Verification method, device, electronic device and storage medium

Abstract

The disclosed embodiment discloses a verification method, device, electronic device and storage medium, the method comprising: obtaining a signature file of a data packet to be verified; the data packet to be verified includes multiple first data objects; the signature file includes summary information of a second data object; determining first statistical information of the first data object according to the data packet to be verified, and determining second statistical information of the second data object according to the signature file; verifying the data packet to be verified according to the first statistical information and the second statistical information to obtain a first verification result. This technical solution can prevent an attacker from adding malicious files to a data packet after the signature file is generated, resulting in the verification party ignoring the newly added malicious files during the security verification of the data packet based only on the summary information in the signature file, thereby improving the security of the data.

Description

Technical Field

[0001] The present disclosure relates to the technical field of computer technology, and in particular to a verification method, device, electronic device and storage medium. Background Art

[0002] Digital signatures are used in the process of verifying the authenticity of data. The owner of the data encrypts the summary information of the data with a private key, and then publishes the original data and the encrypted summary information together. The user of the data decrypts the summary information with the public key, calculates the summary information of the obtained data, and then compares the two for verification. If the verification is successful, it means that the obtained data is credible. Digital signatures can be used in various scenarios, such as the verification of installation packages during application installation, the verification of received data packets during data transmission, etc. With the development of Internet technology, there are more and more applications on smart devices, and data transmission is becoming more and more frequent. How to verify the security of various data packets to prevent devices from being maliciously attacked is one of the technical problems that related fields are committed to solving. Summary of the invention

[0003] Embodiments of the present disclosure provide a verification method, device, electronic device, and computer-readable storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a verification method, including:

[0005] Acquire a signature file of a data packet to be verified; the data packet to be verified includes a plurality of first data objects; the signature file includes summary information of a second data object;

[0006] Determine first statistical information of the first data object according to the data packet to be verified, and determine second statistical information of the second data object according to the signature file;

[0007] The data packet to be verified is verified according to the first statistical information and the second statistical information to obtain a first verification result.

[0008] Furthermore, the first statistical information includes a first quantity of the first data objects and / or a first data object identification list; the second file information includes a second quantity of the second data objects and / or a second data object identification list.

[0009] Further, the data packet to be verified is verified according to the first statistical information and the second statistical information to obtain a first verification result, including:

[0010] When the first number and the second number are inconsistent, the first verification result is determined to be a verification failure.

[0011] Further, the data packet to be verified is verified according to the first statistical information and the second statistical information to obtain a first verification result, including:

[0012] When the first data object identification list and the second data object identification list are inconsistent, it is determined that the first verification result is a verification failure.

[0013] Furthermore, it also includes:

[0014] The data packet to be verified is verified according to the summary information to obtain a second verification result.

[0015] Furthermore, it also includes:

[0016] When the first verification result or the second verification result is verification failure, it is determined that the data packet to be verified is not credible.

[0017] Furthermore, the signature file is an XML signature file; and / or the data package to be verified is an application installation package.

[0018] In a second aspect, an embodiment of the present invention provides an application installation method, which includes:

[0019] Download the application installation package from the server;

[0020] Verify whether the application installation package is credible using the method described in the first aspect;

[0021] When the application installation package is credible, the application installation package is installed.

[0022] In a third aspect, an embodiment of the present invention provides a data transmission method, which includes:

[0023] Receive data packets;

[0024] Verify whether the data packet is credible using the method described in the first aspect;

[0025] When the data packet is not credible, the data packet is discarded.

[0026] In a fourth aspect, an embodiment of the present invention provides a verification device, which includes:

[0027] An acquisition module is configured to acquire a signature file of a data packet to be verified; the data packet to be verified includes a plurality of first data objects; the signature file includes summary information of a second data object;

[0028] A first determining module is configured to determine first statistical information of the first data object according to the data packet to be verified, and to determine second statistical information of the second data object according to the signature file;

[0029] The first verification module is configured to verify the data packet to be verified according to the first statistical information and the second statistical information to obtain a first verification result.

[0030] Furthermore, the first statistical information includes a first quantity of the first data objects and / or a first data object identification list; the second file information includes a second quantity of the second data objects and / or a second data object identification list.

[0031] Furthermore, the first verification module includes:

[0032] The first verification submodule is configured to determine that the first verification result is a verification failure when the first number and the second number are inconsistent.

[0033] Furthermore, the first verification module includes:

[0034] The second verification submodule is configured to determine that the first verification result is a verification failure when the first data object identification list and the second data object identification list are inconsistent.

[0035] Furthermore, it also includes:

[0036] The second verification module is configured to verify the data packet to be verified according to the summary information to obtain a second verification result.

[0037] Furthermore, it also includes:

[0038] The second determination module is configured to determine that the data packet to be verified is not credible when the first verification result or the second verification result is verification failure.

[0039] Furthermore, the signature file is an XML signature file; and / or the data package to be verified is an application installation package.

[0040] In a fifth aspect, an embodiment of the present invention provides an application installation device, which includes:

[0041] A download module, configured to download an application installation package from a server;

[0042] A third verification module is configured to use the device described in the fourth aspect to verify whether the application installation package is credible;

[0043] The installation module is configured to install the application installation package when the application installation package is credible.

[0044] In a sixth aspect, an embodiment of the present invention provides a data transmission device, comprising:

[0045] A receiving module, configured to receive a data packet;

[0046] a fourth verification module, configured to verify whether the data packet is authentic using the apparatus according to the fourth aspect;

[0047] The discarding module is configured to discard the data packet when the data packet is untrustworthy.

[0048] The functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions.

[0049] In one possible design, the structure of any of the above-mentioned devices includes a memory and a processor, the memory is used to store one or more computer instructions that support any of the above-mentioned devices to perform any of the above-mentioned methods, and the processor is configured to execute the computer instructions stored in the memory. Any of the above-mentioned devices may also include a communication interface for any of the above-mentioned devices to communicate with other devices or communication networks.

[0050] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method described in any one of the above aspects.

[0051] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium for storing computer instructions used by any of the above-mentioned devices, which includes computer instructions involved in executing the method described in any of the above-mentioned aspects.

[0052] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0053] The above method in the embodiment of the present disclosure can verify whether a new file is added to the data packet by comparing whether the first statistical information and the second statistical information are consistent; this method can prevent attackers from adding malicious files to the data packet after the signature file is generated, causing the verifier to ignore the newly added malicious files during the security verification of the data packet based only on the summary information in the signature file, thereby improving the security of the data.

[0054] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:

[0056] Figure 1 A flowchart showing a verification method according to an embodiment of the present disclosure is shown;

[0057] Figure 2 An exemplary implementation flow chart according to an embodiment of the present disclosure is shown;

[0058] Figure 3 A flowchart showing an application installation method according to an embodiment of the present disclosure is shown;

[0059] Figure 4 A flow chart showing a data transmission method according to an embodiment of the present disclosure;

[0060] Figure 5 It is a structural diagram of an electronic device suitable for implementing a verification method, an application installation method and / or a data transmission method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0061] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0062] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.

[0063] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0064] A commonly used data packet signature mechanism is to generate a signature file after the data packet is signed. The signature file can be a file in any syntax format, such as a signature file in XML format, a signature file in JSON format, etc. The signature file records the storage path of each object in the data packet (such as files, tables, programs, data records, etc.) and the summary information of these objects; the verification mechanism of the signed data packet generally includes the following steps: reading the signature file, calculating the summary information of the file under the file path recorded in the signature file, and verifying the data packet based on the calculated summary information and the summary information recorded in the signature file. The inventor of the present disclosure has found that the problem with the traditional verification mechanism of the above-mentioned signature file is that if one or more new files are added to the signed data packet, these files will not appear in the storage path list and summary information list recorded in the corresponding signature file, so when doing verification, the newly added one or more files will not be verified.

[0065] Therefore, the embodiment of the present disclosure proposes a verification method. The method includes: obtaining a signature file of a data packet to be verified; the data packet to be verified includes multiple first data objects; the signature file includes summary information of the second data object; determining the first statistical information of the first data object according to the data packet to be verified, and determining the second statistical information of the second data object according to the signature file; verifying the data packet to be verified according to the first statistical information and the second statistical information to obtain a first verification result. The above method in the embodiment of the present disclosure can verify whether a new file has been added to the data packet by comparing whether the first statistical information and the second statistical information are consistent; this method can prevent attackers from adding malicious files to the data packet after the signature file is generated, resulting in the verification party ignoring the newly added malicious files during the security verification of the data packet based only on the summary information in the signature file, thereby improving the security of the data.

[0066] The details of the embodiments of the present disclosure are described in detail below through specific examples.

[0067] Figure 1 FIG. 1 is a flow chart showing a verification method according to an embodiment of the present disclosure. Figure 1 As shown, the verification method includes the following steps:

[0068] In step S101, a signature file of a data packet to be verified is obtained; the data packet to be verified includes a plurality of first data objects; the signature file includes summary information of a second data object;

[0069] In step S102, first statistical information of a first data object is determined according to the data packet to be verified, and second statistical information of a second data object is determined according to the signature file;

[0070] In step S103, the data packet to be verified is verified according to the first statistical information and the second statistical information to obtain a first verification result.

[0071] In this embodiment, the data packet to be verified may be a data packet including multiple first data objects. It is understandable that the first data object may be any data object, such as a file, a program, a table, a data record, etc. The signature file may include, but is not limited to, summary information of the content of each second data object in the original data packet to be signed and attribute information of each second data object, such as the identifier of the second data object, the path list of the second data object in the data packet, etc. It is understandable that the signature file is created by the issuer of the data packet based on the original data packet, and the second data object targeted by the signature file may be completely identical to the first data object in the data packet to be verified, or may not be completely identical.

[0072] In the traditional signature verification process, the corresponding first data object can be obtained from the data packet to be verified according to the path list in the signature file, and the summary information of the first data object can be calculated (the calculation method of the summary information of the first data object is the same as the calculation method of the summary information of the second data object), and then the summary information of the second data object corresponding to the current path in the signature file is compared with the calculated summary information to see if they are consistent. If they are consistent, it means that the content of the first data object is consistent with the content of the second data object. When the summary information of all the second data objects in the signature file is verified and consistent with the summary information of the corresponding first data object, it can be considered that the verification of the data packet to be verified has passed; however, in this traditional verification method, the newly added first data object in the data packet to be verified cannot be verified, so it can be used by attackers to attack the user of the data packet to be verified.

[0073] Therefore, in the process of using the signature to verify the data packet to be verified, the embodiment of the present disclosure also uses the first statistical information and the second statistical information to verify whether the data packet to be verified has a new data object compared to the original data packet. In this embodiment, the first statistical information may be information obtained by counting multiple first data objects in the data packet, and the first statistical information may include but is not limited to the first number of first data objects and / or a first data object identifier list of the first data objects. The first statistical information can be obtained by counting the first data objects in the data packet.

[0074] The second statistical information may be information obtained by counting the second data objects targeted in the signature file, and the second statistical information may include but is not limited to the second number of second data objects and / or a second data object identifier list. The second statistical information may be obtained by parsing the signature file and obtaining a path list of the second data objects corresponding to the statistical summary information in the parsed signature file.

[0075] If the data packet to be verified is exactly the same as the original data packet for which the signature file is created, it can be determined that the first statistical information is also consistent with the second statistical information. If the data packet to be verified is not exactly the same as the original data packet, the first statistical information and the second statistical information may be inconsistent. Therefore, by comparing the first statistical information and the second statistical information to verify the data packet to be verified, it can at least rule out the possibility that a malicious attacker tampers with the original data packet by adding a new data object to the data packet to be verified, thereby avoiding the possibility that when the summary information in the signature file is used to verify each data object, the newly added data object cannot be verified, which is an attack behavior.

[0076] In an optional implementation of this embodiment, step S103, i.e., the step of verifying the data packet to be verified according to the first statistical information and the second statistical information to obtain a first verification result, further includes the following steps:

[0077] When the first number and the second number are inconsistent, the first verification result is determined to be a verification failure.

[0078] In this optional implementation, the first data object in the data packet to be verified may be a file, etc., and its number can be counted, for example, it can be counted using an interface for counting the number of files provided by the operating system. The signature file may include a list of paths of all second data objects in the original data packet and corresponding summary information. For example, if the original data packet is an application installation package and includes 10 files, when creating a signature file, summary information may be calculated for each of the 10 files, and the paths of the 10 files in the application installation package and the corresponding summary information may be recorded in the signature file. The signature file may record the above content in a predetermined grammatical format; during the verification process, the content in the signature file may be parsed and read according to the predetermined grammatical format, and the number of files included in the signature file, such as 10, may be counted.

[0079] If the first and second numbers counted are different, it can at least be determined that the data packet to be verified is different from the original data packet for creating the signature file in the number of data objects. Therefore, it can be determined that the data packet to be verified is inconsistent with the original data packet, and it can be determined that the verification of the data packet to be verified has failed.

[0080] In an optional implementation of this embodiment, step S103, i.e., the step of verifying the data packet to be verified according to the first statistical information and the second statistical information to obtain a first verification result, further includes the following steps:

[0081] When the first data object identification list and the second data object identification list are inconsistent, it is determined that the first verification result is a verification failure.

[0082] In this optional implementation, the signature file may include a path list of all second data objects in the original data packet and the corresponding summary information, and the path list may include the identifier of the second data object. Therefore, the second data object identifier list can be obtained by counting the identifiers of the second data objects in the signature file, and the first data object identifier list can be obtained by counting the identifiers of the first data objects included in the data packet to be verified, and then the identifiers in the first data object identifier list and the identifiers in the second data object identifier list are compared to see whether they correspond one to one. If they do not correspond one to one, it can at least be determined that the first data object included in the data packet to be verified is different from the second data object in the original data packet, and the verification of the data packet to be verified fails. In this way, it is also possible to verify the situation that a new data object is added to the data packet to be verified, avoiding the situation that the new data object in the data packet cannot be verified using the traditional verification method. In addition, by comparing the first data object identifier list and the second data object identifier list, not only can the situation of the new data packet be verified, but also the situation that the first data object in the data packet to be verified is inconsistent with the second data object in the original data packet can be directly verified from the identifier, without the need to calculate the summary information of the first data object in the data packet to be verified, which can save computing resources and improve the verification efficiency of the data packet.

[0083] In an optional implementation of this embodiment, the method further includes the following steps:

[0084] The data packet to be verified is verified according to the summary information to obtain a second verification result.

[0085] In this optional implementation, the signature information in the signature file may be summary information of the second data object in the original data packet. When the signature information in the signature file is used to verify the data packet to be verified, the summary information of the first data object in the data packet to be verified may be calculated, and the summary information may be calculated using a summary algorithm recorded in the signature file, which is also used to calculate the summary information of the second data object when the signature file is created.

[0086] During the verification process, the first data object can be obtained from the data packet to be verified according to the file path recorded in the signature file, and the summary information of the first data object can be calculated, and then the calculated summary information can be compared with the summary information recorded in the signature file. It can be understood that the verification of the data packet to be verified according to the summary information includes not only comparing the summary information of the first data object and the second data object, but also other verifications. For example, the signature file can also include other information to be verified, such as the summary information of all the contents included in the signature file. During the verification, the summary information of all the contents included in the signature file can also be calculated and compared with the corresponding summary information recorded in the signature file to prevent the signature file from being tampered with.

[0087] It can be understood that in the embodiments of the present disclosure, in the process of verifying the data packet to be verified, the first statistical information and the second statistical information can be used to verify the data packet to be verified, and a first verification result can be obtained. When the first verification result is a verification failure, the verification process can be directly terminated, and a final verification result that the data packet to be verified is unreliable is output; when the first verification result is a verification success, the summary information in the signature file can be used to continue to verify the data packet to be verified, and a second verification result is obtained; when the second verification result is also a verification success, a final verification result that the data to be verified is credible is output.

[0088] Of course, in some embodiments of the present disclosure, the summary information in the signature file may be used to verify the data packet to be verified first, and then the first statistical information and the second statistical information may be used to verify the data packet to be verified after the verification is passed. In other embodiments, the process of verifying the data packet to be verified using the summary information in the signature file and the process of verifying the data packet to be verified using the first statistical information and the second statistical information may be performed in parallel, and finally a final verification result of whether the data packet to be verified is credible or not may be obtained based on the first verification result and the second verification result.

[0089] In short, no matter which verification order is adopted, only when the first verification result and the second verification result are both verified, the final verification result is that the data packet to be verified is credible, and in other cases, that is, when the first verification result or the second verification result is verified failed, the final verification result is that the data packet to be verified is unreliable.

[0090] In an optional implementation of this embodiment, the signature file is an XML signature file; and / or the data package to be verified is an application installation package.

[0091] XML Signature is a W3C recommended standard that defines the XML syntax of a signature. An XML signature file is a signature document created for an original data packet. An XML signature file has a fixed syntax format, in which the calculation method of summary information, the data object targeted by the summary information, the path of the data object in the data packet, summary information of all contents in the XML signature file, etc. are recorded in the fixed syntax format. An application installation package may include multiple files. The publisher of the application installation package may create an XML signature file using the XML signature method, and publish the XML signature file together with the application installation package. After obtaining the application installation package, the user of the application installation package may verify the application installation package according to the verification method in the disclosed embodiment.

[0092] An implementation method of the present disclosure is described below using an XML signature file and an application installation package as an example.

[0093] Figure 2 An exemplary implementation flowchart according to an embodiment of the present disclosure is shown, which illustrates the process of creating an XML signature file for an application installation package and verifying the application installation package using the XML signature file. Figure 2 As shown, the publisher of the application installation package creates an XML signature file for the application installation package; the application installation package includes n files d1, d2, ..., dn; the process of creating the XML signature file is as follows:

[0094] 1. Creation of Reference element: Get the application installation package, use the specified digest algorithm such as SHA1 to calculate n digest information for n files in the application installation package, and combine the file path list of n files in the application installation package, the corresponding digest information, and the algorithm used in the process such as the above digest algorithm into a Reference element, which may include the following content:

[0095] URI = "\application installation package\……\d1", summary information d1;

[0096] URI = "\application installation package\……\d2", summary information d2;

[0097] …

[0098] URI = "\application installation package\……\dn", summary information dn;

[0099] Digest algorithms, etc.

[0100] 2. Creation of the SignedInfo element: Combine the specified signature algorithm, reference elements, and other algorithms to be used in the signing process into a SignedInfo element;

[0101] 3. Signature: Use the above signature algorithm to sign (encrypt) the signature information element to obtain the signature value;

[0102] 4. The signature information element, signature value, and other optional information (such as verification key) are recorded in the XML signature file.

[0103] Verification process of application installation package using XML signature file:

[0104] 1. Obtain the application installation package to be verified (including n files e1, e2, ..., em) and the corresponding XML signature file;

[0105] 2. Count and obtain the number of files m in the application installation package and the number of file paths n included in the reference elements in the XML signature file;

[0106] 3. When m and n are not equal, the verification process ends and the result of application installation package verification failure is output;

[0107] 4. When m and n are equal, verify the reference element in the XML signature file: use the file path in the reference element in the XML signature file to obtain files e1, e2, ..., em from the application installation package, and use the digest algorithm in the reference element to calculate the digest information of the files e1, e2, ..., em; compare the calculated digest information e1, digest information e2, ..., digest information em with the corresponding digest information d1, digest information d2, ..., digest information dm in the reference element. If they are consistent, it means that the reference element verification has passed;

[0108] 5. Signature verification: Use the signature method in the signature information element to sign the signature information element to obtain the signature value, and compare the signature value with the signature value in the XML signature file. If they are exactly the same, the verification passes, the verification process ends, and the result of successful verification of the application installation package is output.

[0109] It can be understood that the creation and verification process of the above-mentioned XML signature file is only for illustration. The method of the embodiment of the present disclosure is not limited to the above implementation steps in the specific implementation process. The actual application may also include other steps, such as encryption and decryption of the XML signature file, etc. The specific steps can be determined according to the actual situation and are not limited here.

[0110] It should be noted that the signature file in the embodiment of the present disclosure is not limited to the XML signature file and the application installation package. The above verification method proposed in the embodiment of the present disclosure can be used as long as each data object in a data packet including multiple data objects is verified separately.

[0111] Figure 3A flowchart of an application installation method according to an embodiment of the present disclosure is shown. Figure 3 As shown, the application installation method includes the following steps:

[0112] In step S301, the application installation package is downloaded from the server;

[0113] In step S302, the above verification method is used to verify whether the application installation package is credible;

[0114] In step S303, when the application installation package is credible, the application installation package is installed.

[0115] In this embodiment, the application installation method can be executed on the client. In response to the user's request, the client requests to download the corresponding application installation package from the server. The client can also obtain the signature file of the application installation package, which can be downloaded together with the application installation package or obtained by other means. The client can use the signature file to verify the application installation package. The verification process can refer to the verification method proposed in the embodiment of the present disclosure, and the details can refer to the above description of the verification method, which will not be repeated here.

[0116] After the application installation package is successfully verified, the client can determine that the application installation package is credible, so the installation file in the application installation package can be run locally to successfully install the application. After the application installation package verification fails, the client can determine that the application installation package is not credible, and can refuse to install the application, and output a prompt to the user that the application installation package is not credible. The application installation package verification method proposed in the embodiment of the present disclosure can avoid the situation where the newly added files cannot be verified using the traditional verification method, and can further improve the security of the application installation process.

[0117] Figure 4 FIG. 1 is a flow chart showing a data transmission method according to an embodiment of the present disclosure. Figure 4 As shown, the data transmission method includes the following steps:

[0118] In step S401, a data packet is received;

[0119] In step S402, the above verification method is used to verify whether the data packet is credible;

[0120] In step S403, when the data packet is unreliable, the data packet is discarded.

[0121] In this embodiment, the data transmission method is executed at the data receiving party. After receiving the data packet, the data receiving party can also obtain the signature file of the data packet; the signature file can be received from the data sending party together with the data packet, or can be obtained by other means. The data receiving party can use the signature file to verify the data packet. The verification process can refer to the verification method proposed in the embodiment of the present disclosure, and the details can refer to the above description of the verification method, which will not be repeated here.

[0122] After the data packet verification succeeds, the data receiving party can determine that the data packet is credible, so the data receiving party can use the data packet normally; and after the data packet verification fails, the data receiving party can determine that the data packet is untrustworthy, so the data packet can be discarded, and / or feedback information that the data packet is untrustworthy can be fed back to the data sending party. The data packet verification method proposed in the embodiment of the present disclosure can avoid the situation where the newly added file cannot be verified by the traditional verification method, and can further improve the security of data transmission.

[0123] The following are embodiments of the apparatus of the present disclosure, which can be used to execute embodiments of the method of the present disclosure.

[0124] According to an embodiment of the present disclosure, the verification device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The verification device includes:

[0125] An acquisition module is configured to acquire a signature file of a data packet to be verified; the data packet to be verified includes a plurality of first data objects; the signature file includes summary information of a second data object;

[0126] A first determination module is configured to determine first statistical information of a first data object according to a data packet to be verified, and to determine second statistical information of a second data object according to a signature file;

[0127] The first verification module is configured to verify the data packet to be verified according to the first statistical information and the second statistical information to obtain a first verification result.

[0128] In an optional implementation of this embodiment, the first statistical information includes a first quantity of first data objects and / or a first data object identification list; the second file information includes a second quantity of second data objects and / or a second data object identification list.

[0129] In an optional implementation of this embodiment, the first verification module includes:

[0130] The first verification submodule is configured to determine that the first verification result is a verification failure when the first number and the second number are inconsistent.

[0131] In an optional implementation of this embodiment, the first verification module includes:

[0132] The second verification submodule is configured to determine that the first verification result is a verification failure when the first data object identification list and the second data object identification list are inconsistent.

[0133] In an optional implementation of this embodiment, the method further includes:

[0134] The second verification module is configured to verify the data packet to be verified according to the summary information to obtain a second verification result.

[0135] In an optional implementation of this embodiment, the method further includes:

[0136] The second determination module is configured to determine that the data packet to be verified is not credible when the first verification result or the second verification result is verification failure.

[0137] In an optional implementation of this embodiment, the signature file is an XML signature file; and / or the data package to be verified is an application installation package.

[0138] The verification device in this embodiment is Figure 1-Figure 2 The verification methods in the illustrated embodiment and related embodiments correspond to each other. For specific details, please refer to the above description of the verification method, which will not be repeated here.

[0139] According to an application installation device of an embodiment of the present disclosure, the device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The application installation device includes:

[0140] A download module, configured to download an application installation package from a server;

[0141] A third verification module is configured to use the above verification device to verify whether the application installation package is credible;

[0142] The installation module is configured to install the application installation package when the application installation package is credible.

[0143] The application installation device in this embodiment Figure 3 The application installation methods in the illustrated embodiments correspond to each other. For specific details, please refer to the above description of the application installation method, which will not be repeated here.

[0144] According to a data transmission device in one embodiment of the present disclosure, the device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The data transmission device includes:

[0145] A receiving module, configured to receive a data packet;

[0146] A fourth verification module is configured to use the verification device to verify whether the data packet is credible;

[0147] The discard module is configured to discard the data packet when the data packet is untrustworthy.

[0148] The verification device in this embodiment is Figure 4 The data transmission methods in the illustrated embodiments correspond to each other. For specific details, please refer to the above description of the data transmission method, which will not be repeated here.

[0149] Figure 5 It is a structural diagram of an electronic device suitable for implementing the verification method, application installation method and / or data transmission method according to an embodiment of the present disclosure.

[0150] like Figure 5 As shown, the electronic device 500 includes a processing unit 501, which can be implemented as a processing unit such as a CPU, a GPU, a FPAG, and a NPU. The processing unit 501 can perform various processes in the embodiments of any of the above methods of the present disclosure according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. In RAM503, various programs and data required for the operation of the electronic device 500 are also stored. The processing unit 501, ROM502, and RAM503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0151] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0152] In particular, according to an embodiment of the present disclosure, any method in the above referenced embodiment of the present disclosure may be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a readable medium thereof, and the computer program includes a program code for executing any method in the embodiment of the present disclosure. In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 509, and / or installed from a removable medium 511.

[0153] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the road map or block diagram can represent a module, a program segment or a part of a code, and a part of a module, a program segment or a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0154] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.

[0155] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the device in the above-mentioned embodiment; or a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.

[0156] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.

Claims

1. A verification method, wherein: include: Obtaining an XML signature file of an application installation package; the application installation package includes multiple files; The XML signature file includes a signature information element, and the signature information element includes a signature algorithm and a reference element; Determine first statistical information of the plurality of files according to the application installation package, and determine second statistical information of the plurality of files in the original application installation package according to the XML signature file, wherein the first statistical information includes a first data object identifier list of the plurality of files; and the second statistical information includes a second data object identifier list of the plurality of files in the original application installation package; Verifying the application installation package according to the first statistical information and the second statistical information to obtain a first verification result; When the first verification result is that the verification is passed, the application installation package is verified according to the summary information to obtain a second verification result, wherein the summary information of the multiple files and the corresponding summary information in the reference element are compared. If they are consistent, it means that the second verification result is verified to be passed. The summary information of the multiple files is obtained by obtaining the multiple files from the application installation package using the file path in the reference element in the XML signature file, and then calculating the multiple files using the summary algorithm in the reference element; When the second verification result is that the verification is passed, the signature information element is signed using the signature algorithm in the signature information element to obtain a signature value, and the signature value is compared with the signature value in the XML signature file. If they are completely consistent, the verification is passed.

2. The method according to claim 1, wherein: The first statistical information also includes a first number of multiple files; the second statistical information also includes a second number of multiple files in the original application installation package.

3. The method according to claim 2, wherein: The application installation package is verified according to the first statistical information and the second statistical information to obtain a first verification result, including: When the first number and the second number are inconsistent, the first verification result is determined to be a verification failure.

4. The method according to claim 2 or 3, wherein: The application installation package is verified according to the first statistical information and the second statistical information to obtain a first verification result, including: When the first data object identification list and the second data object identification list are inconsistent, it is determined that the first verification result is a verification failure.

5. The method according to claim 1, wherein: Also includes: When the first verification result or the second verification result is verification failure, it is determined that the application installation package is not credible.

6. A method for installing an application, wherein: include: Download the application installation package from the server; Verify whether the application installation package is credible using the method described in any one of claims 1 to 5; When the application installation package is credible, the application installation package is installed.

7. A data transmission method, wherein: include: Receive the application installation package; Verify whether the application installation package is credible using the method described in any one of claims 1 to 5; When the application installation package is not credible, the application installation package is discarded.

8. A verification device, wherein: include: An acquisition module, configured to acquire an XML signature file of an application installation package; The application installation package includes multiple files; The XML signature file includes a signature information element, and the signature information element includes a signature algorithm and a reference element; a first determining module configured to determine first statistical information of the plurality of files according to the application installation package, and to determine second statistical information of the plurality of files in the original application installation package according to the XML signature file, wherein the first statistical information includes a first data object identifier list of the plurality of files; and the second statistical information includes a second data object identifier list of the plurality of files in the original application installation package; A first verification module is configured to verify the application installation package according to the first statistical information and the second statistical information to obtain a first verification result; The second verification module is configured to verify the application installation package according to the summary information when the first verification result is verification passed, and obtain a second verification result, wherein the summary information of the multiple files and the corresponding summary information in the reference element are compared, and if they are consistent, it means that the second verification result is verified passed, and the summary information of the multiple files is obtained by obtaining the multiple files from the application installation package using the file path in the reference element in the XML signature file, and then calculating the multiple files using the summary algorithm in the reference element; When the second verification result is that the verification is passed, the signature information element is signed using the signature algorithm in the signature information element to obtain a signature value, and the signature value is compared with the signature value in the XML signature file. If they are completely consistent, the verification is passed.

9. The device according to claim 8, wherein: The first statistical information also includes a first quantity of the plurality of files; and the second statistical information also includes a second quantity of the plurality of files in the original application installation package.

10. The device according to claim 9, wherein: The first verification module comprises: The first verification submodule is configured to determine that the first verification result is a verification failure when the first number and the second number are inconsistent.

11. The device according to claim 9 or 10, wherein: The first verification module comprises: The second verification submodule is configured to determine that the first verification result is a verification failure when the first data object identification list and the second data object identification list are inconsistent.

12. The device according to claim 8, wherein: Also includes: The second determination module is configured to determine that the application installation package is not credible when the first verification result or the second verification result is verification failure.

13. An application installation device, wherein: include: A download module, configured to download an application installation package from a server; A third verification module, configured to verify whether the application installation package is credible using the apparatus according to any one of claims 8 to 12; The installation module is configured to install the application installation package when the application installation package is credible.

14. A data transmission device, wherein: include: A receiving module, configured to receive an application installation package; a fourth verification module, configured to verify whether the application installation package is authentic using the apparatus according to any one of claims 8 to 12; The discarding module is configured to discard the application installation package when the application installation package is not credible.

15. An electronic device, wherein: comprising a memory and a processor; wherein, The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having computer instructions stored thereon, wherein: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images