基于数字证书的自有APP签名保护方案  

APP security protection method based on digital certificate signature verification

作　　者：邱勤[1] 刘璐[1] 王馨裕[1] 白雪[1] QIU Qin;LIU Lu;WANG Xin-yu;BAI Xue(China Mobile Information Security Center, Beijing 100053, China)

机构地区：[1]中国移动通信集团公司信息安全管理与运行中心,北京100053

出　　处：《电信工程技术与标准化》2016年第12期8-11,共4页Telecom Engineering Technics and Standardization

摘　　要：为应对移动应用(APP)盗版、仿冒、篡改风险,保证自有APP来源可信、内容完整,本文提出了一套基于数字证书的APP签名保护与安全控制技术方案,实现了对自有应用进行签名认证和全流程安全管控。该方案规范了自有APP的签名证书,明确了正版标识;采用可信副署签名技术,加强代码保护,实现被篡改应用可识别可追溯;通过中央监控平台,及时发现并限制异常应用,实现了APP的全流程实时安全管控。In order to protect mobile APP from piracy, imitation, manipulation and assure that the source of selfownedapps is trusted and the content is integrated and valid, we propose an APP protection methodbased on digital certificate verification. We introduce an authorized digital certificate standard, andpropose countersign technology to track manipulating source, and control the aberrant suspicious APPfrom running via the integrated security software development kit and central monitoring platform. In theend, we realize an app protection and control system from APP development step, to distribution step, tothe fi nal running course.

关 键 词：数字证书 全周期安全防护 版权保护 代码签名 

分 类 号：TN918.91[电子电信—通信与信息系统] TP311.56[电子电信—信息与通信工程]