如何从服务器验证客户端代码尚未被修改
我有一个通过 json-rpc 与 java 客户端通信的 java 服务器。客户端应该向服务器报告内部统计数据，从而修改服务器的行为。客户端和服务器组件都是在内部编写的，因此我可以控制客户端的操作以及它如何报告统计信息，但是有没有办法可以验证客户端代码是否未被修改？如果有，它仍然会为客户端提供服务，但使用一些默认行为。
客户端将是公开的，因此对于有人反编译它们并改变行为来说并不是什么大问题。
仅仅让客户端发送代码签名是没有好处的，因为通过将客户端的原始副本与修改后的副本一起保存，很容易被欺骗。
I have a java server that communicates with a java client via json-rpc. The client is supposed to report internal stats to the server which modifies the servers behaviour. Both client and server compenents are written in house so I can control what the client does and how it reports stats but is there a way I can verify that the client code hasn't been modified? If it has it will still service the client but using some default behaviours.
The clients will be publicly available so it's not a big deal for someone to decompile them and alter behaviours.
Simply having the client send a signature of the code no good because could be easily spoofed by keeping an original copy of the client alongside the modified one.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
你不能。您基本上无法知道客户端上正在运行什么代码，并且您的任何程序逻辑都不应该依赖于将客户端视为“可信”。所有访问控制、验证等都应在服务器上（或在两个地方）完成。
某些专业环境（例如嵌入智能卡上的代码，或操作系统设计为仅运行签名代码的游戏机等设备）为您提供了更多的保证，因为逆向工程/获得对设备的适当控制的难度增加了。设备。但即使是这些也不是绝对可靠的（看看 iPhone 或任何控制台，看看这些设备被“破解”需要多长时间，与这样做的兴趣相比，让您了解安全级别）。
You can't. You essentially have no way of knowing what code is running on the client, and none of your program logic should rely on treating the client as "trusted". All access control, validation etc should be done on the server (or in both places).
Certain specialist environments (e.g. code embedded on a smart card, or devices such as games consoles whoes OS is designed to only run signed code) give you a bit more of a guarantee because of the increased difficulty of reverse engineering/gaining appropriate control of the device. But even these aren't infallible (look at the iPhone or any console and see how long it took for the devices to be 'cracked' compared with the interest in doing so to give you an idea of the level of security).
您无法验证客户端是否未使用客户端-服务器架构进行修改。
您永远不应该信任来自客户端的输入，除非经过身份验证的用户（登录名+密码匹配）通过安全连接（例如 SSL）与您对话。
客户端只需调用逻辑，而不是将其发送到服务器。
You cannot verify that the client was not modified with a client-server architecture.
You should never trust the input from a client unless an authenticated user (login + password match) is talking to you over a secure connection (e.g. SSL).
The client has to just call the logic instead of sending it to the sever.
首先想到的是客户端发送签名文件（代码内）和自身的哈希值。
但是，就像你说的，它可以被欺骗。
如果您试图依靠客户端的真实性在服务器上执行操作：不要！重新考虑您的逻辑。如果这只是一个额外的安全措施（就这样吧）。
First thing that comes to mind would be for the client to send both a signature file (within code) and a hash of itself.
But, like you say, it can be spoofed.
If you are trying to relly on the client's authenticity to do stuff on the server: don't! Rethink you logic. If this is just an extra safety measure (go with it).