论文部分内容阅读
Android应用开发完成之后,应用市场或其他开发人员等第三方有可能需要向该应用中增加某些功能.而Android系统要求所有的APK(Android Package,Android应用安装包)必须经过签名之后才能发布,由数字签名机制的性质可知经过第三方修改后的Android应用其签名肯定会发生改变,加之Android应用又极易获得,这就会导致未经授权的第三方擅自修改已发布的Android应用,以及难以验证二次发布的Android应用原设计者签名的有效性等问题.针对未授权修改和验证APK原设计者签名有效性困难等问题,本文提出一种基于可传递签名机制的APK授权方案,方案对Android安全机制中的应用签名机制进行了改进,并利用可传递签名机制适用于二元传递关系签名的特性来实现APK授权和验证原设计者的版权.通过第三方二次开发后发布的APK,任何验证者都很容易计算出合成签名即授权信息,根据声称者(应用开发者)提供的参数和计算出的合成签名验证者能够验证声称者声明的合法性,以此实现保护APK设计者版权和Android应用安全的目的.分析表明该方案能够满足Android应用签名的安全性要求.
After the completion of the Android application development, third parties such as the application market or other developers may need to add some functions to the application, while the Android system requires that all APKs (Android Package, Android Application Installation Package) must be signed before being released, The nature of the digital signature mechanism shows that the signatures of third-party modified Android applications will surely change. In addition, Android applications are also easily obtainable. This will result in unauthorized third party unauthorized modification of published Android applications and difficulty Verify the validity of the original designer’s signature of the second released Android application, etc. In order to solve the problem of the validity of the original designer’s signature, such as unauthorized modification and verification APK, this paper proposes an APK authorization scheme based on transitive signature mechanism, Android security mechanism of the application signature mechanism has been improved and the use of transitive signature mechanism applies to binary transfer relationship signature features to achieve the authority of the APK and verify the original designer’s copyright through third-party secondary development after the release of the APK, Any verifier can easily calculate the synthetic signature that is authorized information, according to the claim (application Developers) to provide the parameters and calculated composite signature verifier can verify the legitimacy of the claimed statement, in order to protect the APK designer’s copyright and Android application security purposes.The analysis shows that the program can meet the Android application signature security Claim.