APP interface security verification method and system in iOS mixed mode

Abstract

The invention discloses an APP interface security verification method and system in an iOS mixed mode, and the method comprises the steps: enabling an APP to initiate a request to a server side, obtaining a current security verification code and validity period information, and storing the security verification code and the validity period information in a data storage region of the APP; intercepting a native network request and a WebView network request of the APP to obtain a first network request; obtaining a security check code in a data storage area of the APP, and checking the rule to generate a security check parameter; modifying an interface domain name in the first network request, and respectively adding the security verification parameter to the corresponding first network request to obtain a second network request containing an encryption parameter; performing security verification on the second network request at the server side according to the verification rule, and returning a verification result to the APP; and executing corresponding operation according to the verification result. The invention relates to the technical field of safety verification, and solves the problem of potential safety hazards of an interface under a mixed mode architecture.

Description

Technical Field

[0001] The present invention belongs to the field of APP security verification, and relates to iOS hybrid mode application development technology, and specifically to an iOS hybrid mode APP interface security verification method and system. Background Art

[0002] With the rapid development of mobile applications (APPs), more and more applications are beginning to adopt a hybrid mode, which combines native functions and Web technologies to provide better user experience and richer functions. In this hybrid mode, APPs need to frequently interact with servers for data, and these interactions need to be secure to prevent malicious attacks and data leakage. Traditional interface security verification methods often cannot meet the needs of hybrid mode applications and have risks such as security verification bypass and security parameter leakage. Therefore, a more effective and reliable security verification method and system are needed to ensure the security and reliability of data transmission.

[0003] The invention patent with the publication number CN107204977A discloses an "interface security verification method and device, computer-readable storage medium", in which the method part includes the first system intercepting the second system and interface verification information through the security verification aspect, adding it to the HTTP request header, sending a request to the second system, and the second system verifies itself and the interface verification information through the security verification aspect interception. If the verification is successful, the second system executes the interface and feeds back the result to the first system. That is, this method ensures the security of the interface through a security authentication certificate and a secure socket layer hypertext transfer protocol request. In the development of iOS hybrid mode applications, due to the complexity of the hybrid mode architecture, the data processing and interaction of the native and hybrid parts are different, and data format conversion incompatibility or loss problems will occur in the information transmission, making the verification mechanism invalid; and third-party components may introduce new security risks due to insufficient consideration of compatibility and interaction specifications, interfere with the verification information transmission and verification process, and threaten the interface security. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes an iOS hybrid mode APP interface security verification method and system, which are used to solve the security risk problem caused by the inability of existing security verification methods to cope with the special structure and complex security environment of the iOS hybrid mode.

[0005] To achieve the above-mentioned purpose, the first aspect of the present invention provides an iOS hybrid mode APP interface security verification system, including: a verification code request module, a request interception module, a security verification module, a request modification module, a server verification module and an APP response module; wherein,

[0006] Verification code request module: used to initiate a request to the server to obtain the security verification code and validity period information of the current iOS APP, and save the security verification code and validity period information in the data storage area of ​​the iOS APP;

[0007] Request interception module: used to intercept the native network request and WebView network request of iOS APP to obtain the first network request; wherein the first network request includes the first native network request and the first WebView network request;

[0008] Security verification module: used to obtain the security verification code in the data storage area of ​​iOS APP, generate security verification parameters according to the security verification code and verification rules, and obtain security verification parameters; among which, the security verification parameters include native security verification parameters and WebView security verification parameters;

[0009] Request modification module: used to modify the interface domain name in the first network request, and add the security verification parameters to the corresponding first network request respectively, to obtain a second network request containing encryption parameters; wherein the second network request includes a second native network request and a second WebView network request;

[0010] The server verification module is used to receive the second network request, perform security verification according to the verification rule, and return the verification result to the iOS APP; wherein the verification result includes verification success and verification failure;

[0011] APP response module: used to receive verification results and perform corresponding operations based on the verification results.

[0012] In iOS hybrid mode applications, due to the coexistence of native functions and Web technologies, the data interaction between APP and server is frequent and complex. In order to prevent malicious attacks and data leakage, a comprehensive security verification system is needed. Through the collaborative work of the above technical modules, from obtaining verification codes, intercepting requests, generating and adding verification parameters to server verification and APP response, a complete security verification closed loop is formed to ensure that every network request undergoes strict security checks.

[0013] Furthermore, the interception of native network requests and WebView network requests of iOS APP includes:

[0014] A1, follow the five steps of "register, intercept, forward, callback, end", and subclass the NSURLProtocol class provided by the iOS system;

[0015] A2, rewrite the canonicalRequestForRequest method of the NSURLProtocol class to intercept the native network requests and WebView network requests of iOS APP.

[0016] The characteristics of hybrid mode applications determine that both native network requests and WebView network requests need to be security checked. By subclassing the NSURLProtocol class, these two types of requests can be intercepted uniformly and then intercepted and processed according to the same rules, avoiding security vulnerabilities caused by different request types.

[0017] Further, generating security verification parameters according to the security verification code and the verification rule includes:

[0018] B1, obtain the security verification code and validity period, and determine whether the validity period of the security verification code has expired according to the current timestamp; if yes, trigger the verification code request module, obtain the new security verification code and validity period information, and jump to B2; if no, jump to B2;

[0019] B2. Generate corresponding security verification parameters according to the first network request and verification rules.

[0020] Furthermore, the verification rules include:

[0021] B2-1, collect security verification data; the security verification data includes the network request address, the APP user's unique ID, the current timestamp, the security verification code, the current mobile phone's unique ID, and a pre-set fixed string;

[0022] B2-2, the security verification data is concatenated in a preset order, and the concatenated character string is encrypted to obtain a security verification parameter.

[0023] By judging the validity period of the security verification code based on the current timestamp, it can be ensured that the verification code is valid when it is used to generate subsequent security verification parameters. The various security verification data collected at the same time can represent the legitimacy characteristics of the request. By verifying these parameters, it can be accurately determined whether the request comes from a legitimate APP and has not been tampered with, thereby ensuring that only legitimate requests can pass the security verification and protect the security of server data.

[0024] Furthermore, the security verification parameters are added to the corresponding first network request respectively, including: using the canonicalRequestForRequest method of the NSURLProtocol class to add the security verification parameters to the header parameters corresponding to the first network request.

[0025] Furthermore, performing a safety check according to the check rule includes:

[0026] C1, collecting corresponding security verification data from the received second network request, and performing splicing and encryption processing according to a preset sequence to obtain encryption parameters on the server side;

[0027] C2, compare the encryption parameters of the second network request and the encryption parameters of the server side character by character, and determine whether the corresponding characters are the same; if yes, the verification result is a successful verification; if not, the verification result is a failed verification.

[0028] The same data collection, splicing and encryption methods are used when generating security verification parameters and server verification to ensure that the server and APP have consistent judgment standards for the legitimacy of requests, thereby improving the accuracy and reliability of the system.

[0029] Further, performing corresponding operations according to the verification result includes:

[0030] When the verification result is successful, the APP continues to perform subsequent operations according to the pre-set business logic;

[0031] When the verification result is a verification failure, the verification code request module is triggered, and subsequent operations start from the verification code request module.

[0032] A second aspect of the present invention provides an iOS hybrid mode APP interface security verification method, comprising:

[0033] S1, iOS APP initiates a request to the server to obtain the current security verification code and validity period information, and saves the security verification code and validity period information in the data storage area of ​​iOS APP;

[0034] S2, intercepting the native network request and the WebView network request of the iOS APP to obtain a first network request; wherein the first network request includes the native network request and the WebView network request;

[0035] S3, obtain the security verification code in the data storage area of ​​the iOS APP, and generate and obtain security verification parameters according to the security verification code and verification rules; wherein the security verification parameters include native security verification parameters and WebView security verification parameters;

[0036] S4, modifying the interface domain name in the first network request, and adding the security verification parameters to the corresponding first network request, respectively, to obtain a second network request containing encryption parameters; wherein the second network request includes a second native network request and a second WebView network request;

[0037] S5, using the server to receive the second network request, perform security verification according to the verification rule, and return the verification result to the iOS APP; wherein the verification result includes verification success and verification failure;

[0038] S6, performing corresponding operations according to the verification result.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] By uniformly intercepting native network requests and WebView network requests of iOS APP, generating security verification parameters based on verification rules and verifying them on the server side, a comprehensive security verification process was carried out, which significantly improved the security of the interface and effectively prevented malicious attacks and data leakage.

[0041] By adopting a unified processing mechanism for native network requests and WebView network requests, and dynamically updating the verification code according to the current timestamp, we can avoid security vulnerabilities caused by differences in request types and fixed parameters, and effectively solve the security bypass problem.

[0042] By adding security verification parameters to the header parameters of network requests for secure transmission, and verifying the legitimacy of the parameters and the validity period of the verification code based on the verification mechanism on the server side, the confidentiality, integrity and validity of the security parameters are ensured, and the leakage of security parameters is prevented. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A framework diagram of an iOS hybrid mode APP interface security verification system provided by the present invention;

[0045] Figure 2 A flowchart of an iOS hybrid mode APP interface security verification method provided by the present invention. DETAILED DESCRIPTION

[0046] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] See also Figure 1-Figure 2 The first aspect of the present invention provides an iOS hybrid mode APP interface security verification system, including an APP end and a server end; wherein,

[0048] The APP end includes a verification code request module, a request interception module, a security verification module, a request modification module, and an APP response module; and the request interception module includes an iOS native unit, a WebView unit, a native interception unit, and a WebView request interception unit;

[0049] The server side includes a server verification module and server storage data;

[0050] Verification code request module: used to initiate a request to the server to obtain the security verification code and validity period information of the current iOS APP, and save the security verification code and validity period information in the data storage area of ​​the iOS APP;

[0051] Request interception module: used to intercept the native network request and WebView network request of iOS APP to obtain the first network request; wherein the first network request includes the first native network request and the first WebView network request;

[0052] Security verification module: used to obtain the security verification code in the data storage area of ​​iOS APP, generate security verification parameters according to the security verification code and verification rules, and obtain security verification parameters; among which, the security verification parameters include native security verification parameters and WebView security verification parameters;

[0053] Request modification module: used to modify the interface domain name in the first network request, and add the security verification parameters to the corresponding first network request respectively, to obtain a second network request containing encryption parameters; wherein the second network request includes a second native network request and a second WebView network request;

[0054] Server verification module: used to receive the second network request, perform security verification according to the verification rules, and return the verification result to the iOS APP; wherein the verification result includes verification success and verification failure;

[0055] APP response module: used to receive verification results and perform corresponding operations based on the verification results.

[0056] It should be noted that the verification code request module, request interception module, security verification module, request modification module, server verification module and APP response module in the system are in communication connection, and the verification code request module is in communication connection with the security verification module and the APP response module respectively, and the request interception module is in communication connection with the request modification module;

[0057] In iOS hybrid mode applications, there is a large amount of data interaction between the APP and the server, which involves user privacy information and important business data. In order to prevent malicious attacks and data leakage, it is necessary to establish a comprehensive security verification system to perform strict security checks on every network request sent from the APP.

[0058] In this embodiment, first, the verification code request module is used as the starting point of the security verification, responsible for establishing communication with the server, obtaining the security verification code and validity period information, and properly storing them in the data storage area of ​​the iOS APP;

[0059] Specifically, when the APP is started or at a specific time interval (such as each login or every period of time), the verification code request module sends a request to the server; the server generates a unique security verification code based on its own security algorithm and the relevant identification information of the APP (such as the unique identifier of the APP, user information, etc.) and sets its validity period. For example, in an online education APP, the server may generate a security verification code based on factors such as the APP version number, the user's account ID, and the current timestamp, and set the validity period to 24 hours.

[0060] Next, the request interception module is used to intercept the native network request and WebView network request of the iOS APP to obtain the first network request;

[0061] Specifically, in the request interception module, the NSURLProtocol class provided by the iOS system is subclassed according to the five steps of "register, intercept, forward, callback, and end":

[0062] First, perform the registration operation, for example, add the [NSURLProtocolregisterClass:[custom subclass class name class]] code in the applicationDidFinishLaunching method of AppDelegate so that the system can recognize the custom subclass;

[0063] When a network request is initiated, the subclassed NSURLProtocol class intercepts the request based on the preset logic. For native network requests, it can identify whether the request comes from the native code part of the app; for WebView network requests, it can be determined by the identifier or mechanism related to WebView. For example, in a travel app, when the user clicks to search for a hotel on the native interface (native network request) or loads a tourist attraction introduction page in WebView (WebView network request), the request interception module will intercept these requests;

[0064] During the interception process, some pre-processing operations will be performed on the request, such as recording relevant information of the request to provide data support for subsequent security verification. Then forwarding, callback and other operations will be performed as needed to ensure the integrity of the request processing process, and finally the end operation will be performed after the request processing is completed.

[0065] Then, the security verification module will obtain the security verification code from the data storage area of ​​the iOS APP, generate security verification parameters based on the verification code and verification rules, and provide a basis for server verification;

[0066] Specifically, first obtain the security verification code and validity period in the data storage area of ​​the iOS APP. Then determine whether the security verification code has expired based on the current timestamp;

[0067] If the security verification code has not expired, generate security verification parameters according to the first intercepted network request (including native network request and WebView network request) according to the verification rules;

[0068] The verification rules include: collecting security verification data, such as the network request address, APP user unique identification ID, current timestamp, security verification code, current mobile phone unique identification and a pre-set fixed string (such as SECURITY_KEY); then concatenating these data in a preset order, for example, network request address + APP user unique identification ID + current timestamp + security verification code + current mobile phone unique identification + fixed string; then encrypting the concatenated string through MD5 to obtain security verification parameters.

[0069] Next, the request modification module modifies the interface domain name in the first network request and adds the security verification parameters to the corresponding first network request to obtain a second network request containing encryption parameters, thereby enhancing the security of the request and enabling the server to obtain verification information:

[0070] Specifically, first, for the first intercepted network request, modify its interface domain name. For example, if the original request points to http: / / oldserver.example.com / api, you can modify it to https: / / newserver.example.com / api according to business needs and security policies, direct the request to a more secure server address, or adapt to changes in business development;

[0071] Next, the security verification parameters are added to the header parameters corresponding to the first network request using the canonicalRequestForRequest method of the NSURLProtocol class. For example, the generated security verification parameters are added to a header field named X-Security-Parameter, so that the server can obtain these parameters for verification when receiving the request, and obtain a second network request containing the encrypted parameters.

[0072] The second network request containing the encryption parameters obtained by the request modification module will be sent to the server verification module on the server side; then, in the server verification module, a security verification is performed according to the same verification rules as the APP side to prevent malicious attacks and data leakage:

[0073] Specifically, when the server receives the second network request, it will collect the corresponding security verification data from the request. The collection method and splicing order of these data are the same as the APP side, and then the spliced ​​character data is encrypted with MD5 to obtain the encryption parameters of the server side;

[0074] Next, the encryption parameters of the second network request are compared character by character with the encryption parameters of the server to determine whether the corresponding characters are the same. If all corresponding characters are the same, the verification result is successful, and the data storage module on the server can continue to be accessed and returned to the APP; otherwise, the verification result is failed.

[0075] In the APP response module, the verification result returned by the server verification module is received, and corresponding operations are performed according to the result to ensure the normal operation of the interaction between the APP and the server:

[0076] When the APP response module receives the verification result that the verification is successful, the APP continues to perform subsequent operations according to the pre-set business logic;

[0077] When the verification result is a verification failure, the verification code request module is triggered, the security verification code and validity period information are re-acquired from the verification code request module, and a network request is re-initiated for security verification.

[0078] The second aspect of the present invention provides an iOS hybrid mode APP interface security verification method, including:

[0079] S1, iOS APP initiates a request to the server to obtain the current security verification code and validity period information, and saves the security verification code and validity period information in the data storage area of ​​iOS APP;

[0080] S2, intercepting the native network request and the WebView network request of the iOS APP to obtain a first network request; wherein the first network request includes the native network request and the WebView network request;

[0081] S3, obtain the security verification code in the data storage area of ​​the iOS APP, and generate and obtain security verification parameters according to the security verification code and verification rules; wherein the security verification parameters include native security verification parameters and WebView security verification parameters;

[0082] S4, modifying the interface domain name in the first network request, and adding the security verification parameters to the corresponding first network request, respectively, to obtain a second network request containing encryption parameters; wherein the second network request includes a second native network request and a second WebView network request;

[0083] S5, receiving the second network request, performing a security check according to the check rule, and returning the check result to the iOS APP; wherein the check result includes a check success and a check failure;

[0084] S6, performing corresponding operations according to the verification result.

[0085] Working principle of the present invention:

[0086] First, the verification code request module obtains the security verification code and validity period information from the server and stores them in the APP data storage area; then, the request interception module intercepts the native and WebView network requests by subclassing the NSURLProtocol class to obtain the first network request; then, the security verification module obtains the verification code and determines whether it is expired according to the rules and the current timestamp. If it is not expired, the security verification parameters are generated according to the first network request; then, the request modification module modifies the interface domain name of the first network request and adds security verification parameters to obtain the second network request; then, the server verification module receives the second network request, verifies it according to the rules and returns the result; finally, the APP response module performs corresponding operations according to the verification result, forming a complete security verification closed loop to ensure the security of network requests.

[0087] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. An iOS hybrid mode APP interface security verification system, characterized in that: include: Verification code request module: used to initiate a request to the server to obtain the security verification code and validity period information of the current iOS APP, and save the security verification code and validity period information in the data storage area of ​​the iOS APP; Request interception module: used to intercept the native network request and WebView network request of iOS APP and obtain the first network request; The first network request includes a first native network request and a first WebView network request; Security verification module: used to obtain the security verification code in the data storage area of ​​iOS APP, generate security verification parameters according to the security verification code and verification rules, and obtain security verification parameters; among which, the security verification parameters include native security verification parameters and WebView security verification parameters; Request modification module: used to modify the interface domain name in the first network request, and add the security verification parameters to the corresponding first network request respectively, to obtain a second network request containing encryption parameters; wherein the second network request includes a second native network request and a second WebView network request; The server verification module is used to receive the second network request, perform security verification according to the verification rule, and return the verification result to the iOS APP; wherein the verification result includes verification success and verification failure; APP response module: used to receive verification results and perform corresponding operations based on the verification results.

2. According to claim 1, an iOS hybrid mode APP interface security verification system is characterized in that: The interception of native network requests and WebView network requests of iOS APP includes: A1, follow the five steps of "register, intercept, forward, callback, end" to subclass the NSURLProtocol class provided by the iOS system; A2, rewrite the canonicalRequestForRequest method of the NSURLProtocol class to intercept the native network requests and WebView network requests of iOS APP.

3. According to claim 1, an iOS hybrid mode APP interface security verification system is characterized in that: The generating of security verification parameters according to the security verification code and the verification rule comprises: B1, obtain the security verification code and validity period, and determine whether the validity period of the security verification code has expired according to the current timestamp; if yes, trigger the verification code request module, obtain the new security verification code and validity period information, and jump to B2; if no, jump to B2; B2. Generate corresponding security verification parameters according to the first network request and verification rules.

4. According to claim 3, an iOS hybrid mode APP interface security verification system is characterized in that: The verification rules include: B2-1, collect security verification data; the security verification data includes the network request address, the APP user's unique ID, the current timestamp, the security verification code, the current mobile phone's unique ID, and a pre-set fixed string; B2-2, the security verification data is concatenated in a preset order, and the concatenated character string is encrypted to obtain a security verification parameter.

5. The iOS hybrid mode APP interface security verification system according to claim 1 is characterized in that: Adding the security verification parameters to the corresponding first network request respectively includes: using the canonicalRequestForRequest method of the NSURLProtocol class to add the security verification parameters to the header parameters corresponding to the first network request.

6. The iOS hybrid mode APP interface security verification system according to claim 1, characterized in that: Performing a safety check according to the check rules includes: C1, collecting corresponding security verification data from the received second network request, and performing splicing and encryption processing according to a preset sequence to obtain encryption parameters on the server side; C2, compare the encryption parameters of the second network request and the encryption parameters of the server side character by character, and determine whether the corresponding characters are the same; if yes, the verification result is a successful verification; if not, the verification result is a failed verification.

7. The iOS hybrid mode APP interface security verification system according to claim 1, characterized in that: The performing corresponding operations according to the verification result includes: When the verification result is successful, the APP continues to perform subsequent operations according to the pre-set business logic; When the verification result is a verification failure, the verification code request module is triggered, and subsequent operations start from the verification code request module.

8. An iOS hybrid mode APP interface security verification method, applied to an iOS hybrid mode APP interface security verification system according to any one of claims 1-7, characterized in that: include: S1, iOS APP initiates a request to the server to obtain the current security verification code and validity period information, and saves the security verification code and validity period information in the data storage area of ​​iOS APP; S2, intercepting the native network request and the WebView network request of the iOS APP to obtain a first network request; wherein the first network request includes the native network request and the WebView network request; S3, obtain the security verification code in the data storage area of ​​the iOS APP, and generate and obtain security verification parameters according to the security verification code and verification rules; wherein the security verification parameters include native security verification parameters and WebView security verification parameters; S4, modifying the interface domain name in the first network request, and adding the security verification parameters to the corresponding first network request, respectively, to obtain a second network request containing encryption parameters; wherein the second network request includes a second native network request and a second WebView network request; S5, using the server to receive the second network request, perform security verification according to the verification rule, and return the verification result to the iOS APP; wherein the verification result includes verification success and verification failure; S6, performing corresponding operations according to the verification result.

Images