Method and device for preventing application program from being secondarily packaged and released and electronic equipment

Abstract

The invention provides a method and device for preventing an application program from being secondarily packaged and released and electronic equipment, and relates to the technical field of internet security. The method comprises the steps that a dynamic secret key request initiated by a client is received, and the dynamic secret key request carries a temporary public key, application signature information, a device unique identifier and a timestamp; verifying the legality of the client based on the application signature information and the timestamp; when the verification result is legal, generating a dynamic symmetric key, binding the dynamic symmetric key with the application signature information and the unique identifier of the equipment, and setting the validity period of the key; and encrypting the dynamic secret key by adopting the temporary public key, and transmitting the encrypted dynamic secret key back to the client, so that communication data between the server and the client are encrypted and transmitted through the dynamic symmetric secret key in the subsequent period of validity of the secret key. The secondary packaging APP with the tampered signature cannot pass the verification of the server to obtain the effective key and cannot normally use the core service, so that the APP is fundamentally prevented from being packaged and released for the second time.

Description

Technical Field

[0001] This invention relates to the field of internet security technology, and in particular to a method, apparatus, and electronic device for preventing applications from being repackaged and distributed. Background Technology

[0002] The Android system ensures the authenticity and integrity of applications through an APP signing mechanism. Its core logic is: developers sign the APP with their private key, and the system verifies the legality of the signature by using the public key embedded in the APP during installation or runtime. If the signatures do not match, the system will refuse to install the APP over the existing one, but allows users to uninstall the official APP and then install a repackaged APP from a third-party source.

[0003] Existing technologies rely solely on the signature verification mechanism built into the Android system, which has the following core drawbacks:

[0004] The protection is limited in scope: it can only prevent repackaged apps from overwriting the official app, but it cannot prevent attackers from distributing repackaged apps (with malicious code injected) through third-party websites;

[0005] High risk to users: After uninstalling the official app, users can directly install repackaged apps distributed by third parties. The system only pops up a warning instead of prohibiting it, making users vulnerable to malicious code attacks.

[0006] Lack of end-to-end protection: Existing solutions do not address the communication security between the APP and the server. If a repackaged APP bypasses client signature verification, it can still interact normally with the server, stealing user data or abusing services.

[0007] The aforementioned issues pose a security risk to Android apps due to repackaging, seriously threatening user information security and developers' rights. Summary of the Invention

[0008] This invention provides a method, apparatus, and electronic device for preventing applications from being repackaged and released, which solves the shortcomings of existing technologies that rely solely on system signature verification and cannot prevent third parties from distributing repackaged apps. By constructing full-link protection through "two-way verification between client and server + dynamic key encryption", the repackaged app cannot use core services normally, thus fundamentally curbing the harm of repackaging.

[0009] This invention provides a method for preventing applications from being repackaged and redistributed, applied on the server side, comprising:

[0010] Receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp;

[0011] The legitimacy of the client is verified based on the application signature information and the timestamp;

[0012] When the verification result is valid, a dynamic symmetric key is generated based on the encryption algorithm, and the dynamic symmetric key is bound to the application signature information and the device unique identifier, and the key validity period is set.

[0013] The temporary public key is used to encrypt the dynamic symmetric key, and the encrypted dynamic symmetric key is sent back to the client so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0014] According to a method for preventing an application from being repackaged and released according to the present invention, the timing for the client to initiate the dynamic key request includes: when the application is first launched, when the core function is triggered, or when the old dynamic symmetric key is nearing its preset expiration date.

[0015] According to a method for preventing the repackaging and redistribution of an application provided by the present invention, the step of verifying the legitimacy of the client based on the application signature information, the device unique identifier, the timestamp, and the random number includes:

[0016] Verify whether the application signature information is consistent with the official application signature information;

[0017] Verify whether the difference between the current time and the timestamp exceeds the preset request validity period.

[0018] According to a method for preventing the repackaging and redistribution of an application provided by the present invention, the dynamic key request further carries a random number, and the method for verifying the legitimacy of the client based on the application signature information, the device unique identifier, the timestamp, and the random number further includes:

[0019] Verify the combination of the timestamp and the random number to determine whether the dynamic key request is the first request.

[0020] A method for preventing applications from being repackaged and distributed according to the present invention further includes:

[0021] When transmitting data using the dynamic symmetric key, HTTPS protocol is forcibly enabled and certificate binding is activated.

[0022] This invention also provides another method for preventing applications from being repackaged and distributed, applied to the aforementioned client, including:

[0023] A temporary key pair is generated based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key;

[0024] A dynamic key request is sent to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp;

[0025] The encrypted dynamic symmetric key returned by the server is decrypted using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client can be encrypted and transmitted using the dynamic symmetric key during the key's validity period.

[0026] The present invention also provides an apparatus for preventing applications from being repackaged and distributed, comprising:

[0027] The request receiving module is used to receive dynamic key requests initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp;

[0028] A validity verification module is used to verify the validity of the client based on the application signature information and the timestamp;

[0029] The first key generation module is used to generate a dynamic symmetric key based on an encryption algorithm when the verification result is valid, and to bind the dynamic symmetric key with the application signature information and the device unique identifier, and set the key validity period.

[0030] The encrypted return module is used to encrypt the dynamic symmetric key using the temporary public key and return the encrypted dynamic symmetric key to the client, so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0031] The present invention also provides another device for preventing applications from being repackaged and distributed, comprising:

[0032] The second key generation module is used to generate temporary key pairs based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key;

[0033] The request initiation module is used to initiate a dynamic key request to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp;

[0034] The key decryption module is used to decrypt the encrypted dynamic symmetric key returned by the server using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client during the key's validity period can be encrypted and transmitted using the dynamic symmetric key.

[0035] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method for preventing the application from being repackaged and distributed as described above.

[0036] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for preventing the application from being repackaged and distributed as described above.

[0037] This invention provides a method, apparatus, and electronic device for preventing the repackaging and redistribution of applications. The method involves a client initiating a dynamic key request to a server. The server verifies the client's legitimacy based on the application signature information and timestamp carried in the dynamic key request. If the verification passes, a dynamic symmetric key is generated and bound to the application signature information and a unique device identifier, with a key validity period set. Furthermore, the dynamic key is encrypted using a temporary public key sent by the client and then sent back to the client. Subsequent core interface communication data between the server and client can be transmitted encrypted using the dynamic symmetric key. The core architecture of this invention is a full-link protection system built on "two-way authentication between client and server + dynamic key encryption." Through multi-dimensional identity verification between the client and server, dynamic key negotiation, and encrypted communication, it achieves precise interception of repackaged apps. Repackaged apps with tampered signatures cannot pass server verification, cannot obtain a valid key, and cannot use core services normally, resulting in communication failure. This fundamentally curbs the harm caused by repackaged apps, prevents users from installing unofficial versions of software, and prevents apps from being repackaged and redistributed. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1 This is one of the flowcharts illustrating the method for preventing applications from being repackaged and republished according to the present invention;

[0040] Figure 2 This is the second flowchart of the method for preventing applications from being repackaged and released according to the present invention;

[0041] Figure 3 This is a schematic diagram of the interaction process of the method for preventing applications from being repackaged and released according to the present invention.

[0042] Figure 4 This is one of the structural schematic diagrams of the device provided by the present invention for preventing applications from being repackaged and released;

[0043] Figure 5 This is the second schematic diagram of the device for preventing applications from being repackaged and released according to the present invention;

[0044] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0046] It should be noted that, in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0047] The terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0048] The following is combined Figures 1 to 6 This invention describes a method, apparatus, and electronic device for preventing applications from being repackaged and distributed.

[0049] The core architecture of this invention is "two-way authentication between client and server + dynamic encryption." Through multi-dimensional identity verification between the client and server, dynamic key negotiation, and encrypted communication, it achieves precise interception of repackaged apps. The overall process is as follows: client initiates key request → server performs multi-factor authentication → generates dynamic key → encrypted communication → periodically updates key.

[0050] This core architecture can be applied to the entire communication process between the APP client and the server, as well as to core communication processes, such as when the application is first launched or when core functions (such as login, payment, data synchronization, etc.) are triggered.

[0051] like Figure 1 As shown, this invention provides a method to prevent applications from being repackaged and republished, which can be applied to the server side of Android system APPs, and specifically includes the following steps:

[0052] Step 110: Receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp.

[0053] Specifically, before initiating a request, the client generates a temporary key pair based on an asymmetric encryption algorithm (such as RSA). This temporary key pair includes a temporary public key and a temporary private key. The client keeps the temporary private key and exposes the temporary public key to the outside world, sending it to the server along with the dynamic key request.

[0054] Application signature information is information related to the original digital signature of the app obtained by the client through the Android system API. In some embodiments, the application signature information can be a SHA-256 hash value calculated based on the digital signature, ensuring that the signature information cannot be tampered with.

[0055] The device is uniquely identified by the client's device IMEI, Android ID, or a unique identifier generated from hardware information, which is used to bind the client's device identity.

[0056] The timestamp is generated when the dynamic key request is initiated.

[0057] The above information is sent to the server along with the dynamic key request. The client can initiate a dynamic key request when the application starts for the first time, when a core function is triggered, or when the old dynamic symmetric key is about to expire (i.e., when the dynamic symmetric key is updated periodically).

[0058] Step 120: Verify the legitimacy of the client based on the application signature information and the timestamp.

[0059] Specifically, the server verifies the client's identity to intercept requests for repackaging the app. In some embodiments, step 120 specifically includes:

[0060] Verify whether the application signature information is consistent with the official application signature information.

[0061] Verify whether the difference between the current time and the timestamp exceeds the preset request validity period.

[0062] In this embodiment, the server can query a preset database of official APP signature SHA-256 hash values ​​and compare it with the signature hash value submitted by the client. If they do not match, it is determined that the APP has been repackaged, and the request is rejected. For example, when the client logs into the APP, the client calculates sign = SHA256(signature + username + timestamp). The server recalculates sign using a preset valid signature. If they do not match, login is rejected.

[0063] Simultaneously, the difference between the current time and the client's timestamp is calculated. If the difference exceeds a preset validity period (e.g., 5 minutes), the request is deemed expired and the response is rejected. This dual-verification process validates the client's dynamic key request for legitimacy.

[0064] In some embodiments, the dynamic key request also carries a random number, and step 120 may further include: verifying the combination of the timestamp and the random number to determine whether the dynamic key request is the first request.

[0065] In this embodiment, the server can maintain a blacklist database containing "timestamp + random number combinations". If the combination submitted by the client already exists in the blacklist, it is determined to be a replay request and is rejected. Using timestamps and random numbers ensures that each request is unique, preventing replay attacks, that is, preventing attackers from reusing old requests.

[0066] In some embodiments, for handling validity verification anomalies, the server records the anomaly information (device identifier, request time, submitted signature hash value, and reason for verification failure) for requests that fail verification, supporting subsequent security audits and blacklisting of risky devices.

[0067] Step 130: When the verification result is valid, generate a dynamic symmetric key based on the encryption algorithm, bind the dynamic symmetric key with the application signature information and the device unique identifier, and set the key validity period.

[0068] Specifically, when the verification is successful, a dynamic symmetric key is generated using a symmetric encryption algorithm (such as AES). This dynamic symmetric key is then bound to the client's application signature information and unique device identifier, ensuring that the key is only valid for the legitimate client. The generation of the dynamic symmetric key depends on the client's legitimacy, ensuring that a tampered application cannot obtain a valid key.

[0069] Step 140: Encrypt the dynamic symmetric key using the temporary public key, and send the encrypted dynamic symmetric key back to the client so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0070] Specifically, the server uses the temporary public key provided by the client to encrypt the dynamic symmetric key, and sends the encrypted dynamic symmetric key back to the client. The client then uses its own temporary private key to decrypt the key and finally obtain a usable dynamic symmetric key.

[0071] All subsequent communication between the client and server is encrypted using this dynamic symmetric key to prevent data leakage and tampering, while also blocking service calls from repackaged apps, making it both fast and secure. Furthermore, the dynamic symmetric key has an expiration date; after expiration, the key can be renewed by repeating the above process, further reducing the risk of leakage.

[0072] To improve performance, the aforementioned dynamic symmetric key encrypted communication can be applied to core interface communication between the server and the client, such as login, payment, and data synchronization.

[0073] A hybrid encryption scheme combining asymmetric and symmetric encryption (e.g., RSA + AES) is employed. The server and client negotiate and generate a secure dynamic symmetric key. RSA is used to securely negotiate the AES key, and AES is used to encrypt communication data. The AES key is not transmitted directly but is encrypted with the RSA public key before transmission. Even if intercepted, it cannot be cracked without the app's RSA private key, thus preventing key leakage. Furthermore, repackaged apps, due to invalid signatures, cannot pass server authentication and therefore cannot obtain the AES dynamic key, hindering normal communication with the server. Actual data transmission is encrypted with the AES dynamic key, which is significantly faster than RSA and does not slow down the app's user experience (e.g., login and data loading are smooth). RSA securely escorts the AES key, while AES efficiently transports the actual data; the combination of the two balances security and communication efficiency.

[0074] In some embodiments, the method further includes: when transmitting encrypted data using the dynamic symmetric key, forcibly enabling the HTTPS protocol and setting up certificate binding.

[0075] In this embodiment, HTTPS protocol is forcibly enabled, and certificate pinning is also enabled. The client only trusts the official preset server certificate, and attackers cannot forge server certificates to steal communication content, which can prevent man-in-the-middle attacks from stealing encrypted data.

[0076] Accordingly, such as Figure 2 As shown, the present invention also provides another method to prevent applications from being repackaged and distributed, which can be applied to the client of Android system APP, specifically including the following steps:

[0077] Step 210: Generate a temporary key pair based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key.

[0078] Step 220: Initiate a dynamic key request to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp.

[0079] Step 230: Decrypt the encrypted dynamic symmetric key returned by the server using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client can be encrypted and transmitted using the dynamic symmetric key during the key's validity period.

[0080] To more clearly describe one method of the present invention for preventing applications from being repackaged and distributed, Figure 3 This is a schematic diagram illustrating the interaction flow between the client and server in an exemplary embodiment of method one. Figure 3 As shown, the client initiates a dynamic key request, carrying a temporary public key, application signature information, device unique identifier, timestamp, and random number. The server receives this dynamic key request and first performs a triple verification of the client and the request's legitimacy based on the application signature information, timestamp, and random number, specifically verifying signature legitimacy, request timeliness, and preventing replay attacks. If the triple verification is successful, a dynamic symmetric key is generated based on a symmetric encryption algorithm, and this dynamic symmetric key is bound to the client's application signature information and device unique identifier to ensure the key is only valid for the legitimate client and to set a key validity period. The dynamic symmetric key is then encrypted using the temporary public key generated by the client and sent back to the client. The client receives the encrypted dynamic symmetric key, decrypts it using a stored temporary private key, and obtains the original dynamic symmetric key. Within the validity period of this dynamic symmetric key, the client encrypts core communication data using the dynamic key and sends it to the server. The server receives the data, decrypts it using the same dynamic symmetric key, obtains the original core communication data, and responds accordingly. The response data can also be encrypted using the dynamic symmetric key before being sent back to the client. Similarly, the client receives the data and decrypts it using the same dynamic symmetric key to obtain the original response data. This prevents data leakage and tampering, while also blocking service calls from repackaged apps, thereby improving software security and reducing the risk of users using malicious software packages with reverse-engineered code.

[0081] The method described above for preventing the repackaging and redistribution of applications involves a client initiating a dynamic key request to the server. The server verifies the client's legitimacy based on the application signature information and timestamp carried in the dynamic key request. If the verification passes, a dynamic symmetric key is generated and bound to the application signature information and the device's unique identifier, with a set validity period. Furthermore, the dynamic key is encrypted using a temporary public key sent by the client and then sent back to the client. Subsequent core interface communication data between the server and the client can then be transmitted encrypted using the dynamic symmetric key. The core architecture of this invention is a full-link protection system built on "two-way client-server verification + dynamic key encryption." Through multi-dimensional identity verification between the client and server, dynamic key negotiation, and encrypted communication, it achieves precise interception of repackaged apps. Repackaged apps with tampered signatures cannot pass server verification, cannot obtain a valid key, and cannot use core services normally, resulting in communication failure. This fundamentally curbs the harm caused by repackaged apps, prevents users from installing unofficial versions of software, and prevents apps from being repackaged and redistributed.

[0082] The apparatus for preventing the repackaging and distribution of applications provided by the present invention is described below. The apparatus for preventing the repackaging and distribution of applications described below can be referred to in correspondence with the method for preventing the repackaging and distribution of applications described above.

[0083] like Figure 4 As shown, the present invention also provides an apparatus for preventing applications from being repackaged and distributed, comprising:

[0084] The request receiving module 410 is used to receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp;

[0085] The legitimacy verification module 420 is used to verify the legitimacy of the client based on the application signature information and the timestamp;

[0086] The first key generation module 430 is used to generate a dynamic symmetric key based on an encryption algorithm when the verification result is valid, and to bind the dynamic symmetric key with the application signature information and the device unique identifier, and set the key validity period.

[0087] The encrypted return module 440 is used to encrypt the dynamic symmetric key using the temporary public key and return the encrypted dynamic symmetric key to the client, so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0088] like Figure 5As shown, the present invention also provides another device for preventing applications from being repackaged and distributed, comprising:

[0089] The second key generation module 510 is used to generate a temporary key pair based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key;

[0090] The request initiation module 520 is used to initiate a dynamic key request to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp;

[0091] The key decryption module 530 is used to decrypt the encrypted dynamic symmetric key returned by the server using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client during the key's validity period can be encrypted and transmitted using the dynamic symmetric key.

[0092] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a method to prevent the application from being repackaged and distributed, the method including:

[0093] Receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp;

[0094] The legitimacy of the client is verified based on the application signature information and the timestamp;

[0095] When the verification result is valid, a dynamic symmetric key is generated based on the encryption algorithm, and the dynamic symmetric key is bound to the application signature information and the device unique identifier, and the key validity period is set.

[0096] The temporary public key is used to encrypt the dynamic symmetric key, and the encrypted dynamic symmetric key is sent back to the client so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0097] or,

[0098] A temporary key pair is generated based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key;

[0099] A dynamic key request is sent to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp;

[0100] The encrypted dynamic symmetric key returned by the server is decrypted using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client can be encrypted and transmitted using the dynamic symmetric key during the key's validity period.

[0101] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is capable of executing the methods provided above for preventing the repackaging and distribution of application programs, the method comprising:

[0103] Receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp;

[0104] The legitimacy of the client is verified based on the application signature information and the timestamp;

[0105] When the verification result is valid, a dynamic symmetric key is generated based on the encryption algorithm, and the dynamic symmetric key is bound to the application signature information and the device unique identifier, and the key validity period is set.

[0106] The temporary public key is used to encrypt the dynamic symmetric key, and the encrypted dynamic symmetric key is sent back to the client so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0107] or,

[0108] A temporary key pair is generated based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key;

[0109] A dynamic key request is sent to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp;

[0110] The encrypted dynamic symmetric key returned by the server is decrypted using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client can be encrypted and transmitted using the dynamic symmetric key during the key's validity period.

[0111] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods provided above for preventing the repackaging and distribution of application programs, the method comprising:

[0112] Receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp;

[0113] The legitimacy of the client is verified based on the application signature information and the timestamp;

[0114] When the verification result is valid, a dynamic symmetric key is generated based on the encryption algorithm, and the dynamic symmetric key is bound to the application signature information and the device unique identifier, and the key validity period is set.

[0115] The temporary public key is used to encrypt the dynamic symmetric key, and the encrypted dynamic symmetric key is sent back to the client so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

[0116] or,

[0117] A temporary key pair is generated based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key;

[0118] A dynamic key request is sent to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp;

[0119] The encrypted dynamic symmetric key returned by the server is decrypted using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client can be encrypted and transmitted using the dynamic symmetric key during the key's validity period.

[0120] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0121] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for preventing applications from being repackaged and redistributed, characterized in that, Applied to the server side, including: Receive a dynamic key request initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp; The legitimacy of the client is verified based on the application signature information and the timestamp; When the verification result is valid, a dynamic symmetric key is generated based on the encryption algorithm, and the dynamic symmetric key is bound to the application signature information and the device unique identifier, and the key validity period is set. The temporary public key is used to encrypt the dynamic symmetric key, and the encrypted dynamic symmetric key is sent back to the client so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

2. The method for preventing applications from being repackaged and released according to claim 1, characterized in that, The client initiates the dynamic key request at the following times: when the application is launched for the first time, when a core function is triggered, or when an old dynamic symmetric key is nearing its preset expiration date.

3. The method for preventing the repackaging and redistribution of an application according to claim 1, characterized in that, The verification of the client's legitimacy based on the application signature information, the device unique identifier, the timestamp, and the random number includes: Verify whether the application signature information is consistent with the official application signature information; Verify whether the difference between the current time and the timestamp exceeds the preset request validity period.

4. The method for preventing the repackaging and redistribution of an application according to claim 3, characterized in that, The dynamic key request also carries a random number. The verification of the client's legitimacy based on the application signature information, the device unique identifier, the timestamp, and the random number further includes: Verify the combination of the timestamp and the random number to determine whether the dynamic key request is the first request.

5. The method for preventing the repackaging and redistribution of an application according to claim 1, characterized in that, Also includes: When transmitting data using the dynamic symmetric key, HTTPS protocol is forcibly enabled and certificate binding is activated.

6. A method for preventing applications from being repackaged and redistributed, characterized in that, Applied to the client according to any one of claims 1 to 5, comprising: A temporary key pair is generated based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key; A dynamic key request is sent to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp; The encrypted dynamic symmetric key returned by the server is decrypted using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client can be encrypted and transmitted using the dynamic symmetric key during the key's validity period.

7. An apparatus for preventing the repackaging and redistribution of an application, characterized in that, include: The request receiving module is used to receive dynamic key requests initiated by the client, wherein the dynamic key request carries a temporary public key, application signature information, device unique identifier, and timestamp; A validity verification module is used to verify the validity of the client based on the application signature information and the timestamp; The first key generation module is used to generate a dynamic symmetric key based on an encryption algorithm when the verification result is valid, and to bind the dynamic symmetric key with the application signature information and the device unique identifier, and set the key validity period. The encrypted return module is used to encrypt the dynamic symmetric key using the temporary public key and return the encrypted dynamic symmetric key to the client, so that subsequent communication data between the server and the client during the key's validity period can be transmitted encrypted using the dynamic symmetric key.

8. An apparatus for preventing the repackaging and redistribution of an application, characterized in that, include: The second key generation module is used to generate temporary key pairs based on an asymmetric encryption algorithm, wherein the temporary key pair includes a temporary public key and a temporary private key; The request initiation module is used to initiate a dynamic key request to the server, wherein the dynamic key request carries the temporary public key, application signature information, device unique identifier, and timestamp; The key decryption module is used to decrypt the encrypted dynamic symmetric key returned by the server using the temporary private key to obtain the dynamic symmetric key, so that subsequent communication data between the server and the client during the key's validity period can be encrypted and transmitted using the dynamic symmetric key.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method for preventing the application from being repackaged and distributed as described in any one of claims 1 to 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for preventing the application from being repackaged and distributed as described in any one of claims 1 to 6.

Images