Android 将许可证验证卸载到受信任的服务器
我一直在阅读有关 LVL 的内容，并且之前已经在我的应用程序中实现了它，并通过闪屏检查许可证。但我确信您可能已经猜到它很容易被破解。我并不是想保护我的应用程序并做到 100% 万无一失，只是想让破解者阻止尝试。
由于我的应用程序需要在线连接并且经常从我的服务器获取数据，因此我想在服务器端实现许可证检查，如果许可证有效，它将返回数据，如果无效，则不会返回任何内容。
我在这里阅读了这篇博客文章：
“如果您的应用程序有一个在线组件，则防止盗版的一种非常强大的技术是将 ResponseData 类中包含的许可证服务器响应的副本及其签名发送到您的在线组件然后，您的服务器可以验证用户是否已获得许可，如果没有，则拒绝提供任何在线内容，
因为许可证响应是经过加密签名的，您的服务器可以检查以确保许可证响应没有被篡改。存储在的 RSA 公钥Android Market 发布者控制台。
执行服务器端验证时，您需要检查以下所有内容：
响应签名是否有效。 许可证服务返回了 LICENSED 响应。 包名称和版本代码与正确的应用程序匹配。 许可证响应尚未过期（额外检查 VT 许可证响应）。 您还应该记录 userId 字段，以确保破解的应用程序不会重播其他许可用户的许可证响应。 （这可以通过来自单个 userId 的异常大量许可证检查来看出。）”
我只需要帮助来开始如何执行服务器端验证。是的，我可以获得响应签名、LICENSE 或 NOT_LICENSED 响应，软件包名称、许可证到期，但如何在我的服务器上检查？
如果您能提供任何帮助，我们将不胜感激。
I've been reading about LVL and have implemented it in my app before with a splash screen checking the license.. but I'm sure you could've guessed it was easily cracked. I'm not trying to secure my app and be 100% fool proof but just want to make it discouraging for crackers to attempt.
Since my app requires an online connection and often fetches data from my server I was wanting to implement license checking on the server side, if license is valid it will return data, if not, nothing will be returned.
I've read this blog post here:
"If your application has an online component, a very powerful technique to prevent piracy is to send a copy of the license server response, contained inside the ResponseData class, along with its signature, to your online server. Your server can then verify that the user is licensed, and if not refuse to serve any online content.
Since the license response is cryptographically signed, your server can check to make sure that the license response hasn’t been tampered with by using the public RSA key stored in the Android Market publisher console.
When performing the server-side validation, you will want to check all of the following:
That the response signature is valid.
That the license service returned a LICENSED response.
That the package name and version code match the correct application.
That the license response has not expired (check the VT license response extra).
You should also log the userId field to ensure that a cracked application isn’t replaying a license response from another licensed user. (This would be visible by an abnormally high number of license checks coming from a single userId.)"
I just need help to get started on how to perform server-side validation. Yes I can get the response signature, LICENSE or NOT_LICENSED respond, package name, license expiration, but how do I check in on my server?
Any help to get started would be greatly appreciated. Thanks for your time.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这可能会帮助您开始使用：android-market-license 验证 php 项目
This may help you get started: android-market-license verification php project
这应该可以帮助您开始：
http://php.net/manual/en/function .openssl-verify.php
我无法验证它的效果如何，但我们的 PHP 人员仍在研究它。
This should get you started:
http://php.net/manual/en/function.openssl-verify.php
I cannot verify how well this works though as our PHP guy is still working on it.