An API authentication method for Android system

Abstract

This invention discloses an API authentication method for an Android system. The method includes: 1) creating an Excel manifest file and template, dividing read and write permissions according to functional modules, and generating ciphertext using information such as the package name of the corresponding permission application; 2) creating a ciphertext generation tool, selecting the read and write permissions required by each application in the Excel manifest file, using a PC-based ciphertext generation tool written in a specific language, and running the ciphertext generation tool; 3) using the ciphertext generation tool to generate the corresponding ciphertext, which is then given to each application to configure metadata information; 4) upon startup, the vehicle computer reads the metadata information of each application, parses it, and caches it, and performs permission determination when each application calls a CustomAPI. This method can effectively identify the caller's identity, control API access rights, and thus protect the security of platform data.

Description

Technical Field

[0001] The present invention relates to an authentication method, and in particular to an API authentication method for an Android system. Background Art

[0002] The OEM requires that the vehicle body-related APIs provided by Tier 1 and the public APIs provided by third-party applications (such as voice, input method, etc.) must be encapsulated into CustomAPIs. All places where the corresponding interfaces need to be used must call through CustomAPI.jar, such as Figure 1 shown.

[0003] There is a security issue here. For example, when an application calls the CustomAPI, if the application cannot be checked for permissions to determine whether the application has permission to call security-related interfaces, ordinary applications can call them at will, and the access rights of the API cannot be controlled, then the security of the platform data cannot be protected. Summary of the Invention

[0004] The purpose of the present invention is to overcome the defects of the prior art and provide an API authentication method for the Android system, which can well identify the identity of the caller, control the access rights of the API, and thus protect the security of the platform data.

[0005] The object of the present invention is achieved as follows: an API authentication method for an Android system, comprising the following steps:

[0006] 1) Create an Excel list file and template, divide the read and write permissions according to the functional modules, and use the package name and other information of the corresponding permission application to generate ciphertext;

[0007] 2) Create a ciphertext generation tool, select the read and write permissions required for each application in the Excel manifest file, write the PC ciphertext generation tool in a specific language, and run the ciphertext generation tool;

[0008] 3) Use the ciphertext generation tool to generate the corresponding ciphertext and give it to each application to configure metadata information; generate the corresponding ciphertext according to the application package name and the required interface permission information, configure it in the application's AndroidManifest file, and use it for permission verification when the application calls the CustomAPI;

[0009] 4) When the car computer is turned on, it reads the metadata information of each application, parses it and caches it, and performs permission judgment when each application calls the CustomAPI.

[0010] As a further limitation of the present invention, the specific process of running the ciphertext generation tool in step 2) is: reading the application permission list Excel, checking whether the parameter content and format comply with the specifications, if so, generating an application authentication ciphertext based on the package name and permission status, writing the authentication ciphertext into the last row of the permission list Excel according to the application package name, and then terminating the operation; if not, a pop-up window prompts a specific error message and terminates the operation.

[0011] As a further limitation of the present invention, the step 3) specifically includes: the ciphertext generation tool first reads the Excel list file and displays the read permission names on the interface;

[0012] When the ciphertext generation tool generates ciphertext separately, enter the application package name, select the required read and write permissions, and then click the "Generate Ciphertext" button. The generated ciphertext will be directly displayed on the interface;

[0013] When the ciphertext generation tool generates ciphertext in batches, click the "Batch Generate" button to directly read the package name and permissions already filled in the Excel list, and the generated ciphertext will be directly written into the ciphertext row in Excel;

[0014] Finally, the application developer puts the encrypted information in the form of meta-data in AndroidManifest.xml.

[0015] As a further limitation of the present invention, step 4) specifically includes: after the vehicle computer is turned on, ApiCheckService will obtain the metadata information configured by each application and parse the permission information corresponding to each application; when the application calls the corresponding API, ApiCheckService determines whether the application has the permission to call the API, and if so, continues execution; otherwise, an exception is thrown.

[0016] The present invention adopts the above technical solution, and compared with the existing technology, the beneficial effects are as follows: the method of the present invention divides the permissions of the API provided by a certain application into read permissions and write permissions; in the ciphertext generation tool, the read and write permissions of other application APIs that need to be used can be selected for a single application, and then the ciphertext can be generated; the read and write permissions of multiple applications using other application APIs can also be filled in Excel, and then the ciphertext generation tool can be used to read the Excel and generate ciphertext in batches, thereby improving development efficiency; the corresponding ciphertext is generated according to the package name of the application and the required interface permission information, and configured into the AndroidManifest file of the application for use in permission verification when the application calls the CustomAPI; the present invention can well identify the identity of the caller, control the access rights of the API, and thus protect the security of the platform data; and can meet the increasingly stringent security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of encapsulating an application in the existing technology into a CustomAPI.

[0018] Figure 2 Flowchart of the operation of the ciphertext generation tool of the present invention.

[0019] Figure 3 The present invention uses the interface displayed by the ciphertext generation tool.

[0020] Figure 4 Flowchart of the permission judgment when each application calls CustomAPI in the present invention.

[0021] Figure 5 Flowchart of the overall operation of the present invention. DETAILED DESCRIPTION

[0022] An API authentication method for an Android system includes the following steps:

[0023] 1) Create an Excel list file and template, divide the read and write permissions according to the functional modules, and use the package name and other information of the corresponding permission application to generate ciphertext;

[0024] When creating an Excel manifest file, it's necessary to clearly define permissions and divide them by functional module. Permissions are divided into read and write permissions. Applications select read and write permissions based on their needs, and the OEM ultimately evaluates whether to grant them.

[0025] The Excel list file has the following fields, but is not limited to these fields:

[0026]

[0027] 2) Create a ciphertext generation tool, select the read and write permissions required for each application in the Excel manifest file, write the PC-side ciphertext generation tool in C#, and run the ciphertext generation tool;

[0028] like Figure 2 As shown, the specific process of running the ciphertext generation tool is as follows: read the application permission list Excel, verify whether the parameter content and format meet the specifications, if they meet the specifications, generate an application authentication ciphertext according to the package name and permission status, generate the corresponding ciphertext by calling the GetAES256Key method, write the authentication ciphertext to the last row of the permission list Excel according to the application package name, and end the operation; if it does not meet the specifications, a pop-up window will prompt a specific error message and end the operation.

[0029] 3) Use the ciphertext generation tool to generate the corresponding ciphertext and give it to each application to configure metadata information; generate the corresponding ciphertext according to the application package name and the required interface permission information, configure it in the application's AndroidManifest file, and use it for permission verification when the application calls the CustomAPI;

[0030] The ciphertext generation tool first reads the Excel list file and displays the read permission name on the interface. The running interface is as follows: Figure 3 As shown,

[0031] When the ciphertext generation tool generates ciphertext separately, enter the application package name, select the required read and write permissions (1 represents permission, 0 represents no permission), and then click the "Generate Ciphertext" button. The generated ciphertext will be directly displayed on the interface.

[0032] When the ciphertext generation tool generates ciphertext in batches, click the "Batch Generate" button to directly read the package name and permissions already filled in the Excel list, and the generated ciphertext will be directly written into the ciphertext row in Excel;

[0033] Finally, the application developer puts the encrypted information in the form of meta-data in AndroidManifest.xml.

[0034] Part of the algorithm program:

[0035]

[0036] Meta-data is a key-value pair. The key value that all applications need to configure is uniformly cer_service_key, and the value is the ciphertext generated for each application by the ciphertext generation tool.

[0037] 4) When the car computer is turned on, it reads the metadata information of each application, parses it, and caches it, and performs permission judgment when each application calls the CustomAPI;

[0038] like Figure 4 As shown in the figure, after the car computer is turned on, ApiCheckService will obtain the metadata information configured by each application and parse the permission information corresponding to each application; when the application calls the corresponding API, ApiCheckService determines whether the application has the permission to call the API. If so, it will continue to execute, otherwise it will throw an exception.

[0039] When the present invention works, Figure 5 As shown, when the application calls the API, the API management module passes in the permission name that needs to be verified, and the permission management module determines whether all permission lists have been obtained;

[0040] If yes, get the permission code; if not, get it from the system. If the acquisition is successful, get the permission code. If the acquisition from the system fails, get it from the cache and decrypt the cached permissions until the permission code is obtained.

[0041] After obtaining the permission code, determine whether it has the caller permission list. If so, perform authentication to determine whether the application has permission to call the API. If so, continue execution; otherwise, throw an exception.

[0042] The present invention provides an API authentication method for an Android system. By creating an Excel list file and template, read and write permissions are divided according to functional modules, and the package name of the corresponding permission application is used to generate ciphertext. A ciphertext generation tool is created, in which the read and write permissions required to use other application APIs can be selected for a single application, and then ciphertext is generated. Alternatively, the read and write permissions of multiple applications using other application APIs can be filled in Excel, and then the Excel can be read using a tool to generate ciphertext in batches, thereby improving development efficiency.

[0043] The present invention is not limited to the above-mentioned embodiments. On the basis of the technical solutions disclosed in the present invention, those skilled in the art can make some substitutions and modifications to some of the technical features therein according to the disclosed technical content without creative labor, and these substitutions and modifications are all within the protection scope of the present invention.

Claims

1. An API authentication method for an Android system, characterized in that: The following steps are involved: 1) Create an Excel manifest file and template, divide read and write permissions according to functional modules, use the package name information of the corresponding permission application, and generate the Excel manifest file; 2) Create a ciphertext generation tool, select the read and write permissions required for each application in the Excel manifest file, write the PC ciphertext generation tool in a specific language, and run the ciphertext generation tool; 3) Use the ciphertext generation tool to generate the corresponding ciphertext and give it to each application to configure metadata information; generate the corresponding ciphertext according to the application package name and the required interface permission information, configure it in the application's AndroidManifest file, and use it for permission verification when the application calls the CustomAPI; 4) When the car computer is turned on, it reads the metadata information of each application, parses it and caches it, and performs permission judgment when each application calls the CustomAPI.

2. The API authentication method for Android system according to claim 1, characterized in that: The specific process of running the ciphertext generation tool described in step 2) is as follows: read the application permission list Excel, verify whether the parameter content and format comply with the specifications, if so, generate the authentication ciphertext for each application based on the package name and permission status, write the authentication ciphertext to the last row of the permission list Excel according to the application package name, and terminate the operation; if not, a specific error message will pop up and the operation will terminate.

3. The API authentication method for Android system according to claim 1, characterized in that: The step 3) specifically includes: the ciphertext generation tool first reads the Excel list file and displays the read permission name on the interface; When the ciphertext generation tool generates ciphertext separately, enter the application package name, select the required read and write permissions, and then click the "Generate Ciphertext" button. The generated ciphertext will be directly displayed on the interface; When the ciphertext generation tool generates ciphertext in batches, click the "Batch Generate" button to directly read the package name and permissions already filled in the Excel list, and the generated ciphertext will be directly written into the ciphertext row in Excel; Finally, the application developer puts the encrypted information in the form of meta-data in AndroidManifest.xml.

4. The API authentication method for Android system according to claim 1, characterized in that: The step 4) specifically includes: after the vehicle computer is turned on, ApiCheckService will obtain the metadata information configured by each application and parse the permission information corresponding to each application; when the application calls the corresponding API, ApiCheckService determines whether the application has the permission to call the API, and if so, continues execution; otherwise, an exception is thrown.

Images