Android App tamper-proofing method based on Native layer

Abstract

The invention discloses an Android App tamper-proof method based on a Native layer, which comprises the following steps that key information is input in advance, the key information of the App is written into a C language source file through an automatic script or tool, the C language source file is compiled into a library file. So file of the Native layer, and the key information comprises a signature file MD5 value and an interaction secret key; a. So file is reinforced and confused through a reinforcing tool, the structure and logic of the. So file are changed, the safety and the reverse engineering defense capability are improved, and the reinforced and confused. So file is added into an App project and compiled and packaged into. Apk. The tamper-proofing method has the advantages of being higher in safety, more difficult to bypass by attackers, more comprehensive in safety protection, high in customizability and the like, and compared with an existing technical scheme, the tamper-proofing method has more remarkable advantages and more beneficial effects.

Description

Technical Field

[0001] The present invention relates to the technical field of Android operating system, and in particular to an Android App anti-tampering method based on a Native layer. Background Art

[0002] With the popularity of smart phones, the Android operating system has become one of the most popular mobile operating systems due to its openness. With this popularity, security issues have become increasingly prominent, especially the security of apps.

[0003] With the widespread popularity of Android devices, malware developers are constantly looking for loopholes to tamper with legitimate applications. They may insert malicious code to steal users' sensitive information, such as personal identity information, bank account passwords, etc. These malware can be spread through various channels, such as third-party app stores, malicious links, etc., posing huge security risks to users. At the same time, after the App is tampered with, it may lead to serious consequences such as user privacy leakage and financial loss. Therefore, it is particularly important to develop an effective App anti-tampering method. Existing anti-tampering technologies mostly rely on the implementation of the application layer, such as code obfuscation, Dex reinforcement, etc., which are easily broken by attackers familiar with the Android system. Therefore, there is an urgent need for a more basic anti-tampering technology that is more difficult for attackers to identify and bypass.

[0004] Currently, no effective solution has been proposed for the problems in the related technologies. Summary of the invention

[0005] In view of the problems in the related technology, the present invention proposes an Android App anti-tampering method based on the Native layer, which aims to protect the key information and logic of the Android application program and prevent malicious tampering and reverse engineering. By embedding key information in the Native layer, performing compilation reinforcement and obfuscation, runtime signature verification, and server-side interactive verification and other technical means, the security of the Android application program and the ability to defend against reverse engineering are effectively improved, thereby overcoming the technical problems of the existing related technology.

[0006] The technical solution of the present invention is achieved in this way:

[0007] An Android App anti-tampering method based on the Native layer includes the following steps:

[0008] Enter key information in advance. Use automated scripts or tools to write the key information of the App into a C language source file, and compile the C language source file into a native layer library file .so file. The key information includes: the signature file MD5 value and the interactive key;

[0009] Use the hardening tool to harden and obfuscate the .so file, change its structure and logic, improve security and the ability to defend against reverse engineering, and add the hardened and obfuscated .so file to the App project, compile and package it into .apk;

[0010] Runtime signature verification, including: when the .apk is installed on the phone and started, the App simultaneously starts an asynchronous thread to obtain the MD5 value of the signature file stored in the .so file through the interaction between the native layer and the Native layer. If it is different from the MD5 value of the signature file of the current App, it can be considered that the .apk has been tampered with and there is a security risk, and the App should be exited immediately;

[0011] Perform server-side interaction verification, including: when the client interacts with the server, the client uses the interaction key stored in the .so file and the signature algorithm agreed upon with the server to obtain the signature; after the server receives the request, it compares the signature. If any inconsistency is found, the client is tasked with storing security risks and the server refuses to process the request.

[0012] Furthermore, the step of compiling and packaging the .apk file includes the following steps:

[0013] Use reinforcement tools to confuse and reinforce the App project.

[0014] Furthermore, the key information entry comprises the following steps:

[0015] Identify the key information that needs to be protected, including the MD5 value of the application's signature file and the client-server interaction key;

[0016] Use an automated script or tool to specify key information. The tool will automatically encode the information and embed it into a C language source file. The C language source file will be compiled into a .so file, a library file of the Native layer.

[0017] Furthermore, the step of hardening and obfuscating the .so file by using a hardening tool includes the following steps:

[0018] Use the NDK tool chain to compile the C language source files containing key information into .so files;

[0019] After the compilation is completed, the .so file is hardened and obfuscated through hardening tools to change its structure and logic.

[0020] Furthermore, the runtime signature verification in the step includes the following steps:

[0021] Read the MD5 value of the signature file of the current application through the Native layer code and compare it with the MD5 value embedded in the .so file, including:

[0022] If the comparison results are consistent, the application continues to operate normally;

[0023] If they are inconsistent, the application will be closed immediately to prevent the execution of the tampered application.

[0024] Furthermore, the server-side interactive verification described in the step includes the following steps:

[0025] Dynamically obtain the interaction key through the Native layer code;

[0026] Use the obtained secret key to sign the interactive data and send the signed data to the server;

[0027] After receiving the data, the server verifies the signature of the received data to confirm the integrity of the data and the legitimacy of the source.

[0028] Beneficial effects of the present invention:

[0029] 1. The present invention has higher security: Compared with the existing application layer anti-tampering technology, the present invention adopts a native layer-based anti-tampering method to protect the key information and logic of the application at a deeper level. By embedding key information in the native layer, compiling reinforcement and obfuscation, and runtime signature verification and other multiple technical means, the security of Android applications is effectively improved, and the risk of malicious tampering and reverse engineering is reduced.

[0030] 2. The present invention is more difficult to be bypassed by attackers: The anti-tampering method of the present invention adopts a more basic technical means that is more difficult for attackers to identify and bypass. By embedding key information in the Native layer and compiling, reinforcing and obfuscating, the difficulty of anti-tampering is effectively improved. In contrast, the existing application layer anti-tampering technology is easily broken by attackers familiar with the Android system, while the solution of the present invention greatly improves the reliability of protection.

[0031] 3. The present invention provides more comprehensive security protection: The present invention not only protects the key information and logic of the application, but also provides a security mechanism for runtime signature verification and server-side interaction verification, which comprehensively guarantees the security of the application from application startup to interaction with the server. This comprehensive security protection solution greatly reduces the risk of application attacks and guarantees the privacy and financial security of users.

[0032] 4. High customizability of the present invention: The anti-tampering method of the present invention is highly customizable. Developers can select key information to be protected according to actual needs and embed the information into a C language file through an automated script or tool. This flexible customization method enables the solution of the present invention to adapt to various types of Android applications, providing a more personalized security protection solution.

[0033] In summary, the anti-tampering method of the present invention has the advantages of higher security, being more difficult to be bypassed by attackers, more comprehensive security protection and high customizability. Compared with the existing technical solutions, it has more significant advantages and more beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 The following is a flow chart of an Android App anti-tampering method based on the Native layer according to an embodiment of the present invention. Figure 1 ;

[0036] Figure 2 The following is a flow chart of an Android App anti-tampering method based on the Native layer according to an embodiment of the present invention. Figure 2 . DETAILED DESCRIPTION

[0037] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present invention.

[0038] According to an embodiment of the present invention, a Native layer-based Android App tamper-proofing method is provided.

[0039] like Figure 1-Figure 2 As shown, the Android App anti-tampering method based on the Native layer according to an embodiment of the present invention includes the following steps:

[0040] Enter key information in advance and write the key information of the App (signature file MD5 value, interaction key) into the C language source file through automated scripts or tools;

[0041] This technical solution defines the key information that needs to be protected, including the MD5 value of the application's signature file and the client-server interaction key. Then, through a dedicated tool, this key information is embedded in a C language source file, converted and encoded to prevent direct reading. In this process, developers can use automated scripts or tools to specify key information. The tool will automatically encode the information and embed it into the C language source file. The C language source file will then be compiled into a library file at the Native layer, i.e., a .so file, to ensure the security of the information.

[0042] Compile and reinforce .so files: Compile the C language source files after entering information into .so files through NDK-Build, and use obfuscation and reinforcement technology to process the .so files securely;

[0043] In this technical solution, during the compilation process, the C language source file containing key information will be compiled into a .so file using the standard NDK tool chain. After the compilation is completed, the .so file is hardened and obfuscated to improve security and the ability to defend against reverse engineering. The hardening tool hardens and obfuscates the .so file, changes its structure and logic, and makes reverse analysis more difficult, thereby effectively protecting the key information and logic of the application.

[0044] Pack and reinforce Apk: Add the .so file produced in the previous step to the App project, compile and package it into .apk, and confuse and reinforce the App project at the same time;

[0045] Runtime signature verification: When the .apk is installed on the phone and started, the App simultaneously starts an asynchronous thread to obtain the MD5 value of the signature file stored in the .so file through the interaction between the native layer and the Native layer. If it is different from the MD5 value of the signature file of the current App, it can be considered that the .apk has been tampered with and there is a security risk. The App should be exited immediately.

[0046] This technical solution reads the MD5 value of the signature file of the current application through the Native layer code when the application is started, and compares it with the MD5 value embedded in the .so file. If the comparison results are consistent, the application continues to run normally; if they are inconsistent, the application will be closed immediately to prevent the execution of the tampered application. This mechanism effectively protects the integrity and security of the application.

[0047] Server interaction verification: When the client interacts with the server, the client needs to use the interaction key stored in the .so file and the signature algorithm agreed upon with the server to obtain the signature. After receiving the request, the server compares the signature. If any inconsistency is found, the client is tasked with storing security risks and the server refuses to process the request.

[0048] In this technical solution, when the application needs to interact with the server, the interaction key is first obtained dynamically through the Native layer code. Then the interaction data is signed using the obtained key, and the signed data is sent to the server. After receiving the data, the server verifies the signature of the received data to confirm the integrity of the data and the legitimacy of the source. This mechanism effectively prevents data from being tampered with or forged, and protects the communication security between the application and the server.

[0049] In summary, with the help of the above technical solution of the present invention, the following effects can be achieved:

[0050] 1. The present invention has higher security: Compared with the existing application layer anti-tampering technology, the present invention adopts a native layer-based anti-tampering method to protect the key information and logic of the application at a deeper level. By embedding key information in the native layer, compiling reinforcement and obfuscation, and runtime signature verification and other multiple technical means, the security of Android applications is effectively improved, and the risk of malicious tampering and reverse engineering is reduced.

[0051] 2. The present invention is more difficult to be bypassed by attackers: The anti-tampering method of the present invention adopts a more basic technical means that is more difficult for attackers to identify and bypass. By embedding key information in the Native layer and compiling, reinforcing and obfuscating, the difficulty of anti-tampering is effectively improved. In contrast, the existing application layer anti-tampering technology is easily broken by attackers familiar with the Android system, while the solution of the present invention greatly improves the reliability of protection.

[0052] 3. The present invention provides more comprehensive security protection: The present invention not only protects the key information and logic of the application, but also provides a security mechanism for runtime signature verification and server-side interaction verification, which comprehensively guarantees the security of the application from application startup to interaction with the server. This comprehensive security protection solution greatly reduces the risk of application attacks and guarantees the privacy and financial security of users.

[0053] 4. High customizability of the present invention: The anti-tampering method of the present invention is highly customizable. Developers can select key information to be protected according to actual needs and embed the information into a C language file through an automated script or tool. This flexible customization method enables the solution of the present invention to adapt to various types of Android applications, providing a more personalized security protection solution.

[0054] In summary, the anti-tampering method of the present invention has the advantages of higher security, being more difficult to be bypassed by attackers, more comprehensive security protection and high customizability. Compared with the existing technical solutions, it has more significant advantages and more beneficial effects.

[0055] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. After considering the disclosure of the specification and the examples, those skilled in the art will easily think of other embodiments of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and the examples are only regarded as exemplary, and the true scope and spirit of the present disclosure are indicated by the claims.

[0056] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An Android App anti-tampering method based on the Native layer, characterized in that: The following steps are involved: Enter key information in advance. Use automated scripts or tools to write the key information of the App into a C language source file, and compile the C language source file into a native layer library file .so file. The key information includes: the signature file MD5 value and the interactive key; Use the hardening tool to harden and obfuscate the .so file, change its structure and logic, improve security and the ability to defend against reverse engineering, and add the hardened and obfuscated .so file to the App project, compile and package it into .apk; Runtime signature verification, including: when the .apk is installed on the phone and started, the App simultaneously starts an asynchronous thread to obtain the MD5 value of the signature file stored in the .so file through the interaction between the native layer and the Native layer. If it is different from the MD5 value of the signature file of the current App, it can be considered that the .apk has been tampered with and there is a security risk, and the App should be exited immediately; Perform server-side interaction verification, including: when the client interacts with the server, the client uses the interaction key stored in the .so file and the signature algorithm agreed upon with the server to obtain the signature; after the server receives the request, it compares the signature. If any inconsistency is found, the client is tasked with storing security risks and the server refuses to process the request.

2. According to the Android App anti-tampering method based on the Native layer of claim 1, it is characterized in that: The steps described in the above steps are to compile and package the .apk file, including the following steps: Use reinforcement tools to confuse and reinforce the App project.

3. The method for preventing Android App from being tampered with based on the Native layer according to claim 1, characterized in that: The key information entry comprises the following steps: Identify the key information that needs to be protected, including the MD5 value of the application's signature file and the client-server interaction key; Use an automated script or tool to specify key information. The tool will automatically encode the information and embed it into a C language source file. The C language source file will be compiled into a .so file, a library file of the Native layer.

4. The Android App anti-tampering method based on the Native layer according to claim 1 is characterized in that: The steps described in this article are to use the hardening tool to harden and confuse the .so file, including the following steps: Use the NDK tool chain to compile the C language source files containing key information into .so files; After the compilation is completed, the .so file is hardened and obfuscated through hardening tools to change its structure and logic.

5. The Android App anti-tampering method based on the Native layer according to claim 1 is characterized in that: The runtime signature verification of the steps includes the following steps: Read the MD5 value of the signature file of the current application through the Native layer code and compare it with the MD5 value embedded in the .so file, including: If the comparison results are consistent, the application continues to operate normally; If they are inconsistent, the application will be closed immediately to prevent the execution of the tampered application.

6. The Android App anti-tampering method based on the Native layer according to claim 1 is characterized in that: The server-side interactive verification is performed as described in the steps, including the following steps: Dynamically obtain the interaction key through the Native layer code; Use the obtained secret key to sign the interactive data and send the signed data to the server; After receiving the data, the server verifies the signature of the received data to confirm the integrity of the data and the legitimacy of the source.

Images