Interface calling method, device, equipment, and storage medium
By performing C language verification on the Android APP installation package signature, generating and using encrypted passwords to verify the interface caller, the problem of leaking the interface encryption password after the Android APP is decompiled, and the authentication of the interface caller is realized. Information security guarantee.
Patent Information
- Application Number
- CN202110360425.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-04-02
- Publication Date
- 2025-02-11
- Estimated Expiration
- 2041-04-02
AI Technical Summary
When an Android APP calls the background interface, it is easy to be decompiled, resulting in the leakage of the interface encryption password. Third parties can call the interface through other channels to obtain encrypted data.
By obtaining the installation package signature and calling the pre-set C language verification rules to verify the signature. If it passes, a correct encryption password will be generated. If it does not pass, an incorrect encryption password will be generated. The sending interface call request will carry the encryption password.
The identity of the interface caller is effectively verified, the leakage of correct encrypted strings is avoided, unauthorized third parties are prevented from calling the Android interface, and information security is ensured.
Smart Images
Figure CN113094660B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information protection technology, and in particular to a method, device and equipment for interface calling, and a storage medium. Background Art
[0002] In related technologies, in order to ensure information security, when calling a background interface, an APP will concatenate a string used as a password after the request parameters to form a new string, and then encrypt the new string to achieve the purpose of information protection. However, Android APPs are very easy to be decompiled. Once decompiled, the interface encryption password will be leaked, and third-party users who obtain the password can call the interface through other means to obtain encrypted data. Summary of the invention
[0003] In view of this, the purpose of the present application is to overcome the deficiencies of the prior art and to provide a method, apparatus and device, and storage medium for interface calling.
[0004] To achieve the above objectives, this application adopts the following technical solutions:
[0005] The first aspect of the present application provides an interface calling method, comprising:
[0006] Get the installation package signature;
[0007] Calling a pre-set C language verification rule to verify the signature of the installation package;
[0008] If the verification is successful, a correct encrypted string is obtained, and a correct encrypted password is generated based on the correct encrypted string; if the verification is unsuccessful, an incorrect encrypted string is obtained, and an incorrect encrypted password is generated based on the incorrect encrypted string;
[0009] Sending an interface call request, wherein the interface call request carries an encrypted password;
[0010] When the encryption password carried in the interface call request is the correct encryption password, the required data information fed back by the corresponding interface is received; when the encryption password carried in the interface call request is the incorrect encryption password, the invalid information fed back by the corresponding interface is received.
[0011] Optionally, generating a correct encryption password according to the correct encryption string includes:
[0012] Generate a new correct character string using the correct encrypted character string, and encrypt the new correct character string to obtain the correct encrypted password;
[0013] The generating an erroneous encryption password according to the erroneous encryption character string comprises:
[0014] A new error string is generated by using the erroneous encrypted string, and the new error string is encrypted to obtain the erroneous encrypted password.
[0015] Optionally, the generating a new correct character string by using the correct encrypted character string includes:
[0016] Concatenate the request parameter with the correct encrypted string to form the new correct string;
[0017] The step of generating a new error string by using the erroneous encrypted string comprises:
[0018] The request parameter is concatenated with the encrypted string of error to form the new error string.
[0019] Optionally, verifying the signature of the installation package includes:
[0020] Input the installation package signature into the pre-set C language verification rule, and determine whether the installation package signature is consistent with the signature information pre-stored in the pre-set C language verification rule;
[0021] If they are consistent, the verification passes; if they are inconsistent, the verification fails.
[0022] A second aspect of the present application provides an interface calling device, including:
[0023] Get module, used to get the installation package signature;
[0024] A calling module is used to call a pre-set C language verification rule to verify the signature of the installation package;
[0025] A generating module, for obtaining a correct encrypted string if the verification is passed, and generating a correct encrypted password according to the correct encrypted string; and for obtaining an incorrect encrypted string if the verification is not passed, and generating an incorrect encrypted password according to the incorrect encrypted string;
[0026] A sending module, used for sending an interface call request, wherein the interface call request carries an encrypted password;
[0027] A receiving module is used to receive the required data information fed back by the corresponding interface when the encryption password carried in the interface call request is the correct encryption password; and to receive invalid information fed back by the corresponding interface when the encryption password carried in the interface call request is the incorrect encryption password.
[0028] Optionally, when generating a correct encrypted password according to the correct encrypted string, the generating module is used to generate a new correct string using the correct encrypted string, and encrypt the new correct string to obtain the correct encrypted password;
[0029] When generating an erroneous encryption password according to the erroneous encryption string, the generating module is used to generate a new erroneous string by using the erroneous encryption string, and encrypt the new erroneous string to obtain the erroneous encryption password.
[0030] Optionally, when the new correct string is generated by using the correct encrypted string, the generating module is further used to concatenate the request parameter with the correct encrypted string to form the new correct string;
[0031] When the new error string is generated by using the erroneous encrypted string, the generating module is used to concatenate the request parameter with the erroneous encrypted string to form the new error string.
[0032] Optionally, when verifying the signature of the installation package, the calling module is used to:
[0033] Input the installation package signature into the pre-set C language verification rule, and determine whether the installation package signature is consistent with the signature information pre-stored in the pre-set C language verification rule;
[0034] If they are consistent, the verification passes; if they are inconsistent, the verification fails.
[0035] A third aspect of the present application provides an interface calling device, including:
[0036] A processor, and a memory connected to the processor;
[0037] The memory is used to store computer programs;
[0038] The processor is used to call and execute the computer program in the memory to perform the method according to the first aspect of the present application.
[0039] The fourth aspect of the present application provides a storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the various steps of the interface calling method described in the first aspect of the present application.
[0040] The technical solution provided by this application may have the following beneficial effects:
[0041] In the scheme of the present application, when calling the Android interface, the installation package signature can be obtained first, and then the pre-set C language verification rules can be called to verify the obtained installation package signature to determine whether the caller is a legitimate user. If the verification passes, the obtained string is the correct encrypted string, and the correct encryption password can be generated using the correct encrypted string; if the verification fails, the obtained string is an incorrect encrypted string, and the incorrect encryption password can be generated using the incorrect encrypted string. Send an interface call request, which carries the encryption password. When the encryption password carried by the interface call request is the correct encryption password, the required data information fed back by the corresponding interface can be received. When the encryption password carried by the interface call request is the incorrect encryption password, the invalid information fed back by the corresponding interface can be received. In this way, based on the extremely difficult characteristics of C language decompilation, the pre-set C language verification rules can be used to verify the identity of the interface caller, avoid the leakage of the correct encrypted string, prevent the unauthorized third party from calling the Android interface, and ensure information security. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0043] Figure 1 This is a flowchart of an interface calling method provided by an embodiment of the present application.
[0044] Figure 2 It is a structural diagram of an interface calling device provided in another embodiment of the present application.
[0045] Figure 3 It is a structural diagram of an interface calling device provided by another embodiment of the present application. DETAILED DESCRIPTION
[0046] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be described in detail below. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other implementation methods obtained by ordinary technicians in the field without creative work belong to the scope of protection of the present application.
[0047] See also Figure 1This is a flow chart of a method for calling an interface provided by an embodiment of the present application. This embodiment provides a method for calling an interface, as shown in the figure, the method may at least include the following implementation steps:
[0048] Step 11: Get the installation package signature.
[0049] When an APP needs to call the Android backend interface, the APP must first obtain the installation package signature. The installation package signature is the signature information of the current installation package designed by the original developer.
[0050] During implementation, the signature information of the installation package may be a string representing its identity information.
[0051] Step 12: Call the pre-set C language verification rules to verify the installation package signature.
[0052] Step 13: If the verification passes, a correct encrypted string is obtained, and a correct encrypted password is generated based on the correct encrypted string; if the verification fails, an incorrect encrypted string is obtained, and an incorrect encrypted password is generated based on the incorrect encrypted string.
[0053] Step 14: Send an interface call request, where the interface call request carries an encrypted password.
[0054] After obtaining the encrypted password, the APP sends an interface call request carrying the encrypted password to the background interface and waits to receive feedback from the background interface.
[0055] Step 15: When the encryption password carried in the interface call request is a correct encryption password, receive the required data information fed back by the corresponding interface; when the encryption password carried in the interface call request is an incorrect encryption password, receive the invalid information fed back by the corresponding interface.
[0056] The required data information is the valid information fed back by the corresponding interface according to the interface call request after receiving the correct encryption password. The invalid information is the invalid feedback given by the corresponding interface after receiving the wrong encryption password and confirming that the current interface call is an illegal call according to the wrong encryption password.
[0057] In this embodiment, when calling the Android interface, the installation package signature can be first obtained, and then the pre-set C language verification rules can be called to verify the obtained installation package signature to determine whether the caller is a legitimate user. If the verification passes, the obtained string is the correct encrypted string, and the correct encryption password can be generated using the correct encrypted string; if the verification fails, the obtained string is an incorrect encrypted string, and the incorrect encryption password can be generated using the incorrect encrypted string. Send an interface call request, which carries the encryption password. When the encryption password carried by the interface call request is the correct encryption password, the required data information fed back by the corresponding interface can be received. When the encryption password carried by the interface call request is the incorrect encryption password, the invalid information fed back by the corresponding interface can be received. In this way, based on the extremely difficult characteristics of C language decompilation, the pre-set C language verification rules can be used to verify the identity of the interface caller, avoid the leakage of the correct encrypted string, prevent the unauthorized third party from calling the Android interface, and ensure information security.
[0058] In specific implementation, the encrypted string of the interface can be shuffled and saved in a C language file, and a JIN interface can be provided for Java language calls. When calling the Java language, the signature information of the current installation package, that is, the installation package signature, needs to be passed in. The installation package signature is only available to the original developer. Even if the APP is decompiled and repackaged, the correct signature information of the current installation package cannot be obtained due to the lack of the original signature file. The C language file will verify the signature of the passed-in installation package. If the verification passes, the correct encrypted string can be obtained. If the verification fails, the wrong encrypted string will be obtained.
[0059] In some embodiments, in the above step 13, generating a correct encrypted password based on the correct encrypted string may specifically include: using the correct encrypted string to generate a new correct string, and encrypting the new correct string to obtain the correct encrypted password.
[0060] Similarly, in step 13, generating an erroneous encryption password according to the erroneous encryption string may specifically include: generating a new erroneous string using the erroneous encryption string, and encrypting the new erroneous string to obtain the erroneous encryption password.
[0061] In other words, the encrypted string can be obtained regardless of whether the verification of the installation package signature is passed or not. However, the correct encrypted string can only be obtained if the verification is passed. Similarly, only the correct encrypted string can generate the correct encrypted password. In this way, the verification based on the C language verification rules not only effectively utilizes the extremely difficult characteristics of C language decompilation, but also effectively protects the correct encrypted string and avoids the loss caused by password leakage.
[0062] In some embodiments, in order to effectively utilize the encrypted string and prevent data leakage caused by the leakage of the encrypted password, the above-mentioned use of the correct encrypted string to generate a new correct string may specifically include: concatenating the request parameter with the correct encrypted string to form a new correct string. Similarly, the above-mentioned use of the wrong encrypted string to generate a new wrong string may specifically include: concatenating the request parameter with the wrong encrypted string to form a new wrong string.
[0063] In some embodiments, the installation package signature is verified, which may specifically include: inputting the installation package signature into a pre-set C language verification rule, and determining whether the installation package signature is consistent with the signature information pre-stored in the pre-set C language verification rule; if they are consistent, the verification passes; if they are inconsistent, the verification fails.
[0064] Based on the same technical concept, this embodiment provides a device for interface calling, such as Figure 2 As shown, the device may specifically include: an acquisition module 201, used for acquiring the signature of the installation package; a calling module 202, used for calling a pre-set C language verification rule to verify the signature of the installation package; a generating module 203, used for obtaining a correct encrypted string if the verification is passed, and generating a correct encrypted password based on the correct encrypted string; if the verification fails, obtaining an incorrect encrypted string, and generating an incorrect encrypted password based on the incorrect encrypted string; a sending module 204, used for sending an interface call request, the interface call request carries an encrypted password; a receiving module 205, used for receiving the required data information fed back by the corresponding interface when the encrypted password carried in the interface call request is a correct encrypted password; and receiving invalid information fed back by the corresponding interface when the encrypted password carried in the interface call request is an incorrect encrypted password.
[0065] Optionally, when a correct encrypted password is generated from a correct encrypted string, the generation module 203 can be used to generate a new correct string using the correct encrypted string, and encrypt the new correct string to obtain a correct encrypted password. Similarly, when an incorrect encrypted password is generated from an incorrect encrypted string, the generation module 203 can be used to generate a new incorrect string using the incorrect encrypted string, and encrypt the new incorrect string to obtain an incorrect encrypted password.
[0066] Optionally, when a new correct string is generated using a correct encrypted string, the generation module 203 can be specifically used to concatenate the request parameter with the correct encrypted string to form a new correct string. Similarly, when a new incorrect string is generated using an incorrect encrypted string, the generation module 203 can be specifically used to concatenate the request parameter with the incorrect encrypted string to form a new incorrect string.
[0067] Optionally, when verifying the installation package signature, module 202 is called, which can be specifically used to: input the installation package signature into a pre-set C language verification rule, and determine whether the installation package signature is consistent with the signature information pre-stored in the pre-set C language verification rule; if they are consistent, the verification passes; if they are inconsistent, the verification fails.
[0068] The specific implementation scheme of the interface calling device proposed in the embodiment of the present application can refer to the implementation scheme of the interface calling method described in any of the above embodiments, which will not be repeated here.
[0069] The embodiment of the present application also provides a device for interface calling, such as Figure 3 As shown, the device may specifically include: a processor 301, and a memory 302 connected to the processor 301; the memory 302 is used to store computer programs; the processor 301 is used to call and execute the computer program in the memory 302 to execute the interface calling method described in any of the above embodiments.
[0070] The specific implementation scheme of the interface calling device proposed in the embodiments of the present application can refer to the implementation scheme of the interface calling method described in any of the above embodiments, which will not be repeated here.
[0071] An embodiment of the present application further provides a storage medium storing a computer program. When the computer program is executed by a processor, each step of the interface calling method described in any of the above embodiments is implemented.
[0072] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.
[0073] It should be noted that, in the description of this application, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "plurality" refers to at least two.
[0074] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.
[0075] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0076] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.
[0077] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.
[0078] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.
[0079] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.
[0080] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.
Claims
1. A method for interface calling, characterized in that: include: Get the installation package signature; Calling a pre-set C language verification rule to verify the installation package signature; If the verification passes, the correct encrypted string is obtained, and the correct encrypted password is generated according to the correct encrypted string; If the verification fails, an erroneous encrypted string is obtained, and an erroneous encrypted password is generated according to the erroneous encrypted string; Sending an interface call request, wherein the interface call request carries an encrypted password; When the encryption password carried in the interface call request is the correct encryption password, receiving the required data information fed back by the corresponding interface; When the encryption password carried in the interface call request is the wrong encryption password, receiving invalid information fed back by the corresponding interface; The generating an erroneous encryption password according to the erroneous encryption character string comprises: Generate a new error string using the erroneous encrypted string, and encrypt the new error string to obtain the erroneous encrypted password; The step of generating a new error string by using the erroneous encrypted string comprises: Concatenate the request parameter with the encrypted string of the error to form the new error string; The generating a correct encryption password according to the correct encryption string comprises: Generate a new correct character string using the correct encrypted character string, and encrypt the new correct character string to obtain the correct encrypted password; The step of generating a new correct character string by using the correct encrypted character string comprises: The request parameter is concatenated with the correct encrypted string to form the new correct string.
2. The method for interface calling according to claim 1, characterized in that: The verifying the signature of the installation package includes: Input the installation package signature into the pre-set C language verification rule, and determine whether the installation package signature is consistent with the signature information pre-stored in the pre-set C language verification rule; If they are consistent, the verification passes; if they are inconsistent, the verification fails.
3. An interface calling device, characterized in that: include: Get module, used to get the installation package signature; A calling module is used to call a pre-set C language verification rule to verify the signature of the installation package; A generation module is used to obtain a correct encrypted string if the verification passes, and generate a correct encrypted password according to the correct encrypted string; If the verification fails, an erroneous encrypted string is obtained, and an erroneous encrypted password is generated according to the erroneous encrypted string; A sending module, used for sending an interface call request, wherein the interface call request carries an encrypted password; A receiving module, configured to receive required data information fed back by a corresponding interface when the encryption password carried in the interface call request is the correct encryption password; When the encryption password carried in the interface call request is the wrong encryption password, receiving invalid information fed back by the corresponding interface; When generating an erroneous encrypted password according to the erroneous encrypted string, the generating module is used to generate a new erroneous string by using the erroneous encrypted string, and encrypt the new erroneous string to obtain the erroneous encrypted password; When the new error string is generated by using the erroneous encrypted string, the generating module is used to concatenate the request parameter with the erroneous encrypted string to form the new error string; When the correct encrypted password is generated according to the correct encrypted string, the generating module is used to generate a new correct string using the correct encrypted string, and encrypt the new correct string to obtain the correct encrypted password; When the new correct string is generated by using the correct encrypted string, the generating module is further used to concatenate the request parameter with the correct encrypted string to form the new correct string.
4. The interface calling device according to claim 3, characterized in that: When verifying the signature of the installation package, the calling module is used to: Input the installation package signature into the pre-set C language verification rule, and determine whether the installation package signature is consistent with the signature information pre-stored in the pre-set C language verification rule; If they are consistent, the verification passes; if they are inconsistent, the verification fails.
5. An interface calling device, characterized in that: include: A processor, and a memory connected to the processor; The memory is used to store computer programs; The processor is used to call and execute the computer program in the memory to perform the method according to any one of claims 1-2.
6. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, each step of the interface calling method as described in any one of claims 1-2 is implemented.
Citation Information
Patent Citations
Call method and device for open platform
CN104199657A