Application signature method and device, equipment and storage medium

Abstract

The invention discloses a signature method and device of an application program, equipment and a storage medium, the signature method of the application program comprises the following steps: receiving an application certificate generation request of a development end, and when the application certificate generation request carries a csr file, signing and issuing an application certificate for the development end based on the csr file; the method comprises the following steps: acquiring application information of an application program to be signed, and signing and issuing a profi authorization file by adopting a profi key pair and a profi signature certificate which are generated in advance based on the application information; and controlling the development end to sign the application package data of the to-be-signed application program and the profi authorization file based on the key pair stored in the development end and the application certificate. The application certificate and the profi authorization file are automatically signed and issued for the application program according to the application certificate generation request sent by the development end, so that the development end can automatically perform digital signature based on the application certificate and the profi authorization file, and the signature efficiency of the application program can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a signing method, device, equipment and storage medium for an application. Background Art

[0002] With the development of computer technology, more and more applications can be installed in terminals to meet the diversified needs of users. For example, instant messaging applications provide chat session functions, browser applications provide reading functions, etc. As the number of applications installed on terminals increases, the security risks of terminal devices will also increase. For this reason, many applications will use digital signatures to protect the credibility and integrity of their data, so that terminal devices can verify the security of applications through digital signatures.

[0003] At present, it is generally necessary to compile the developed code into a hap package using IDE tools, and then manually sign the compiled hap, which will affect the signing efficiency of the application.

[0004] Therefore the prior art still needs to be improved and enhanced. Summary of the invention

[0005] The technical problem to be solved by the present application is to provide a signing method, device, equipment and storage medium for an application program in view of the deficiencies in the prior art.

[0006] In order to solve the above technical problems, the first aspect of the present application provides a signing method for an application program, which is applied to a cloud platform. The signing method for the application program specifically includes:

[0007] Receive an application certificate generation request from a development end, wherein the application certificate generation request is used to apply for an application certificate and a profile authorization file for the application to be signed;

[0008] When the application certificate generation request carries a csr file, issuing an application certificate for the development end based on the csr file;

[0009] Obtain application information of the application to be signed, and issue a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate;

[0010] The control development end signs the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate.

[0011] The signing method of the application, wherein the method further comprises:

[0012] When the application certificate generation request does not carry a csr file, a key pair and an application certificate are generated for the development end.

[0013] The signing method of the application, wherein when the application certificate generation request does not carry a csr file, after generating a key pair and an application certificate for the development end, the method further includes:

[0014] The key pair is sent to the development end so that the development end stores the key pair.

[0015] The signing method of the application, wherein, when the version information of the application to be signed is a debugging version, the application information includes the package name information of the application to be signed and the device information of the debugging device; when the version information of the application to be signed is a release version, the application information includes the package name information of the application to be signed.

[0016] The signing method of the application, wherein the generation process of the profile key pair and the profile signing certificate specifically includes:

[0017] Generate a self-signed root certificate and issue an intermediate certificate through the root certificate;

[0018] Generate a profile key pair and use the intermediate certificate to issue a profile signing certificate.

[0019] The signing method of the application, wherein the issuing of the profile authorization file based on the application information using the pre-generated profile key pair and profile signing certificate specifically includes:

[0020] Obtaining a profile private key from the profile key pair;

[0021] Performing a profile file signing on the application information based on the profile private key to obtain signed application information;

[0022] The signed application information and the profile signing certificate are packaged into a p7b format to obtain a profile authorization file.

[0023] The signing method of the application, wherein the signing method of the application further comprises:

[0024] When the version information of the application to be signed is a debugging version, the profile authorization file includes time limit information.

[0025] A second aspect of the present application provides a signature device for an application, wherein the signature device for the application specifically includes:

[0026] A receiving module, used to receive an application certificate generation request from a development end, wherein the application certificate generation request is used to apply for an application certificate and a profile authorization file for the application to be signed;

[0027] A first issuing module, configured to issue an application certificate to the development end based on the csr file when the application certificate generation request carries a csr file;

[0028] The second issuing module is used to obtain application information of the application to be signed, and issue a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate;

[0029] The control module is used to control the development end to sign the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate.

[0030] The signature device of the application, wherein the first issuing module is further used for:

[0031] When the application certificate generation request does not carry a csr file, a key pair and an application certificate are generated for the development end.

[0032] The signature device of the application, wherein the signature device of the application further includes a feedback module;

[0033] The feedback module is used to send the key pair to the development end, so that the development end stores the key pair.

[0034] The signing device of the application, wherein, when the version type of the application to be signed is a debugging version, the application information includes the package name information of the application to be signed and the device information of the debugging device; when the version type of the application to be signed is a release version, the application information includes the package name information of the application to be signed.

[0035] The signature device of the application, wherein the generation process of the profile key pair and the profile signature certificate specifically includes:

[0036] Generate a self-signed root certificate and issue an intermediate certificate through the root certificate;

[0037] Generate a profile key pair and use the intermediate certificate to issue a profile signing certificate.

[0038] The signature device of the application, wherein the second issuing module specifically includes:

[0039] an acquiring unit, configured to acquire a profile private key in the profile key pair;

[0040] A signing unit, configured to sign the application information with a profile file based on the profile private key to obtain signed application information;

[0041] The packaging unit is used to package the signed application information and the profile signing certificate into a p7b format to obtain a profile authorization file.

[0042] The signing device for the application, wherein when the version information of the application to be signed is a debugging version, the profile authorization file includes time limit information.

[0043] A third aspect of the present application provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps in the signing method of any of the above applications.

[0044] A fourth aspect of the present application provides a terminal device, comprising: a processor and a memory;

[0045] The memory stores a computer-readable program executable by the processor;

[0046] When the processor executes the computer-readable program, the steps in any of the above-described application signing methods are implemented.

[0047] Beneficial effects: Compared with the prior art, the present application provides a signing method, apparatus, device and storage medium for an application, wherein the signing method for the application includes receiving an application certificate generation request from a development end, and when the application certificate generation request carries a csr file, issuing an application certificate for the development end based on the csr file; obtaining application information of the application to be signed, and issuing a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate; and controlling the development end to sign the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate. The present application automatically issues an application certificate and a profile authorization file for the application according to the application certificate generation request sent by the development end, so that the development end can automatically perform digital signing based on the application certificate and the profile authorization file, which can effectively improve the signing efficiency of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A flowchart of a method for signing an application provided in an embodiment of the present application.

[0050] Figure 2 A timing example diagram of a signing method for an application provided in an embodiment of the present application.

[0051] Figure 3 An example flowchart of a method for signing an application provided in an embodiment of the present application.

[0052] Figure 4 An example diagram of a method for signing an application provided in an embodiment of the present application.

[0053] Figure 5 A schematic diagram of the structure of a signature device for an application provided in an embodiment of the present application.

[0054] Figure 6 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The embodiments of the present application provide a signature method, device, equipment and storage medium for an application. To make the purpose, technical solution and effect of the present application clearer and more specific, the present application is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0057] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0058] It should be understood that the sequence numbers and sizes of the steps in this embodiment do not mean the order of execution. The execution order of each process is determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0059] After research, it is found that with the development of computer technology, more and more applications can be installed in terminals to meet the diversified needs of users. For example, instant messaging applications provide chat session functions, browser applications provide reading functions, etc. As the number of applications installed on terminals increases, the security risks of terminal devices will also increase. For this reason, many applications will use digital signatures to protect the credibility and integrity of their data, so that terminal devices can verify the security of applications through digital signatures.

[0060] At present, developers generally need to compile the developed code into a hap package using IDE tools, and then manually sign the compiled hap, which will affect the signing efficiency of the application.

[0061] In order to solve the above problems, in an embodiment of the present application, an application certificate generation request from the development end is received. When the application certificate generation request carries a csr file, an application certificate is issued to the development end based on the csr file; application information of the application to be signed is obtained, and a profile authorization file is issued based on the application information using a pre-generated profile key pair and a profile signing certificate; the development end is controlled to sign the application package data of the application to be signed and the profile authorization file based on its stored key pair and the application certificate. The present application automatically issues an application certificate and a profile authorization file for the application according to the application certificate generation request sent by the development end, so that the development end can automatically perform digital signatures based on the application certificate and the profile authorization file, which can effectively improve the signing efficiency of the application.

[0062] The application content is further explained below through the description of embodiments in conjunction with the accompanying drawings.

[0063] This embodiment provides a signature method for an application program, which is applied to a cloud platform, such as Figure 1, Figure 2 and Figure 3 As shown, the method includes:

[0064] S10, receiving an application certificate generation request from the development end.

[0065] Specifically, the application certificate generation request is used to apply for an application certificate and a profile authorization file for the application to be signed, wherein the application certificate generation request may include the configuration information of the application to be signed, and the configuration information may include a csr file, the application package name of the application to be signed, and version information, etc. The csr file is a certificate request file, which is used to request the cloud platform to issue an application certificate according to the public key in the key pair specified by the developer. The version information is used to reflect the version type of the application to be signed, wherein the version information may be a debug version or a release version, etc.

[0066] The application certificate generation request can be generated by the developer and sent to the cloud platform. For example, the developer first generates the application certificate generation request and then sends the application certificate generation request to the cloud platform, so that the cloud platform issues the application certificate and profile authorization file to the developer based on the application certificate generation request. Alternatively, the application certificate generation request can be generated by the cloud platform itself. For example, the cloud platform pre-sets the issuance interface, the developer logs in to the cloud platform and uploads the locally stored configuration information through the issuance interface to trigger the cloud platform to generate the application certificate generation request by itself.

[0067] In the embodiment of the present application, the application certificate generation request is generated by the cloud platform itself. Specifically, the cloud platform serves as a digital twin platform for the development end, and sets a login interface for the development end. The development end logs in to the digital twin platform through the login interface and schedules the issuance interface of the digital twin platform to upload the locally stored configuration information to the digital twin platform through the development interface; after the digital twin platform receives the configuration information, it generates an application certificate generation request for the development end. That is to say, when the development end logs in to the digital twin platform through the login interface, the configuration information uploaded by the development end is received through the issuance interface, and when the configuration information is received, an application certificate generation request is automatically generated, so as to issue the application certificate and profile authorization file to the development end based on the application certificate generation request.

[0068] S20: When the application certificate generation request carries a csr file, an application certificate is issued to the development end based on the csr file.

[0069] Specifically, the csr file is a certificate request file, which is used to request the cloud platform to issue an application certificate based on the public key in the key pair specified by the developer. That is to say, the developer will generate a key pair and a csr file by itself before requesting an application certificate, and store the key pair and the csr file locally on the developer, so that when applying for an application certificate from the cloud platform, the csr file can be uploaded to the cloud platform. To this end, before receiving the application certificate generation request from the developer, the method may also include: when the developer forms the application to be signed, it will respond to the key generation operation performed by the developer in the die interface, generate a key pair and a csr file for the application to be signed, and store the key pair and the csr file locally on the developer.

[0070] When the application certificate generation request carries a csr file, the process of issuing the application certificate for the development end based on the csr file can be to read the public key in the key pair specified by the development end carried in the csr file, and issue the application certificate for the application to be signed based on the public key in the key pair specified by the development end. The application certificate is used to digitally sign the application to be signed, so as to ensure that the data has not been tampered with or damaged through the digital signature, thereby protecting the computer application from various security vulnerabilities and attacks, ensuring that the application and its data can run without being attacked, and improving the security of the application.

[0071] Of course, in actual applications, the application certificate generation request may not carry a csr file, that is, the cloud platform does not need to use the public key in the key pair specified by the developer to issue the application certificate. In addition, the cloud platform needs to generate a key pair for the application to be signed, and then use the public key in the key pair to generate a key pair for the application to be signed.

[0072] Correspondingly, the signing method of the application further includes: when the application certificate generation request does not carry a csr file, generating a key pair and an application certificate for the development end.

[0073] Specifically, the key pair generated for the development end can be randomly generated for the development end, or can be generated according to the key information input by the development end. For example, the development end inputs the key information on the cloud platform, and then the cloud platform generates a key pair for the development end based on the key information. After the key pair is generated for the development end, the public key in the key pair will be used to issue an application certificate for the application to be signed. In other words, generating a key pair and an application certificate for the development end specifically involves first generating a key pair for the development end, and then issuing an application certificate for the application to be signed based on the public key in the key pair generated by the development end. In addition, after the key pair is generated for the development end, a key pair storage file is generated based on the key pair, and the key pair storage file is fed back to the development end so that the development end stores the key pair, wherein the key pair storage file can be in p12 format.

[0074] Furthermore, when generating an application certificate, the required parameter list may be:

[0075]

[0076]

[0077] S30: Obtain application information of the application to be signed, and issue a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate.

[0078] Specifically, the application information may include the application package name and version information, etc., wherein the application information can be obtained by parsing the application certificate generation request. Of course, when the application certificate generation request does not include the application package name and version information, it can be obtained by sending an application information acquisition request to the development end. In an embodiment of the present application, the application certificate generation request includes the application package name and version information, so that when issuing an application certificate and a profile authorization file for the application to be signed based on the application certificate generation request, the application information can be obtained by directly parsing the application certificate generation request, without the need to communicate with the development end. This can reduce the time spent on communication and improve the efficiency of application signing on the one hand; on the other hand, it can also avoid signature failures or signature errors caused by communication anomalies.

[0079] Furthermore, when the application information of the application to be signed is provided, the information content that needs to be included in the application information can be determined based on the version information of the application to be issued. Specifically, when the version information of the application to be signed is a debug version, the application information includes the package name information of the application to be signed and the device information of the debugging device; when the version information of the application to be signed is a release version, the application information includes the package name information of the application to be signed. When the version information of the application to be signed is a debug version, the present application sets the device information of the debugging device in the application information, so that the generated profile authorization file includes the device information of the debugging device. In this way, the debugging device of the signed application after the debug version is installed can be restricted, thereby further improving the security of the signed application. Of course, it should be noted that the device information of the debugging device can be one or more.

[0080] The profile key pair and profile signing certificate are pre-generated and used to issue a profile authorization file for the application to be signed. For example, the generation process of the profile key pair and profile signing certificate can be:

[0081] Generate a self-signed root certificate and issue an intermediate certificate through the root certificate;

[0082] Generate a profile key pair and use the intermediate certificate to issue a profile signing certificate.

[0083] Specifically, the root certificate is self-issued, and the intermediate certificate is issued by the root certificate, and is used to issue a profile signing certificate for the application to be signed. The profile key pair is used as the key information of the profile authorization file to encrypt the profile authorization file. Among them, the profile key pair can be randomly generated, or it can be generated according to preset conditions, for example, a profile key pair generation method is pre-given, or the key information that the profile key pair needs to include is pre-given. In an embodiment of the present application, the profile key pair is generated based on the key information that the profile key pair needs to include, wherein the key information may include:

[0084] ├──-keyAlias ​​#Key alias, required

[0085] ├──-keyPwd #key password, optional

[0086] ├──-keyAlg #Key algorithm, required, including RSA / ECC

[0087] ├──-keySize #Key length, required. The length of the RSA algorithm is 2048 / 3072 / 4096, and the length of the ECC algorithm is NIST-P-256 / NIST-P-384

[0088] ├──-keystoreFile #Keystore file, required, JKS or P12 format

[0089] ├──-keystorePwd #Keystore password, optional.

[0090] Exemplarily, generating a self-signed root certificate and issuing an intermediate certificate through the root certificate may specifically include:

[0091] Get input parameters;

[0092] The root certificate is issued based on the input parameters, and the intermediate certificate is issued based on the input parameters and the root certificate.

[0093] Specifically, the input parameters may include:

[0094]

[0095] After obtaining the input parameters, execute cmd: ava -jar .. / hapsigntool / hap_sign_tool / build / libs / hap-sign-tool.jar generate-ca-keyAlias ​​"kaihong application rootca" -signAlg "SHA256withECDSA" -keyAlg "ECC" -keySize "NIST-P-256" -subject "C = CN, O = Kaihong, OU = Kaihong Safety platform, CN = KaihongOS Application Root CA" -keystoreFile "result\CA.p12" -outFile "result\root-ca.cer" -keyPwd "123456" -keystorePwd "123456" -issuerKeyPwd "123456" -validity "365" to issue the root certificate. Of course, when generating the root certificate and intermediate certificate, no key pair is generated in advance. The following command will be executed after the key pair is generated according to the key information provided by the parameter when calling the generate-ca interface and stored in the CA.p12 file.

[0096] After issuing the root certificate, run cmd:ava-jar.. / hapsigntool / hap_sign_tool / build / libs / hap-sign-tool.jar generate-ca-keyAlias"kaihong application sub ca"-signAlg"SHA256withECDSA"-keyAlg"ECC"-keySize"NIST-P-256"-subject"C=CN,O=Kaihong,OU=Kaihong Safety platform,CN=KaihongOS Application Sub CA"-keystoreFile"result\CA.p12"-outFile"result\sub-sign-srv-ca.cer"-keyPwd"123456"-keystorePwd"123456"-issuer"C=CN,O=Kaihong,OU=Kaihong Safetyplatform,CN=KaihongOS Application Root CA"-issuerKeyAlias"kaihongapplication root ca"-issuerKeyPwd"123456"-validity"365" to issue the intermediate certificate.

[0097] Furthermore, when generating a profile signing certificate, the parameter list used can be:

[0098]

[0099] ├──-subCaCertFile #Required when outForm is certChain, intermediate CA certificate

[0100] ├──-outFile #Output certificate file (certificate or certificate chain), optional. If not filled in, it will be output directly to the console.

[0101] In addition, it should be noted that when a key pair (referred to as a developer key pair) is generated for the development end and stored locally on the development end, it is also generated based on the pre-given key information, wherein the parameter list of the key information is the same as the parameter list used to generate the profile signing certificate, and the parameter information corresponding to the same parameter item in the two parameter lists may be different.

[0102] Exemplarily, the issuing of a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate specifically includes:

[0103] S31, obtaining a profile private key in the profile key pair;

[0104] S32, signing the application information with a profile file based on the profile private key to obtain signed application information;

[0105] S33. Package the signature application information and the profile signature certificate into a p7b format to obtain a profile authorization file.

[0106] Specifically, the profile authorization file includes the signed application information and the profile signing certificate. For example, the application information includes the application package name and the device information of the debugging device, then the profile authorization file includes the application package name and the device information of the debugging device. In addition, in actual applications, when the version information of the application to be signed is a debugging version, the profile authorization file may include application level, signature validity period, and time limit information in addition to the application information. That is to say, when the signed application information and the profile signing certificate are packaged into the p7b format, the application level, signature validity period, and time limit information may be obtained, and then the application information, application level, signature validity period, time limit information, and the profile signing certificate may be packaged into the p7b format. Among them, the signature validity period is used to reflect the limited period of the application certificate, and the time limit information is used to reflect the period of use of the application certificate that the debugging device can use, so as to verify the debugging device through the signature validity period and time limit information. Moreover, when the profile authorization file includes time limit information, the application information may not include the device information of the debugging device, so that the time limit information can be used as the usage restriction condition of the application. This can not only ensure that the debug version of the application will not be used without restriction, but also avoid the need to apply for debugging permissions for each debugging device. Even when a new debugging device is added, the application needs to be re-signed, which brings convenience to users.

[0107] S40, controlling the development end to sign the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate.

[0108] Specifically, after generating the application certificate and profile authorization file for the application to be signed, the application certificate and profile authorization file can be fed back to the development end in response to the download request of the development end, so that the development end can generate a hap package based on the key pair stored therein and the application certificate for the application package data of the application to be signed and the profile authorization file. For example, after the cloud platform generates the application certificate and profile authorization file for the application to be signed, the application certificate and profile authorization file are recorded as a p7b file, wherein the p7b file can be configured with a file type, and the file type includes a debug type and a release type. The file type allows the developer to know the purpose of the p7b file. For example, when the file type is a debug type, it means that the p7b file is used to sign the debug version of the application, and when the file type is a release type, it means that the p7b file is used to sign the release version of the application.

[0109] When generating a hap packet, the required parameter list may include:

[0110]

[0111] Furthermore, when the developer signs the application package data of the application to be signed and the profile authorization file, it can configure the key pair storage file, p7b file and application certificate cer required for the signature, and then compile the application package data of the application to be signed based on the key pair storage file, p7b file and application certificate cer to generate a hap file with a signature. Specifically, when the configured p7b file is of debug type, the generated hap file is used for local installation and debugging, and the time range and validity period will be restricted based on the signature validity period and time limit information during installation; when the configured p7b file is of release type, the generated hap file is used for release.

[0112] For example, the developer can use a preset signing tool (eg, hap-sign-tool.jar, etc.) to sign the application package data of the application to be signed and the profile authorization file. Figure 4 As shown, the application package data of the application to be signed, the key store file stored locally on the development end (used to store the key pair corresponding to the application certificate), the profile authorization file (which may include the profile original file, i.e. application information, profile signature and profile signing certificate, etc.) and the application signing certificate file (which may include the root certificate, intermediate certificate and application certificate) are signed through the signing tool to obtain the signed application package (i.e. hap package).

[0113] In summary, this embodiment provides a signing method for an application, which includes receiving an application certificate generation request from a development end, and when the application certificate generation request carries a csr file, issuing an application certificate for the development end based on the csr file; obtaining application information of the application to be signed, and issuing a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate; and controlling the development end to sign the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate. This application automatically issues an application certificate and a profile authorization file for the application according to the application certificate generation request sent by the development end, so that the development end can automatically perform digital signing based on the application certificate and the profile authorization file, which can effectively improve the signing efficiency of the application.

[0114] Based on the above application signature method, the present application embodiment provides an application signature device, such as Figure 5 As shown, the signature device of the application program specifically includes:

[0115] The receiving module 100 is used to receive an application certificate generation request from a development end, wherein the application certificate generation request is used to apply for an application certificate and a profile authorization file for the application to be signed;

[0116] The first issuing module 200 is used to issue an application certificate to the development end based on the csr file when the application certificate generation request carries a csr file;

[0117] The second issuing module 300 is used to obtain application information of the application to be signed, and issue a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate;

[0118] The control module 400 is used to control the development end to sign the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate.

[0119] In one embodiment, the first issuing module is further used for:

[0120] When the application certificate generation request does not carry a csr file, a key pair and an application certificate are generated for the development end.

[0121] In one embodiment, the signature device of the application further includes a feedback module;

[0122] The feedback module is used to send the key pair to the development end, so that the development end stores the key pair.

[0123] In one embodiment, when the version type of the application to be signed is a debugging version, the application information includes the package name information of the application to be signed and the device information of the debugging device; when the version type of the application to be signed is a release version, the application information includes the package name information of the application to be signed.

[0124] In one embodiment, the process of generating the profile key pair and the profile signing certificate specifically includes:

[0125] Generate a self-signed root certificate and issue an intermediate certificate through the root certificate;

[0126] Generate a profile key pair and use the intermediate certificate to issue a profile signing certificate.

[0127] In one embodiment, the second issuing module specifically includes:

[0128] an acquiring unit, configured to acquire a profile private key in the profile key pair;

[0129] A signing unit, configured to sign the application information with a profile file based on the profile private key to obtain signed application information;

[0130] The packaging unit is used to package the signed application information and the profile signing certificate into a p7b format to obtain a profile authorization file.

[0131] In one embodiment, when the version information of the application to be signed is a debugging version, the profile authorization file includes time limit information.

[0132] Based on the above-mentioned application signing method, an embodiment of the present application provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps in the application signing method as described in the above-mentioned embodiment.

[0133] Based on the above application signature method, the present application also provides a terminal device, such as Figure 6As shown, it includes at least one processor (processor) 20; display screen 21; and memory (memory) 22, and may also include a communications interface (Communications Interface) 23 and a bus 24. Among them, the processor 20, the display screen 21, the memory 22 and the communication interface 23 can communicate with each other through the bus 24. The display screen 21 is configured to display a preset user guide interface in the initial setting mode. The communication interface 23 can transmit information. The processor 20 can call the logic instructions in the memory 22 to execute the method in the above embodiment.

[0134] In addition, the logic instructions in the memory 22 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0135] The memory 22 is a computer-readable storage medium that can be configured to store software programs, computer executable programs, such as program instructions or modules corresponding to the methods in the embodiments of the present disclosure. The processor 20 executes functional applications and data processing by running the software programs, instructions or modules stored in the memory 22, that is, implementing the methods in the above embodiments.

[0136] The memory 22 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 22 may include a high-speed random access memory and may also include a non-volatile memory. For example, a variety of media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, may also be a transient storage medium.

[0137] In addition, the specific process of loading and executing the multiple instruction processors in the above-mentioned storage medium and the terminal device has been described in detail in the above-mentioned method, and will not be described one by one here.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for signing an application, characterized in that: Applied to the cloud platform, the signing method of the application program specifically includes: Receive an application certificate generation request from a development end, wherein the application certificate generation request is used to apply for an application certificate and a profile authorization file for the application to be signed; When the application certificate generation request carries a csr file, issuing an application certificate for the development end based on the csr file; Obtain application information of the application to be signed, and issue a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate; The control development end signs the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate.

2. The application signing method according to claim 1, characterized in that: The method further comprises: When the application certificate generation request does not carry a csr file, a key pair and an application certificate are generated for the development end.

3. The application signing method according to claim 2, characterized in that: When the application certificate generation request does not carry a csr file, after generating a key pair and an application certificate for the development end, the method further includes: The key pair is sent to the development end so that the development end stores the key pair.

4. The application signing method according to claim 1, characterized in that: When the version information of the application to be signed is a debugging version, the application information includes the package name information of the application to be signed and the device information of the debugging device; When the version information of the application to be signed is a release version, the application information includes package name information of the application to be signed.

5. The application signing method according to claim 1, characterized in that: The generation process of the profile key pair and profile signature certificate specifically includes: Generate a self-signed root certificate and issue an intermediate certificate through the root certificate; Generate a profile key pair and use the intermediate certificate to issue a profile signing certificate.

6. The application signing method according to any one of claims 1, 4 or 5, characterized in that: The issuing of the profile authorization file based on the application information using the pre-generated profile key pair and profile signature certificate specifically includes: Obtaining a profile private key from the profile key pair; Performing a profile file signing on the application information based on the profile private key to obtain signed application information; The signed application information and the profile signing certificate are packaged into a p7b format to obtain a profile authorization file.

7. The application signing method according to claim 1, characterized in that: The signing method of the application further includes: When the version information of the application to be signed is a debugging version, the profile authorization file includes time limit information.

8. A signature device for an application, characterized in that: The signature device of the application program specifically includes: A receiving module, used to receive an application certificate generation request from a development end, wherein the application certificate generation request is used to apply for an application certificate and a profile authorization file for the application to be signed; A first issuing module, configured to issue an application certificate to the development end based on the csr file when the application certificate generation request carries a csr file; The second issuing module is used to obtain application information of the application to be signed, and issue a profile authorization file based on the application information using a pre-generated profile key pair and a profile signing certificate; The control module is used to control the development end to sign the application package data of the application to be signed and the profile authorization file based on the key pair stored therein and the application certificate.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in the signing method of the application program as described in any one of claims 1-7.

10. A terminal device, characterized in that: include: Processor and memory; The memory stores a computer-readable program executable by the processor; When the processor executes the computer-readable program, the processor implements the steps in the signing method of the application program according to any one of claims 1 to 7.

Images