Digital signature method and digital signature device

Abstract

The present disclosure relates to a digital signature method and a digital signature device, which signs an application package APK by using a native signature method to obtain a native APK; generates developer signature information; signs the developer signature information and data of the native APK by using a private key of the developer to obtain a developer signature value; and inserts the developer signature value and the developer signature information into an APK signature block of the native APK to obtain a developer real-name APK. Since the developer signature information at least contains a developer certificate including a public key of the developer issued by a certificate authority CA, the legality of the developer certificate can be guaranteed. If the developer real-name APK signature verification is passed, it indicates that the identity of the developer is real, that is, the APK to be installed is developed by a real developer and has not been tampered with, and no malicious code or virus is introduced, so that the situation of data being maliciously stolen or leaked after the APK is installed can be avoided, and the data security and the security of the mobile network are improved.

Description

Technical Field

[0001] This disclosure relates to the field of digital signature technology, and more specifically, to a digital signature method and a digital signature device. Background Technology

[0002] When installing an application package (APK), electronic devices require the APK to have the developer's signature information. The electronic device verifies the developer's signature information before installing the APK, and only allows installation if the verification is successful.

[0003] In related technologies, developers simply sign the APK using their own self-issued certificates. Since the legitimacy of these certificates cannot be verified, even if the developer's signature information passes verification, it doesn't guarantee the developer's authenticity. In other words, there's no guarantee the APK to be installed was developed by the genuine developer; it may have been tampered with—for example, injected with malicious code or viruses. Because users cannot verify the developer's identity, they are likely to install a tampered APK, potentially leading to malicious data theft or leakage, resulting in poor data security. Summary of the Invention

[0004] This disclosure provides a digital signature method and a digital signature device to at least solve the problem in the aforementioned related technologies where users cannot distinguish the authenticity of the developer, and may install tampered APKs, which may lead to malicious data theft or leakage, resulting in poor data security.

[0005] According to a first aspect of the present disclosure, a digital signature method is provided, applied to a developer terminal. The method includes: signing an application package APK using a native signature method to obtain a native APK; generating developer signature information, wherein the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) including the developer's public key; signing the developer signature information and data of the native APK using the developer's private key to obtain a developer signature value; and inserting the developer signature value and the developer signature information into the APK signature block of the native APK to obtain a developer-named APK.

[0006] Optionally, the step of using the developer's private key to sign the developer signature information and the data of the native APK to obtain the developer signature value includes: using the developer's private key to sign the developer signature information and the data of the native APK according to the SM2 algorithm to obtain the developer signature value.

[0007] Optionally, the data of the native APK includes the contents of the APK ZIP file entries, the APK central directory, and the APK signature block.

[0008] According to a second aspect of the present disclosure, a digital signature method is provided, applied to a third-party terminal. The method includes: obtaining a developer-registered application package (APK) generated by a developer terminal, wherein the APK signature block of the developer-registered APK includes developer signature information and a developer signature value, the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) including the developer's public key, and the developer signature value is obtained by signing the developer signature information and data of the native APK using the developer's private key, wherein the native APK is obtained by signing the APK using a native signature method; performing signature verification on the developer signature value in the developer-registered APK; if the signature verification of the developer signature value in the developer-registered APK passes, generating third-party signature information, wherein the third-party signature information at least includes a third-party certificate issued by the CA including the third party's public key; signing the third-party signature information and data of the native APK using the third party's private key to obtain a third-party signature value; and inserting the third-party signature value and the third-party signature information into the APK signature block of the developer-registered APK to obtain a third-party signed APK.

[0009] Optionally, the signature verification of the developer signature value in the developer-registered APK includes: using the public key of the CA to verify the signature of the developer certificate contained in the developer signature information; and if the developer certificate signature verification is successful, using the developer's public key contained in the developer certificate to verify the signature of the developer signature value.

[0010] Optionally, the step of using the third party's private key to sign the third party's signature information and the data of the native APK to obtain a third party signature value includes: using the third party's private key to sign the third party's signature information and the data of the native APK according to the SM2 algorithm to obtain the third party signature value.

[0011] Optionally, the data of the native APK includes the contents of the APK ZIP file entries contained in the native APK and the APK central directory.

[0012] According to a third aspect of the present disclosure, a digital signature method is provided, applied to a developer terminal and at least one third-party terminal. The digital signature method includes: performing a first digital signature operation at the developer terminal to generate a developer-identified APK; and at each of the at least one third-party terminal, obtaining the developer-identified APK generated by the developer terminal or a third-party signed APK generated by another third-party terminal, and performing a second digital signature operation on the developer-identified APK or the third-party signed APK to generate a third-party signed APK for that third-party terminal. The first digital signature operation includes: signing an application package APK using a native signature method to obtain a native APK; generating developer signature information, wherein the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) including the developer's public key; signing the developer signature information and data of the native APK using the developer's private key to obtain a developer signature value; and signing the developer signature information and data of the native APK. The developer signature value and the developer signature information are inserted into the APK signature block of the native APK to obtain a developer-signed APK. The second digital signature operation includes: verifying the developer signature value in the developer-signed APK or the developer signature value in a third-party signed APK generated by another third-party terminal; if the signature verification of the developer signature value in the developer-signed APK or the developer signature value in a third-party signed APK generated by another third-party terminal is successful, generating third-party signature information, wherein the third-party signature information at least includes a third-party certificate issued by the CA including the third party's public key; signing the third-party signature information and the data of the native APK using the third party's private key to obtain a third-party signature value; and inserting the third-party signature value and the third-party signature information into the APK signature block of the developer-signed APK or the third-party signed APK generated by another third-party terminal to obtain a third-party signed APK for that third-party terminal.

[0013] According to a fourth aspect of the present disclosure, a digital signature device is provided, applied to a developer terminal, comprising: a first signature module configured to sign an application package APK using a native signature method to obtain a native APK; a generation module configured to generate developer signature information, wherein the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) including the developer's public key; a second signature module configured to sign the developer signature information and data of the native APK using the developer's private key to obtain a developer signature value; and an insertion module configured to insert the developer signature value and the developer signature information into the APK signature block of the native APK to obtain a developer-identified APK.

[0014] Optionally, the second signature module is configured to sign the developer signature information and the data of the native APK using the developer's private key according to the SM2 algorithm to obtain the developer signature value.

[0015] Optionally, the data of the native APK includes the contents of the APK ZIP file entries, the APK central directory, and the APK signature block.

[0016] According to a fifth aspect of the present disclosure, a digital signature device is provided, applied to a third-party terminal, comprising: an acquisition module configured to acquire a developer-authenticated application package (APK) generated by a developer terminal, wherein the APK signature block of the developer-authenticated APK includes developer signature information and a developer signature value, the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) including the developer's public key, and the developer signature value is obtained by signing the developer signature information and data of the native APK using the developer's private key, wherein the native APK is obtained by signing the APK using a native signature method; and a signature verification module configured to acquire a developer-authenticated application package (APK) generated by a developer terminal, wherein the developer signature information includes developer signature information and a developer signature value, ... The system is configured to: 1) perform signature verification on the developer signature value in the developer-authenticated APK; 2) generate third-party signature information if the signature verification of the developer signature value in the developer-authenticated APK passes, wherein the third-party signature information includes at least a third-party certificate issued by the CA containing the third party's public key; 3) sign module, configured to sign the third-party signature information and the data of the native APK using the third party's private key to obtain a third-party signature value; and 4) insert module, configured to insert the third-party signature value and the third-party signature information into the APK signature block of the developer-authenticated APK to obtain a third-party signed APK.

[0017] Optionally, the signature verification module is configured to: use the public key of the CA to perform signature verification on the developer certificate contained in the developer signature information; and if the developer certificate signature verification is successful, use the public key of the developer contained in the developer certificate to perform signature verification on the developer signature value.

[0018] Optionally, the signing module is configured to sign the third-party signing information and the data of the native APK using the third party's private key according to the SM2 algorithm to obtain the third-party signing value.

[0019] Optionally, the data of the native APK includes the contents of the APK ZIP file entries contained in the native APK and the APK central directory.

[0020] According to a sixth aspect of the present disclosure, a digital signature system is provided, including a developer terminal and at least one third-party terminal; at the developer terminal, a first digital signature operation is performed to generate a developer-identified APK; at each of the at least one third-party terminal, the developer-identified APK generated by the developer terminal or a third-party signed APK generated by another third-party terminal is obtained, and a second digital signature operation is performed on the developer-identified APK or the third-party signed APK to generate a third-party signed APK for that third-party terminal; wherein, the first digital signature operation includes: signing an application package APK using a native signature method to obtain a native APK; generating developer signature information, wherein the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) including the developer's public key; signing the developer signature information and the data of the native APK using the developer's private key to obtain a developer signature value; and signing the developer signature value and the data of the native APK. The developer's signature information is inserted into the APK signature block of the native APK to obtain a developer-signed APK. The second digital signature operation includes: verifying the developer signature value in the developer-signed APK or the developer signature value in a third-party signed APK generated by another third-party terminal; if the signature verification of the developer signature value in the developer-signed APK or the developer signature value in a third-party signed APK generated by another third-party terminal is successful, generating third-party signature information, wherein the third-party signature information at least includes a third-party certificate issued by the CA including the third party's public key; signing the third-party signature information and the data of the native APK using the third party's private key to obtain a third-party signature value; and inserting the third-party signature value and the third-party signature information into the APK signature block of the developer-signed APK or the third-party signed APK generated by another third-party terminal to obtain a third-party signed APK for that third-party terminal.

[0021] According to a seventh aspect of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement a digital signature method according to the present disclosure.

[0022] According to an eighth aspect of the present disclosure, a computer-readable storage medium is provided that, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform a digital signature method according to the present disclosure.

[0023] The technical solutions provided by the embodiments of this disclosure bring at least the following beneficial effects:

[0024] Because the developer's signature information includes at least a developer certificate issued by a Certificate Authority (CA) containing the developer's public key, the legitimacy of the developer certificate is guaranteed. If the developer's verified APK signature passes verification, it indicates that the developer's identity is genuine, meaning the APK to be installed was developed by the real developer and has not been tampered with, preventing the introduction of malicious code or viruses. This avoids the possibility of data theft or leakage after installing the APK, improving data security and mobile network security. Furthermore, because the third-party signature information includes at least a third-party certificate issued by a CA containing the third party's public key, the legitimacy of the third-party certificate is guaranteed. If the third-party signed APK signature passes verification, it means the APK to be installed has been legitimately approved and verified by a third party. Since the APK to be installed has passed the legitimate third-party's regulatory review, the security and legitimacy of the APK to be installed are guaranteed. Moreover, since the third-party terminal has already verified the developer's verified APK signature before signing it, the successful verification of the third-party signed APK implicitly indicates that the developer's verified APK signature has also passed. At the same time, the identity of the developer and the security and legality of the APK to be installed are verified, which can ensure that the electronic device with the APK installed is protected from malicious attacks and ensure data security.

[0025] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0027] Figure 1 This is a schematic diagram illustrating a digital signature method according to an exemplary embodiment of the present disclosure;

[0028] Figure 2 This is a flowchart illustrating a digital signature method according to an exemplary embodiment of the present disclosure;

[0029] Figure 3 This is a schematic diagram illustrating a native APK according to an exemplary embodiment of the present disclosure;

[0030] Figure 4 This is a flowchart illustrating another digital signature method according to exemplary embodiments of the present disclosure;

[0031] Figure 5 This is a flowchart illustrating yet another digital signature method according to exemplary embodiments of the present disclosure;

[0032] Figure 6 This is a schematic diagram illustrating an APK file structure that has been signed by the developer and multiple third parties according to an exemplary embodiment of the present disclosure;

[0033] Figure 7 This is a block diagram illustrating a digital signature device according to an exemplary embodiment of the present disclosure;

[0034] Figure 8 This is a block diagram illustrating another digital signature device according to exemplary embodiments of the present disclosure;

[0035] Figure 9 This is a block diagram illustrating a digital signature system according to exemplary embodiments of the present disclosure;

[0036] Figure 10 This is a block diagram illustrating an electronic device according to exemplary embodiments of the present disclosure. Detailed Implementation

[0037] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0038] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following examples do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0039] It should be noted that the phrase "at least one of several items" in this disclosure refers to three parallel cases: "any one of the several items", "a combination of any number of the several items", and "all of the several items". For example, "including at least one of A and B" includes the following three parallel cases: (1) including A; (2) including B; (3) including A and B. As another example, "performing at least one of step one and step two" indicates the following three parallel cases: (1) performing step one; (2) performing step two; (3) performing both step one and step two.

[0040] Currently, electronic devices require the APK to have the developer's signature information before installing it. The device verifies the developer's signature information before installation; only if the verification is successful will the APK be allowed to install. Android is a computer operating system primarily used on mobile devices, such as smartphones and tablets. The following uses Android APKs as an example to illustrate the problems existing in related technologies.

[0041] Although the Android system requires APKs to have developer signature information, and the signing method has been upgraded from v1 to v2 and v3, it still does not require application (app) developers to register with a Certificate Authority (CA) and obtain a signing certificate. Developers simply use their own self-signed certificates to sign the APK. Because there is no third-party recognized authority, the legitimacy of the developer's self-signed certificate cannot be verified. Even if the developer's signature information passes verification, the developer's identity cannot be guaranteed. On the one hand, because the true developer of the APK cannot be identified, software liability is difficult to trace; on the other hand, it cannot be guaranteed that the APK to be installed was developed by the genuine developer. The APK may have been tampered with, for example, by injecting malicious code or viruses. In this case, because users cannot distinguish the developer's authenticity, they may install a tampered APK, potentially leading to malicious data theft or leakage, resulting in poor data security. Furthermore, as software plays an increasingly important role in cyberspace, testing and certifying software quality, security, and compliance will become crucial measures to ensure software security. App maturity certification, code security testing, and software functionality industry review all require relevant organizations to sign and authenticate apps. Currently, Android APKs only have a single signature and verification mechanism for developers, which cannot meet the needs of third-party organizations to implement multi-signature for apps.

[0042] To address the technical problem in related technologies where users cannot verify the authenticity of developers, potentially leading to the installation of tampered APKs and subsequent malicious data theft or leakage, resulting in poor data security, this disclosure proposes a digital signature method. Since the developer's signature information includes at least a developer certificate issued by a Certificate Authority (CA) containing the developer's public key, the legitimacy of the developer certificate is guaranteed. If the developer's verified APK signature passes verification, it indicates that the developer's identity is genuine, meaning the APK to be installed was developed by the real developer, has not been tampered with, and will not introduce malicious code or viruses. This prevents malicious data theft or leakage after installing the APK, improving data security and mobile network security.

[0043] To address the technical issue that Android APKs, with only a single developer signature and verification mechanism, cannot meet the needs of third-party organizations for multi-signature applications, the digital signature method proposed in this disclosure ensures the legitimacy of the third-party certificate by including at least a third-party certificate issued by a CA containing the third party's public key. If the third-party signed APK signature verification passes, it indicates that the APK to be installed has been legitimately approved and verified by a third party. Since the APK has passed the legitimate third-party review, its security and legitimacy are guaranteed. Furthermore, since the third-party terminal has already verified the developer's real-name APK signature before signing it, the successful third-party signed APK signature verification implicitly confirms the successful developer's real-name APK signature verification. Thus, the verification of the developer's identity and the security and legitimacy of the APK to be installed are simultaneously achieved, ensuring that the electronic device installing the APK is protected from malicious attacks and safeguarding data security and mobile network security.

[0044] Figure 1 This is a schematic diagram illustrating a digital signature method according to an exemplary embodiment of the present disclosure. Developer terminal 1 needs to first register with a Certificate Authority (CA2) and apply for a developer certificate 3. For example, developer terminal 1 can first generate a developer's public key 41 and a developer's private key 42, and then send the developer's public key 41 to CA2. Next, after verifying the developer's identity, CA2 can sign the developer's public key 41, generate a developer certificate 3, and send it to developer terminal 1. Next, developer terminal 1 can generate a developer-identified APK based on the developer certificate 3 issued by CA2. It should be noted that the aforementioned developer can be the creator of the APP or an organization responsible for the APP.

[0045] Third-party terminal 5 also needs to register and apply for a third-party certificate 6 with the certificate authority CA2. For example, third-party terminal 5 can first generate a third-party public key 71 and a third-party private key 72, and then send the third-party public key 71 to CA2. Next, after verifying the identity of the third party, CA2 can sign the third-party public key 71, generate third-party certificate 6, and send it to third-party terminal 5. Then, third-party terminal 5 can generate a third-party signed APK based on the third-party certificate 6 issued by CA2.

[0046] Figure 2 This is a flowchart illustrating an exemplary embodiment of a digital signature method according to the present disclosure, applied to a developer terminal.

[0047] Reference Figure 2In step 201, the application package APK can be signed using native signing methods to obtain the native APK. For example, the Android native v2 or v3 signing methods can be used to sign the APK to obtain the native APK.

[0048] According to an exemplary embodiment of this disclosure, the data of a native APK may include APK ZIP file entry content, an APK central directory, and an APK signature block. Figure 3 This is a schematic diagram illustrating a native APK according to an exemplary embodiment of the present disclosure. Figure 3 The document also shows the end of the APK's central directory. Thus, this disclosure presents an APK multi-signature mechanism based on Android's native v2 and v3 signing methods, which is compatible with both Android v2 and v3 signing mechanisms. This ensures both the integrity of the APK and the authenticity of the APK developer's identity, achieving traceability of software responsibility.

[0049] In step 202, developer signature information can be generated. This developer signature information may include at least a developer certificate 3 issued by a certificate authority (CA2) containing the developer's public key 41.

[0050] According to an exemplary embodiment of this disclosure, the developer signature information may also include, but is not limited to, at least one of the following: developer name, developer signature address, developer signature date, and software bill of materials (SBOM).

[0051] In step 203, the developer's private key 42 can be used to sign the developer signature information and the data of the native APK to obtain the developer signature value. That is, the developer's private key 42 can be used to sign the developer signature information, the contents of the APK ZIP file entries, the APK central directory, and the APK signature block to obtain the developer signature value. For example, the digest values ​​of the developer signature information, the APK ZIP file entries, the APK central directory, and the APK signature block can be calculated first. Then, the developer's private key 42 can be used to perform a signature calculation on these digest values ​​to obtain the developer signature value.

[0052] According to an exemplary embodiment of this disclosure, the developer's signature value can be obtained by signing the developer's signature information and the data of the native APK using the developer's private key 42 based on the SM2 algorithm. In addition to the SM2 algorithm, algorithms such as RSA and DSA can also be used.

[0053] In step 204, the developer signature value and developer signature information can be inserted into the APK signature block of the native APK to obtain a developer-authenticated APK. For example, the developer signature value and developer signature information can be inserted into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain a developer-authenticated APK. Since the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) containing the developer's public key, the legitimacy of the developer certificate can be guaranteed. If the developer-authenticated APK signature verification passes, it indicates that the developer's identity is genuine, meaning the APK to be installed was developed by the real developer and has not been tampered with, and will not introduce malicious code or viruses. This avoids the possibility of data being maliciously stolen or leaked after installing the APK, improving data security and mobile network security.

[0054] Figure 4 This is a flowchart illustrating another digital signature method according to an exemplary embodiment of the present disclosure, applied to a third-party terminal.

[0055] Reference Figure 4 In step 401, the developer-authenticated application package APK generated by developer terminal 1 can be obtained. The APK signature block of the developer-authenticated APK can contain developer signature information and a developer signature value. The developer signature information can at least contain a developer certificate 3 issued by a certificate authority (CA2) including the developer's public key 41. The developer signature value is obtained by signing the developer signature information and the data of the native APK using the developer's private key 42. The native APK is obtained by signing the APK using a native signing method.

[0056] In step 402, the developer signature value in the developer-registered APK can be verified.

[0057] According to an exemplary embodiment of this disclosure, the public key 81 of CA2 can be used to verify the signature of the developer certificate 3 contained in the developer signature information. For example, a third-party terminal 5 can use the public key 81 of CA2 to perform signature verification calculation on the signature value of the developer certificate 3 to obtain the digest value of the developer certificate 3. Then, the third-party terminal 5 can calculate the digest value of the developer certificate 3 itself and compare the calculated digest value of the developer certificate 3 with the digest value of the developer certificate 3 obtained through signature verification calculation. If the two match, it can be determined that the signature verification of the developer certificate 3 is successful, that is, it means that the developer certificate 3 was indeed issued by CA2 and the developer certificate 3 has not been tampered with, that is, the public key 41 contained in the developer certificate 3 is indeed the developer's public key.

[0058] Next, if the developer certificate 3 signature verification passes, the developer's public key 41 contained in developer certificate 3 can be used to verify the developer signature value. For example, the developer's public key 41 contained in developer certificate 3 can be used to perform signature verification calculation on the developer signature value to obtain the digest value of the developer signature information, the digest value of the APK ZIP file entry content, the digest value of the APK central directory, and the digest value of the APK signature block. Then, the third-party terminal 5 can calculate the digest value of each of the developer signature information, APK ZIP file entry content, APK central directory, and APK signature block contained in the developer-identified APK, and compare the calculated digest value of the developer signature information with the digest value of the developer signature information calculated through signature verification, compare the calculated digest value of the APK ZIP file entry content with the digest value of the APK ZIP file entry content calculated through signature verification, compare the calculated digest value of the APK central directory with the digest value of the APK central directory calculated through signature verification, and compare the calculated digest value of the APK signature block with the digest value of the APK signature block calculated through signature verification. If all four comparison results match, it can be determined that the developer's signature value has passed the signature verification. This indicates that the APK has indeed been signed by the developer, thus confirming the developer's identity and that the APK was indeed developed by the real developer and has not been tampered with.

[0059] If the developer's signature value passes the signature verification, it can be confirmed that the developer's real-name APK signature verification has passed.

[0060] In step 403, if the developer signature value in the developer-registered APK passes the signature verification, third-party signature information can be generated. This third-party signature information may at least include a third-party certificate 6 issued by CA2, containing the third party's public key 71. It should be noted that the third-party signature information may also include, but is not limited to, the third-party signature project name, third-party name, signature date, signature address, and Software Bill of Materials (SBOM), etc.

[0061] In step 404, the third-party signature information and the data of the native APK can be signed using the third-party private key 72 to obtain the third-party signature value. It should be noted that the process of obtaining the third-party signature value is similar to that of obtaining the developer signature value, and will not be described in detail here.

[0062] According to exemplary embodiments of this disclosure, a third-party signature value can be obtained by signing third-party signature information and data of the native APK using a third party's private key based on the SM2 algorithm. In addition to the SM2 algorithm, algorithms such as RSA and DSA can also be used.

[0063] According to an exemplary embodiment of this disclosure, when the third-party signature information and the data of the native APK are signed using the third party's private key 72 to obtain the third-party signature value, the data of the native APK may include the contents of the APKZIP file entries contained in the native APK and the APK central directory.

[0064] In step 405, the third-party signature value and third-party signature information can be inserted into the APK signature block of the developer-signed APK to obtain a third-party signed APK. For example, the third-party signature value and third-party signature information can be inserted into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain a third-party signed APK.

[0065] Figure 5 This is a flowchart illustrating yet another digital signature method according to an exemplary embodiment of the present disclosure.

[0066] Reference Figure 5 In step 501, a first digital signature operation can be performed at developer terminal 1 to generate a developer-authenticated APK.

[0067] The first digital signature operation includes:

[0068] Developer terminal 1 can sign the application package APK using native signing methods to obtain a native APK. For example, developer terminal 1 can use Android's native v2 or v3 signing methods to sign the APK and obtain a native APK. Then, developer terminal 1 can generate developer signature information. This developer signature information can at least include a developer certificate issued by a certificate authority (CA2) containing the developer's public key 41. Next, developer terminal 1 can use the developer's private key 42 to sign the developer signature information and the data of the native APK to obtain a developer signature value. Then, developer terminal 1 can insert the developer signature value and developer signature information into the APK signature block of the native APK to obtain a developer-identified APK. For example, developer terminal 1 can insert the developer signature value and developer signature information into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain a developer-identified APK. In this way, since the developer signature information at least includes a developer certificate issued by a certificate authority (CA) containing the developer's public key, the legitimacy of the developer certificate can be guaranteed. If the developer's real-name APK signature verification passes, it means that the developer's identity is real, that is, the APK to be installed was developed by the real developer and has not been tampered with, and will not introduce malicious code or viruses. This can avoid the situation where data is maliciously stolen or leaked after the APK is installed, thus improving data security and mobile network security.

[0069] In step 502, at each of the at least one third-party terminals, a developer-named APK generated by the developer terminal or a third-party signed APK generated by another third-party terminal can be obtained, and a second digital signature operation can be performed on the developer-named APK or the third-party signed APK to generate a third-party signed APK for that third-party terminal.

[0070] The second digital signature operation includes:

[0071] The developer signature value in the developer-registered APK or the developer signature value in the third-party signed APK generated by another third-party terminal can be verified. Next, if the signature verification of the developer signature value in the developer-registered APK or the third-party signed APK generated by another third-party terminal is successful, third-party signature information can be generated. This third-party signature information can at least include a third-party certificate 6 issued by CA2, containing the third party's public key 71. It should be noted that the third-party signature information can also include the third-party signing project name, third-party name, signing date, signing address, and Software Bill of Materials (SBOM), etc. Then, the third-party signature information and the data of the native APK can be signed using the third party's private key 72 to obtain the third-party signature value. Next, the third-party signature value and third-party signature information can be inserted into the APK signature block of the developer-registered APK or the third-party signed APK generated by another third-party terminal to obtain the third-party signed APK for that third-party terminal. For example, the third-party signature value and third-party signature information can be inserted into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain the third-party signed APK for that third-party terminal. In this way, since the third-party signing information at least includes a third-party certificate issued by a CA containing the third party's public key, the legitimacy of the third-party certificate can be guaranteed. If the third-party signed APK signature verification passes, it means that the APK to be installed has been legitimately approved and verified by a third party. Because the APK to be installed has passed the regulatory review of a legitimate third party, the security and legitimacy of the APK to be installed are guaranteed. Furthermore, since the third-party terminal has already verified the developer's real-name APK signature before signing it, the successful third-party signed APK signature verification implicitly means that the developer's real-name APK signature verification has passed. At this point, the verification of the developer's identity and the security and legitimacy of the APK to be installed are simultaneously achieved, ensuring that the electronic device installing the APK is protected from malicious attacks and guaranteeing data security and mobile network security.

[0072] According to exemplary embodiments of this disclosure, the APK obtained according to the digital signature method of this disclosure can be independently verified by the developer and various third-party organizations. These third-party organizations can be software security testing and certification bodies, software industry compliance certification bodies, etc.

[0073] For example, when verifying a developer, as mentioned earlier, CA2's public key 81 can be used to verify developer certificate 3 in the developer signature information. If developer certificate 3 is verified correctly, it means that developer certificate 3 was indeed issued by CA2 and has not been tampered with, and the developer's public key 41 contained in developer certificate 3 is indeed the real developer's public key. Next, the developer signature value can be verified using the developer's public key 41 contained in developer certificate 3. If the developer signature value is verified correctly, it means that the APK has indeed been signed by the real developer, that is, the APK was indeed developed by the real developer, and the APK has not been tampered with.

[0074] When verifying a third party, CA2's public key 81 can be used to verify the third-party certificate 6 in the third-party signature information. If the third-party certificate 6 is verified correctly, it means that the third-party certificate 6 was indeed issued by CA2, that is, the third party is a legitimate and authoritative organization, and the third-party certificate 6 has not been tampered with. Furthermore, the third-party public key 71 contained in the third-party certificate 6 is indeed the genuine third-party public key. Next, the third-party signature value can be verified using the third-party public key 71 contained in the third-party certificate 6. If the third-party signature value verification passes, it means that the third party did indeed sign the APK, that is, the APK has been tested by the third party, and the APK has not been tampered with. Since the third party can be a software security testing and certification organization or a software industry compliance certification organization, the security, legitimacy, and validity of an APK tested by the third party can be guaranteed. Furthermore, since the third-party terminal has already verified the developer's real-name APK signature before signing it, the successful third-party signed APK signature verification implicitly means that the developer's real-name APK signature verification has passed. At the same time, the verification of the developer's identity, the legitimacy of the third party, and the security and validity of the APK to be installed are all implemented, which can ensure that electronic devices with APKs installed are protected from malicious attacks and ensure data security and mobile network security.

[0075] Figure 6 This is a schematic diagram illustrating an APK file structure that has been signed by the developer and multiple third parties, according to an exemplary embodiment of this disclosure. Figure 6As shown, the developer signature value and developer signature information obtained by the developer performing digital signature can be placed in the APK signature block between the APK ZIP file entry content and the APK central directory; the third-party signature values ​​1 to n and third-party signature information 1 to n obtained by the first to nth third parties performing digital signature can be placed in the APK signature block between the APK ZIP file entry content and the APK central directory. As mentioned earlier, the third parties can be software security testing and certification organizations, software industry compliance certification organizations, etc. Utilizing multiple third parties to perform a second digital signature operation on the developer-registered APK or a third-party signed APK generated by another third-party terminal can achieve the purpose of multi-party supervision and review of the APK, and also achieve traceability of software responsibility. For example, a software security testing and certification organization performing a second digital signature operation on a developer-registered APK can ensure the security of the APK; a software industry compliance certification organization performing a second digital signature operation on a developer-registered APK can ensure that the APK complies with industry standards, and so on.

[0076] Figure 7 This is a block diagram illustrating a digital signature device according to an exemplary embodiment of the present disclosure, the digital signature device being applied to a developer terminal.

[0077] Reference Figure 7 The digital signature device 700 may include a first signature module 701, a generation module 702, a second signature module 703, and an insertion module 704.

[0078] The first signing module 701 can use native signing methods to sign the application package APK to obtain the native APK. For example, the first signing module 701 can use Android's native v2 or v3 signing methods to sign the APK to obtain the native APK.

[0079] According to an exemplary embodiment of this disclosure, the data of a native APK may include APK ZIP file entry content, an APK central directory, and an APK signature block.

[0080] The generation module 702 can generate developer signature information. This developer signature information may include at least a developer certificate issued by a Certificate Authority (CA) containing the developer's public key.

[0081] According to exemplary embodiments of this disclosure, the developer signature information may also include, but is not limited to, at least one of the following: developer name, developer signature address, developer signature date, and software bill of materials (SBOM).

[0082] The second signature module 703 can use the developer's private key 42 to sign the developer signature information and the data of the native APK to obtain the developer signature value. That is, the second signature module 703 can use the developer's private key 42 to sign the developer signature information, the contents of the APK ZIP file entries, the APK central directory, and the APK signature block to obtain the developer signature value. For example, the second signature module 703 can first calculate the digest value of the developer signature information, the digest value of the contents of the APK ZIP file entries, the digest value of the APK central directory, and the digest value of the APK signature block. Next, the second signature module 703 can use the developer's private key 42 to perform signature calculations on the digest values ​​of the developer signature information, the APK ZIP file entries, the APK central directory, and the APK signature block to obtain the developer signature value.

[0083] According to an exemplary embodiment of this disclosure, the second signature module 703 can sign the developer signature information and the data of the native APK using the developer's private key 42 according to the SM2 algorithm to obtain the developer signature value. In addition to the SM2 algorithm, algorithms such as RSA and DSA can also be used.

[0084] The insertion module 704 can insert the developer signature value and developer signature information into the APK signature block of the native APK to obtain a developer-authenticated APK. For example, the insertion module 704 can insert the developer signature value and developer signature information into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain a developer-authenticated APK. Since the developer signature information at least includes a developer certificate issued by a Certificate Authority (CA) containing the developer's public key, the legitimacy of the developer certificate can be guaranteed. If the developer-authenticated APK signature verification passes, it indicates that the developer's identity is genuine, meaning the APK to be installed was developed by the real developer and has not been tampered with, and will not introduce malicious code or viruses. This avoids the possibility of data being maliciously stolen or leaked after installing the APK, improving data security and mobile network security.

[0085] Figure 8 This is a block diagram illustrating another digital signature device according to exemplary embodiments of the present disclosure, which is applied to a third-party terminal.

[0086] Reference Figure 8 The digital signature device 800 may include an acquisition module 801, a signature verification module 802, a generation module 803, a signature module 804, and an insertion module 805.

[0087] The acquisition module 801 can acquire the developer-authenticated application package APK generated by developer terminal 1. The APK signature block of the developer-authenticated APK can contain developer signature information and a developer signature value. The developer signature information can at least contain a developer certificate 3 issued by a certificate authority (CA2) including the developer's public key 41. The developer signature value is obtained by signing the developer signature information and the data of the native APK using the developer's private key 42. The native APK is obtained by signing the APK using a native signing method.

[0088] The signature verification module 802 can verify the developer signature value in the developer's real-name APK.

[0089] According to an exemplary embodiment of this disclosure, the signature verification module 802 can use the public key 81 of CA2 to perform signature verification on the developer certificate 3 contained in the developer signature information. For example, the signature verification module 802 can use the public key 81 of CA2 to perform signature verification calculation on the signature value of the developer certificate 3 to obtain the digest value of the developer certificate 3. Then, the signature verification module 802 can calculate the digest value of the developer certificate 3 itself and compare the calculated digest value of the developer certificate 3 with the digest value of the developer certificate 3 obtained through signature verification calculation. If the two match, it can be determined that the signature verification of the developer certificate 3 is successful, that is, it means that the developer certificate 3 was indeed issued by CA2 and the developer certificate 3 has not been tampered with, that is, the public key 41 contained in the developer certificate 3 is indeed the developer's public key.

[0090] Next, if the signature verification of developer certificate 3 passes, the signature verification module 802 can use the developer's public key 41 contained in developer certificate 3 to verify the developer's signature value. For example, the signature verification module 802 can use the developer's public key 41 contained in developer certificate 3 to perform signature verification calculation on the developer's signature value, and obtain the digest value of the developer's signature information, the digest value of the APK ZIP file entry content, the digest value of the APK central directory, and the digest value of the APK signature block. Then, the signature verification module 802 can calculate the digest values ​​of the developer signature information, APK ZIP file entries, APK central directory, and APK signature block contained in the developer-registered APK. It then compares the calculated digest values ​​of the developer signature information with those calculated through signature verification, the APK ZIP file entries with those calculated through signature verification, the APK central directory with those calculated through signature verification, and the APK signature block with those calculated through signature verification. If all four comparison results match, the developer signature verification is successful. This confirms that the APK has indeed been signed by the developer, thus verifying the developer's identity, the APK's authenticity, and that it was indeed developed by the genuine developer and has not been tampered with.

[0091] If the developer's signature value passes the signature verification, the signature verification module 802 can confirm that the developer's real-name APK signature verification has passed.

[0092] If the developer signature value in the developer-registered APK passes the signature verification, the generation module 803 can generate third-party signature information. This third-party signature information may include at least a third-party certificate 6 issued by CA2, containing the third party's public key 71. It should be noted that the third-party signature information may also include, but is not limited to, the third-party signature project name, third-party name, signature date, signature address, and Software Bill of Materials (SBOM), etc.

[0093] The signature module 804 can use the third party's private key 72 to sign the third party's signature information and the data of the native APK to obtain the third party's signature value.

[0094] According to an exemplary embodiment of this disclosure, the signature module 804 can sign the third-party signature information and the data of the native APK using the third party's private key according to the SM2 algorithm to obtain the third-party signature value. In addition to the SM2 algorithm, algorithms such as RSA and DSA can also be used.

[0095] According to an exemplary embodiment of this disclosure, the signature module 804 uses the third party's private key 72 to sign the third party's signature information and the data of the native APK. When obtaining the third party's signature value, the data of the native APK includes the contents of the APK ZIP file entries contained in the native APK and the APK central directory.

[0096] The insertion module 805 can insert the third-party signature value and third-party signature information into the APK signature block of the developer-authenticated APK to obtain a third-party signed APK. For example, the insertion module 805 can insert the third-party signature value and third-party signature information into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain a third-party signed APK.

[0097] Figure 9 This is a block diagram illustrating a digital signature system according to exemplary embodiments of the present disclosure.

[0098] Reference Figure 9 The digital signature system 900 may include a developer terminal 901 and at least one third-party terminal 902.

[0099] The first digital signature operation can be performed at developer terminal 901 to generate a developer-identified APK.

[0100] The first digital signature operation includes:

[0101] Developer terminal 901 can sign the application package APK using native signing methods to obtain a native APK. For example, developer terminal 901 can use Android native v2 or v3 signing methods to sign the APK to obtain a native APK. Then, developer terminal 901 can generate developer signature information. This developer signature information can at least include a developer certificate 3 issued by a certificate authority (CA2) containing the developer's public key 41. Next, developer terminal 901 can use the developer's private key 42 to sign the developer signature information and the data of the native APK to obtain a developer signature value. Then, developer terminal 901 can insert the developer signature value and developer signature information into the APK signature block of the native APK to obtain a developer-identified APK. For example, developer terminal 901 can insert the developer signature value and developer signature information into the APK signature block between the APKZIP file entry content and the APK central directory to obtain a developer-identified APK. Thus, since the developer signature information at least includes a developer certificate issued by a certificate authority (CA) containing the developer's public key, the legitimacy of the developer certificate can be guaranteed. If the developer's real-name APK signature verification passes, it means that the developer's identity is real, that is, the APK to be installed was developed by the real developer and has not been tampered with, and will not introduce malicious code or viruses. This can avoid the situation where data is maliciously stolen or leaked after the APK is installed, thus improving data security and mobile network security.

[0102] At each of the at least one third-party terminals 902, a developer-named APK generated by a developer terminal 901 or a third-party signed APK generated by another third-party terminal can be obtained, and a second digital signature operation can be performed on the developer-named APK or the third-party signed APK to generate a third-party signed APK for that third-party terminal.

[0103] The second digital signature operation includes:

[0104] The developer signature value in the developer-registered APK or the developer signature value in a third-party signed APK generated by another third-party terminal is verified. Next, if the signature verification of the developer signature value in the developer-registered APK or the developer signature value in a third-party signed APK generated by another third-party terminal is successful, third-party signature information can be generated. This third-party signature information can at least include a third-party certificate 6 issued by CA2, containing the third party's public key 71. It should be noted that the third-party signature information can also include the third-party signing project name, third-party name, signing date, signing address, and Software Bill of Materials (SBOM), etc. Then, the third-party signature information and the data of the native APK can be signed using the third party's private key 72 to obtain the third-party signature value. Next, the third-party signature value and third-party signature information can be inserted into the APK signature block of the developer-registered APK or the third-party signed APK generated by another third-party terminal to obtain the third-party signed APK for that third-party terminal. For example, the third-party signature value and third-party signature information can be inserted into the APK signature block between the APK ZIP file entry content and the APK central directory to obtain the third-party signed APK for that third-party terminal. In this way, since the third-party signing information at least includes a third-party certificate issued by a CA containing the third party's public key, the legitimacy of the third-party certificate can be guaranteed. If the third-party signed APK signature verification passes, it means that the APK to be installed has been legitimately approved and verified by a third party. Because the APK to be installed has passed the regulatory review of a legitimate third party, the security and legitimacy of the APK to be installed are guaranteed. Furthermore, since the third-party terminal has already verified the developer's real-name APK signature before signing it, the successful third-party signed APK signature verification implicitly means that the developer's real-name APK signature verification has passed. At this point, the verification of the developer's identity and the security and legitimacy of the APK to be installed are simultaneously achieved, ensuring that the electronic device installing the APK is protected from malicious attacks and guaranteeing data security and mobile network security.

[0105] If multiple third parties exist, each third party can obtain its own third-party signed APK by performing the aforementioned second digital signature operation. As mentioned earlier, third parties can be software security testing and certification organizations, software industry compliance certification organizations, etc. Utilizing multiple third parties to perform the second digital signature operation on a developer-registered APK or a third-party signed APK generated by another third-party terminal can achieve the purpose of multi-party APK supervision and review, and also ensure traceability of software responsibility. For example, a software security testing and certification organization performing a second digital signature operation on a developer-registered APK can guarantee the APK's security; a software industry compliance certification organization performing a second digital signature operation on a developer-registered APK can guarantee that the APK complies with industry standards, and so on.

[0106] Figure 10 This is a block diagram illustrating an electronic device according to exemplary embodiments of the present disclosure.

[0107] Reference Figure 10 The electronic device 1000 includes at least one memory 1001 and at least one processor 1002. The at least one memory 1001 stores instructions that, when executed by the at least one processor 1002, perform a digital signature method according to an exemplary embodiment of the present disclosure.

[0108] As an example, electronic device 1000 may be a PC, tablet, personal digital assistant, smartphone, or other device capable of executing the aforementioned instructions. Here, electronic device 1000 is not necessarily a single electronic device, but may be a collection of any devices or circuits capable of executing the aforementioned instructions (or instruction sets) individually or in combination. Electronic device 1000 may also be part of an integrated control system or system manager, or may be configured to interconnect with a portable electronic device locally or remotely (e.g., via wireless transmission) through an interface.

[0109] In electronic device 1000, processor 1002 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, processor may also include analog processors, digital processors, microprocessors, multi-core processors, processor arrays, network processors, etc.

[0110] The processor 1002 can execute instructions or code stored in the memory 1001, which can also store data. Instructions and data can also be sent and received via a network through a network interface device, which can employ any known transmission protocol.

[0111] The memory 1001 may be integrated with the processor 1002, for example, by arranging RAM or flash memory within an integrated circuit microprocessor. Alternatively, the memory 1001 may include a separate device, such as an external disk drive, a storage array, or other storage device usable by any database system. The memory 1001 and the processor 1002 may be operatively coupled, or may communicate with each other, for example, via I / O ports, network connections, etc., enabling the processor 1002 to read files stored in the memory.

[0112] In addition, the electronic device 1000 may also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, mouse, touch input device, etc.). All components of the electronic device 1000 can be interconnected via a bus and / or network.

[0113] According to exemplary embodiments of this disclosure, a computer-readable storage medium may also be provided, which, when executed by a processor of an electronic device, enables the electronic device to perform the aforementioned digital signature method. Examples of computer-readable storage media include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disc storage, hard disk drive (HDD), solid-state drive (SSD), card storage (such as multimedia cards, secure digital (SD) cards, or ultra-fast digital (XD) cards), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid-state drive, and any other device configured to store a computer program and any associated data, data files, and data structures in a non-transitory manner and to provide the computer program and any associated data, data files, and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the aforementioned computer-readable storage medium can run in an environment deployed in computer devices such as clients, hosts, agent devices, servers, etc. Furthermore, in one example, the computer program and any associated data, data files, and data structures are distributed across a networked computer system, such that the computer program and any associated data, data files, and data structures are stored, accessed, and executed in a distributed manner through one or more processors or computers.

[0114] According to the digital signature method and device disclosed herein, since the developer's signature information at least includes a developer certificate issued by a Certificate Authority (CA) containing the developer's public key, the legitimacy of the developer certificate can be guaranteed. If the developer's real-name APK signature verification passes, it indicates that the developer's identity is genuine, meaning the APK to be installed was developed by the real developer and has not been tampered with, and will not introduce malicious code or viruses. This avoids the possibility of data being maliciously stolen or leaked after installing the APK, improving data security and mobile network security. Furthermore, since the third-party signature information at least includes a third-party certificate issued by a CA containing the third party's public key, the legitimacy of the third-party certificate can be guaranteed. If the third-party signed APK signature verification passes, it indicates that the APK to be installed has been legitimately approved and verified by a third party. Because the APK to be installed has passed the legitimate third-party's regulatory review, the security and legitimacy of the APK to be installed are guaranteed. Further, since the third-party terminal has already verified the developer's real-name APK signature before signing it, the successful third-party signed APK signature verification implicitly indicates that the developer's real-name APK signature verification has passed. At the same time, the identity of the developer and the security and legality of the APK to be installed are verified, which can ensure that the electronic device with the APK installed is protected from malicious attacks and ensure data security and mobile network security.

[0115] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0116] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A digital signature method applied to a terminal of a developer, characterized by, The method comprises: signing an application package APK by using a native signing method to obtain a native APK; generating developer signature information, wherein the developer signature information at least contains a developer certificate including a public key of the developer issued by a certificate authority CA; signing the developer signature information and data of the native APK by using a private key of the developer to obtain a developer signature value; inserting the developer signature value and the developer signature information into an APK signature block of the native APK to obtain a developer real-name APK; wherein the developer signature information contains at least one of the following: a developer name, a developer signature address, and a developer signature date; wherein the method further comprises: sending the developer real-name APK to a terminal of a third party to enable the terminal of the third party to perform signature verification on the developer signature value in the developer real-name APK; in a case where the signature verification on the developer signature value in the developer real-name APK is passed, generating third-party signature information, wherein the third-party signature information at least contains a third-party certificate including a public key of the third party issued by the CA; signing the third-party signature information and data of the native APK by using a private key of the third party to obtain a third-party signature value; and inserting the third-party signature value and the third-party signature information into the APK signature block of the developer real-name APK to obtain a third-party signature APK, wherein the third party is a software security detection and certification authority or a software industry compliance certification authority.

2. The method of claim 1, wherein, The signing of the developer signature information and data of the native APK by using the private key of the developer to obtain a developer signature value comprises: signing the developer signature information and data of the native APK by using the private key of the developer according to an SM2 algorithm to obtain the developer signature value.

3. The method of claim 1 or 2, wherein, The data of the native APK contains APK ZIP file entry content, an APK central directory, and the APK signature block.

4. A digital signature method applied to a terminal of a third party, characterized by, The method comprises: obtaining a developer real-name application package APK generated by a terminal of a developer, wherein an APK signature block of the developer real-name APK contains developer signature information and a developer signature value, the developer signature information at least contains a developer certificate including a public key of the developer issued by a certificate authority CA, the developer signature value is obtained by signing the developer signature information and data of a native APK by using a private key of the developer, the native APK is obtained by signing an APK by using a native signing method, and the third party is a software security detection and certification authority or a software industry compliance certification authority; performing signature verification on the developer signature value in the developer real-name APK; in a case where the signature verification on the developer signature value in the developer real-name APK is passed, generating third-party signature information, wherein the third-party signature information at least contains a third-party certificate including a public key of the third party issued by the CA; signing the third-party signature information and data of the native APK by using a private key of the third party to obtain a third-party signature value; inserting the third-party signature value and the third-party signature information into the APK signature block of the developer real-name APK to obtain a third-party signature APK; The developer signature information includes at least one of the following: Developer name, developer signature address, developer signature date.

5. The method of claim 4, wherein, The signature verification on the developer signature value in the developer real-name APK includes: signature verification on the developer certificate included in the developer signature information by using a public key of the CA; In the case where the developer certificate signature verification is passed, signature verification is performed on the developer signature value by using the public key of the developer included in the developer certificate.

6. The method of claim 4, wherein, The signature verification on the developer signature value in the developer real-name APK includes: According to the SM2 algorithm, the third-party signature information and the data of the native APK are signed by using the private key of the third party to obtain the third-party signature value.

7. The method of claim 6, wherein, The data of the native APK includes APK ZIP file entry content and APK central directory included in the native APK.

8. A method of digitally signing, characterized by, The digital signature method includes: At the terminal of the developer, a first digital signature operation is performed to generate a developer real-name APK; At each of the terminals of the at least one third party, the developer real-name APK generated by the terminal of the developer or another third-party signature APK generated by another terminal of a third party is obtained, and a second digital signature operation is performed on the developer real-name APK or the another third-party signature APK to generate a current third-party signature APK of the terminal of the third party. The first digital signature operation includes: signing an application package APK by using a native signature method to obtain a native APK; generating developer signature information, wherein the developer signature information at least includes a developer certificate including a public key of the developer issued by a certificate authority CA; signing the developer signature information and data of the native APK by using a private key of the developer to obtain a developer signature value; inserting the developer signature value and the developer signature information into the APK signature block of the native APK to obtain a developer real-name APK; The second digital signature operation includes: signature verification on the developer signature value in the developer real-name APK or the developer signature value in another third-party signature APK generated by another terminal of a third party. In a case where the signature verification of the developer signature value in the developer real-name APK or the developer signature value in the another third-party signature APK generated by the terminal of the another third party is passed, third-party signature information is generated, wherein the third-party signature information at least contains a third-party certificate including a public key of the third party issued by the CA; The third-party signature information and data of the native APK are signed by using a private key of the third party to obtain a third-party signature value; The third-party signature value and the third-party signature information are inserted into the APK signature block of the developer real-name APK or the another third-party signature APK generated by the terminal of the another third party to obtain a current third-party signature APK of the terminal of the third party; The developer signature information contains at least one of the following: a developer name, a developer signature address, and a developer signature date.

9. A digital signature device applied to a terminal of a developer, characterized by, Comprise: A first signature module configured to sign an application package APK by using a native signature method to obtain a native APK; A generation module configured to generate developer signature information, wherein the developer signature information at least contains a developer certificate including a public key of the developer issued by a certificate authority center CA; A second signature module configured to sign the developer signature information and data of the native APK by using a private key of the developer to obtain a developer signature value; An insertion module configured to insert the developer signature value and the developer signature information into an APK signature block of the native APK to obtain a developer real-name APK; The developer signature information contains at least one of the following: a developer name, a developer signature address, and a developer signature date. The terminal of the developer is further configured to: send the developer real-name APK to a terminal of a third party to enable the terminal of the third party to perform signature verification on the developer signature value in the developer real-name APK; in a case where the signature verification of the developer signature value in the developer real-name APK is passed, generate third-party signature information, wherein the third-party signature information at least contains a third-party certificate including a public key of the third party issued by the CA; sign the third-party signature information and data of the native APK by using a private key of the third party to obtain a third-party signature value; and insert the third-party signature value and the third-party signature information into the APK signature block of the developer real-name APK to obtain a third-party signature APK, wherein the third party is a software security detection and certification agency or a software industry compliance certification agency.

10. The digital signature device of claim 9, wherein, The second signature module is configured to sign the developer signature information and data of the native APK by using a private key of the developer according to an SM2 algorithm to obtain the developer signature value.

11. The digital signature device according to claim 9 or 10, characterized by The data of the native APK contains APK ZIP file entry content, an APK central directory, and the APK signature block.

12. A digital signature device applied to a terminal of a third party, characterized by, Comprise: An obtaining module is configured to obtain a developer real-name application package APK generated by a terminal of a developer, wherein an APK signature block of the developer real-name APK contains developer signature information and a developer signature value, the developer signature information contains at least a developer certificate including a public key of the developer issued by a certificate authority CA, and the developer signature value is obtained by signing data of a native APK with a private key of the developer, wherein the native APK is obtained by signing an APK with a native signature method, and the third party is a software security detection certification authority or a software industry compliance certification authority; A signature verification module is configured to perform signature verification on the developer signature value in the developer real-name APK; A generating module is configured to generate third-party signature information if the signature verification on the developer signature value in the developer real-name APK is passed, wherein the third-party signature information contains at least a third-party certificate including a public key of the third party issued by the CA; A signing module is configured to sign the third-party signature information and data of the native APK with a private key of the third party to obtain a third-party signature value; An inserting module is configured to insert the third-party signature value and the third-party signature information into the APK signature block of the developer real-name APK to obtain a third-party signature APK; The developer signature information contains at least one of the following: a developer name, a developer signature address, and a developer signature date.

13. The digital signature device of claim 12, wherein, The signature verification module is configured to: perform signature verification on the developer certificate contained in the developer signature information with a public key of the CA; and perform signature verification on the developer signature value with a public key of the developer contained in the developer certificate if the signature verification on the developer certificate is passed.

14. The digital signature device of claim 12, wherein, The signing module is configured to sign the third-party signature information and data of the native APK with a private key of the third party according to an SM2 algorithm to obtain the third-party signature value.

15. The digital signature device of claim 14, wherein, The data of the native APK includes APK ZIP file entry content and an APK central directory contained in the native APK.

16. A digital signature system characterized by The terminal of the developer and at least one terminal of a third party, wherein the third party is a software security detection certification authority or a software industry compliance certification authority; A first digital signature operation is performed at the terminal of the developer to generate a developer real-name APK; At each terminal of the at least one third party, the developer real-name APK generated by the terminal of the developer or another third-party signature APK generated by another terminal of a third party is obtained, and a second digital signature operation is performed on the developer real-name APK or the another third-party signature APK to generate a current third-party signature APK of the terminal of the third party; The first digital signature operation includes: signing an application package APK with a native signature method to obtain a native APK; generating developer signature information, wherein the developer signature information at least contains a developer certificate issued by a certificate authority (CA) and including a public key of the developer; signing the developer signature information and data of the native APK by using a private key of the developer to obtain a developer signature value; inserting the developer signature value and the developer signature information into an APK signature block of the native APK to obtain a developer real-name APK; wherein the second digital signature operation comprises: performing signature verification on the developer signature value in the developer real-name APK or the developer signature value in another third-party signature APK generated by a terminal of another third party; generating third-party signature information when the signature verification on the developer signature value in the developer real-name APK or the developer signature value in another third-party signature APK generated by a terminal of another third party is passed, wherein the third-party signature information at least contains a third-party certificate issued by the CA and including a public key of the third party; signing the third-party signature information and data of the native APK by using a private key of the third party to obtain a third-party signature value; inserting the third-party signature value and the third-party signature information into the APK signature block of the developer real-name APK or another third-party signature APK generated by a terminal of another third party to obtain a current third-party signature APK of the terminal of the third party; wherein the developer signature information contains at least one of the following: a developer name, a developer signature address, and a developer signature date.

17. An electronic device, comprising: comprise: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the digital signature method of any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device can perform the digital signature method of any one of claims 1 to 8.

Images