Android application biometric authentication security method based on static detection

Abstract

The invention discloses an Android application biometric authentication security method based on static detection. The method comprises the following steps: extracting static resource files from a to-be-detected application installation package, and collecting to obtain application basic information; decompiling a DEX file in the application installation package by using a Soot analysis tool and a Soot-infoflow-android Android static analysis tool through reverse engineering, obtaining a Jimple intermediate language, and loading the application installation package to a global memory space; through a static analysis technology, performing biometric authentication interface security analysis and third-party dependency library identification analysis on the use condition of an biometric authentication interface of an application program, so as to eliminate misuse of the biometric authentication interface and misuse of the biometric authentication interface matched with a cryptographic object; obtaining the implementation security of the biometric authentication interface of the application and / or the use security of the biometric authentication interface of a biometric authentication dependency library used by the application through asynchronous callback. According to the invention, whether a security risk that Android biometric authentication can be bypassed exists in an App or not can be automatically identified, and security vulnerabilities caused by misuse of an Android biometric authentication interface by an Android App or a third-party biometric authentication dependency library used by the Android App are supported to be efficiently analyzed in batches.

Description

technical field [0001] The invention relates to a technology in the field of information security, in particular to a biometric authentication security method for Android applications based on static detection. Background technique [0002] Existing Android applications begin to use the biometric authentication interface provided by the system to provide users with convenient and fast biometric authentication instead of traditional password authentication. However, the misuse of the biometric authentication interface may lead to high-privileged attackers easily bypassing biometric authentication, so that biometric authentication of applications can be completed without passwords and legal biometric information. Similarly, the open source biometric authentication dependency library developed by a third party or the biometric authentication dependency library developed internally may have the misuse of the Android biometric authentication interface, and compared with the forme...

AI Technical Summary

Problems solved by technology

Similarly, the open source biometric authentication dependency library developed by a third party or the biometric authentication dependency library developed internally may have the misuse of the Android biometric authentication interface, and compared with the former, the impact is more extensive and the security threat is greater

Images