本文選題：Android + 白盒密鑰　； 參考：《北京郵電大學》2013年碩士論文

【摘要】：Android操作系統(tǒng)快速發(fā)展,已經(jīng)成為目前智能手機最受歡迎的操作系統(tǒng)之一,但同時其安全問題日益凸顯。在智能手機惡意軟件OS平臺排名中Android迅速超越Symbian,成為攻擊者的頭號目標。而Android自身安全體系不夠強大,第三方防護軟件保護能力欠缺,Android在惡意攻擊環(huán)境下面臨著盜版、逆向工程、代碼篡改等嚴峻的安全形勢。因此Android的安全方向何去何從非常重要。 在此背景之下,本課題旨在通過研究設計實現(xiàn)一個防止逆向工程攻擊的軟件保護方案,提高Android應用的自衛(wèi)能力,防止知識產(chǎn)權(quán)被侵害、重要信息被泄露等。 本文主要進行了如下幾方面的工作： [1]對Android的安全現(xiàn)狀進行闡述,說明Android安全形勢非常嚴峻,亟需加強其安全保護能力。本文對Android的體系結(jié)構(gòu)和開發(fā)編譯等進行講解,并通過分析Android系統(tǒng)的安全模型以及其權(quán)限、沙箱、簽名等安全機制的不足,深度解剖Android存在的安全隱患及其根源,接著闡述Android平臺的應用軟件被惡意攻擊的嚴峻形勢。 [2]分析傳統(tǒng)的軟件攻擊于段和傳統(tǒng)的軟件保護方式,結(jié)合Android系統(tǒng)的自身特點,提出一套適用于Android平臺的軟件保護方案。 [3]對本文方案中應用到的關鍵技術(shù)實現(xiàn)進行可行性分析和編程應用,包括通過動態(tài)加載譯文、混淆技術(shù)、反調(diào)試技術(shù)等在一定程度上制止逆向工程的腳步,特別是針對本方案中核心技術(shù)點(白盒密碼、加密防篡改完整性校驗)進行了非常詳細的闡述分析和設計實現(xiàn)。本文也對方案中涉及到的其它算法如AES、MD5和HMAC的應用進行了簡單的介紹。 [4]對本技術(shù)方案的抗攻擊性能、完整性和運行效率等進行數(shù)據(jù)和實驗分析。實驗結(jié)果表明,該方案在軟件測試階段一定程度上滿足反逆向工程攻擊的軟件保護目的。 本論文提出的基于Android平臺的軟件保護方案成功借鑒傳統(tǒng)軟件保護方案的實現(xiàn)方式,采用將加密、混淆、防篡改、完整性校驗等融合一體,全方位增強軟件的抵抗逆向工程的能力。
[Abstract]:The rapid development of the Android operating system has become one of the most popular operating systems for smartphones, but at the same time its security problems are becoming increasingly prominent. In the rankings of the OS platform for smart phone malware, Android has quickly surpassed Symbian, becoming the number one target of the attacker. And the Android self security system is not strong enough, and the third party protection software is not strong The lack of protection ability, Android in the environment of malicious attacks faced with piracy, reverse engineering, code tampering and other severe security situation. So what is the direction of the security of Android is very important.
In this context, the purpose of this project is to implement a software protection scheme to prevent reverse engineering attacks, to improve the self-defense capability of Android applications, to prevent intellectual property rights from being infringed, and to reveal important information.
This article mainly carried out the following aspects of the work:
[1] expounds the security status of Android, indicating that the security situation of Android is very severe and needs to strengthen its security protection ability. This article explains the architecture and development of Android, and analyzes the security model of the Android system and its limits of security mechanism such as its authority, sandbox, and signature, and deeply dissected the existence of Android. Security risks and their root causes, then describes the grim situation of Android platform application software being attacked by malicious.
[2] analyzes the traditional software protection mode of traditional software, and combines the characteristics of Android system, and puts forward a set of software protection scheme for Android platform.
[3] carries out the feasibility analysis and programming application of the key technology implemented in this scheme, including the dynamic load translation, obfuscation technology, anti debugging technology and so on to a certain extent to stop the reverse engineering steps, especially for the core technical points in this scheme (white box cipher, encryption and tamper proof integrity verification). Detailed analysis, design and implementation. This article also gives a brief introduction to other algorithms involved in the scheme, such as AES, MD5 and HMAC.
[4] carries out data and experimental analysis on the anti attack performance, integrity and efficiency of this technical scheme. The experimental results show that the scheme satisfies the software protection aim of anti reverse engineering attack to some extent in the software testing stage.
In this paper, the software protection scheme based on Android platform has been successfully used for the implementation of the traditional software protection scheme. It integrates the integration of encryption, confusion, tamper proof, integrity check and so on, and improves the ability of the software to resist reverse engineering in all directions.
【學位授予單位】：北京郵電大學
【學位級別】：碩士
【學位授予年份】：2013
【分類號】：TP311.53;TN929.5

【參考文獻】

相關碩士學位論文 前1條

1 董九山;基于加密自檢測的軟件防篡改技術(shù)的研究與實現(xiàn)[D];華中科技大學;2007年

，

本文編號：1898961