*** WO2017206185A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/084809 WO2017206185A1 (zh) 2016-06-03 2016-06-03 验证应用程序合法性的方法、装置及***

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/084809 WO2017206185A1 (zh) 2016-06-03 2016-06-03 验证应用程序合法性的方法、装置及***

Publications (1)

Publication Number Publication Date
WO2017206185A1 true WO2017206185A1 (zh) 2017-12-07

Family

ID=60479550

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/084809 WO2017206185A1 (zh) 2016-06-03 2016-06-03 验证应用程序合法性的方法、装置及***

Country Status (1)

Country Link
WO (1) WO2017206185A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111651734A (zh) * 2020-05-27 2020-09-11 支付宝(杭州)信息技术有限公司 小程序应用的安装管理方法、装置、设备及***
CN113014391A (zh) * 2021-01-22 2021-06-22 深圳市网心科技有限公司 嵌入式***的鉴权方法、终端设备及计算机可读存储介质
US11449616B2 (en) * 2017-12-27 2022-09-20 China Unionpay Co., Ltd. Application management method for terminal, application server, and terminal

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130111592A1 (en) * 2011-10-26 2013-05-02 Verizon Patent And Licensing, Inc. Mobile application security and management service
CN103679002A (zh) * 2013-12-12 2014-03-26 小米科技有限责任公司 监控文件变化的方法、装置及服务器
CN103678993A (zh) * 2013-11-26 2014-03-26 小米科技有限责任公司 一种对终端进行控制的方法和装置
CN103886260A (zh) * 2014-04-16 2014-06-25 中国科学院信息工程研究所 一种基于二次签名验签技术的应用程序管控方法
CN104049973A (zh) * 2014-06-25 2014-09-17 北京思特奇信息技术股份有限公司 安卓应用程序的安全验证方法及装置
CN104751049A (zh) * 2015-03-09 2015-07-01 广东欧珀移动通信有限公司 一种应用程序安装方法及移动终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130111592A1 (en) * 2011-10-26 2013-05-02 Verizon Patent And Licensing, Inc. Mobile application security and management service
CN103678993A (zh) * 2013-11-26 2014-03-26 小米科技有限责任公司 一种对终端进行控制的方法和装置
CN103679002A (zh) * 2013-12-12 2014-03-26 小米科技有限责任公司 监控文件变化的方法、装置及服务器
CN103886260A (zh) * 2014-04-16 2014-06-25 中国科学院信息工程研究所 一种基于二次签名验签技术的应用程序管控方法
CN104049973A (zh) * 2014-06-25 2014-09-17 北京思特奇信息技术股份有限公司 安卓应用程序的安全验证方法及装置
CN104751049A (zh) * 2015-03-09 2015-07-01 广东欧珀移动通信有限公司 一种应用程序安装方法及移动终端

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11449616B2 (en) * 2017-12-27 2022-09-20 China Unionpay Co., Ltd. Application management method for terminal, application server, and terminal
CN111651734A (zh) * 2020-05-27 2020-09-11 支付宝(杭州)信息技术有限公司 小程序应用的安装管理方法、装置、设备及***
CN113014391A (zh) * 2021-01-22 2021-06-22 深圳市网心科技有限公司 嵌入式***的鉴权方法、终端设备及计算机可读存储介质

Similar Documents

Publication Publication Date Title
WO2018214777A1 (zh) 一种数据通信方法、装置、设备和存储介质
TWI610577B (zh) 用於使用特定於應用的網路存取身份碼來進行到無線網路的受贊助連接的設備和方法（一）
KR102018971B1 (ko) 네트워크 액세스 디바이스가 무선 네트워크 액세스 포인트를 액세스하게 하기 위한 방법, 네트워크 액세스 디바이스, 애플리케이션 서버 및 비휘발성 컴퓨터 판독가능 저장 매체
US20190123909A1 (en) End-to-End Service Layer Authentication
WO2018050081A1 (zh) 设备身份认证的方法、装置、电子设备及存储介质
US11451614B2 (en) Cloud authenticated offline file sharing
WO2018076365A1 (zh) 密钥协商方法及装置
US8418242B2 (en) Method, system, and device for negotiating SA on IPv6 network
CN113099443B (zh) 设备认证方法、装置、设备和***
JP6896940B2 (ja) 第１のアプリケーションと第２のアプリケーションとの間の対称型相互認証方法
US20190281449A1 (en) Secure ble just works pairing method against man-in-the-middle attack
CN109302412B (zh) 基于CPK的VoIP通信处理方法、终端、服务器及存储介质
CN107040513B (zh) 一种可信访问认证处理方法、用户终端和服务端
WO2019052227A1 (zh) 一种授权方法和网元
WO2016201732A1 (zh) 一种虚拟sim卡参数管理方法、移动终端及服务器
JP2017535998A5 (zh)
JP7292263B2 (ja) デジタル証明書を管理するための方法および装置
TW201644292A (zh) 用於使用特定於應用的網路存取身份碼來進行到無線網路的受贊助連接的設備和方法（二）
KR20160078426A (ko) 무선 직접통신 네트워크에서 비대칭 키를 사용하여 아이덴티티를 검증하기 위한 방법 및 장치
CN107026823B (zh) 应用于无线局域网wlan中的接入认证方法和终端
WO2016011588A1 (zh) 移动管理实体、归属服务器、终端、身份认证***和方法
CN111970699A (zh) 一种基于ipk的终端wifi登陆认证方法以及***
US20140237627A1 (en) Protecting data in a mobile environment
WO2017206185A1 (zh) 验证应用程序合法性的方法、装置及***
JP6122422B2 (ja) モバイルネット

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16903570

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16903570

Country of ref document: EP

Kind code of ref document: A1